This policy explains what audesti does with personal data — what we collect, why, who else sees it, how long we keep it and what you can ask us to do about it.
audesti is a voice-testimonial platform. A business invites someone to record a short voice note; we transcribe it, analyse it automatically, and give the business tools to review, approve and publish it. That means two very different groups of people appear in this policy, and the answers differ for each.
01Our role: controller or processor
For account holders — the businesses that use audesti, and their team members — we are the controller. We decide what account, billing and usage data we need, and why.
For guests — the people who record testimonials — we are a processor acting on the instructions of the business that invited them. That business is the controller. It chose who to invite, why, and what to do with the result. If you recorded a testimonial and want it removed, changed or unpublished, the business that invited you is the right first stop; we can also act directly, as set out in clause 9.
Dodo Payments, our payment processor and merchant of record, is an independent controller of payment data. We never see your card details.
Where a business processes personal data of people in the EU, UK or India through audesti, our Data Processing Addendum sets out the processor terms.
02Whose data this covers
- Account holders and team members — people who sign in to audesti.
- Guests — people who record a testimonial. No account required.
- MCP access users — account holders who connect an AI assistant to their account.
- Visitors — people who read a public share page, a showcase page, or a widget embedded on someone else's site.
03What we collect
3.1Account holders and team members
| Identity | Email address, first and last name, profile image, phone number if you add one |
| Business profile | Company name, brand logo, theme colour, public showcase slug |
| Sign-in | Supabase Auth identifier, sign-in method (magic link or Google). We do not hold a password for accounts created this way; a hashed password exists only on legacy accounts predating the move to Supabase Auth |
| Preferences | Interface language, onboarding state, auto-email and auto-approve settings |
| Team | Who owns the team, who belongs to it, pending invitations and their expiry |
| Subscription | Plan, status, billing cycle, start, renewal and end dates, subscription identifier at Dodo Payments, last payment date and amount, plan-change history |
| Developer access | API key, when it was last used, how many calls it has made |
| Assistant access | OAuth grants and tokens for connected AI assistants, their scope, when each was created, last used and revoked; the client's registered name and version |
| Referrals | Your referral code, who referred you, bonus allowance earned |
We do not collect or store card numbers, bank details, CVVs or billing addresses. Those go directly to Dodo Payments.
3.2Guests
Entered by the business that invited you, before you ever see the page:
- your name, and optionally your email, company and job title.
Collected when you record:
- the recording itself, as made in your browser;
- a cleaned copy of it for playback — the same words, with background noise reduced and the volume evened out;
- the verbatim transcript, and an edited transcript — the same meaning in tidier wording, which is what gets displayed;
- the language the recording was detected to be in, its duration, and any translations that have been generated;
- automated analysis of the transcript: topics and their sentiment, overall sentiment, product or feature mentions, pain points, quotable phrases, mentions of other companies, and any outcomes or results you described;
- your consent record: that you consented, which version of the consent wording you saw, the timestamp, your IP address, your browser's user-agent string, and an anonymous session identifier;
- your publication decision: whether you opted in to public sharing, where you did so (the recording page or a later email), and when — or, if you declined or later withdrew, that fact and its date.
We keep the IP address and user-agent specifically as proof of consent. That is the only reason they exist on the record.
3.3MCP access users
When you connect an AI assistant, we record which client connected, the scope you granted, and when the connection was created, last used and revoked. See clause 6.3 for what the assistant can then see.
3.4Visitors to public pages and widgets
We count views and plays so businesses can see which testimonials perform. These are stored only as daily totals per testimonial and per surface — widget or share page. We do not store an identifier, a cookie, a profile or an IP address against a view. Some views are sampled and scaled up on read rather than counted individually.
3.5Collected automatically on every request
- Server logs of requests and errors, which may include IP address, user-agent and the path requested.
- Your IP address, used transiently for rate limiting and abuse prevention. On our production setup this comes from Cloudflare.
- Analytics on the app and marketing pages only — see clause 7.
04Why we process it, and on what basis
| Purpose | Basis (UK/EU GDPR) |
|---|---|
| Providing the platform to an account holder | Performance of a contract |
| Recording, transcribing, editing, translating and analysing a testimonial | The guest's consent, taken on the recording page, and our contract with the business |
| Publishing a testimonial on an audesti public page or as a share card | The guest's separate, optional consent |
| Showing an approved testimonial in a widget the business embeds on its own site | The business's legitimate interest in promoting itself, under its own controllership |
| Sending testimonial-request, team-invitation and share-permission emails | Performance of a contract, and legitimate interests |
| Billing, collections and tax records | Contract, and legal obligation |
| Security, rate limiting, fraud and abuse prevention | Legitimate interests |
| Product analytics on app and marketing pages | Legitimate interests — see clause 7 for the current position |
| Responding to legal requests | Legal obligation |
Where we rely on consent, you may withdraw it at any time; that does not affect processing already carried out.
