Six vendors.
No audio.
Third-party services that may process personal data on our behalf in the operation of VoiceType. Updated when our production architecture changes. For how data categories map to your rights, also read the Privacy Policy.
No sub-processor receives raw audio recordings. Audio is processed and discarded entirely on your device. The optional Cloud Polish feature, when enabled by a Pro user, transmits post-transcription text only.
Six vendors that
may process your data.
| Vendor | Purpose | Data categories | Region | Privacy & DPA |
|---|---|---|---|---|
| Stripe, Inc. + Stripe Payments Europe, Limited (MoR for EU) |
Payment processing, subscription lifecycle, transactional emails (receipts, billing notices, refund confirmations, ARL renewal reminders) for direct (non-App Store) sales. | Email, payment-method metadata, billing address. Full card data is held by Stripe under PCI-DSS, never by us. | United States and EU. | stripe.com/privacy · DPA |
| Vercel Inc. | API and marketing-site hosting; edge routing for our HTTPS endpoints and static download metadata. | IP addresses, user agent, request metadata for logs and rate limits. | United States (regional edge as routed by Vercel). | vercel.com/legal/privacy-policy · DPA |
| Upstash, Inc. | Server-side key/value store for entitlement state, rate limits, and short-lived data (session tokens, recovery-key hashes). | Hashed or opaque keys (e.g., derived from email), random device identifiers you send in authenticated calls. | United States (with replication as configured in the provider's console). | upstash.com/trust/privacy.html |
| OpenAI, L.L.C. | Cloud Polish (opt-in, Pro only): grammar and phrasing for transcribed text submitted by Pro users who explicitly enable Cloud Polish. | Post-transcription text only, transmitted only when Cloud Polish is enabled. Audio is never sent. | United States (and regions OpenAI may route to for the API in use). | openai.com/policies/privacy-policy · DPA |
| Apple, Inc. | (a) macOS system services running on-device (microphone access, Apple Speech as on-device fallback). (b) App Store distribution and purchase validation for App Store purchases. | (a) On-device only. (b) App Store transaction tokens; Apple holds App Store purchaser data. | On-device for system services; Apple operates global infrastructure for the App Store. | apple.com/privacy |
| Hugging Face, Inc. | Distribution endpoint for the open-weights speech and language models the app downloads on first run (WhisperKit-CoreML, Qwen 3.5 GGUF). Hugging Face does not receive your dictation content. | Standard CDN request metadata (IP, user agent) at model-download time. | United States and EU. | huggingface.co/privacy |
Transactional email
Customer-facing transactional emails (purchase receipts, billing reminders, refund confirmations, sub-processor change notices, California ARL renewal reminders) are sent by Stripe under Stripe's privacy program. We do not operate a separate transactional or marketing email service, and we do not maintain a marketing newsletter. If we add a separate email-sending vendor in the future, we'll publish that change on this page and provide at least 30 days' notice as described below.
Software framework providers (not sub-processors)
The following parties contribute software, frameworks, or model weights that are bundled into or downloaded by the VoiceType app and run entirely on your device. They are not sub-processors because they have no access to your data and do not process personal data on our behalf:
- Argmax, Inc. — publisher of WhisperKit (MIT-licensed). Provides the on-device speech-recognition framework. No access to your audio or transcripts.
- OpenAI, Inc. (in its capacity as the original publisher of the Whisper model weights, MIT-licensed) — speech-recognition models we run on-device. (Note: OpenAI in its capacity as the operator of the GPT API is a sub-processor for users of Cloud Polish; see the table above.)
- Qwen Team / Alibaba Group — publishers of the Qwen 3.5 model weights (Apache License 2.0). Used by the on-device language-model polish feature. No access to your text.
- llama.cpp project (Georgi Gerganov and contributors) — on-device LLM inference engine, MIT-licensed.
- Whisper.cpp / WhisperKit ecosystem contributors — community-maintained on-device implementations.
Notice of changes
We will provide at least 30 days' notice before adding a new sub-processor that processes personal data in a materially new way. To subscribe to change notices, email privacy@techbantu.us with the subject "Sub-processor list." We email subscribers and post updates on this page with the "Last updated" date revised.
International transfers
Where personal data of EEA/UK/Swiss residents is transferred to vendors located in the United States, each vendor relies on Standard Contractual Clauses (or, where applicable, the EU–US Data Privacy Framework) as documented in its respective privacy program linked above. Hugging Face hosts in EU and US regions; Stripe operates EU subsidiaries (e.g., Stripe Payments Europe, Limited) for EU sales as Merchant of Record.
Privacy: privacy@techbantu.us · Legal: legal@techbantu.us