Scribewave

GDPR overview

GDPR compliance is claimed explicitly and documented in reasonable detail. The publisher is established in Belgium, so the regulation applies directly and no Article 27 representative is required. The privacy and cookie statement, last updated on 3 September 2024, is organised by category of data subject - applicants, users, suppliers, visitors, subscribers - and cites its legal bases article by article: consent 6(1)(a), contract 6(1)(b), legal obligation 6(1)(c) and legitimate interest 6(1)(f). Rights of access, rectification, erasure, restriction and portability are described, with a one-month response time extendable by two, exercised through privacy@scribewave.com. Transfers outside the EEA rely on the Commission's standard contractual clauses, and a DPA is offered on the Enterprise tier. One inconsistency: the complaints paragraph points to "the Dutch data protection authority" while giving the contact details of the Belgian one.

Who owns the data?

The terms of service are unambiguous: "You retain full ownership of your Work. We don't claim any ownership to any of it." Anything the service produces from your files - transcripts, subtitles, translations - is your exclusive property under article 1.1. The rights you grant Scribewave are limited to running the service: hosting, backups, and sharing when you instruct it. Article 9.3 confirms that suspended content stays yours, with reasonable efforts made to return it. The privacy statement adds that "We do not sell your personal information to third parties", and the pricing page frames subscriptions as full ownership, with files kept as long as you want.

Reuse rights

You can reuse everything the service produces without asking permission: transcripts, subtitles, translations and AI-generated summaries are yours to edit, export, publish or sell. On the publisher's side, use is deliberately narrow. The pricing, comparison and about pages all state that customer audio is never used to train models, on any plan, and the researcher page repeats that files are used neither for AI training nor for human annotation; even the Enterprise custom-vocabulary feature is described as adapting to a client's terminology without training on their audio. Data is shared only with the providers needed to run the business - Billit for subscriptions, Stripe for payments, Sendgrid for email - plus Google Analytics and Google Ads through cookies, subject to consent. The privacy statement reserves the right to disclose data where the law requires it, or to protect people, prevent fraud and defend legal rights.

Data retention & training

Hosting summary

Scribewave places customer data in the European Union. The privacy statement is explicit: "Scribewave stores all personal data which it has collected in the cloud using data centre(s) within the EU." The home page repeats that data is stored on European servers, and the pricing page adds that files are stored and processed on European infrastructure. No country and no cloud provider is named, so the claim cannot be verified more precisely than "the EU". Transfers outside the EEA remain possible and are covered by the standard contractual clauses approved by the European Commission. The security measures described are HTTPS encryption, hashed passwords and card numbers, daily backups of all data, and permanent deletion on request at any time. One distinction matters when reading network data: the marketing website itself is served from a Vercel and Amazon address geolocated in the United States (76.76.21.21). That concerns delivery of the web pages, not the storage of customer recordings, which the publisher places in the EU.