Privacy Policy

Last updated: 22 July 2026

Undertone is a voice dictation service operated by VINICIUS ZANDONADI, UNIPESSOAL LDA (Portugal). This page explains, in plain language, what we collect, why, and what control you have. The short version: what we keep is governed by consents you control — switch storage off and your dictations (text and audio) are processed and discarded — and there is a delete-everything button that actually works.

What we collect

Account: your email address, sign-in method, and plan. Required — dictation is tied to your account.
Technical data: the ordinary records any online service generates — IP address, device/browser type, and diagnostic logs (timings, errors). We run no advertising and no third-party analytics; there is nothing here beyond what operating the service requires.
Your words and audio:with the "Store my dictation content" consent (on by default, switchable anytime), each round's transcript and recording are stored in private, encrypted storage — powering your history, cross-device sync, and the Extract audio download. Turn it off and dictations are transcribed, delivered, and discarded — text and audio both.
Contributed recordings: a separate, off-by-default opt-in additionally allows recordings to be used to evaluate and improve accuracy.
Dictionary, snippets, and settings: synced to your account so they follow you across devices.
App context: the desktop app sends the nameof the application you dictate into (e.g. "Slack") so the writing style can adapt. It does not read other applications' content.
Usage: weekly word counts for the free-tier meter, and basic latency/reliability telemetry.

What we do with it

Provide the service: transcription and AI cleanup run on our servers via AI providers under API terms that prohibit them from training on your data (they may retain API traffic briefly — typically up to 30 days — for abuse monitoring, then delete it).
Our legal bases under the GDPR: performing our contract with you (running the service), your consent (storage, improvement, and recordings toggles), legitimate interest (security, preventing abuse), and legal obligations (billing records).
Improve the product — only under the "Help improve Undertone" consent, and audio only under the separate recordings opt-in.
We never sell your data and never share it with third parties beyond the processors below.

Who processes it for us

OpenAI — speech-to-text and text processing (API; no training on API data).
Vercel — hosting and AI model routing.
Supabase — database, authentication, and encrypted storage.
Stripe — payments and subscriptions, as merchant of record. We never see or store your card details.
Resend — transactional email (sign-in codes).

Data is encrypted in transit and at rest with these providers, in the EU and the US. Where data leaves the EU, transfers rely on the safeguards in our processors' data processing agreements (standard contractual clauses or adequacy decisions). Our vendors may not use your data for anything beyond providing their service to us.

Children

Undertone is not directed at children. You must be at least 13 (16 where local law sets a higher bar) to use it; we don't knowingly collect children's data, and we delete it if we learn we have.

Your rights and controls

All three data consents are toggles in Settings → Data & privacy, changeable anytime.
Delete my data (same screen) erases your stored dictations, history, and contributed recordings immediately.
Under the GDPR and the LGPD you can request access, correction, portability, objection, or full account deletion: support@z2lab.dev (we may verify your identity first). You can also complain to your data-protection authority (in Portugal, the CNPD).
Data is kept only while your account exists or the relevant consent stays on.

Changes

If this policy changes materially, we'll note it here and, for significant changes, tell you in the product.