Privacy Notice
Data controller: ROTOXI – [company name, registered seat, email to be completed]. Effective from 4 October 2026.
1. What data do we process?
- Account data: email address, account identifier, plan and subscription status, used allowance.
- Device identifier: a random identifier generated by the extension (to enforce the limit of 2 active devices).
- Usage data: the type, amount (seconds, characters) and time of requests. Not the content of the text.
- Payment data: handled by Stripe; we store only the Stripe customer and subscription identifiers, no card data.
2. Content sent for translation
The extension does not store audio or video. In live mode, short (up to 8-second) segments of the tab’s audio go from memory directly to the processor and reach the AI provider (OpenAI) only for the duration of the translation. Text to be translated reaches it the same way. We do not log this content.
Community cache (to reduce costs):
- Course videos (Skool, Kajabi, Loom, Vimeo, Wistia, Mux) timed subtitle track: per segment, the original text, the translation and the generated voice, tied to the video’s identifier and length. Only someone watching the same video can request it; at most 200 different videos per user per day. We store the track creator’s identifier internally for abuse handling; other users cannot see it.
- Public YouTube videos: we keep the subtitle translation and the related voice in a shared store, so another user gets it for the same video without reprocessing.
- The body text of Skool and Kajabi lessons: we store the translation tied to the course. Only someone who has the original text receives it (the key is a cryptographic hash of the text); the store cannot be browsed.
- Comments, forum posts, private messages and other web pages are not placed in the shared store, only in your own browser’s local storage.
3. Purpose and legal basis
Providing the service and performing the contract (GDPR Art. 6(1)(b)), preventing abuse (legitimate interest, Art. 6(1)(f)), and fulfilling accounting obligations (Art. 6(1)(c)).
4. Data processors
- Supabase Inc. – database, authentication, storage
- OpenAI – translation, speech recognition, speech synthesis
- Stripe – payment
- Vercel Inc. – serving the website
5. Retention
We keep account data until the account is deleted, and billing data for the statutory period (8 years). We keep the usage log for at most 24 months. The content of the shared cache is not personal data.
6. Your rights
Access, rectification, erasure, restriction, data portability and objection – can be requested at the data controller’s email address. Complaint: Hungarian National Authority for Data Protection and Freedom of Information (naih.hu).