Privacy Policy
Effective 24 October 2026
- Your voice and dictated text never reach our servers. The app sends them straight to the speech and AI providers you choose.
- We store what an account needs: your email, password hash, team, settings, dictionary, snippets and connected Macs.
- We don't sell your data, don't show ads, don't train AI on your data and don't identify speakers by their voice.
- Your dictation history, text and audio stay on your Mac. The app sends us only daily counts (how many dictations, words, seconds of audio and AI tokens per model) to show your usage statistics and estimated cost.
1. Who is responsible
SayVelio, based in the Republic of Cyprus, is the controller of the personal data described in this policy, which covers the SayVelio apps for macOS and iPhone (including the SayVelio keyboard), sayvelio.com and app.sayvelio.com. Contact us about privacy at hello@sayvelio.com.
When an organization sets up a SayVelio team for its staff, the organization is the controller of its members' account data and we process it on its behalf under our Data Processing Addendum. If you are a member of such a team, your organization's own privacy notice also applies.
2. Your voice and dictated text
This is the part people ask about most, so here is exactly what happens.
- Recording. The app listens only while you hold the dictation key. The microphone is not used at any other time.
- Transcription and cleanup. The recording goes directly from your Mac to the speech recognition provider you selected. If AI cleanup is on, the transcript, together with your prompt, your dictionary and the writing style for the app you are typing in, goes directly to the language model provider you selected. These providers act under their own terms and privacy policies with whoever owns the API key: you, your team, or us when you use our trial key. The providers and setups are described below.
- Our servers never receive your recordings, transcripts or cleaned text. The only text of yours we keep is the snippets you save to insert later (see below).
- History on your Mac. The app keeps your recent dictations (up to 500) on your Mac so you can review and copy them, and keeps the audio of only the most recent ones (30 by default, which you can change). You can clear the history in the app at any time.
- On iPhone. The iPhone app works the same way, and wherever this policy says Mac, the same applies to your iPhone. iOS doesn't let keyboards use the microphone, so the SayVelio app records while a dictation session is open and can keep the microphone ready in the background for a few minutes after your last dictation (iOS shows the orange microphone dot meanwhile). The SayVelio keyboard asks for Full Access only to exchange commands, the finished text and your saved snippets (ready-made texts such as contact details that you keep in the app to insert from the keyboard) with the SayVelio app on the same iPhone. Snippets are also kept on our servers, encrypted, so they appear on your other devices; you can turn this off for each device in the app. What you type with the keyboard is not sent to us or to anyone else, except a word you choose to add to your dictionary from the keyboard menu; word suggestions are worked out on the iPhone from the text before the cursor.
- No voiceprints. We do not identify or verify speakers by their voice, and we do not analyze emotion or other characteristics of your voice.
- No training. We do not use your audio or text to train AI models. Check your provider's settings for how it treats API data; major providers do not train on API data by default.
AI providers the app can use
| Provider | Used for | Models currently offered | Privacy policy |
|---|---|---|---|
| OpenAI | Speech recognition and AI cleanup | GPT-4o Transcribe, GPT-4o mini Transcribe, Whisper; GPT models for cleanup (on our trial: GPT Realtime mini, or GPT Realtime when you choose best quality) | openai.com |
| Anthropic | AI cleanup | Claude models | anthropic.com |
| Groq | Speech recognition | Whisper Large v3, Whisper Large v3 Turbo | groq.com |
| Deepgram | Speech recognition | Nova-3, Nova-2 | deepgram.com |
| ElevenLabs | Speech recognition | Scribe | elevenlabs.io |
We may add providers or models over time; this list shows the ones the current version of the app can use. Only the providers selected in your settings, or in your team's settings, receive your data.
How processing works in each setup
Who processes your audio and text, and under whose agreement, depends on how SayVelio is set up:
- Your own API key. You enter your own key for a provider. The app sends data from your Mac directly to that provider under your own account and the provider's terms. SayVelio does not receive the data and is not a party to that processing.
