Privacy Policy

1. Controller and contact

The controller under the GDPR is Bent Eisheuer, Freisinger Landstraße 47a, 85748 Garching, Germany. Email: legetdev@gmail.com. No separate data-protection officer has been designated; privacy requests can be sent directly to the controller.

2. Website delivery

The website is hosted by Vercel Inc. When you visit, Vercel and the controller process technical request data such as your IP address, timestamp, requested path, referrer, and browser or device information. This is necessary to deliver and secure the site. The legal basis is Article 6(1)(f) GDPR: the legitimate interests in reliable and secure publication of the website. Server logs are retained according to the hosting plan and then deleted or aggregated unless longer retention is needed to investigate abuse.

The site does not run audience analytics, advertising pixels, contact forms, or optional tracking cookies. It uses locally served fonts. Essential browser storage, if introduced by the hosting layer for security or delivery, is used only where technically necessary.

3. Download and local app data

The installer is downloaded from this domain. The app stores its settings, dictionary, dictation history, statistics, meeting transcripts, summaries, action items, and optional remembered-voice representations locally on your Mac. Licence details and user-supplied AI API keys are stored in macOS Keychain. You control these local records through the app and macOS. Keychain items can remain after the app is removed unless you delete them in the app first or through Keychain Access.

The app requests microphone access for dictation, Accessibility access to insert text, and Screen Recording access when you use system-audio meeting capture. Screen Recording is the macOS permission used for system audio; Saywave does not use it to make a video recording. Core speech transcription runs on the device after the selected model is available.

4. Trial checks

Starting the 7-day trial sends a stable, one-way-derived device identifier and trial timestamps to a Saywave trial service hosted on Cloudflare Workers and KV. The identifier is derived from the Mac platform identifier with an app-specific value. It is pseudonymous personal data: the service does not receive the underlying platform identifier, but it can recognise a returning device. The app checks at launch and periodically; during the trial it must successfully check at least once every 48 hours.

Processing is necessary to provide the trial under Article 6(1)(b) GDPR and to prevent repeated trial resets under Article 6(1)(f) GDPR. A record expires automatically 24 months after that device's last trial validation. A validation refreshes this period; abandoned records therefore delete automatically while active installations remain reset-resistant. You may request earlier deletion; this prevents the service from verifying any remaining trial entitlement on that device.

5. Licence activation and purchases

Sales are currently closed. If sales open, Lemon Squeezy acts as Merchant of Record and processes checkout data under its own buyer privacy terms. Activating or validating a licence sends the licence key, Lemon Squeezy instance identifier, and your Mac's local name to Lemon Squeezy. The response may include the customer name and email, which the app stores locally in Keychain. The legal basis is Article 6(1)(b) GDPR for licence performance and Article 6(1)(f) GDPR for fraud prevention. Avoid putting sensitive personal information in your Mac's device name.

6. Model downloads

On-device speech and speaker models that are not bundled with the installer download from Hugging Face when first selected or required. Hugging Face receives the IP address and normal download request metadata. The legal basis is Article 6(1)(b) GDPR because the requested model is needed to provide that feature. Once downloaded, the model is stored on your Mac until you remove the related local app data.

7. Optional OpenAI or Anthropic features

You can optionally add your own OpenAI or Anthropic API key and choose cloud-backed rewrite, cleanup, translation, or meeting-summary functions. When invoked, Saywave sends the selected dictated text or meeting transcript, together with the instruction, directly from your Mac to the provider you selected. The API key is sent for authentication. Audio is not sent by this cloud-text feature. The legal basis for Saywave initiating the request is Article 6(1)(b) GDPR. The provider processes the request under your direct account and its current API terms and privacy documentation.

Do not send personal, confidential, special-category, or third-party data unless you have a lawful basis, appropriate authority, and a provider configuration suitable for that data. You can keep these features local by selecting an available on-device AI backend instead.

8. Recipients and international transfers

Depending on the feature, recipients are Vercel (website hosting), Cloudflare (trial infrastructure), Lemon Squeezy (future checkout and licensing), Hugging Face (model downloads), and either OpenAI or Anthropic when you select a cloud AI feature. These providers may process data outside Germany or the EEA. Where the GDPR requires a transfer safeguard, processing relies on the provider's applicable adequacy mechanism, including an EU–US Data Privacy Framework certification where valid, or standard contractual clauses with supplementary safeguards. Contact us for the mechanism applicable to a specific flow.

9. Retention

• Website request logs: according to the active hosting plan and security need.
• Trial records: 24 months after the device's last trial validation, unless erased earlier.
• Purchase records: retained by the Merchant of Record under its legal obligations.
• Licence validation data: while needed to provide and protect the licence.
• Local app data and Keychain items: until you delete them as described above.
• Optional cloud requests: under the provider terms and settings of your own account.

Data may be retained longer where necessary to establish, exercise, or defend legal claims, or where a binding legal duty requires it.

10. Your rights

Subject to the legal conditions, you may request access, rectification, erasure, restriction, data portability, or object to processing based on legitimate interests. You may also lodge a complaint with a supervisory authority. Our competent authority is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach. No decision producing legal or similarly significant effects is made solely by automated means.

To exercise a right, email legetdev@gmail.com. We may ask for information necessary to verify that the request relates to you. Providing technical website data is necessary to receive the site; providing trial, licence, model-download, or optional cloud data is necessary only when you choose the corresponding feature.

11. Changes

We update this policy when data flows or legal requirements change. Material changes are presented before the affected processing where required. The date below identifies this version.