Privacy Policy

SCAPTION processes live event audio to provide transcription and translation, relayed through our backend to the third-party processors listed on our subprocessors page. Questions about data handling: [email protected]. Last updated: 1 October 2026. The Spanish version prevails in case of discrepancy. An improved version of this policy will be published soon; substantial changes are announced in advance.

Esta política también está disponible en español.

Who we are

SCAPTION is a trading name of Luis Miguel Burgaz Olmeda (sole trader), NIF 73052907P, registered address Paseo Constitución 8, local izquierda, 50008 Zaragoza, Spain. Data-protection contact: [email protected].

Who is responsible for what

Two different roles, and the distinction decides who you ask about what. For event content (the audio we relay, the captions, an attendee's question) the SCAPTION customer running the event is the controller and SCAPTION is their processor: we process it on their instructions and for no other purpose. For your account, billing, this website and our marketing emails, SCAPTION is the controller. We sign a Data Processing Agreement (GDPR art. 28) with any customer who needs one, on every plan and at no charge. Write to [email protected].

Why we may process your data

• Performance of a contract (art. 6.1.b). Running your account, relaying your events, metering usage and billing what you used.
• Legal obligation (art. 6.1.c). Invoices and the accounting records tax law requires us to keep.
• Legitimate interest (art. 6.1.f). Keeping the service secure and available, preventing abuse of a live relay, filtering audience-submitted questions, and the product telemetry and diagnostics described below.
• Consent (art. 6.1.a). Marketing emails and the analytics and advertising cookies described below. Both are optional, both are withdrawable, and neither affects the service.

What we store

During a live event, audio and the resulting captions are processed in real time and streamed to the audience output. They are not retained after the session. What we keep for your account is session metadata only: when each session started and ended and how long it ran, how many microphones it used, its languages (spoken, captioned, and those attendees asked for), its output and room code, which of your technicians ran it, how many attendee devices joined (a count, never who), and how much translation it consumed (counts, never text). That is what your usage and billing are based on. We do not store your event audio, and we do not keep transcripts by default. Neither do our providers keep it to improve their own products: every request we make to Deepgram, our speech-to-text provider, carries an explicit opt-out, so your event audio is not retained by them and is never used to train or improve their models; Soniox, which takes over only if Deepgram cannot connect, and for Basque and Galician, processes real-time audio in memory and, under its agreement with us, neither retains it nor uses it for training. The one provider retention we cannot switch off is OpenAI's, which holds API requests for 30 days for abuse monitoring and then deletes them; OpenAI does not use API data to train its models.

Everything we do store (your account, session metadata, and the optional transcripts you choose to keep, through AI Summary or when closing the app, described below) rests encrypted in our database hosted in the European Union (Frankfurt, Germany).

AI Summary (optional)

If (and only if) an operator uses the AI Summary feature, or chooses keep the transcript when closing the app, that session’s transcript is sent to our backend and stored so you can generate and re-download the summary from your dashboard, and from the room link too, if you choose to share one with the event's organiser. The narrower moderation link gives no access to the transcript. Only when a summary is generated is the transcript processed by OpenAI, to produce it; a transcript kept without a summary never reaches OpenAI. Either way it is kept for at most 30 days, and is then automatically deleted from our servers along with any generated summaries. Both are off unless you choose them, and the app tells you before the transcript leaves the machine. If you never use AI Summary and never choose to keep a transcript when closing, no transcript is ever stored. While stored, the transcript rests in the EU (Frankfurt, Germany); the summary itself is generated by OpenAI under a Data Processing Agreement with OpenAI Ireland Ltd incorporating the EU Standard Contractual Clauses.

