Privacy Policy

The short version

Your audio and manuscripts stay yours. We use them to run your proof, nothing else. We don't use them to train AI models, and we delete the files on a fixed schedule.

What we collect

• Account details: your email, password (stored hashed), organization name and team members.
• Project files: the audio and script you upload, and the transcripts, flags, review audio and waveforms we make from them.
• Your review work: keep and dismiss decisions, notes and project details.
• Usage and billing records: hours processed, price and technical logs.

We use one type of cookie: the one that keeps you signed in.

How we use your files

We use project files only to deliver the service you asked for: transcribing audio, comparing it to the script, running audio checks and showing you the results.

We don't sell your content, use it to train AI models, or claim any rights to it. If we ever want to use your review decisions to improve our detection, we'll ask first, and it stays off unless you opt in.

How long we keep it

• Uploaded audio and scripts: deleted when your run finishes.
• Review audio, waveforms, read-along and pronunciation files: deleted 30 days after the run finishes. After that, flags stay available, but audio playback and clips don't.
• Uploads that never finish: deleted after 30 days.
• Temporary processing files: deleted within 7 days.
• Results: flags, decisions and the script sentences they quote stay in your account until you delete the project or close your account.
• Deleting a project: removes its files and results right away, apart from routine backups, which age out, and usage records we keep for billing.

Who processes your data

We use these providers to run the service. Each one only gets what it needs for its job:

• AssemblyAI: speech transcription (receives audio). We've opted out of its model improvement program, and it deletes the data on a short schedule.
• Cloudflare R2: file storage.
• Supabase: accounts and database.
• Railway: application hosting.
• Resend: transactional email.
• Stripe: card payments, once enabled. We never see full card numbers.

These providers mainly process data in the United States.

Share links

A share link shows kept pickups and their audio to anyone who has the link, with no sign-in. Only share it with people you trust.

Security

Files and data are encrypted in transit and at rest by our providers. Access is limited to your organization, and file links expire. No system is perfectly secure, so tell us right away if you think something's wrong.

Your choices

You can ask us to access, correct, export or delete your personal data, or close your account, by emailing hello@getsecondpass.com.

Changes

If we make a meaningful change, we'll update this page and tell account owners by email.