Dumai

GDPR overview

The privacy policy, effective 3 June 2025, addresses the GDPR explicitly. A dedicated section sets out the legal bases relied on for EU and UK users, namely consent, legitimate interests, legal obligations and vital interests, and lists the rights available in the EEA, the United Kingdom, Switzerland and Canada: access, copy, rectification, erasure, restriction, portability, objection, and the right not to be subject to a decision taken solely by automated means. Consent can be withdrawn at any time by email, and requests go through a data subject access request form. Complaint routes are named: the member state supervisory authority, the UK ICO, the Swiss FDPIC. Two gaps remain. No Article 27 EU representative is designated, and no data protection officer is named. The publisher never claims compliance in so many words.

Who owns the data?

Dumai's terms are explicit on ownership: the publisher asserts no ownership over user contributions, and the user retains full ownership of them together with the associated intellectual property rights. The counterpart is responsibility, since the user alone answers for what they record. Feedback and suggestions sent to the publisher are treated differently: they may be used and shared for any purpose, without compensation. The app's own code, design, content and marks remain the publisher's property. Section 16 of the terms adds a warning worth reading twice: routine backups are performed, but the publisher accepts no liability whatsoever for lost or corrupted data.

Reuse rights

Users may reuse their own recordings, transcripts and summaries freely. The terms grant the publisher no ownership over them, so no permission is needed to export, republish or exploit one's own notes, including commercially. The restriction runs the other way: content belonging to Dumai itself, meaning the software, design, text, graphics and marks, is licensed only for personal, non-commercial use or an internal business purpose, and may be downloaded or printed but not resold or redistributed. Two caveats sit alongside this. Recordings and personal information are shared with ElevenLabs and OpenAI so the AI features can run, and any suggestion or feedback sent to the publisher may be reused and shared without compensation.

Data retention & training

Hosting summary

Dumai publishes nothing about where user data is hosted. The privacy policy, the terms of use and the home page name no hosting country, no region and no cloud provider; there is no trust or security page and no certification such as SOC 2 or ISO 27001. The only third parties identified are ElevenLabs and OpenAI, which process recordings for the AI features, and Google Analytics for audience measurement, and their own infrastructure is not described. The policy mentions backup archives when explaining deletion, without saying where they sit. On the network side, the dumai.app domain resolves to an anycast Amazon address, but that describes the marketing site, not the storage of user recordings. Legally, the terms are governed by the law of Ukraine and give exclusive jurisdiction to the courts of Kyiv, with arbitration seated in Brussels. In short, the jurisdiction of the contract is known; the jurisdiction of the data is not.