Privacy Policy

1. Who We Are

Pepys is operated by KMF Ventures LLC, a Wyoming, USA limited liability company.

• Service: Pepys, available at pepys.co
• Contact: contact@pepys.co (for privacy, legal, support, and copyright matters)

If you have any questions about this policy or how we handle your data, email us at contact@pepys.co. Copyright and DMCA notices are handled under our Terms of Service and may also be sent to contact@pepys.co.

2. Summary

Pepys turns audio and video into timestamped, searchable transcripts. You either upload a file or paste a link to media on a third-party platform, and we transcribe it. We can also generate summaries, chapters, translations, structured "framework" analyses, and answers to your questions about your transcript through an AI chat.

To do this, we rely on a small set of trusted third-party vendors ("subprocessors") for hosting, storage, transcription, AI processing, payments, and email. We describe them by role below. You can request our current subprocessor list at contact@pepys.co.

In short: our business model is selling transcription, not your data. We do not sell your personal information, we do not use your content to train our own models, and you own your transcripts and uploads. You can delete them – or your whole account – at any time.

3. What Data We Collect

Account data

When you create an account, we collect your name and email address. Depending on how you sign in, we also store either:

• a password, kept only as a salted hash – we never store your password in plain text; or
• a Google account identifier, if you choose to sign in with Google (OAuth).

We verify your email address through a confirmation link.

Content data

This is the heart of the service, and it includes:

• the audio and video files you upload;
• the media links you paste (for example, from YouTube, TikTok, Instagram, Facebook, Spotify, podcasts, or any URL);
• everything we derive from that media – transcripts, summaries, chapters, translations, AI analyses, and the messages you exchange with the AI chat about your transcript; and
• the optional persona / "about you" context you set to tailor AI output.

Billing data

Payments are handled by Polar, our Merchant of Record. Pepys stores a reference to each Polar order, your card's brand and last 4 digits, and an append-only credit ledger recording your purchases and usage.

We never store full card numbers. Polar and its PCI-DSS Level 1 payment processor process and store your card details.

Technical data

To run and protect the service, we process:

• your IP address, used for rate-limiting and abuse prevention;
• one-way content hashes of audio, used to de-duplicate identical files and avoid re-processing the same media; and
• basic request and usage logs.

Cookies

Pepys sets a single essential, signed session cookie to keep you logged in. See the Cookies section below for details.

4. Sensitive Information and Your Content

The media you submit and the optional persona / "about you" context you set may contain personal or even sensitive information – for example, details about health, beliefs, or other private matters – because you choose what to include.

Pepys processes that content only to provide the service and at your direction. You control what you submit, and you are responsible for having any rights, permissions, and consents needed to upload, transcribe, and process it – including the rights of any people recorded and compliance with applicable recording and consent laws. This mirrors the representations you make in our Terms of Service.

Please do not submit special-category or other sensitive personal data unless you have a lawful basis to do so. If you are unsure, do not upload it.

5. How and Why We Use Your Data

We use your data to:

• Provide the service – authenticate you, transcribe your media, and generate summaries, chapters, translations, analyses, and chat answers.
• Process payments – sell and track one-time credit packs, maintain your credit balance, and run any auto-reload top-ups you enable.
• Communicate with you – send transactional email such as email verification, receipts, and account notices.
• Secure and protect the service – enforce rate limits, prevent abuse and fraud, and de-duplicate identical uploads.
• Maintain and improve the service – keep it running reliably and make it better over time.
• Comply with the law – meet our legal, accounting, tax, and fraud-prevention obligations.

We do not use your content to train our own models.

6. How Your Content Flows Through AI Processing

We want to be specific about what happens to your media:

• The media you upload, or that we fetch from a link, is stored in cloud blob storage.
• The audio is converted (downsampled) and split into chunks.
• Those chunks are sent to a speech-to-text provider for transcription.
• The transcript is reassembled and stored.
• To generate summaries, chapters, translations, framework analyses, and chat answers, the transcript text (and, where you have set it, your persona / "about you" context) is sent to a large-language-model (LLM) provider, routed through an AI gateway.

