Privacy Policy
How RiverScript collects, uses, and protects your personal information.
Last updated: June 14, 2026
RiverScript is operated by Lex Valo (Business ID: 3617726-2), a business registered in Finland ("we", "us", "our"). This policy explains what personal data we collect, why we collect it, and your rights under the General Data Protection Regulation (GDPR).
Data controller: Lex Valo (Business ID: 3617726-2), Finland — [email protected]
What We Collect
Account data. When you sign up, we collect your email address — either directly via email registration or through Google OAuth.
Files you upload. Audio and video files submitted for transcription are stored temporarily. All source files are automatically and permanently deleted 7 days after upload, regardless of whether your account remains active.
Transcripts. Transcripts generated from your files are stored in your account until you delete them or close your account.
Usage data. We store basic account-level data: transcription count, remaining balance, and subscription status. This is used solely to operate the service.
Analytics. We use two privacy-first analytics tools. Umami is self-hosted on our own infrastructure and collects only anonymous, aggregated page view data — no personal data, no cookies, no cross-site tracking. PostHog is configured with memory-only persistence, meaning it collects session-level product usage (such as which features are used) but stores nothing in cookies or local storage. Data is not retained between sessions.
Cookies
We do not use tracking cookies.
We built RiverScript without advertising networks, retargeting pixels, or any form of cross-site tracking. The only cookies RiverScript sets are:
- Session cookie (
authjs.session-token) — keeps you logged in. This is a strictly necessary functional cookie required for the service to work. - Referral code — a temporary cookie (expires after 1 hour) set only when you arrive via a referral link. It contains no personal data and is deleted automatically after your account is created.
No advertising cookies. No social network trackers. No third-party cookies of any kind.
Legal Basis for Processing
| Processing activity | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation and authentication | Contract performance — Art. 6(1)(b) |
| File storage and transcription | Contract performance — Art. 6(1)(b) |
| Transcript storage | Contract performance — Art. 6(1)(b) |
| Subscription billing | Contract performance — Art. 6(1)(b) |
| Transactional email | Contract performance — Art. 6(1)(b) |
| Anonymous analytics | Legitimate interests — Art. 6(1)(f) |
Data Retention
| Data | Retention period |
|---|---|
| Source audio/video files | 7 days from upload, then permanently deleted |
| Transcripts | Until you delete them or close your account |
| Account data (email address, preferences) | Until you close your account |
| Analytics | Umami: anonymous aggregates only. PostHog: memory-only, cleared at session end. |
| Payment records | Retained by Polar in accordance with their privacy policy and applicable law |
Subprocessors
To provide RiverScript, we share data with third-party processors. Your audio files are sent to AI transcription providers solely to perform the transcription you requested; we do not permit these providers to use your data for any other purpose. A full list is available on the Subprocessors page.
International Transfers
Several subprocessors are located in the United States. These transfers are conducted under Standard Contractual Clauses (SCCs) adopted by the European Commission, or under the EU-US Data Privacy Framework where the provider is certified. Core infrastructure (servers and database) is located within the EU.
Your Rights
Under the GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — delete your account and all associated data at any time from Settings → Account
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Restriction — request that we limit processing in certain circumstances
To exercise any right, contact us at [email protected]. We respond within 30 days.
You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) tietosuoja.fi
Data Security
Your data is stored on servers in the European Union (Hetzner Cloud, Helsinki, Finland). We use HTTPS/TLS for all data in transit, encrypted database connections, and access controls that limit who can reach production systems. Source audio files are automatically deleted after 7 days.
Children
RiverScript is not directed at children under 16. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this policy from time to time. If changes are material, we will notify registered users by email. The date at the top of this page always reflects the most recent update.
Contact
Lex Valo (Business ID: 3617726-2) Finland [email protected]