Shownotes

GDPR overview

GDPR is addressed concretely rather than in passing. Section 3 of the privacy policy is titled Data Protection Rights Under General Data Protection Regulation (GDPR) and enumerates eight rights for EU residents: to be informed, of access, to rectification, to be forgotten, to restrict processing, to data portability, to object to direct marketing, and rights regarding automated decision-making and profiling. The vendor may verify identity before answering a request. Two structural facts support this: data is hosted in Frankfurt, Germany, and the registered office declared on the site is in Ireland, so both processing and publisher sit inside the EU. No Article 27 representative is named, consistent with an EU-established publisher. The gaps are real too: no DPO, no DPA, no subprocessor list, no retention period and no effective date on the policy. Requests go to a single email address.

Who owns the data?

Ownership cannot be established from the vendor's own documents, because Shownotes publishes no terms and conditions: the sitemap lists no such page and none is linked anywhere on the site. The only legal text available is a six-section privacy policy, and it says nothing about who owns uploaded audio, generated transcripts or generated summaries. What it does commit to is narrow but explicit: personal data and usage data are collected to run and improve the service, and are not sold to any third party. Nothing describes licensing, reuse by the vendor, or what happens to your content if you close your account. In practice, users get a stated non-sale promise and no contractual ownership clause behind it.

Reuse rights

No terms and conditions exist, so no document grants or restricts the reuse of the material you produce with the tool. In practice nothing on the site limits what you do with your own transcripts, summaries or generated landing pages, and the product is plainly built for republication: it hands back a downloadable full transcript, an editable summary and a shareable page. That freedom rests on the absence of a contract rather than on a granted right, which is a meaningful difference for professional use. On the vendor's side, the privacy policy states that collected information serves to provide, maintain and improve the service, to support customers and to produce analysis, and that it is not sold to third parties. Whether uploaded content feeds model training is never addressed.

Data retention & training

Hosting summary

The privacy policy makes one clear statement on hosting: data is stored in Frankfurt, Germany and is not sold to any third party. That places storage inside the European Union, and it lines up with the registered office the site declares in Ireland, so both processing location and publisher fall under EU jurisdiction. One distinction is worth keeping straight: the site is served through Cloudflare on an anycast address, and the resolved node reports a United States location. That reflects content delivery, not where recordings are kept. Beyond Frankfurt, nothing further is specified. No secondary processing location is named, no subprocessor is listed even though the workflow evidently involves outside services, no hosting certification is published, and no transfer mechanism such as standard contractual clauses is mentioned. In short, the jurisdiction is stated and favourable, while the operational detail behind it is absent.