Legal
SrutiAI Privacy Policy
Last updated: 27 October 2026
1. The short version
- Your recordings never come to us. SrutiAI transcribes, translates and analyses them on your own computer. We never receive your audio, transcripts, translations, summaries, codes, notes, studies, file names or folder paths, and we could not hand them to anyone because we do not have them.
- We hold a small account record so that your plan works: who you are, which computer holds your licence, and how many minutes of audio you have processed.
- Some features go online only when you use them, and the app shows you what each one sends before it sends it.
- We do not sell or share personal data for advertising, and we do not use anyone's data to train AI models.
This policy covers SrutiAI for desktop and the account service and website that support it. Any web-based SrutiAI service we may offer in future will have its own privacy policy.
2. Who we are
SrutiAI is made by Tanwir Adib Chowdhury, an individual in Ontario, Canada ("we", "us"). We are the controller of the personal data described in section 4. The person accountable for our compliance with this policy is Tanwir Adib Chowdhury, at privacy@srutiai.com. Our postal address is available on request.
3. What stays on your computer
Everything you create or import in SrutiAI is stored on your computer, in the app's own folder: recordings, transcripts, translations, summaries, reading lists, studies and their analysis, papers and documents you add, your translation memory, notifications, backups you make, and the app's own logs. We have no access to it.
- The app's log files stay on your computer and are never sent. Lines that quote what was said are left out of them.
- The request log on the Privacy & data screen records every request the app makes (time, destination, purpose and size), so you can check this policy against what actually happened. It stays on your computer.
- Backups go only where you save them. If that folder is synced by a cloud service, that service receives the backup under its own terms.
Research participants. If you took part in research and your interview was processed with SrutiAI, we hold none of it. The researcher is responsible for it; please contact them. If you contact us, we will tell you this.
4. What we collect, why, and on what basis
4.1 Your account
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address; how you sign in (Google, email link or password); your Google account identifier and the name on it, if you use Google; account creation and last sign-in dates | To create your account and sign you in | Contract |
| Password, stored only as a secure hash by our authentication provider | Sign-in | Contract |
| Sign-in records kept by our authentication provider, including the IP address and time of each sign-in, deleted after 90 days | Security and abuse prevention | Legitimate interests (keeping accounts secure) |
4.2 Your licence, computers and usage
| Data | Why | Legal basis |
|---|---|---|
| For each installation: a random install key and its fingerprint, the operating system, the app version, when it was activated, last checked in and deactivated, and an optional name you give it | To run your plan on one computer at a time, and to let you move it | Contract |
| A record of each licence move | To apply the limit of 10 moves a day | Contract; legitimate interests (preventing account sharing) |
| For each recording processed: its length, rounded up to the whole minute, and when the report arrived | To count your trial minutes and enforce your plan's allowance | Contract |
| Your plan, its features and its status | To decide what the app may do | Contract |
| Which version of the Terms of Use, EULA and this policy you agreed to, and the minute you agreed, as the app reports it | To show what you agreed to, and to ask again when they change | Contract |
The install key is not taken from your hardware. It is generated at random on first sign-in. The app never reads your computer's serial number, network address, hardware ID, hostname or user name.
Minutes are rounded and carry no content. The service never learns what a recording is called or what was said in it.
4.3 Trials
| Data | Why | Legal basis |
|---|---|---|
| A one-way keyed hash of your email address, your Google account identifier (if used) and the install fingerprint | To allow one trial per person | Legitimate interests (preventing trial abuse) |
These records are kept after you delete your account, without any link to it, for 3 years from the start of the trial, so that a new account cannot restart a trial.
4.4 Payments
Payments are handled by Stripe, which sells your plan as merchant of record (shown at checkout as Link). Stripe receives your name, email, billing address and payment details directly, and processes them as an independent controller under its own privacy policy, stripe.com/privacy. We never see your card number. Stripe sends us back your subscription's plan, billing interval, amount and currency, status, period and trial dates, cancellation status, invoice status and a customer reference, so that your plan works. Legal basis: contract.