We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not use it to build advertising profiles.
05Automated processing and AI
Transcription, transcript editing, translation and analysis are entirely automated. No one at audesti listens to recordings or reads transcripts as a matter of routine. We access content only when an account holder asks us to for support, or where we must to investigate abuse, secure the platform, or comply with the law.
What runs: OpenAI's Whisper produces the transcript while the guest waits. Afterwards, as a background job, a GPT-4o-mini model produces the edited transcript and the analysis. Audio clean-up for playback is done by Auphonic where available, and by local processing otherwise. Transcription always uses the original recording, never the cleaned copy.
No model training. We do not use recordings, transcripts or analysis to train our own models, and our AI sub-processors are not permitted to use them to train theirs.
Its limits. Output is probabilistic. Transcripts can contain errors; the edited transcript can differ in wording from what was said, which is why the verbatim transcript is always retained and shown to the account holder. Sentiment, topics and inferred outcomes are inferences, not facts.
No significant decisions. We do not use this processing to make decisions producing legal or similarly significant effects about anyone, and account holders are contractually barred from using audesti for decisions about employment, health, credit, insurance, housing, education, immigration or legal rights.
06Who else sees the data
6.1Sub-processors
We use the providers listed, with their locations and roles, at Sub-processors. In summary: OpenAI (transcription, editing, translation, analysis), Auphonic (audio clean-up), Supabase (database, file storage, authentication), Railway (application hosting), Cloudflare (network, caching, rate limiting), SendGrid (transactional email), Dodo Payments (payments, as independent controller), and Google (analytics on app and marketing pages; Google sign-in where an account holder chooses it).
Each is bound to process data only on our instructions, to keep it confidential and to secure it. We will post changes to that list before a new sub-processor starts handling personal data.
6.2The business that invited a guest
A guest's recording, transcripts, analysis, consent record and contact details are visible to the account that collected them, and to that account's team members.
6.3AI assistants an account holder connects
An account holder can connect an AI assistant to their account over our MCP connector, after signing in and approving the connection. Depending on the scope granted, the assistant can read that account's testimonials, transcripts, analysis results, testimonial requests, quotable phrases and statistics — and, with write access, create testimonial requests (which can email a guest), approve testimonials, edit them, and create share links.
This happens only for the account that approved it, only after an explicit consent step, and can be revoked at any time from the Connector page. Once data reaches the assistant, it is handled by that assistant's provider under their terms and privacy policy, not ours. We have no control over how long they keep it or what else they do with it. An account holder connecting an assistant is making that disclosure decision on behalf of the guests whose testimonials the assistant can read.
6.4Everyone, where a testimonial is published
See clause 8.
6.5Legal and corporate
We may disclose data where we must to comply with law, a court order or a lawful request from an authority; to establish, exercise or defend legal claims; or to protect the rights, safety and property of audesti, our users or the public. If audesti is involved in a merger, acquisition or sale of assets, data may transfer as part of it; we will give notice before it becomes subject to a different privacy policy.
07Cookies and analytics
In short: a session cookie keeps you signed in, and Google Analytics runs on the app and marketing pages. We use no advertising or retargeting cookies anywhere, and no analytics at all on the pages guests and visitors see. In full:
7.1Where cookies are and are not used
audesti has two kinds of page, and they behave differently.
Pages where you are the customer — cookies are used
The marketing site, the sign-in page, the pricing page, the legal pages and the whole signed-in app.
| Cookie | Set by | Purpose | Duration | Consent |
|---|---|---|---|---|
session | audesti | Keeps you signed in and carries CSRF protection. HttpOnly, SameSite=Lax, Secure in production. | Browser session | Essential — no consent required |
remember_token | audesti | Keeps you signed in between visits, if you ask to be remembered. | Persistent | Essential — no consent required |
_ga, _ga_* | Google Analytics 4 | Measures page views and how the product is used, so we know what to improve. | Up to 2 years | Analytics |
Pages guests and visitors see — no cookies beyond what is strictly necessary
The testimonial recording page, embed widgets wherever they appear, public share pages, share-card images and public showcase pages.
These pages carry no analytics, no Google tag and no advertising technology. If you were invited to record a testimonial, or you are reading a published one, nothing is tracking you across sites.
Two things on those pages are worth naming, because they are not cookies but people reasonably ask:
- View and play counts. We count that a testimonial was seen or played, stored only as a daily total per testimonial. No cookie, no identifier, no IP address is stored against a view.
