Who is responsible
Vitava, Inc. is the data controller for the personal data described here. Contact: [contact email]. Our governing location is the United States.
Your recordings stay on your device
Recording, importing, editing, separating stems and exporting audio happen in your browser. Recordings and transcripts are saved in this browser’s local storage. The Recorder captures shared tab or system audio, not your microphone. Only voice notes on Transcribe use your microphone, with your permission.
Audio leaves your device only when you choose transcription or optional cloud backup. Opening a share link retrieves audio that its owner has backed up and chosen to share.
Transcription and AI tools
When you transcribe, audio is sent through our service to ElevenLabs Scribe or, if unavailable, Lovable AI. Language and speaker-identification choices are sent with the request. Transcript AI tools send transcript text and its title to Lovable AI to generate summaries, action items, chapters or title suggestions. These providers process the content under their own service and privacy terms; do not submit sensitive material you do not want processed this way.
We process these requests to provide the service you ask for, on the basis of contract performance. Local transcripts remain in your browser unless you use optional account sync.
Optional accounts, backup and sharing
Signing in supplies an email address, account identifier and authentication information; Google sign-in may also supply a name and profile details. Lovable Cloud handles account access, private storage and sync. Backups include audio, artwork, track metadata and transcripts. We use this data to provide your account, restore tracks and sync your work, on the basis of contract performance.
Backup files are private. Anyone with an active share link can access the shared track, and can download it if you allow downloads. Links can expire or be revoked. Share only audio you are entitled to share.
Usage, security and payments
We use monthly transcription and storage totals to enforce plan allowances. Signed-out transcription uses a hashed IP identifier. Hosting and security services may process IP addresses, device/browser information and request logs to deliver the site, prevent fraud and protect the service. Our basis is contract performance and legitimate interests in operating a secure service.
Paddle is our Merchant of Record and receives the information needed for checkout, subscription management, payments, tax compliance and invoicing. We receive subscription status and identifiers so we can provide the right plan. This processing is based on contract performance and applicable legal obligations. Paddle handles payment details under its privacy notice.
Optional anonymous statistics and cookies
“Share anonymous usage” is off by default. If you enable it, PostHog receives limited events such as export format, stem settings and coarse duration ranges. These events do not contain audio, recording titles or transcript text. Analytics uses in-memory, cookieless persistence with no session recording or automatic activity capture. Our basis is your consent; switch it off in Settings at any time to stop future events.
Essential browser storage supports sign-in, local recordings, preferences, model caches and resumable backups. Authentication services may use essential cookies. We do not use marketing cookies. You can manage cookies and site storage in your browser; clearing site data can permanently erase local recordings, so export them first.
Who receives data and where
Recipients are the hosting, authentication and storage providers needed to run SOUWND (Lovable Cloud); transcription and AI providers (ElevenLabs and Lovable AI); PostHog if you opt in; and Paddle for purchases. Professional legal or accounting advisers may receive records when needed, and authorities may receive information when required by law.
Providers may process data outside your country. Where UK or EEA data protection law applies, international transfers must use applicable safeguards, such as adequacy decisions or standard contractual clauses. Contact us for information about the safeguards relevant to your data.
Retention and deletion
Local files remain until you delete them or clear the browser’s site data. Cloud backups remain until you remove them or request deletion; signing out or cancelling Pro does not automatically delete backups. We keep account and service records only for as long as needed to provide the service, handle security and disputes, and meet legal obligations, then delete or anonymise them. Provider retention is governed by the relevant provider’s terms.
To remove a backup, open its track and use “Remove cloud copy” in the menu. Deleting a local track does not remove its cloud backup. Revoke share links in the track’s Share options. To request deletion of your account and all cloud backups, contact [contact email] from the account’s email address. There is currently no self-service account-deletion button. Export any files you wish to keep first. Account deletion does not clear copies stored in your browser, and legally required payment records may be retained by Paddle.
Your rights and security
Depending on your location, you may request access, correction, deletion, restriction, portability or object to processing. You can withdraw consent without affecting earlier lawful processing. Contact [contact email]; we may need to verify your identity. Where GDPR applies, we respond within one month, subject to lawful extensions, and you can complain to your supervisory authority.
We use appropriate technical and organisational measures, including encrypted connections, private storage and access controls. No system is perfectly secure; keep your device and account protected.