FastScribe

GDPR overview

The privacy policy effective 14 July 2026 names the GDPR and the CCPA and opens data subject rights "depending on where you live", but never states in so many words that the service is GDPR-compliant. The rights listed are access, rectification, erasure and account deletion, portability, objection and restriction, and withdrawal of consent. Rectification and deletion are self-service (Settings > Profile; Settings > Security > Delete account, which erases account, profile and active sessions). Other requests go by email to support@fastscribe.org, may require identity verification, and receive a reply within 30 calendar days, any extension being explained inside that period. The right to complain to a local supervisory authority is stated, and the terms recall the 14-day EU/UK withdrawal right for first-time credit buyers. No Article 27 EU representative, no DPO and no data processing agreement are published, and no hosting country is disclosed.

Who owns the data?

Under the terms of service in force since 10 March 2025, users keep all rights to the content they submit, including the recordings uploaded and the transcripts derived from them. In exchange, submitting content grants the publisher a worldwide, non-exclusive, royalty-free licence to use, reproduce, modify and distribute that content; the terms attach no stated purpose limit or expiry to that licence, which is broader than a strict processing mandate. The service, its software and its original content remain the publisher's intellectual property. In practice, the counterweight is deletion: a user can remove any transcription job from the dashboard at any time, and delete the account itself from the settings.

Reuse rights

Users may reuse their own transcripts, subtitles, summaries and exports freely and without asking permission: they retain all rights over the content they submit, and ten export formats exist precisely so the output can be published, edited or archived elsewhere. On the publisher's side, the privacy policy effective 14 July 2026 lists account data (name, email, contact details), usage data (pages visited, time spent) and device data (IP address, browser, operating system), used to deliver and maintain the service, notify changes, provide support, analyse and improve, monitor usage and fix technical incidents. The publisher states that it does not sell personal data, does not use extension data for personalised advertising and does not exploit browsing activity unrelated to the requested feature, and that uploaded files are not used to train models. Sharing is limited to operating the service, complying with the law, protecting users, or answering a support request the user initiated. One provider is named, Supadata, which receives the submitted URL when a social video is transcribed; infrastructure, hosting, authentication, payment and analytics providers are cited by category only. Staff do not manually review URLs or transcripts except for security, fraud, legal obligations or an explicit support request.

Data retention & training

Hosting summary

FastScribe does not disclose where data is hosted. Neither the privacy policy effective 14 July 2026, nor the terms, nor any trust or security page names a hosting country or region, and no certification such as SOC 2, ISO 27001 or HIPAA is claimed. The only statement on the subject is generic: infrastructure, hosting, authentication, payment and analytics providers may process the minimum information needed to perform their services, under contractual and security obligations. One provider is named elsewhere in the policy, Supadata, which receives the submitted URL when a social video is transcribed. As a network observation rather than a commitment from the publisher, the domain resolves to 76.13.190.88, an address geolocated in Kuala Lumpur, Malaysia, on AS47583 Hostinger International Limited, while the registrar, Spaceship, Inc., is US-based; neither fact establishes where recordings are actually stored or processed. On the client side, the browser extension keeps its access token, the consent flag, recent job state and settings in local browser storage. Buyers with data residency requirements should ask before uploading.