- Fonts, icons and stylesheets load from a public CDN (jsDelivr). Loading a file from a CDN exposes your IP address to it, as it does with any website. No cookie is set.
7.2Similar technologies
localStorage/sessionStoragehold small interface preferences, such as the language you chose, in your own browser. They never leave your device.- Cloudflare, our network provider, may set a cookie to distinguish genuine visitors from automated traffic, as part of security and rate limiting. This is strictly necessary.
7.3Consent, and where we currently stand
Essential cookies do not require consent — the platform cannot work without them.
Analytics cookies do require consent in the EU and UK.
We are being straight with you: audesti does not yet show a cookie consent banner. Google Analytics therefore loads on the app and marketing pages without asking first. We know that falls short of what EU and UK rules expect, and we are working on it.
Two things limit the impact in the meantime, and both are factual rather than excuses: no analytics of any kind runs on the pages guests and visitors see, and we run no advertising or retargeting technology at all.
Until a banner exists, you can block analytics yourself:
- turn on your browser's tracking protection, or use a content blocker;
- install Google's opt-out add-on;
- send a Do Not Track or Global Privacy Control signal;
- block or clear cookies through your browser settings — this will also sign you out of audesti, because the session cookie goes with them.
Browser instructions: Chrome · Safari · Firefox · Edge
7.4Third parties
Only two third parties are involved in anything on this page. Google receives analytics data from app and marketing pages, under its own privacy terms. Cloudflare sits in front of the platform as our network and security layer. Nobody else receives anything, and no data from this platform is sold or shared for advertising.
7.5Changes to our cookie use
We will update this section when our cookie use changes — including when the consent banner described in 7.3 ships, at which point this section will be revised to match.
08Public exposure — read this if you recorded a testimonial
Two separate permissions decide where a testimonial can appear.
The business approves it. Nothing is published anywhere until the business reviews and approves it. Once approved, it can appear in embed widgets the business places on its own website. That is the business's decision, on the business's site.
You opt in, separately, for audesti's own public pages. A testimonial appears on a public audesti share page (/s/<code>), as a downloadable share-card image, or on the business's public showcase page (/reviews/<slug>) only if you gave the separate, optional permission — on the recording page, or by answering a later email asking for it. Declining changes nothing else: the business still gets your testimonial for its own use.
The showcase page is indexed by search engines. It is deliberately crawlable, carries structured data, and can be found through search. Share pages and share-card images are served at hard-to-guess addresses but are not password-protected: anyone holding the link can open them.
Recordings are stored at public but unguessable URLs. Audio files and share cards are served from our object storage by a long, random address. They are not listed or indexed, but they are not access-controlled either.
Changing your mind. Ask the business that invited you. When they record your withdrawal, the testimonial leaves the share page and the showcase page at once and the share card is deleted. It does not automatically leave a widget already embedded on the business's own website — that is their site, and taking it down there is their responsibility, which they have agreed to do promptly. To have the recording itself deleted, email [email protected].
09Your rights, and how to use them
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable form, and withdraw consent. You may also have the right not to be discriminated against for exercising these rights.
Account holders can do much of this in the app directly: edit your profile, export testimonials to CSV, delete individual testimonials, delete all of your team's content in one action, or delete your entire account — which also cancels a live subscription first, and deletes your sign-in identity. For anything else, email [email protected].
Guests should normally ask the business that invited you, since it is the controller and holds the relationship. If you would rather come to us, or the business does not respond, email [email protected] for deletion or [email protected] for anything else. Include enough to identify the recording: the link you were sent, or roughly when you recorded and the name you used. We will pass a request on to the relevant business where we must, and we will tell you when we do.
We respond within 30 days. We may ask for enough information to be satisfied who you are, which is a safeguard, not an obstacle. There is no charge unless a request is manifestly unfounded or excessive.
If you are in the EU, UK or India and you think we have got this wrong, you may complain to your data protection authority — in the UK the ICO, in the EU your national authority, in India the Data Protection Board. We would rather you told us first.
10How long we keep it
| Data | Retention |
|---|---|
| Recordings, transcripts, analysis, consent records | Until the account holder deletes them, or deletes the account |
| Account and profile data | Until the account is deleted |
| Billing records and invoices | As long as tax and accounting law requires, after account closure |
| OAuth grants and tokens for assistants | Until revoked; tokens expire and rotate in normal use |
| Server logs | A short operational period, then discarded |
| View and play counts | Retained as daily aggregates; they identify no one |
Deletion is immediate and real. When content is deleted, it goes from our live database and our file storage straight away, and cached copies at our edge are purged. Our database provider does not take scheduled backups on the plan we currently use, so no backup copy survives. If we ever enable backups, a deleted record could persist in one for up to 30 days, and we will update this policy before that becomes true.
