PoraCap
Privacy Policy
Effective date: [DD.MM.YYYY]
1. Data Controller
The controller of personal data is [Company full name], [legal form], registered office at [address], Tax ID (NIP) [NIP], REGON [REGON][, KRS [KRS]] ("Controller", "we").
Contact for data matters: sorokastudios@gmail.com.
2. Data we process
- Account data — e-mail address, password (stored only as an encrypted hash), user identifier, and — for Google sign-in — basic profile data shared by Google.
- Billing data — name/company, Tax ID, address and data needed to issue invoices and process payments.
- Usage data — plan, minutes used per period, identifiers of devices assigned to the account, activity dates.
- Technical data — IP address, browser/app information, event and security logs.
- Content submitted for processing — audio extracted from your project to perform transcription, and the resulting subtitle text. Audio is processed to perform the Service and is not permanently stored on our servers.
3. Purposes and legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Creating and running an account, providing the Service | Art. 6(1)(b) GDPR (performance of a contract) |
| Billing, invoicing, accounting and tax obligations | Art. 6(1)(c) GDPR (legal obligation) |
| Security, abuse prevention, device limits, enforcing the Terms | Art. 6(1)(f) GDPR (legitimate interest) |
| Handling inquiries, complaints and contact | Art. 6(1)(b) and (f) GDPR |
| Marketing (if any), newsletter | Art. 6(1)(a) GDPR (consent) or (f) |
4. Recipients and processors
We entrust data to trusted providers who process it on our behalf only as necessary:
| Provider | Role | Notes |
|---|---|---|
| OpenAI | Transcription and text processing by AI models | Data sent via the API is not used to train models; retained up to 30 days for abuse monitoring unless law requires otherwise. Transfers outside the EEA under Standard Contractual Clauses. |
| Supabase | Database, authentication, server functions | EU region (Frankfurt). |
| Google sign-in (OAuth) | Only if you choose Google sign-in. | |
| Payment provider (e.g. Stripe) | Payment processing | Once online payments launch. Payment data is handled by the provider. |
| Netlify | Hosting of poracap.com | — |
| E-mail / invoicing provider | Message delivery, accounting documents | As necessary. |
Data may be disclosed to competent authorities where required by law.
5. International transfers
Some providers (e.g., OpenAI, payment provider) may process data outside the European Economic Area. In such cases transfers are based on appropriate safeguards, in particular Standard Contractual Clauses approved by the European Commission.
6. Retention
- Account data — for the duration of the account and, after deletion, for the period arising from limitation of claims.
- Billing data and invoices — for the period required by tax law (generally 5 years).
- Audio submitted for transcription — processed transiently to perform the Service, not permanently stored.
- Logs and security data — for the period necessary for security purposes.
7. Your rights
You have the right to: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent (without affecting the lawfulness of processing before withdrawal).
You also have the right to lodge a complaint with the supervisory authority (in Poland: President of the Personal Data Protection Office, PUODO, ul. Stawki 2, 00-193 Warsaw).
To exercise your rights, contact: sorokastudios@gmail.com.
8. Cookies and local storage
The Website uses browser local storage (localStorage) and necessary mechanisms to maintain the login session and remember settings. We do not use advertising tracking cookies without your consent. You can manage browser-stored data in your browser settings.
9. Security
We apply technical and organizational measures appropriate to the risk, including encrypted connections (HTTPS), restricted data access and storing passwords only as hashes. Access keys to external AI services remain server-side and are not shared with Users.
10. Children
The Service is not intended for persons under 16. We do not knowingly collect their data.
11. Changes to this Policy
We may update this Policy. We will notify you of material changes via the Website or e-mail. The current version is effective from [DD.MM.YYYY].