VoiceFill

GDPR overview

GDPR implementation is concrete and documented. The privacy policy, version 1.0 in force since 7 May 2026, names zerodays d.o.o. as controller, gives its address and contact address, and sets out purposes, legal bases, categories of data and retention periods in a table. The legal bases used are contract, law, legitimate interest and consent. Data subject rights are listed individually: access, rectification, restriction, objection, erasure, withdrawal of consent and portability, with erasure within thirty days of a withdrawal. The Slovenian supervisory authority, the Informacijski pooblaščenec, is named as the route for complaints. Transfers outside the EEA are acknowledged and covered by standard contractual clauses. One nuance: the site never states in so many words that it is GDPR compliant, so no compliance claim is recorded here. The Slovenian version of the policy prevails.

Who owns the data?

The publisher, zerodays d.o.o. of Ljubljana, splits its role in two. When it runs the service itself it acts as a processor: it handles the audio and transcripts on the customer's behalf, and forwards any request coming from a patient to the customer, who remains the controller. For its own purposes — billing and the subscription, newsletters, inbound enquiries, fraud prevention — it is the controller in its own right. Data is shared with a set of third parties described by function, some of which move it outside the EEA under standard contractual clauses. The controller can be reached at info@zerodays.dev, and rights or consent withdrawal at info@voicefill.ai.

Reuse rights

Customers keep the use of what they dictate: the reports and transcripts are produced for them, and can be edited before validation, then exported to PDF or Word and reused freely in their own practice or case files without asking the publisher for permission. On the Enterprise plan, audio recordings can be stored and replayed. The publisher's own reuse is expressly limited on the point that matters most: captured audio and transcripts are not used to train machine-learning or generative AI models. Beyond delivering the service, processing is confined to the purposes listed in the privacy policy, each with its own legal basis and retention period. Note that the terms reserve intellectual property in the software and the brand to the publisher, and restrict the licence to internal business use.

Data retention & training

Hosting summary

The site publishes no hosting location. The privacy policy identifies the hosting provider only by function, alongside the other third parties it relies on — a backend provider, a speech-to-text provider, subscription and payment management, crash reporting, bulk email, and the Google and Apple stores. None of them is named, and no country or region of processing is stated anywhere on the site. The policy does acknowledge that some of these third parties move personal data outside the EEA, and says this is covered by standard contractual clauses; that is a transfer safeguard, not a statement of where data sits. The IP address the domain resolves to is an anycast CDN node and says nothing about where processing happens. On the Enterprise plan, audio recordings can be stored and replayed, again without a stated location. A buyer with a data residency requirement — likely in a clinical setting — will have to obtain these commitments contractually, because the public documentation does not provide them.