If you are in the audience, not the customer

Anyone can follow an event on their own phone by scanning the room's QR code, no app, no account, no sign-in. We do not know who you are and we do not track you: choosing a language registers the language on the event, not you, and no analytics or session-replay script ever loads on that page. If the event has audience questions enabled: giving a name is optional and the name is never stored; your question may be translated into the event's language for the moderator, and it is checked by an automatic content filter (OpenAI moderation) that holds back anything it flags for a moderator to review. If that filter cannot be reached at that moment, the question goes through unchecked rather than being lost. Only if a moderator puts your question on the venue screen is its text kept as part of that event's record, for at most 30 days, after which it is deleted automatically. The same 30-day clock applies to the results of any live poll. If the event's operator generates an AI Summary, the questions put on screen and the poll results are part of what OpenAI reads to write it. Anyone holding the room code can read along. The code is an access convenience, not a confidentiality control.

Product telemetry & diagnostics

We record a small number of facts about how SCAPTION itself is used: an account was refused a live session and which plan limit refused it, a checkout was started, a signup attempt failed and for which reason; plus diagnostic reports when something breaks (what failed, where, how often, on which app version). This is our own server-side measurement: no third-party analytics product is involved, nothing is loaded into your browser or the app for it, and none of it leaves our infrastructure. The legal basis is our legitimate interest (art. 6.1.f) in understanding where our own product fails people and in fixing it.

What product telemetry may contain is fixed in code and enforced automatically: counts, timestamps, an account reference, and short pre-defined values such as a plan name or a failure reason, with no free-text field. A diagnostic report also carries the technical error message and where it happened (the place in the code, the app version), filtered automatically before it is stored so that no event content is included. Neither can carry event content of any kind (no audio, no caption, no transcript, no attendee question, no speaker name). Signup failures record only the reason, never the email address or IP that tried. Product telemetry is kept for 12 months and then deleted automatically by a daily job; a diagnostic report is kept for 12 months after the error last occurred, then deleted automatically. You may object to either at any time under "Your rights" below.

If you arrive from one of our campaigns and then create an account, we record where the link said you came from: the campaign parameters carried in the link itself, the referring website's domain (never the full address, which can contain a search you typed), and which page you landed on. It is stored once, with the account, and is never updated afterwards. Nothing is stored on your device for this: the information travels in the link you clicked, so if you leave and come back later there is nothing to remember you by, and the signup is simply recorded as direct.

How long we keep things

• Live audio and captions, never stored. They exist only while they are in flight.
• Account and session metadata (who you are, when a session ran, for how long, in which languages). Kept while your account exists. You can close it yourself at any time, without contacting us, from Account in your dashboard; doing so deletes every login on the account (and with them every email address on it), its name, any stored transcript and any room code you had reserved, and cancels any subscription. What closing keeps is the accounting record: the session records and usage totals your billing was based on, the invoices and the customer record at our payment provider, and, with them, the reason for leaving if you chose to give one. These are kept for as long as tax law requires, which we cannot shorten on request. That is the exception the GDPR itself makes to the right to erasure (art. 17.3.b), and once the account is closed they are no longer linked to any login. Two more things outlive the account: each address on it stays on our do-not-email list, so that we never write to it again, and questions put on screen and vote results are deleted on their usual 30-day clock rather than at once.
• Transcripts you chose to keep (through AI Summary, or when closing the app) and the summaries generated from them, at most 30 days, deleted automatically by a daily job.
• Launched audience questions and poll results, at most 30 days, same automatic deletion.
• Questions and votes you prepare in advance for a room. Kept with that room, and deleted when the room ends: you release its code, its reservation runs out, or you close the account. This is your own material, written by you or by whoever you gave the moderator link to; nothing an attendee types is ever stored here.
• Product telemetry, 12 months, deleted automatically by the same daily job. Counts and short pre-defined values only; never event content.
• Diagnostic reports, 12 months after the error last occurred, then deleted automatically. The technical error message and where it happened, filtered so that no event content is included.
• Marketing consent records. The date, and the exact wording you were shown. Kept while the consent stands and afterwards as evidence that it was freely given, because the law requires us to be able to prove it.

