Privacy Policy
Last updated 10 October 2026 · Applies to saytogo.com and the Say2Go apps for Windows, macOS and Android
Say2Go turns your speech into text. We've built it to collect as little as possible: your audio is streamed for transcription and then discarded — it is not stored on our servers or used to train AI models. This policy explains exactly what we do collect, why, and the rights you have.
1. Who we are
Say2Go is operated by RoraLabs Ltd ("we", "us", "our"), the data controller for the personal data described in this policy.
- Registered company: RoraLabs Ltd, company number 17174536, England & Wales
- Contact: [email protected]
- ICO registration: ZC152425
2. The data we collect
| Data | Why we collect it | Lawful basis (UK GDPR) |
|---|---|---|
| Email address (paid plans) | To create and manage your account and licence | Contract |
| Word count / usage stats (words today, WPM, streak) | To enforce trial limits and show your usage | Contract / Legitimate interests |
| Anonymous device identifier | To link a licence to your devices (device limits) | Legitimate interests |
| Settings you choose (language, custom vocabulary, auto-corrections) | To make the app work the way you set it | Contract |
| Voice audio | Streamed to produce your transcription, then discarded (see §4) | Contract |
| Payment details | Handled by Paddle — we never receive your card number (see §5) | Contract |
We may also store support emails you send us and server-side request logs (including IP addresses) for security and debugging purposes. Logs are retained for no more than 90 days.
3. How we use your data
- To provide transcription and the app's features.
- To create, secure and manage your account and subscription.
- To enforce trial limits and device limits.
- To respond to support requests and important service notices.
- To comply with our legal obligations.
4. Your voice & audio — what actually happens
When you dictate, your audio is streamed over an encrypted (TLS) connection to our transcription service at whisper.saytogo.com, which uses the Deepgram Nova-3 speech model. The text is returned to your device and the audio is discarded immediately after processing. We do not keep voice recordings on our servers, and we have enabled model-improvement opt-out so your audio is not used to train models.
In Meeting mode, the audio is temporarily stored on your device only while the recording is in progress. When you stop the recording, that audio is sent to our server for transcription and then deleted from both the server and your device. No audio is retained after processing completes.
5. Who we share data with (sub-processors)
We share the minimum necessary data with service providers who help us run Say2Go:
- Deepgram (United States) — speech-to-text transcription. Model-improvement opt-out is enabled.
- OpenRouter, Inc. (United States) and Anthropic (United States) — generate meeting summaries from your transcript text when you request one. Transcript text only; no audio and no email address is sent.
- PostHog — product analytics, self-hosted by us on our own server (posthog.roralabs.co.uk), so no third party receives it. See "Analytics in the app" below.
- Sentry (United States) — error reports from our servers, only when enabled. They contain no transcript text or email address.
- Resend (United States) — sends the one-time sign-in code email to your address.
- Paddle (United Kingdom / United States) — our payment provider and Merchant of Record. Paddle handles checkout and your card details; we do not see or store full card numbers. See Paddle's privacy notice.
- Hetzner Online GmbH (Germany) — server infrastructure and hosting.
- Cloudflare (global) — delivers this website and our API; it sees your IP address to serve and protect them.
We do not sell your personal data.
6. International transfers
Some providers may process data outside the UK/EEA. Where they do, transfers are protected by appropriate safeguards (such as the UK International Data Transfer Agreement / Standard Contractual Clauses).
Deepgram, OpenRouter, Anthropic, Sentry and Resend process data in the United States. Paddle processes data in the United Kingdom and United States. Hetzner processes data in the EU (Germany). PostHog is hosted by us. Where data is transferred outside the UK, it is protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or by the UK Extension to the EU-US Data Privacy Framework where the recipient is certified.
7. How long we keep data
- Voice audio: not retained — discarded after transcription.
- Meeting transcripts: kept until you delete the meeting or your account.
- Analytics events: kept for up to 12 months.
- Server logs: no more than 90 days.
- Account & usage data: kept while your account is active and deleted within 30 days of account closure, except records we are required to retain for legal or tax purposes.
Analytics in the app
The Say2Go mobile app sends product analytics (which screens and features are used, device and operating-system type, and crash reports) to our own self-hosted PostHog server. Events are linked to a pseudonymous account identifier derived from your account by a one-way hash. Your email address and name are not sent to PostHog. Crash reports contain the error type and one stack line, not message text. This is on by default and you can switch it off at any time in the app under Settings → Privacy → Share anonymous usage data. The pseudonymous identifier is still personal data, and we treat it as such. This website uses no analytics cookies.
8. Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent where we rely on it. You can delete your account from within the app, or see how to delete your account. To exercise any right, email [email protected].
You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
9. Cookies & similar technologies
Our website uses only what's necessary to function. The checkout is provided by Paddle, which may set cookies needed to process your payment.
The site currently uses no analytics or advertising cookies. We do not use tracking pixels or fingerprinting. Paddle may set functional cookies during checkout — these are necessary to process your payment and are not used for advertising.
10. Security
We use encryption in transit (TLS), our own transcription infrastructure rather than a third-party consumer app, and we limit the data we store. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.
11. Children
Say2Go is not directed at children under 13 and we do not knowingly collect their data. If you become aware that a child under 13 has provided us with personal data, please contact us at [email protected].
12. Changes to this policy
We may update this policy from time to time. We'll change the "last updated" date above and, for significant changes, notify you where appropriate.
13. Contact
Questions about this policy or your data? Email [email protected].