4.5 Support, feedback and surveys
| Data | Why | Legal basis |
|---|---|---|
| Problem reports and feedback: the category and the text you write; and, only if you tick it, a diagnostics block (app version, OS version, processor cores and threads, and the processing backend), shown to you before sending | To answer you and fix problems | Legitimate interests; contract where it concerns your plan |
| Survey answers: a score and any text you write | To improve SrutiAI | Consent (you choose to answer) |
| Emails you send to support@srutiai.com | To answer you | Legitimate interests; contract |
Never paste interview content into a report or email. We ask you not to, because it is the one way such content could reach us.
4.6 Service records
| Data | Why | Legal basis |
|---|---|---|
| An audit log of account events, such as sign-ins, licence moves, plan changes and payment events, with install fingerprints and Stripe event references. For a purchase it also keeps the renewal terms shown at checkout and that you agreed to them | Security, troubleshooting, billing disputes; proof of consent that consumer law asks us to keep | Legitimate interests; legal obligation |
| A record of each notice we email about your plan: which notice, for which plan, and when. Not the email's text or your address | To send each notice once, and to show it was sent | Contract; legal obligation |
| Short-lived security records: request limits (kept 2 days) and one-time licence codes (kept 15 minutes) | Abuse prevention | Legitimate interests |
4.7 Usage statistics and crash reports
SrutiAI does not send usage statistics or crash reports today. If we offer them, they will be separate choices, off unless you switch them on, sent to providers in the EU without your account ID or IP address, and described here before they start.
4.8 Our website
- Cookies. srutiai.com uses only the cookies it needs: a sign-in session cookie, a 15-minute cookie that hands your sign-in back to the desktop app, and a cookie that remembers your chosen currency for a year. No advertising or analytics cookies, and no tracking pixels.
- Server logs. Our host (Google Cloud) records requests, including IP addresses, for security and operation, and keeps them for 30 days.
- Fonts are served from our own site; your browser contacts no font service.
5. Features that contact others, only when you use them
When you use these features, the app contacts the service named. We do not receive what is sent. Each recipient sees your computer's IP address, as with any internet request.
| Feature | What is sent | To |
|---|---|---|
| Model downloads (once, at setup) | A request for each model file: which files shows which languages you chose and whether you use Analysis | SrutiAI's model server on Cloudflare, or Hugging Face if it cannot answer |
| Related reading | The themes you approve for one interview, never its text or names | OpenAlex |
| Scholarly database search | The search terms you approve, drawn from a study's research questions and keywords; never interview text or names | OpenAlex |
| A paper from its link | A request for that page and the PDF it names, with no cookies or account; if that gives no PDF or no details, the paper's DOI, and a request for an open copy of the paper | The site the link points to, and doi.org for a DOI; then OpenAlex, and the site of the open copy it lists (a repository such as arXiv) |
| Zotero | Requests to Zotero running on your own computer | Your computer only |
| AI analysis with your own AI account, by signing in or with your own API key (where offered) | Passages from your study's sources, codes, brief and research questions, with speaker and participant names replaced by IDs; never audio | The provider you choose (today, OpenAI), under your own account and its terms |
About the last feature, your own AI account. It is the one feature that sends interview content off your computer, so it is worth being precise:
- It is processed on the provider's servers, not on your computer. You are the controller of what you send, and your provider handles it under your contract with them. We are not involved and receive none of it.
- Connecting your AI account in Settings (for example, with "Sign in with ChatGPT") is separate from your SrutiAI account. You sign in on the provider's page; the App keeps the token it receives on your computer and never sends it to us.
- The provider's settings decide what happens next. A personal ChatGPT plan may use conversations to improve OpenAI's models unless you turn that off in ChatGPT's data controls; business and education workspaces usually do not. Retention also varies by provider and plan.
- Names are replaced only where they are a speaker's or participant's name. A name said inside a passage is not caught.
- Check that your ethics approval and participants' consent allow it before switching it on. The App records which analysis steps used a provider, in its AI-use statement.