Where your data goes

Everything we store rests in the European Union (Frankfurt). Some of the processors on our subprocessors page are based outside the EEA. Transfers to them are covered by a data processing agreement incorporating the EU Standard Contractual Clauses, or by an adequacy decision. Live audio and the translation fallback are processed in the account's processing region: the European Union, the Americas or Asia-Pacific. Since 25 September 2026 a new account starts in the region of the country it signed up from (the European Union when that country cannot be determined, and for every account opened before then), and the account's owner can change it from the Account page, never while an event is on air. The region is recorded on the account, moves only those two legs to the hosts named on the subprocessors page, and leaves everything we store in Frankfurt. If an operator turns on the optional Zoom captions integration, finished caption lines are additionally sent to Zoom at the customer's own instruction, under the customer's own agreement with Zoom.

Your rights

You may ask us for access to your data, and for its rectification, erasure, restriction or portability; you may object to processing based on legitimate interest; and you may withdraw consent at any time, without that affecting what was lawful before you withdrew it. Two of these you can exercise yourself, immediately, from Account in your dashboard: withdrawing marketing consent, and erasure by closing the account. For anything else, write to [email protected] and we will answer within one month. If you are an event attendee rather than a customer, ask the organiser of that event first (the event content is theirs, and we act on their instructions) but you may write to us and we will route it. You can also lodge a complaint with a supervisory authority: in Spain, the Agencia Española de Protección de Datos.

Analytics & cookies

On our public marketing pages we use Google Analytics and Microsoft Clarity to understand how visitors use the site, and the Meta pixel (Facebook and Instagram) and Google Ads to measure how well our ads work and to show our ads again to people who have visited the site (remarketing), all gated behind the cookie-consent banner. None of them loads until you accept, and you can change your choice at any time from Cookie preferences at the foot of every page. They never load on a page carrying a credential in the URL or an event's content: not on the live attendee page, the Live Q&A link, the sign-in flow, or your dashboard. See our subprocessors page for what each one does with your data.

If you accepted analytics cookies and then create an account, our server also tells Google Analytics that a signup happened: one sign_up event, linked to the identifiers in your existing Google Analytics cookies, with no email address, name or other account detail. Without those cookies (you declined, or withdrew consent, which deletes them) nothing is sent. The film on our home page is hosted on YouTube: it loads from youtube-nocookie.com only when you click to play it, and from then on YouTube (Google) processes that viewing under its own privacy policy.

How did your event go? (one question)

On a paid plan, within a day or two after an event with a session of an hour or more, the person who ran it (or the account owner, if that person's login no longer exists) may receive one email asking how SCAPTION did, from 0 to 10. We send it at most once every 30 days per account, never about the free trial, and it contains no offers. Opening the email or its links saves no answer; only pressing Send on the page stores your score, your comment if you write one, and, the first time, how you heard of us. The legal basis is our legitimate interest (art. 6.1.f) in knowing whether the service we provide to you works. The answers are kept while your account exists and deleted when it is closed, and contain nothing said at your event. Each email has a link to stop them, and that choice is yours personally rather than the account's.

Marketing emails (optional)

If you tick the marketing checkbox at signup, we use your email address to send you SCAPTION news and offers. The legal basis is your consent (GDPR art. 6.1.a). The box is optional, unticked by default, and signup works the same without it. We keep a record of when you consented and the exact text you were shown, as the law requires us to be able to prove it. These emails are sent through MailerLite, which processes your email address solely on our behalf and only for this purpose. Your address is stored in the European Union; our contract is with MailerLite, Inc. (United States) and incorporates the EU Standard Contractual Clauses. MailerLite is listed on our subprocessors page. You can withdraw consent at any time, from Account in your dashboard, from the unsubscribe link in every marketing email, or by writing to [email protected], and withdrawing never affects your account or service. The dashboard setting is yours personally rather than the account's: if several people share an account, each manages their own. Transactional emails about your account (receipts, trial notices, payment issues) are separate and don’t depend on this consent.

For events with strict confidentiality requirements, simply don’t enable AI Summary and close without keeping the transcript. The live captioning path stores no transcript at all.