Privacy policy

This is a translation. The German version is binding.

This privacy policy informs you under Articles 13 and 14 of the General Data Protection Regulation (GDPR) about the processing of personal data on stenowise.com, docs.stenowise.com and account.stenowise.com and in the Stenowise app.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is Stenowise, Inhaber Sören Kann (owner: Sören Kann), Heidkoppel 20B, 21379 Scharnebeck, Germany, email: kontakt@stenowise.com. Please send data protection enquiries to datenschutz@stenowise.com. No data protection officer has been designated, as there is no obligation to do so.

2. Processing operations

All data we store is held on our server at Hetzner Online GmbH, Gunzenhausen (data centre in Nuremberg), which acts as our processor under Art. 28 GDPR for all processing operations below.

2.1 Website and help pages

When you visit stenowise.com and docs.stenowise.com, the web server processes your IP address, the address requested, the time and the information sent by your browser (type, operating system, language). The website sets no cookies, uses no analytics services and embeds no third-party content; form entries are sent to api.stenowise.com (sections 2.6 to 2.8).

Purpose: delivery of the pages.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest: provision and security of the website).
Retention: only for the duration of the visit; no access log is kept for these addresses.

2.2 Account and sign-in

An account is required to use the app. We process your email address, password, the times of sign-up and of confirmation, the app's sign-in data and the start and end of the free trial month; if you sign in with Google, we receive an identifier of your Google account and your email address from Google Ireland Limited, Dublin, Ireland.

Purpose: setting up and maintaining the account, sign-in, granting the free trial month.
Legal basis: Art. 6(1)(b) GDPR.
Recipients: if you sign in with Google, Google Ireland Limited as an independent controller.
Retention: until the account is deleted, which you can do at any time in the app; in backups for at most seven days longer.

Free trial month: After an account is deleted, we store, for as long as we offer the free trial month, a pseudonymised check value of the email address without reference to the account, so that the free trial month is granted only once per address (Art. 6(1)(f) GDPR; legitimate interest: preventing repeated use).

Rank in the statistics: From the word counts we determine which tier (such as "Top 10%") your account belongs to in the current month compared with other accounts; the tier is shown only to you (Art. 6(1)(f) GDPR; legitimate interest: providing the statistics). You can object at any time with the switch "Count me in the rank".

Dictionary: If you sync your dictionary, we store your entries with your consent (Art. 6(1)(a) GDPR) until you switch syncing off. For invitations to a shared dictionary we process the email address given by the inviting person; members see the addresses of the other members (Art. 6(1)(b) GDPR towards the inviting person, point (f) towards the invited person; legitimate interest: delivering the invitation). We delete open invitations when they are accepted, withdrawn or replaced; invitations and entries of shared dictionaries at the latest with the dictionary or its owner's account.

2.3 Dictation, recognition and refinement

The app sends the voice recording with the language setting and dictionary entries to our server, which forwards it for speech recognition to Mistral AI SAS, Paris, France, and if that fails to Scaleway SAS, Paris, France. For text refinement and "Change by voice", Scaleway SAS receives the text concerned with your instructions, settings, dictionary entries and, if a voice style is set, the name of the target application. The service providers do not use the data for training. With recognition on your device, the recording does not leave the device. Dictations may contain special categories of personal data (Art. 9(1) GDPR) such as health data; you determine the content, and we process it solely for recognition and refinement.

Purpose: performance of the contractual service, calculation of the allowance.
Legal basis: Art. 6(1)(b) GDPR.
Recipients: Mistral AI SAS and Scaleway SAS as processors.
Retention: We do not store the recording or the text, only the word count and day per dictation until the account is deleted. Mistral stores nothing for recognition after the recording has ended, and for recognition while you speak up to 30 days for abuse detection. Scaleway stores nothing except diagnostic data on technical errors for up to two weeks.

2.4 Payment and invoices

When you book Stenowise Pro, we process your name, address, country, payment interval and, if given, company and VAT identification number. Credit card payments are handled by Mollie B.V., Amsterdam, Netherlands; it receives your name, email address, the amount and an account identifier, and we receive from it the status of payments, refunds and chargebacks. You enter your card details directly with Mollie. We check VAT identification numbers of other Member States through the European Commission's VIES system. We issue invoices with Lexware Office.

