Hussarcut

Privacy Policy

Version 2026-10 Effective from 15.10.2026 Current
This is an English translation provided for information. The legally binding version is the Polish version.
Table of contents 12

1 Controller

  1. The controller of personal data processed in the Napisy AI service available at [Adres Strony Serwisu] (the Service) and in the Silelab Napisy AI Chmura extension for Adobe Premiere Pro (the Plugin) is [Nazwa Firmy / Imię i Nazwisko], [Adres Siedziby], tax ID (NIP): [NIP], REGON: [REGON] (the Controller, "we").
  2. For data protection matters, contact us by e-mail at [Adres E-mail do Kontaktu] or by post at our registered address. The Controller has not appointed a data protection officer.
  3. This policy explains what data we process, why, who we share it with and how long we keep it. Capitalised terms have the meaning given in the Terms of Service.

2 Key points

  • For transcription the Plugin sends only the audio of the selected speech tracks. Video never leaves your computer – the only exception is the image-based hook analysis, when you run it (up to 24 downscaled frames).
  • The audio file is deleted right after transcription. Subtitle text and analysis results are deleted automatically after 30 days.
  • We do not use analytics or advertising cookies, external analytics tools or advertising pixels. The Plugin does not send telemetry.
  • We do not sell data and do not use Customers' recordings to train models.
  • You can delete your Account yourself in the Service (Account → Delete account).

3.1. Account and sign-in

  • Data: e-mail address, first name or name, password hash – never the password itself, registration and last sign-in dates, language and account settings; when signing in with Google or GitHub – the account identifier at that provider and the e-mail address; with two-step login – the encrypted authenticator app secret and backup codes.
  • Purpose and basis: creating and maintaining the Account and providing the services – Article 6(1)(b) GDPR (contract).
  • Providing data is voluntary but necessary to use the Service.

3.2. Security

  • Data: IP address and browser information in the event log (e.g. sign-in, password change, acceptance of documents, payment), a hashed device fingerprint (computed with a key from the browser, operating system and network) for new-device sign-in alerts, and counters of sign-in and other attempts.
  • When you set a password, we check whether it appears in known breaches: we send only the first 5 characters of the password's SHA-1 hash to the Have I Been Pwned service – neither the password nor its full hash leaves the Service.
  • The registration, password reminder and activation-link resend forms, as well as sign-in after several failed attempts, are protected by Cloudflare Turnstile (bot protection).
  • Purpose and basis: protecting the Service and Accounts against abuse and detecting unauthorised access – Article 6(1)(f) GDPR (legitimate interest).

3.3. Plugin and linked devices

  • Data: computer name (up to 60 characters), Adobe Premiere Pro version, operating system and Plugin version – provided when linking the Plugin to the Account; IP address and time of last use of the device token. The token is stored in the Service only as a hash.
  • Purpose and basis: linking the Plugin to the Account, listing devices and allowing them to be unlinked, security – Article 6(1)(b) and (f) GDPR.

3.4. Recordings, transcripts and analyses

  • Data: the audio file of the selected tracks (exported by the Plugin to MP3) or a file uploaded from disk, file name, size and length, transcription settings, the proper-names dictionary, and the results: subtitle text, SRT file and word timings, and results of the hook analysis, image-based hook analysis and soundbite/reel analysis. Recordings may contain the voice and statements of the Customer and other people.
  • Image-based hook analysis (only at the Customer's request): the Plugin sends up to 24 frames from the beginning of the sequence, downscaled to JPEG. The frames are passed to the AI model and are not stored in the Service – we store only the analysis result.
  • Purpose and basis: performing the transcriptions and analyses ordered by the Customer – Article 6(1)(b) GDPR. For other people's data contained in recordings, we act as a processor on the Customer's behalf (section 15 of the Terms), and the Customer is the controller of that data.
  • We do not use recordings or results to train models and do not share them with other Customers.

3.5. Payments and billing

  • Data: the Stripe customer ID, history of subscriptions, payments, refunds and top-ups, minute usage, and invoice details entered in the payment form (e.g. name, address, tax ID). Card and other payment method details are entered directly in the Stripe form – we have no access to them.
  • Purpose and basis: performing the contract – Article 6(1)(b) GDPR; tax and accounting obligations – Article 6(1)(c) GDPR; establishing and pursuing claims – Article 6(1)(f) GDPR.
  • Where the payment form names Stripe as the seller (reseller) of the service, Stripe also processes payment and invoice data as a separate controller under its own privacy policy.

