Privacy policy

Last updated: October 2026

The German version is the legally binding one; translations are provided for convenience.

Principle. chatFlow is local-first: your dictation history stays on your device by default. Cloud services (e.g. account, translation, AI features) are used only if you actively enable them or sign in.

1. Controller

International Talents LLC
Legal form: Limited Liability Company (Wyoming, USA)
30 N Gould St Ste N
Sheridan, WY 82801
USA
Email: [email protected]

2. What data we process

Account and sign-in data. When you sign in (including via “Sign in with Google”) we process your email address, your name and your profile picture, plus a username you choose. From Google we receive only these basic profile details — no access to Gmail, Calendar or Contacts. When you sign in, we also store which version of our Terms you accepted, in which language and when. So that each Mac receives the free trial week only once, the app transmits a hash value of your Mac's hardware identifier; the identifier itself never leaves your device. We store the hash value together with the account that reported it first.

Voice and text data. When you use dictation, translation or AI features, the relevant audio recording or text is transmitted to the corresponding service for processing and the result is returned to you. On your device, the audio recording is deleted after processing and is not stored permanently by us; at the respective service, the retention period follows that service's terms. Dictation history stays local on your device.

Recording via an agency’s link. If an agency that uses chatFlow sends you a recording link, you record your voice on chatflow.fast without an account. For this we process your first and last name, your date of birth (to check that you are at least 18), your email address, the time of your two confirmations, and your recordings together with their length and whether they were made on a phone. The agency receives your recordings and can see how far you have got; it uses them to train a voice or create clips. The legal basis is your consent (Art. 6(1)(a) GDPR); your name, date of birth and email address also serve as proof of whose voice it is (Art. 6(1)(f) GDPR) and are kept as long as the recordings or a voice trained from them exist; if you withdraw your consent, they are kept as proof for three more years from the end of the year in which you withdrew it and are then deleted. The recordings are stored with our database provider. You can withdraw your consent at any time with the code file you downloaded before your first recording; of the code itself we only keep an irreversible fingerprint.

Voice donation. If, when recording via an agency’s link, you also tick the voluntary box “I donate my recordings …”, we store a copy of your recordings separately from the agency and use it to train our own voice conversion models (the base model, pitch detection and speech sound detection). The legal basis is your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR); we also store the time, version and language of your consent. The agency does not learn whether you donate. The copies are stored with our database provider in the EU; for training they are passed to rented computers in the USA for the duration of a run and deleted there afterwards (Art. 49(1)(a) GDPR). The recordings are not published and not sold. They are kept until you withdraw the donation, at most three years after your last recording. You can withdraw it at any time with your code file at chatflow.fast/stimme-widerrufen, on its own or together with your permission for the agency; we then delete the copies immediately, and models already trained with them are retrained without them within six months at the latest. We keep the record of your consent and its withdrawal.

Usage and billing data. To provide the credit system we process which paid features you use and to what extent (e.g. credits consumed), along with technically necessary log data.

Error and crash reports. If a request on our servers fails, we store a technical error entry (affected function, error message, time, your user ID) in order to fix the error (Art. 6(1)(f) GDPR). We receive error reports from the app only if you allow this in the app or send a report yourself (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Such a report contains the affected function, a technical error message, the stack trace in the case of crashes, the version of chatFlow and of your operating system, the device model and, if you are signed in, your user ID. Beforehand we remove your user name from file paths and remove file names. Dictations, texts, prompts and images are never included. The reports are stored with our database provider and deleted after 30 days. We receive a summary without user IDs once a day by email. You can withdraw your permission at any time in the settings.

Payment data. Payments are handled by our payment partner Stripe. Your full payment details (e.g. card data) are processed there and are not stored by us.

Cookies & local storage. On the website we set no cookies and store nothing in your browser's local storage. To measure reach, we count on the server how often a page was visited – per day, page, country and, if the link carries one, tag (e.g. ?src=instagram). Our hosting provider derives the country from the connection; only these totals are stored, no IP address and no identifier of your device (Art. 6(1)(f) GDPR). If you visit the website from outside the European Union, our hosting provider additionally embeds a measurement script that counts page views. It sets no cookies and stores nothing on your device, but it reads technical details of your browser (browser identifier, visited address, referring page, load times) and sends them to the hosting provider. For visits from the EU it is switched off. For optional analytics or marketing cookies we obtain your consent beforehand.

3. Purposes and legal bases

We process your data to perform the usage contract and to provide the features you request (Art. 6(1)(b) GDPR), on the basis of your consent where you enable optional cloud/AI features (Art. 6(1)(a) GDPR), and to protect legitimate interests such as operation, security and abuse prevention (Art. 6(1)(f) GDPR). You can withdraw consent at any time with effect for the future.

4. Services and processors used

To operate the service we use carefully selected providers that process data on our behalf and are contractually bound:

• Hosting, data centre services & file storage: Cloudflare.
• Account, database & authentication (backend): Supabase.
• Sign-in: “Sign in with Google” (Google Sign-In).
• Email delivery: a business email provider used to send order confirmations and replies to support requests (name and email address) as well as internal error summaries without user IDs.
• AI features (speech recognition, translation, speech synthesis, chat and assistant features as well as text and image AI): specialised AI providers who process the respective content solely to provide the requested function. Where the respective provider's terms allow, use for training their own models is contractually excluded.
• Payment processing: Stripe (as “merchant of record”).

Which specific recipients have received your data is disclosed to you as part of your right of access under Art. 15 GDPR.

5. Retention period

We store personal data only as long as necessary for the stated purposes or as required by statutory retention periods. We delete audio recordings on your device after processing; at the services they are sent to for processing, those services' retention periods apply, which we will tell you in detail on request. Account and billing data are deleted once the usage relationship ends, unless retention obligations apply. We delete error reports after 30 days. We keep the hash value of the hardware identifier even after your account is deleted, then without any link to your account, so that a Mac does not receive a second trial week.

6. Transfers to third countries

Some service providers also process data in the United States or other third countries. Where an adequacy decision of the European Commission exists for the country or recipient concerned, we rely on that decision. Otherwise the transfer is based on the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR. A copy of these safeguards is available from us on request at [email protected].

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority. An informal message to [email protected] is sufficient to exercise these rights.

8. Data security

We take appropriate technical and organisational measures to protect your data. Connections are encrypted. Absolute protection cannot, however, be guaranteed.

9. Changes

We adjust this privacy policy when our data processing changes. The version published on this page applies in each case.

10. Contact

Privacy questions: [email protected]