Purpose: performance of the contract, payment processing, invoicing, tax obligations.
Legal basis: Art. 6(1)(b) GDPR; for invoices and their retention point (c) in conjunction with sections 14 and 14b UStG (German VAT Act) and section 147 AO (German Fiscal Code); for the VIES check point (f) (legitimate interest: correct VAT treatment).
Recipients: Mollie B.V. as an independent controller; Haufe Service Center GmbH, Freiburg (Lexware Office), as processor; the European Commission and the tax administration of the Member State concerned.
Retention: billing details until the account is deleted; invoices and accounting records for eight years from the end of the calendar year of issue, also after the account is deleted.

2.5 Emails

We send emails relating to your account and contract, such as address confirmation, password, order, invoice, cancellation and withdrawal confirmations, notices on payments and on the end of the free trial month, and replies to enquiries, and store the type, time and result of each dispatch.

Purpose and legal basis: performance of the contract under Art. 6(1)(b) GDPR, statutory confirmations under point (c).
Recipients: Scaleway SAS, Paris, France (dispatch), as processor.
Retention: dispatch records until the account is deleted.

Advertising: The notices on the end of the free trial month contain a button to book Stenowise Pro, i.e. advertising for our own similar service (Art. 6(1)(f) GDPR in conjunction with section 7(3) UWG (German Act against Unfair Competition); legitimate interest: direct marketing). You can object at any time (section 4) without incurring any costs other than transmission costs at basic rates.

2.6 Cancellation and withdrawal through the website

Through "Cancel contracts here" and "Withdraw from contract" on stenowise.com we process the email address of your account, your name (optional for cancellation), details of the contract, type and date, for extraordinary cancellation the reason, and the time of receipt. The confirmation is sent to the account address; we receive the reason by email for review. If there is no account for the address, we store nothing.

Purpose: receipt, confirmation and implementation of the declaration; protection of the account holder against declarations by unauthorised persons.
Legal basis: Art. 6(1)(c) GDPR in conjunction with section 312k(4) and section 356a(4) BGB (German Civil Code) (confirmation); Art. 6(1)(b) GDPR (implementation); Art. 6(1)(f) GDPR (protection against declarations by unauthorised persons as legitimate interest).
Recipients: Scaleway SAS as processor; for Stenowise Pro, Mollie B.V. to stop payments and to refund.
Retention: a record of type, contract, times and status of the declaration without name, reason and email address until the account is deleted, thereafter without reference to you.

2.7 Affiliate program

Customers with a voucher code: If you enter a partner's voucher code, we store the partner, the time and place of entry and, for each payment, the commission. To prevent abuse we compare email address, its domain, billing name, company and address with the partner's details and other accounts and review matches manually. The partner receives only aggregated figures per month. The legal basis is Art. 6(1)(b) GDPR (discount), point (f) (commission and abuse check; legitimate interest: settlement with partners, fraud prevention) and point (c) in conjunction with section 147 AO (retention). We store the assignment until the account is deleted and commission data for eight years from the end of the calendar year of the credit note, after deletion of the account without name and email address.

Partners: For the application and the partnership we process name, company, email address, address, country, details of the channel, tax status, tax number or VAT ID and requested code, after approval also bank details or PayPal address, messages, access data, commissions, credit notes and payouts.

Purpose: review of the application, partnership, settlement and payout.
Legal basis: Art. 6(1)(b) GDPR; for credit notes Art. 6(1)(c) GDPR in conjunction with section 147 AO and section 14b UStG; for the VIES check and retention of rejected applications or after a suspension Art. 6(1)(f) GDPR (legitimate interest: correct taxation, queries, defence against claims).
Recipients: Scaleway SAS and Haufe Service Center GmbH as processors; our bank; for payouts via PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, as an independent controller; the European Commission and tax administrations (VIES); tax authorities where required by law.
Retention: rejected applications six months. Bank details, PayPal address and access data until the last payout after the end of the partnership. Credit notes eight years from the end of the calendar year of payout or cancellation; we delete the remaining data with the last credit note, after a suspension no earlier than eight years after the end of the calendar year of the suspension.