3.6. Acceptance of documents

  • Data: the version of the Terms and Privacy Policy, acceptance date, IP address and where it was accepted (registration, sign-in after a change).
  • Purpose and basis: demonstrating the conclusion of the agreement and its terms – Article 6(1)(b) and (f) GDPR.

3.7. Contact and support tickets

  • Data: name, e-mail address, ticket content and attached screenshots. Tickets are handled in our own ticketing system (osTicket) running on our server.
  • Purpose and basis: handling tickets and complaints – Article 6(1)(b), (c) and (f) GDPR.

3.8. E-mails and newsletter

  • Service e-mails (address confirmation, password reset, new-device sign-in alerts, payments, Team invitations, changes to the Terms and Privacy Policy, account deletion confirmation) are sent under the contract – Article 6(1)(b) and (c) GDPR. They cannot be unsubscribed from while the Account exists.
  • The newsletter is sent only to people who have given consent (the checkbox at registration is unticked by default) – Article 6(1)(a) GDPR and consent to receive commercial information electronically. Consent can be withdrawn at any time via the link in every message or in the Account settings; withdrawal does not affect the lawfulness of earlier mailings. We record the date and source of giving or withdrawing consent.

3.9. Referral and partner programmes

  • Data: the referral or partner code stored in a cookie, the assignment of a new Account to the referrer or partner, the number of clicks on a partner link (aggregated, without identifying anyone), and payment amounts of referred Customers needed to calculate rewards or commissions. Partners see only aggregated sales amounts, not the referred people's data.
  • Purpose and basis: granting rewards and settling commissions – Article 6(1)(b) and (f) GDPR.

3.10. Viral Radar – data of creators whose videos are analysed

  • If a Customer uses Viral Radar, the Service downloads publicly available short videos from the selected profiles (Instagram, Facebook, TikTok, YouTube): the profile address and name, video addresses, statistics (e.g. views), the video's audio and its transcript.
  • Purpose and basis: analysing the structure of popular videos (e.g. hook, pace, composition) for Customers – Article 6(1)(f) GDPR. In categories prepared by us, creator names are hidden from Customers; a profile added by a Customer is visible only to that Customer.
  • A creator may object at any time by writing to [Adres E-mail do Kontaktu] – we will then delete their profile data and stop analysing it, unless we demonstrate compelling legitimate grounds.

4 The Plugin – what stays on your computer and what reaches the Service

  1. Locally on the Customer's computer (the Plugin data folder: %APPDATA%\Silelab\napisy-chmura on Windows, ~/Library/Application Support/Silelab/napisy-chmura on macOS, plus the panel storage in Premiere) the Plugin keeps:
  • the device sign-in token – encrypted with the Windows DPAPI mechanism on Windows, and on macOS in a file accessible only to the system user,
  • settings, the state of an interrupted job (to resume it), the list of imported transcripts and favourite looks – no passwords or payment data,
  • temporary files: exported audio (deleted after upload) and frames for image analysis (deleted after upload),
  • downloaded auto-censorship bleep sounds and safe-zone overlay images,
  • SRT subtitle files – in a folder next to the Premiere project file.
  1. To the Service the Plugin sends only: the audio of the selected tracks (for transcription), the name and length of the material, transcription settings and dictionary, video frames (only for the image-based hook analysis), requests for results, analyses and updates, and the device data described in section 3.3.
  2. The Plugin communicates only with the Service's server – it does not send data directly to other companies and contains no analytics or ads. Links (e.g. to the panel, payments, help) open in the Customer's default browser.
  3. The safe zone and profanity masking features run locally in the Plugin on data already downloaded from the Service. Only the bleep sound file is downloaded from the Service (no Customer data is sent).
  4. Plugin updates are downloaded from the Service and installed only if they have a valid digital signature and checksum.

5 Recipients of data

We share data only with providers whose services we actually use, to the extent necessary to provide the services:

  1. [Dostawca Serwera i Poczty E-mail] – hosting of the Service, database, files and the mail server sending our e-mails.
  2. Cloudflare, Inc. (USA) – content delivery network and protection of the Service: traffic to the Service passes through Cloudflare (including IP address, browser headers, page address); Cloudflare Turnstile – bot protection for forms.
  3. Runpod, Inc. (USA) – GPU servers performing transcription: they receive the audio file via a one-time signed link valid for up to 1 hour and return the text with word timings.
  4. OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C., USA) – the language model used for hook analysis, image-based hook analysis, soundbites and reels, and Viral Radar: it receives the transcript text and, for image analysis, the frames, without Account data.
  5. Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe group companies) – payment, subscription, invoice and refund processing.
  6. Google LLC (USA) – only when the Customer signs in with Google (identifier and e-mail address); for Viral Radar we use the YouTube Data API to fetch public video metadata, without Customer data.
  7. GitHub, Inc. (USA) – only when the Customer signs in with GitHub.
  8. Have I Been Pwned – receives only 5 characters of the password hash (section 3.2), which does not allow anyone or any password to be identified.
  9. [Dostawca Proxy dla Viral Radar] – relays the download of public videos analysed in Viral Radar; it does not receive Customer data.
  10. Public authorities – only where the law requires disclosure.

