Privacy Notice
How we collect, use and protect your personal data.
Last updated: June 2026
1. Who we are
Endaxi Scribe is a service operated by IOLIS Ltd, a company registered in Wales (company number 11968202). Our registered office is at C5 Business Centre, C5 North Road, Bridgend Industrial Estate, Bridgend, Wales, CF31 3TP.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, IOLIS Ltd is the data processor for personal data processed through the Endaxi Scribe platform and the data controller for information realted to your account and billing.
If you have any questions about this policy or how we handle your data, you can contact us at [email protected].
2. What data we collect
We collect different categories of personal data depending on how you interact with Endaxi Scribe:
Account holders
- Name and email address provided during registration
- Password (stored only as an Argon2id cryptographic hash — we never see or store your plaintext password)
- Billing information if you subscribe to a paid plan or buy a top-up (processed by our payment provider; we do not store full card details)
- IP addresses, browser type, and session data when you access the platform
Audio and transcripts
How we treat your content: Audio you record or upload, and the transcripts produced from it, are stored against your account so you can access them within the retention window of your plan. We do not use your audio or transcripts to train AI models, and we do not share them with any third party except sub-processors strictly required to deliver the service to you.
Usage data
- Minutes consumed per month and against any top-up balance
- Records of which features you have used (e.g. live recording vs upload)
- Basic technical logs for diagnostics, abuse prevention and security
3. How we use your data
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the Endaxi Scribe service (recording, transcription, storage, playback) | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails (verification, password reset, billing) | Performance of a contract (Art. 6(1)(b)) |
| Maintaining security, diagnostics, and abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| Complying with our legal obligations (tax, accounting) | Legal obligation (Art. 6(1)(c)) |
4. Retention
Account records, billing records and transactional logs are retained for as long as you have an account, and for a reasonable period afterwards to meet legal, tax and accounting obligations.
5. Sub-processors
We use a small number of trusted sub-processors to operate the service — for example, infrastructure providers, transcription model providers, payment processing and transactional email. We require each sub-processor to provide appropriate safeguards for any personal data they process on our behalf.
6. Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Restrict or object to certain types of processing
- Receive a copy of your data in a portable format
- Lodge a complaint with the Information Commissioner’s Office (ICO)
To exercise any of these rights, contact [email protected].
7. Security
We take reasonable technical and organisational measures to protect your data, including:
- Encryption in transit (HTTPS everywhere, with HSTS)
- Argon2id password hashing — no plaintext password storage
- Optional two-factor authentication on every account
- Secure, HttpOnly session cookies
- Access controls and audit logging on our internal systems
8. Cookies
We use only the cookies needed to operate the service — primarily a session cookie to keep you signed in. We do not use third-party advertising or tracking cookies.
9. Changes to this policy
If we make material changes to this policy we will update the “last updated” date above and, where appropriate, notify account holders by email.