- SayVelio's key. Personal accounts always dictate with our OpenAI key, so nobody needs a key of their own. A team also dictates with it, during its trial and afterwards, until the team adds an OpenAI key of its own. The key itself stays on our server. The trial starts once you confirm your email address with the link we send you (accounts made with Google sign-in are confirmed by Google). For each dictation we give the app a short-lived access token that works for a few minutes and for that one request only, and the app sends the recording and the text directly from your Mac to OpenAI's Realtime service under our account. We tag those requests with a pseudonymous identifier derived from your account (not your email), so that OpenAI can trace misuse to a single account. We decide on this processing and OpenAI processes the data as our service provider under its API terms and data processing agreement with us; the audio and text still do not pass through or get stored on our servers. Once your team adds an OpenAI key, your team's setup applies instead, and team members whose admin allows it can use a key saved in the app.
- Your organization's key. Your team owner or a team admin adds the organization's key in the team settings. We store it encrypted and deliver it to the app on members' Macs, and the app then sends data directly to the provider under the organization's account and agreement with that provider. Your organization decides which providers and models are used; SayVelio does not receive the audio or text.
- Processing through SayVelio. In the future we may offer setups where requests go through a gateway: either one run by your organization in its own infrastructure, or one run by us. If we run it, we will act as a processor of that data and the providers above will become our sub-processors. We will update this policy and our Data Processing Addendum before any such setup becomes available, and it will only apply if you or your organization choose it.
Whichever setup you use, we do not use your audio or text to train models. Most providers don't train on API data by default, but their retention periods vary (often up to 30 days for abuse monitoring); see each provider's policy above and your account settings with them.
3. Data we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Email address, password (stored only as a secure hash), or your Google account email if you sign in with Google | Create your account, sign you in, confirm that the address is yours, send password reset links, contact you about the Service | Contract (Art. 6(1)(b)) |
| Date you accepted the Terms and Privacy Policy, and which version | Show that you agreed to them | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) |
| Your personal dictionary: words and names you add on the dashboard, in the app or from the iPhone keyboard menu, including ones the app learns when you correct a dictated word | Recognize your vocabulary on every Mac you use | Contract |
| Your snippets: ready-made texts you save in the app to insert with one tap or by voice, such as your contact details, an address or frequent replies. They may contain other people's details if you add them. We store them encrypted with a key kept separately from the database, and read them only to send them to your signed-in devices. | Show the same snippets on every device you sign in on | Contract |
| Connected Macs and iPhones: name, kind of device, date connected, last time seen, the SayVelio and operating system versions they run, and the random install ID that keeps each device’s usage counted separately | Keep the app signed in, let you disconnect a device, and help with support when something goes wrong | Contract; legitimate interest in fixing errors |
| Team: name, members and roles, invite code, settings, prompt, dictionary, and the team's API keys, which we store encrypted | Apply team settings in members' apps | Contract; for organizations, on their instructions |
| Usage statistics: per day and per Mac, the number of dictations, the number of words and the seconds of audio, and for each speech and cleanup model the number of requests and of tokens (counts only, never text), with a random ID the app creates for each installation so a Mac that signs in again is not counted twice | Show you your usage, time saved and the estimated cost of the AI models, show team owners and admins team totals and when members last dictated, understand how the Service is used, and keep the cost of our trial key in check and prevent its abuse | Contract; legitimate interest for team owners and admins and for improving the Service |
| Whether and when your email address was confirmed, and the one-time links we email you to confirm it or reset your password (we keep only a hash of each link, until it is used, replaced or expires: 48 hours for confirmation, 1 hour for a reset) | Make sure an account belongs to the owner of its address before the trial starts, so one person cannot run the trial on many made-up accounts, and let you reset a forgotten password | Contract; legitimate interest in preventing abuse |
| On our key: how many access tokens and how many dictations your account received each day, and your plan and when its trial ends | Enforce your plan's daily or monthly dictation limit, show you how much of it you have used, and stop abuse of our OpenAI account | Legitimate interest in preventing abuse |
| Account status and plan | Run the Service and stop abuse | Contract and legitimate interest |
| Session cookies, IP address and technical request logs | Keep you signed in, protect against attacks and fix errors | Legitimate interest in a secure Service |
| reCAPTCHA signals (on sign-up and sign-in pages) | Block automated sign-ups and password guessing | Legitimate interest in preventing abuse |
| Messages you send us | Answer you | Contract or legitimate interest |
Personal API keys you enter in the app are kept in your Mac's Keychain and are not sent to us. The app's local settings stay on your Mac unless they come from your team. To learn a word, the app compares the text it inserted with your correction in that field on your Mac; only the corrected word is added to your dictionary, and password fields are never read.