Where supported, we configure provider controls to limit retention and training use. Provider controls vary by service and route. We do not use your content to train our own models. Contact us for current subprocessor information.

7. Automated Processing

Pepys uses automated systems to transcribe and analyze your content – for example, speech-to-text transcription, speaker diarization, summaries, chapters, translations, and AI analyses. These are tools that assist you; you decide how to use their output.

Speaker detection (diarization) is optional and off by default. When you turn it on, our speech-to-text subprocessor analyzes voice characteristics in the audio to distinguish and label who is speaking. Depending on your jurisdiction, this may be treated as biometric or special-category personal data. We use it only to produce the speaker-labeled transcript you requested, we do not use it to identify individuals by name or build voiceprints for any other purpose, and it is retained and deleted on the same terms as the rest of your transcript (see Data Retention). Because the audio may contain other people's voices, you are responsible for having any consent or notice those individuals require before you enable speaker detection.

Our chat assistants – the assistant on this site, the in-app support assistant, and the chat inside a transcript – are AI systems. You are told this at the start of each conversation, and their answers can be inaccurate or incomplete, so please don't treat them as legal, financial, or professional advice.

Pepys does not make decisions that produce legal or similarly significant effects about you based solely on automated processing within the meaning of Article 22 of the GDPR. Because automated output can contain errors, you remain responsible for reviewing it before relying on it, as described in our Terms of Service.

8. Legal Bases (GDPR)

If you are in the EEA or UK, we rely on the following legal bases under the GDPR (and UK GDPR):

• Performance of a contract – to provide the service you sign up for, including transcription, AI features, and billing.
• Legitimate interests – to keep the service secure, prevent abuse and fraud, and maintain and improve the product (balanced against your rights).
• Consent – where consent is required (you can withdraw it at any time).
• Legal obligation – to comply with applicable legal, accounting, and tax requirements.

9. Subprocessors

We rely on a small set of trusted third-party subprocessors to operate Pepys. Rather than expose our infrastructure in detail, we describe them by the role each plays:

• Cloud hosting and storage – running the application and storing your account data, uploaded media, and transcript files.
• Speech-to-text – transcribing your audio and, where you enable it, identifying who spoke when (diarization).
• AI / LLM processing – generating summaries, chapters, translations, framework analyses, and chat answers. Each Gateway request requires zero-data-retention and no-prompt-training routing.
• Payments and Merchant of Record – Polar handles payments, billing, and sales tax/VAT as our Merchant of Record, and stores your card details (Polar uses Stripe, a PCI-DSS Level 1 provider, as its payment processor); we never store full card numbers.
• Transactional email – sending verification links, receipts, and account notices.
• Link resolution – fetching and resolving the media and captions behind links you paste from third-party platforms.
• Sign in with Google (OAuth) – authenticating you if you choose to sign in with Google.

We do not use your content to train our own models. Provider controls vary by service and route. You can request our current subprocessor list at contact@pepys.co.

10. We Do Not Sell Your Data

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. We also do not use your content to train our own models.

11. Data Retention

• Signed-in users – your transcript: your transcripts and derived outputs (summaries, chapters, translations, exports) are retained until you delete them or delete your account. Deleting a transcript removes its associated data. Deleting your account cascades to your files, jobs, transcripts, and ledger.
• Signed-in users – your original recording: the uploaded audio or video file itself is automatically deleted about 30 days after you upload it, whether or not you ask us to. Your transcript is not affected and stays available. We do this because we do not want to hold recordings of people's voices for longer than it takes to do the job you asked for. You can also erase a recording at any time before then, using the delete button on the player in the transcript editor – again, the transcript is kept. Once the recording is gone it cannot be recovered, and re-transcribing or making clips would need a fresh upload.
• Keeping a specific recording: if you have purchased credits, you can mark an individual recording to be kept, and that one is then held until you unmark or delete it instead of expiring on the 30-day schedule. This is per recording and off by default – the short window remains the default for every account, including yours. You can see which of your recordings are marked, and change it, from the player in the transcript editor.
• Account required for transcription: Pepys does not start provider-backed transcription work until you create or sign in to an account.
• Operational data: rate-limit counters and de-duplication caches are purged periodically.
• Records we must keep: we may retain limited records – such as transaction and credit-ledger records – for as long as required for legal, accounting, tax, and fraud-prevention purposes. These are typically kept for the period required by applicable tax and accounting law (commonly up to seven years) and then deleted or anonymized.