6. Who we share data with
We do not sell personal data or share it for advertising. We use these service providers, who process data for us under contract:
| Provider | What for | Where |
|---|---|---|
| Supabase | Account, licence and usage database; sign-in | United States (Ohio) |
| Google Cloud (Firebase App Hosting) | Hosting srutiai.com | United States (Virginia) |
| Resend | Sending sign-in emails and the emails about your plan: when it starts, changes or is cancelled, before a yearly renewal or a price change, and when you cancel or withdraw from the cancel page | United States |
| Zoho | Support email | United States |
| Cloudflare | Model downloads; DNS for srutiai.com; the check that you are a person (Turnstile) on the cancel page, which sees your IP address and browser, sets no tracking cookies and is not used for advertising | Global network; storage in the EU |
Stripe receives payment data as an independent controller and merchant of record (section 4.4). Microsoft receives data about your Store download under its own privacy statement if you install from the Microsoft Store.
We may also disclose data if the law requires it, to protect our rights or users' safety, or to a successor if SrutiAI is sold or reorganised, in which case this policy continues to apply to it.
7. International transfers
We are based in Canada, and some of our providers are in the United States. Where we transfer personal data from the UK or the EU to a country without an adequacy decision, we rely on the provider's certification under the EU-US Data Privacy Framework and its UK extension where available, or on the standard contractual clauses (and the UK addendum).
8. How long we keep it
These periods are applied automatically every night.
| Data | Kept |
|---|---|
| Account, profile, plan and active installs, and which versions of the terms you agreed to | While your account exists |
| Minutes reported per recording, and licence moves | 13 months |
| Installs you signed out of or replaced | 12 months after that |
| Problem reports, feedback and survey answers | 24 months |
| Audit log | 24 months; records of purchases, consent to renewal terms, cancellations and withdrawals 3 years. After account deletion, without any link to you |
| Notices we emailed about your plan | 3 years, or until your account is deleted |
| Trial records | 3 years from the start of the trial, without any link to you |
| Sign-in records with IP addresses | 90 days |
| Short-lived security records | 2 days at most |
| Website server logs | 30 days |
| Emails to support | As long as needed to answer you and deal with any follow-up |
| Billing records | Kept by Stripe as long as tax law requires |
Deleting your account at srutiai.com cancels your plan and deletes your account, profile, installs, usage, survey answers, problem reports and the record of which terms you agreed to at once. The trial and audit records described above are kept without any link to you. Deleting the account does not delete anything on your computer: uninstall the app or delete its folder for that.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Many of these you can do yourself:
- Export everything we hold from your account page at srutiai.com, as one file.
- Delete your account from your account page.
- Switch statistics, crash reports and surveys off in the app's Settings.
For anything else, email privacy@srutiai.com. We answer within 30 days and may ask you to confirm your identity first. You can complain to your data protection authority: in Canada, the Office of the Privacy Commissioner (or Quebec's Commission d'accès à l'information); in the UK, the ICO; in the EU, your local authority.
California and other US states. We do not sell or share personal information as those laws define it, and do not use sensitive personal information to infer characteristics about you.
10. Security
The app's licence is a signed token checked on your computer, sign-in happens in your browser and returns to the app over a local connection, and the app keeps its secrets in your operating system's secure store. Our database allows each account to read only its own records. All traffic is encrypted in transit. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.
11. Children
SrutiAI is for adults. You must be 18 or over to have an account, and we do not knowingly collect children's personal data.
12. Emails we send
- About your account: sign-in links, security notices, and notices about your plan: when it starts (with its renewal terms), changes or is cancelled, a few days before a cancelled plan ends, 60 to 90 days before a yearly plan renews, and 30 days before a price change. Also changes to these policies or the Terms. You cannot turn these off while you have an account, because the law or your contract needs them.
- Receipts, the trial start and trial-ending emails, and renewal reminders come from Stripe, as Link.
- News about SrutiAI, such as new versions and features: we do not send these yet. If we do, every message will say who it is from and let you unsubscribe in one step, and we will ask first where the law requires it.
13. Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects. Your plan's limits are applied automatically, as the Terms of Use describe.
14. Changes
We will tell you about material changes in the app or by email before they take effect, and the app asks you to agree to the new version before you carry on. The date at the top shows the latest version.
15. Contact
Tanwir Adib Chowdhury (SrutiAI), Ontario, Canada · privacy@srutiai.com · support@srutiai.com. Our postal address is available on request.