Usage statistics
To show you how much you dictate and how much time it saves, the app sends us totals for each day: how many dictations you made, how many words they produced and how many seconds of audio you recorded, and for each speech and cleanup model how many requests and tokens it used, so we can estimate what dictation costs with your provider. That is all. These totals never include your audio, the text you dictated, the apps you typed in or the time of day of a dictation.
You see your own statistics on the dashboard, and the Mac app shows them on its Overview page: the counts kept on that Mac plus the daily totals of your other Macs, which the app downloads from us while you are signed in. "Time saved" compares typing the same words at 40 words per minute with the time you spent speaking. If you are in a team, the team owner and the admins they appoint see totals for the whole team and the last day each member dictated. They see each member's own counts only if per-person usage is turned on in the team settings, and members are then told so on their team page.
We keep usage statistics for 24 months and delete them with your account.
We do not collect special categories of data on purpose and we don't make decisions about you based solely on automated processing.
4. Cookies
We use only cookies that are strictly necessary or that remember a choice you made. app.sayvelio.com sets a sign-in session cookie (kept for up to 30 days) and a short-lived cookie that protects Google sign-in (10 minutes). If you pick a language with the language switcher on sayvelio.com or app.sayvelio.com, we store that choice in a cookie (sv_lang) for one year, shared by both sites; it holds only the language code. sayvelio.com sets no other cookies. Google reCAPTCHA, which runs on the sign-up and sign-in pages, may set its own cookies under Google's Privacy Policy. We use no advertising or analytics cookies.
5. How long we keep data
- Account, team and device data: as long as your account exists. When you ask us to delete your account we delete it within 30 days, except where we must keep something by law.
- Snippets: until you delete them in the app or delete your account.
- Usage statistics: 24 months, then deleted day by day; all of them when your account is deleted.
- Disconnected Macs and expired sign-in sessions are removed from the active records straight away.
- Email confirmation and password reset links: deleted when used or replaced, and expired after 48 hours (confirmation) or 1 hour (reset). Resend keeps a record of each email it sent for a limited period under its own retention policy.
- Server logs: kept by our hosting provider for a limited period, typically no longer than 30 days.
- Backups: overwritten in the normal backup cycle.
6. Who receives data
We share personal data only with the providers below, and never sell it.
| Provider | Purpose | Location |
|---|---|---|
| Railway Corporation | Hosting of sayvelio.com, app.sayvelio.com and the database | United States |
| Google LLC / Google Ireland | Google sign-in (if you choose it), reCAPTCHA, web fonts on sayvelio.com | EU / United States |
| Resend (Plus Five Five, Inc.) | Sending account emails: address confirmation and password reset. Resend receives your email address and the message | EU (Ireland) / United States |
| GitHub, Inc. | App downloads and the update feed the app checks | United States |
Providers you choose in the app. Depending on your settings, the app sends audio or text directly to the AI providers listed in section 2. These providers receive the data from your Mac under their own terms with the owner of the API key; we do not send them your data and do not control how they process it. When you use our trial key, OpenAI processes that data as our service provider, as described in How processing works in each setup. Review their privacy policies before you use them.
We may also disclose data if the law requires it, to protect people's safety or our rights, or to a successor if the Service is transferred, for example to a company formed to run SayVelio. We will tell you if that happens.
7. International transfers
Some providers above are outside the European Economic Area. Where they are, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for details.
8. Security
Connections use HTTPS. Passwords are stored as salted hashes, team API keys are encrypted at rest, and personal API keys stay in your Mac's Keychain. The app is signed and notarized by Apple and updates are cryptographically signed. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
9. Your rights
Under the GDPR and similar laws you can ask us to access, correct, delete or export your data, to restrict or object to our processing, and to withdraw consent where we rely on it. Email hello@sayvelio.com from your account's address; we answer within one month. If you are a member of a company team, we may pass your request to your organization, which decides on it.
You can also complain to a data protection authority: in Cyprus, the Commissioner for Personal Data Protection (dataprotection.gov.cy), or the authority where you live or work.
If you are in California or another US state with a privacy law: we don't sell or share personal information for targeted advertising, and you can use the rights above regardless of where you live.
10. Children
SayVelio is not meant for anyone under 16 and we don't knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
11. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows the current version.