Privacy Policy

Last updated: October 5, 2026

This policy explains what personal information Corbeia ("we", "us") collects when you use corbeia.com, the Corbeia web app at app.corbeia.com, the Corbeia desktop app and your Corbeia account (together, "the Service"), how we use and share it, and the rights you have. By using the Service you agree to this policy and to our Terms of Service.

1. Who is responsible for your data

The data controller is Corbeia. For any privacy question or request, email support@corbeia.com. We have not appointed a data protection officer, as our processing does not require one.

2. Your videos and audio stay on your device

Transcription runs locally — in your browser for the web app, and on your computer for the desktop app, using OpenAI's open-source Whisper models. The video and audio files you open are not uploaded to our servers, and we cannot see them, their transcripts or their subtitles. We never use your content to train AI models.

To run locally, the web app downloads the speech recognition model and its runtime from content delivery networks (Hugging Face, jsDelivr and our own Cloudflare storage). The desktop app comes with its speech model built in; the optional large model and GPU acceleration files download from our servers, falling back to Hugging Face and NVIDIA's package on PyPI. These downloads do not include any of your files.

3. Information we collect

Information you give us

• Account: your email address and, if you provide it, your name. If you sign in with Google, we receive your name, email address and profile picture from Google. We don't use passwords — you sign in with Google or with a one-time code sent to your email.
• Purchases: your plan, order number, amount, currency, country, payment status and subscription dates. We do not receive or store your card number — card data is handled by our payment processor (see section 6).
• Waitlist and contact: your email address and the platform you selected when you join a waitlist, and anything you send us by email.

Information collected automatically

• Devices: the computers and browsers signed in to your account (device name, operating system, browser and when they were last used), so we can apply the device limit of your plan.
• Device and network: IP address, browser type, operating system, language and approximate country.
• Usage: pages visited, clicks, scrolling, features used and errors, collected by our analytics tools (see section 5).
• Logs: request times, errors and performance data in our server logs.

Translation: if you choose a translation language, the text of your subtitles (not your video or audio) is sent from your device to Google Translate. Google's handling of that text is covered by the Google Privacy Policy. If you don't choose a translation language, nothing is sent.

4. How we use information, and our legal basis

• Providing the Service, your account and the plan you paid for — performance of a contract
• Billing, payment processing and enforcing device limits — performance of a contract
• Answering support requests — performance of a contract and legitimate interests
• Service emails such as sign-in codes, receipts, renewal reminders, security and policy updates — legitimate interests
• Preventing abuse and fraud and keeping the Service secure — legitimate interests
• Understanding how Corbeia is used and improving it — legitimate interests
• Meeting tax, accounting and other legal obligations — legal obligation
• Product news, launch announcements and offers — your consent, which you can withdraw at any time

We may use aggregated or de-identified data, which can't identify you, for statistics.

5. Cookies and analytics

• Strictly necessary: cookies that keep you signed in and protect your account. These can't be turned off if you want to sign in.
• Functional: browser storage that remembers your settings and lets an interrupted batch resume. Stored only in your browser.
• Analytics: we use Microsoft Clarity to understand how visitors use our site through usage data, heatmaps and session replays. Clarity masks text you type, and we additionally mask your name and email address in the app. Microsoft's handling of this data is covered by the Microsoft Privacy Statement.
• Page statistics: we also count page views with our own cookie-free analytics, which records the page, referrer, browser, device type and country, without cookies or a persistent identifier.

We don't use advertising or marketing cookies. You can block or clear cookies in your browser settings, and you can block Clarity with a browser extension or content blocker without affecting the Service, except that signing in needs strictly necessary cookies.

6. Sharing and disclosure

We do not sell your personal information, including "selling" or "sharing" as defined by laws such as the CCPA. We share it only:

• With service providers that run the Service on our behalf under confidentiality obligations: Cloudflare (hosting, database, storage and content delivery), Waffo Pancake (payments), Resend (email delivery), Microsoft Clarity (analytics), Google (sign-in with Google and translation) and Hugging Face and jsDelivr (model and app file delivery).
• For payments: payment card data is processed exclusively by our PCI-DSS compliant payment processor and merchant of record, Waffo Pancake, and is never stored on our servers.
• For legal reasons: when required by law, court order or a valid request from a public authority, or to protect our rights and users.
• In a business transfer: if Corbeia is sold or merged, we'll tell you in advance and the buyer must keep protecting your information under this policy.
• With your consent, for any other purpose.

7. Security

• All connections use TLS (HTTPS).
• We use one-time sign-in codes instead of passwords, and session cookies that scripts can't read.
• Access to personal data is limited to what's needed to run the Service.

If a data breach affects your personal information, we'll notify you and the relevant authorities within 72 hours of becoming aware of it, where required by law. Please keep access to your email or Google account secure, since it's how you sign in.

8. How long we keep information

• Account information and devices: while your account is active. When you ask us to delete your account, we delete it within 30 days.
• Purchase and transaction records: 7 years, as required for tax and accounting.
• Support emails: 2 years after the conversation ends.
• Server and security logs: up to 90 days.
• Analytics: session replays are kept by Microsoft Clarity for up to 30 days, and aggregated reports for up to 13 months.
• Waitlist emails: until you unsubscribe or the product you signed up for launches and we've told you about it.

9. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, CCPA and other data protection laws), you have the right to:

• know what personal information we collect and how we use it;
• access a copy of your personal information;
• correct inaccurate or incomplete information;
• delete your information;
• restrict or object to certain processing, including processing based on legitimate interests or for marketing;
• receive your information in a machine-readable format (data portability); and
• withdraw consent at any time, without affecting processing done before.

To use any of these rights, email support@corbeia.com from the email address on your account. We respond within 30 days. If you think we haven't handled your data properly, you can also complain to the data protection authority where you live.

10. Marketing emails and unsubscribing

We send product news and offers only if you've signed up for them. You can unsubscribe at any time with the link in any marketing email or by emailing us. Unsubscribing doesn't stop service emails such as sign-in codes, receipts, renewal reminders and security notices.

11. International transfers

We and our service providers process data in several countries, including the United States, the European Union and Singapore. When personal information from the EEA, UK or Switzerland is transferred to countries without an adequacy decision, we rely on our providers' Standard Contractual Clauses (SCCs) or other lawful transfer safeguards.

12. Children

The Service is not directed to children under 13 (or under 16 in the EEA and UK), and we do not knowingly collect personal information from them. You must be at least 18, or have a parent or guardian's permission, to buy a plan. If you believe a child has given us personal information, email us and we'll delete it promptly.

13. Third-party links and services

The Service links to and works with third-party services, such as Google sign-in and Google Translate. This policy covers only information we collect. Third parties handle data under their own policies, which we encourage you to read.

14. Changes to this policy

We may update this policy. For material changes, we'll email account holders at least 15 days before they take effect and update the date at the top of this page. Continuing to use the Service after a change takes effect means you accept the updated policy.

15. Contact

Questions or requests about privacy: support@corbeia.com. We reply within 2 business days.