11Security
- All traffic is encrypted in transit over TLS.
- Data at rest is encrypted by our database and storage provider.
- Row-level security is enabled on every database table, and every query is scoped to the owning account.
- API keys and OAuth tokens are stored hashed, not in readable form.
- Session cookies are HttpOnly, SameSite=Lax and Secure; requests that change data carry CSRF protection.
- Our origin only accepts traffic arriving through our edge, which applies rate limiting and bot filtering.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority where the law requires it, within the time limits it sets.
12International transfers
audesti is operated from India, and our providers are largely in the United States and the European Union. Using the platform means personal data will be transferred across borders — including out of the EEA, the UK and India.
Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum or UK IDTA as applicable, together with the contractual and technical measures described above.
Our database and file storage are hosted in Sydney, Australia (Supabase).
13Children
audesti is for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from a child. If you believe a child has recorded a testimonial, email [email protected] and we will delete it.
14Changes
We may update this policy. The version and effective date at the top identify the current text. For changes that materially affect how we handle personal data, we will give notice by email to account holders, or by a prominent notice in the app, before they take effect. Previous versions are available on request.
15EU, UK and India
This clause is for people and businesses in the EU, the UK and India. It sets out how audesti meets its obligations under the GDPR, the UK GDPR and India's Digital Personal Data Protection Act 2023, and how you exercise your rights. It adds to the clauses above rather than replacing them; where it says something more specific, the more specific statement applies.
15.1Who is responsible for what
| Situation | GDPR / UK GDPR | DPDP Act |
|---|---|---|
| Your account, billing and usage data | audesti is the controller | audesti is the Data Fiduciary |
| A guest's recording, transcript and analysis | The business that invited them is the controller; audesti is its processor | That business is the Data Fiduciary; audesti is its Data Processor |
| Payment data | Dodo Payments is an independent controller | Dodo Payments is an independent Data Fiduciary |
This matters in practice. If you recorded a testimonial and want it removed, the business that invited you decides, and we act on their instruction. We can still act directly where we must — see clause 5.
15.2Lawful bases
For account holders we rely on performance of a contract (running the platform), legal obligation (tax and accounting), and legitimate interests (security, abuse prevention, product analytics on the app and marketing pages).
For guests the business is the controller and chooses its own basis, but the platform is built around consent, and it is taken before anything is recorded:
- consent is given by ticking an unticked box, which is a positive act, not a default;
- it is specific — recording, transcription and AI analysis are named in the wording, and the plain-language explanation sits next to the box, not behind a link;
- publication is a separate, optional consent, so agreeing to record never silently agrees to being published;
- each consent is logged with the version of the wording actually shown, the timestamp, the IP address, the browser user-agent and a session identifier, so what a person agreed to can be reconstructed later;
- granting the browser microphone permission is not treated as consent on its own.
Consent can be withdrawn. A guest asks the business, which records the withdrawal; the testimonial leaves audesti's public pages immediately and the share card is deleted. Withdrawal does not undo processing already carried out lawfully.
15.3Voice recordings: what they are, and what they are not
A voice recording is personal data, and it is personal data of an unusually personal kind. We treat it accordingly.
It is not special-category data under GDPR Article 9. Article 9 covers biometric data processed for the purpose of uniquely identifying a person — voiceprint matching, speaker identification, voice-based authentication. audesti does none of that. We transcribe what was said and analyse the text. We do not fingerprint a voice, match it against any other recording, or attempt to identify anyone from the sound of it. There is no speaker-recognition model anywhere in the platform.
We state this plainly because an earlier version of this page claimed the opposite, and it was wrong. Nothing we do with a recording requires an Article 9 condition.
Two caveats, honestly flagged. First, a guest may say something sensitive — about their health, their politics, their beliefs — and if they do, that content is special category data in the recording. Businesses are contractually barred from soliciting it, and should remove it if it appears. Second, if we ever add voice identification, this page and the consent wording change first, before the feature ships.
15.4Automated processing and Article 22
All transcription, transcript editing, translation and analysis is automated, and no one reads or listens as a matter of routine.
None of it is automated decision-making producing legal or similarly significant effects under Article 22. We produce text and inferences for a business to read; we make no decision about any person. Account holders are contractually barred from using audesti for decisions about employment, health, credit, insurance, housing, education, immigration status or legal rights.
AI output is probabilistic. The verbatim transcript is always kept alongside the edited one precisely so that the machine's version can be checked against what was actually said.