12. Security

We protect your data with measures including:

• encryption in transit (HTTPS/TLS) and at rest via our infrastructure providers;
• passwords stored as salted hashes, never in plain text;
• payment cards handled entirely by Polar and its payment processor; and
• restricted access to systems and data.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you have a concern, contact us at contact@pepys.co.

13. International Transfers

We are based in the United States, and your data is processed primarily in the United States and in other countries by us and our subprocessors. We can provide further detail about a specific subprocessor's processing locations on request at contact@pepys.co.

Storage region. Accounts created from the EEA, the UK or Switzerland are assigned to our EU storage region: the uploaded recording, the transcript file and any clips rendered from it are held in EU data centres and do not leave them. You can see and, before your first transcript, change your storage region in Settings. Two things are deliberately outside that boundary. Your account details – your email address, credit balance and the job records themselves – are held in our primary database in the United States. And transcription is processing, not storage: to convert speech to text, audio is sent to our speech-to-text subprocessors in the United States for every account, whichever storage region it is in. Both transfers rely on the safeguards described below.

Where required by law, we rely on appropriate safeguards to protect personal data transferred across borders – such as the Standard Contractual Clauses for transfers from the EEA, and the UK Addendum to the Standard Contractual Clauses (or the IDTA) for transfers from the UK, as applicable. You can request a copy of the safeguards we use at contact@pepys.co.

14. Your Privacy Rights

For users in the EEA and UK (GDPR)

You have the right to:

• access your personal data;
• rectify inaccurate data;
• erase your data;
• restrict processing;
• port your data to another service;
• object to processing based on legitimate interests; and
• lodge a complaint with your local data protection supervisory authority.

For California residents (CCPA/CPRA)

You have the right to:

• know and access the personal information we collect about you;
• delete your personal information;
• correct inaccurate personal information; and
• opt out of the "sale" or "sharing" of personal information – though, as noted above, we do not sell or share your personal information as those terms are defined.

We will not discriminate against you for exercising any of your privacy rights.

How to exercise your rights

To exercise any of these rights, email us at contact@pepys.co. You can also delete individual content or your entire account directly in the app at any time. We may need to verify your identity before acting on certain requests.

15. Cookies

Pepys uses a single essential, signed session cookie to keep you logged in. It is necessary for the service to function.

We do not use third-party advertising cookies or cross-site tracking, and no third-party analytics SDK is in the product today. If we later add privacy-respecting, first-party or aggregate analytics, we will update this policy.

16. Children

Pepys is not directed to children. The service is not intended for anyone under 13, and we do not knowingly collect personal data from anyone under 13.

If you are between 13 and the age of digital consent in your jurisdiction (which is 16 in much of the EEA, and lower in some countries), you may use Pepys only with the consent of a parent or guardian.

Account holders must additionally meet the contractual age requirement in our Terms of Service (you must be at least 18 or the age of majority in your jurisdiction to enter into a binding contract). If you believe a child has provided us with personal data, contact us at contact@pepys.co and we will take appropriate steps to remove it.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will provide reasonable notice. Your continued use of Pepys after an update means you accept the revised policy.

If you have any questions, email us at contact@pepys.co. Copyright and DMCA matters are handled under our Terms of Service and may also be sent to that address.