Rythmex

GDPR overview

There is no GDPR mention on this site at all. Across the thirteen pages retrieved, in visible text and in page source alike, the words "GDPR" and "General Data Protection Regulation" never appear. No Article 27 EU representative is designated, no data protection officer is named, no data processing agreement is published or offered on request, and no sub-processor list exists. None of the usual data subject rights — access, rectification, erasure, portability, objection — are described; the only route offered is an email address for questions about the privacy policy (billing@rythmex.com). The single explicit time limit is the deletion of uploaded files after 30 days. The publisher presents itself as American (Charlotte address, California law, arbitration in San Francisco) and its policy contemplates transferring information to people outside the user's home country without naming any transfer mechanism — no standard contractual clauses, no adequacy decision.

Who owns the data?

Uploaded files and transcripts remain the user's, and the user must warrant they hold the rights to them. Uploading, however, grants Rythmex and its affiliated companies a non-exclusive, worldwide, royalty-free, transferable, sublicensable, perpetual and irrevocable licence to copy, store, display, modify and otherwise use that content in connection with operating the service — a licence that does not lapse with the account. The same content is designated Confidential Information, usable only for the Permitted Purpose of providing the service and not disclosed without consent, except to Associated Persons (officers, employees, agents, consultants, contractors, affiliated entities) or under subpoena, court order or government request, with prior notice where feasible. The privacy policy states that personal information is neither rented nor sold.

Reuse rights

Users keep their own material and are free to reuse the transcripts they generate: nothing in the terms restricts what they do with their output, provided they held the rights to the source file in the first place. On the publisher's side, sign-up collects a username and an email address. Cookies are used to identify and track visitors, remember preferences and personalize content and advertising, and third-party advertising partners set cookies of their own that fall explicitly outside the scope of Rythmex's policy. Aggregate behavioural statistics are compiled without disclosing identifying information, and registered users may receive product emails about new features, feedback requests and news. The policy also reserves the right to publish a request sent by email — a support message, for instance — in order to clarify it or help other users. Employees, contractors and affiliated organizations may be located outside the user's country of residence, and using the site counts as consent to transferring information to them. Payments run through Paddle.com, which acts as Merchant of Record. Model training is never addressed anywhere on the site: Rythmex neither claims nor rules out training on customer data.

Data retention & training

Hosting summary

Rythmex declares no hosting location. Across the thirteen pages retrieved, no hosting country, no region and no infrastructure provider is named, and the privacy policy contains no hosting section. What the policy does say is that employees, contractors and affiliated organizations may be located outside the user's country of residence, and that using the site constitutes consent to transferring information to them — with no transfer mechanism named. Uploaded files are kept for 30 days from creation and then removed. The only technical signal available is that the domain is served behind Cloudflare (IP 172.67.163.123, AS13335, anycast). That describes content delivery, not where files are stored, and cannot be read as a hosting location. The publisher attaches itself to the United States through its contact address in Charlotte, its choice of Californian law and arbitration in San Francisco. That points to the jurisdiction likely to govern a dispute, not to the jurisdiction the data physically sits in. Anyone with a data residency requirement should obtain a written answer from the publisher before uploading, because the site does not provide one.