No training. Recordings, transcripts and analysis are never used to train our models, and our AI sub-processors are not permitted to use them to train theirs. If you read anywhere in our older documents that providers "may store and use data to improve their models", that statement was inaccurate and has been removed.
15.5Your rights
Under GDPR and UK GDPR
Access (Art. 15) · rectification (Art. 16) · erasure (Art. 17) · restriction (Art. 18) · portability (Art. 20) · objection, including to processing based on legitimate interests (Art. 21) · withdrawal of consent at any time (Art. 7(3)) · not to be subject to a decision based solely on automated processing (Art. 22, which as set out above does not arise here).
Under the DPDP Act 2023
Access to a summary of your personal data and the processing (s. 11) · correction, completion, updating and erasure (s. 12) · grievance redressal (s. 13) · nomination of someone to exercise your rights in the event of death or incapacity (s. 14).
How to exercise them
Account holders can do most of it in the app: edit your profile, export testimonials to CSV, delete individual testimonials, delete all your team's content at once, or delete the whole account — which cancels any live subscription first and removes your sign-in identity. Anything else: [email protected].
Guests should normally ask the business that invited them, since it is the controller and holds the relationship. If you prefer to come to us, or the business does not respond, email [email protected] to have a recording deleted, or [email protected] for anything else. Give us enough to find the recording — the link you were sent, or roughly when you recorded and the name you used. Where a request belongs with a business rather than us, we pass it on and tell you we have.
Our response time is 30 days. Under the DPDP Act, grievances are answered within the statutory period. There is no charge unless a request is manifestly unfounded or excessive, and we may ask for enough information to be sure who you are.
15.6Complaints
Tell us first — [email protected] — and we will try to put it right.
You also have the right to go straight to a regulator:
- UK — the Information Commissioner's Office, ico.org.uk
- EU — the supervisory authority in your country of residence, work or where the issue arose
- India — the Data Protection Board of India
15.7International transfers
audesti is operated from India. Our providers are largely in the United States and the European Union, and the full list with locations is at Sub-processors. Personal data therefore crosses borders, including out of the EEA and the UK.
For transfers out of the EEA we rely on the European Commission's Standard Contractual Clauses. For transfers out of the UK we rely on the UK Addendum to those clauses, or the UK IDTA. These sit alongside the technical measures in clause 8 and the contractual commitments in our DPA.
Under the DPDP Act, transfers out of India are permitted except to a country the Central Government has restricted. We monitor that list.
A copy of the transfer clauses we rely on is available on request.
15.8Security measures
Encryption in transit over TLS · encryption at rest at the database and storage layer · row-level security on every table, with every query scoped to the owning account · API keys and OAuth tokens stored hashed · HttpOnly, SameSite=Lax, Secure session cookies with CSRF protection on state-changing requests · an origin that only accepts traffic through our edge, which applies rate limiting and bot filtering · least-privilege access to production · logging and monitoring.
Breach notification. Where a personal data breach is likely to result in a risk to people's rights, we notify the relevant supervisory authority within 72 hours of becoming aware of it, and affected individuals without undue delay where the risk is high. Acting as a processor, we notify the controlling business without undue delay so that it can meet its own deadline. Under the DPDP Act, we notify the Data Protection Board and affected Data Principals as required.
15.9Retention, DPO and representatives
Retention is set out in clause 10 above. In short: content lives until the account holder deletes it; deletion is immediate from the live database, from file storage and from our edge cache; our database plan takes no scheduled backups today, so nothing survives in one.
Data Protection Officer. We have not appointed one. Our processing is not large-scale monitoring, and does not consist of special-category data as its core activity, so Article 37 does not require it. Privacy matters go to [email protected] and reach the people who decide.
EU and UK representatives. We have not appointed an Article 27 representative. If our offering to people in the EU or UK grows beyond occasional processing, we will appoint one and name them here. In the meantime, requests and regulator correspondence should go to [email protected] and will be handled directly.
15.10Children
audesti is for adults and is not directed at anyone under 18. Under the DPDP Act, processing a child's personal data requires verifiable parental consent, and audesti does not provide a mechanism for it — which is to say the platform must not be used to collect testimonials from children at all. Tell us at [email protected] if you believe a child has recorded one, and we will delete it.
16Contact
Privacy and data-protection requests: [email protected] Guests asking us to delete a recording: [email protected] Everything else: [email protected]
We have not appointed a Data Protection Officer; the nature and scale of our processing does not require one. Privacy questions go to the address above and reach the people who can answer them.
audesti is operated by Beyondt Consultancy and Services, India. Our registered postal address is available on request.