2.8 Download link and notification

Download link: If you request the download link by email, we use your email address only for that email, which Scaleway SAS sends as our processor, and do not store it. The legal basis is Art. 6(1)(b) GDPR.

Notification: If you wish to be informed when Stenowise is available for macOS or Linux, we process your email address, platform, language and the times of entry and confirmation; you are added only after confirming through the link in our email. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time through the link in each of these emails or at datenschutz@stenowise.com. We delete unconfirmed addresses after seven days and confirmed ones after sending the single notification or upon withdrawal. Recipient: Scaleway SAS (dispatch) as processor.

2.9 Support, error reports and usage figures

For enquiries from the app we process the text, app version, operating system and language, at your choice also the app log and the text and recording of the dictation concerned. Crash reports contain type and time, version, technical message and last log lines. For emails to us we process the address, name and content. With usage figures switched on, the app sends daily counts of dictations, errors and speaking time, version and operating system, without text or recording; we evaluate them only in aggregate.

Purpose: handling enquiries, fixing errors, improving reliability.
Legal basis: Art. 6(1)(b) GDPR for enquiries concerning the contract, otherwise point (f) (legitimate interest: replying); for voluntary attachments, crash reports and usage figures your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time through the respective setting.
Recipients: ALL-INKL.COM – Neue Medien Münnich, Friedersdorf (mailboxes), and Scaleway SAS (dispatch) as processors.
Retention: enquiries from the app and crash reports 90 days after they have been dealt with; emails until they are no longer needed and no retention obligation applies; usage figures 13 months, at most until the account is deleted.

2.10 Server logs, abuse protection and backups

For requests to api.stenowise.com and account.stenowise.com, including the app's update check, the web server logs the IP address, address requested, status and time. Our service logs per request the account number, route, status, duration, word and character counts and length of the recording, never dictation content or email addresses. Against unauthorised sign-in attempts and mass requests we process the email address and the shortened IP address briefly without permanent storage. We back up the database daily.

Purpose: secure and uninterrupted operation, troubleshooting, recovery.
Legal basis: Art. 6(1)(f) in conjunction with Art. 32 GDPR (legitimate interest: security and availability of the service).
Retention: The access log is limited to a fixed size; the oldest entries are deleted continuously. We delete the service log after 30 days and backups after seven days.

3. Transfers to third countries

We ourselves do not transfer personal data to countries outside the EU and the European Economic Area (EEA). Mistral processes recordings through its EU endpoint on systems in the EEA; for security services and group companies, Mistral uses sub-processors that may process individual data in third countries, including the United States. According to Mistral, these transfers are protected by appropriate safeguards under Art. 46 GDPR (list: trust.mistral.ai/subprocessors; copy of the safeguards on request at datenschutz@stenowise.com). If you sign in with Google, Google may transfer data to Google LLC, USA; it is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission of 10 July 2023 under Art. 45 GDPR exists.

4. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal. A message to datenschutz@stenowise.com is sufficient; you can also withdraw consents in the app through the respective setting.

5. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence. The authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany (postal address: Postfach 221, 30002 Hannover), email: poststelle@lfd.niedersachsen.de.

6. Obligation to provide data, no automated decision-making

Providing your data is not required by law. Required are, for the account, an email address and password or sign-in with Google; for Stenowise Pro, name and address; for cancellation and withdrawal through the website, the email address of the account and, for withdrawal, also your name. Without this information we cannot conclude the contract or process the declaration. All other information is voluntary.

There is no automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR.

7. Storing and reading information on your device

The website and help pages store nothing on your device; the website only reads your browser's information on operating system and language to show the matching download, without transmitting it. On the partner page we set the cookie "stenowise_partner" after sign-in for at most twelve hours. The app stores on your device your settings, dictionary, history and, if you wish, recordings until you delete them or the chosen period expires, and the sign-in data in the operating system's credential store. These operations are strictly necessary for the services you have expressly requested (section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). The app reads and sends usage figures and crash reports only with your consent (section 25(1) TDDDG).

8. Version

We update this privacy policy when Stenowise or the law changes. Version: 5 October 2026.