Authorised persons acting on the Controller's behalf (customer support, technical administration) also have access to data and are bound by confidentiality. Support staff may sign in to a Customer's Account only to resolve a reported problem; such actions are recorded in the event log.

6 Transfers outside the European Economic Area

Some recipients (Cloudflare, Runpod, OpenAI, Google, GitHub, Stripe group companies) are based in or process data in the USA. Data is then transferred on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) – where the recipient participates in it – or on the basis of standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). A copy of the safeguards can be obtained by writing to [Adres E-mail do Kontaktu].

7 How long we keep data

  • Audio file – deleted right after transcription is completed; unfinished uploads – automatically when they expire (within 24 hours).
  • Frames for image analysis – not stored in the Service.
  • Subtitle text, SRT file, word timings and results of the hook analysis, image analysis and soundbite/reel analysis – 30 days after the transcription is completed, then deleted automatically. Job details (file name, length, date, minutes used) remain until the Account is deleted.
  • Account and settings – until the Account is deleted; unconfirmed Accounts – 7 days.
  • Event log (IP address, browser) – 180 days.
  • Attempt counters (abuse protection) – 24 hours; browser session – until sign-out, at most 12 hours (2 hours of inactivity).
  • Plugin linking codes – deleted one day after they expire; device tokens – until the device is unlinked or the Account is deleted.
  • Notifications from the payment operator – 90 days.
  • Payment and billing data – 5 years from the end of the year in which the tax obligation arose.
  • Acceptances of the Terms and Privacy Policy – until the limitation period for claims expires, including after the Account is deleted.
  • Newsletter consent – until withdrawn or the Account is deleted.
  • Support tickets – for the time needed to handle them and until the limitation period for claims expires.
  • Viral Radar – analyses, downloaded videos and source transcripts: 30 days; Customer scripts: 90 days.
  • Server technical logs – for the time necessary to diagnose errors.

Account deletion: we delete content (transcripts, recordings, analyses, dictionary, settings, the Customer's Viral Radar data), access and devices (password, two-step login, Google/GitHub sign-in, sessions, tokens), and newsletter consents and queue. The e-mail address and name are replaced with anonymous values. Payment and subscription data, document acceptances and the event log remain, without identifying data, on the bases and for the periods described above. Billing data held by Stripe is deleted by Stripe under its own policy.

8 Cookies and browser storage

The Service uses only cookies necessary for its operation and cookies that remember settings. We do not use analytics or advertising cookies.

  • __Host-napisy – the signed-in user's session and form protection (necessary); valid until sign-out, at most 12 hours.
  • theme – the chosen theme (light/dark), 1 year – set when the user changes the theme.
  • napisy_lang – the chosen language, 1 year – set when the user changes the language.
  • napisy_friend – the referral code from a referral link, 30 days.
  • napisy_ref – the partner code from a partner link, for the period set for the partner programme (30 days by default).
  • Browser storage (localStorage) – dismissed notices and side menu state; this data is not sent to the Service.
  • Cloudflare may set technical security cookies (e.g. related to bot protection and Turnstile).
  • Payment takes place on Stripe's page, which uses its own cookies under Stripe's policy.

Cookies can be deleted or blocked in the browser settings; blocking the session cookie makes signing in impossible.

9 Data subject rights

Everyone has the right to: access their data and obtain a copy, rectification, erasure, restriction of processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

You can delete your Account yourself (Account → Delete account). Please send other requests to [Adres E-mail do Kontaktu] – we respond within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or another EU supervisory authority competent for your place of residence.

10 Automated processing

Transcripts and analyses are created automatically by machine learning models, but we do not make decisions about anyone that produce legal effects or similarly significantly affect them (Article 22 GDPR). We do not profile Customers for marketing purposes.

11 Security

Our measures include: encrypted connections (HTTPS), password hashes instead of passwords, encryption of two-step login secrets, storing device tokens only as hashes, one-time signed links for files sent for transcription, attempt limits and bot protection, strict browser security headers, an event log, new-device sign-in alerts and digital signing of Plugin updates.

12 Changes to this Privacy Policy

We announce changes in the Service and by e-mail, together with their effective date. Previous versions are available in the Service.