Privacy Policy

Introduction

HeyDonna ("we," "our," or "us") is committed to protecting the privacy and security of court reporters' sensitive legal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our AI-powered transcript editing service.

Information We Collect

Account Information

• Name and email address
• Professional credentials (bar number, certification)
• Billing information (processed securely through Stripe)

Transcript Data

• Audio recordings you upload
• Transcript documents and edits
• Templates and formatting preferences
• Export history and preferences

Signup security

We use Cloudflare Turnstile to check that signup requests come from people, and necessary network security checks to prevent automated account creation and free-credit abuse. Cloudflare processes information needed to provide the challenge under its Privacy Policy. We process your IP address only during the request to derive a purpose-specific keyed hash; we do not store or log the raw address for these checks. We store the hash and country on new accounts and in security logs, and use shared network hashes to limit automatic free-credit grants to two per IP address in a rolling 24 hours. This necessary security check is separate from the optional, region-dependent browser check below. Shared networks can affect eligibility: accounts over the allowance can still be created without free credits. Contact support for help.

Signup device check

To prevent free-credit abuse, we use device fingerprinting after you accept our Terms of Service and this Privacy Policy during signup. There is no separate device-check checkbox. For visitors in the European Union or United Kingdom, or whose region is unknown, we do not load the fingerprinting library or collect a fingerprint. Accounts are created normally; contact support for review of free-credit eligibility. Elsewhere, including the United States, the check limits automatic free credits to one grant per browser. If the check cannot be completed or verified, support can review eligibility. Account creation and paid credit purchases remain available. Existing accounts are not checked retroactively.

Where the device check is permitted, browser attributes are processed only in browser memory to derive an identifier. Raw attributes are not sent, logged or saved. Only the derived identifier is sent, in a size-limited request, to our authenticated first-party /api/auth/signup-grant route. It is not retained in logs or storage; only versioned, purpose-specific keyed hashes are stored for matching. These hashes are pseudonymous personal data, not anonymous data. Browser-check data is not sold or shared with third parties for their own purposes or sent to a fingerprinting vendor.

A match is not proof of a person or physical device: shared browsers may produce false positives, and browser changes or spoofed identifiers can evade the check. If free credits were withheld by mistake, contact support to appeal; an administrator can correct the grant with a recorded reason. Retrying signup does not automatically grant credits to an already decided account.

Usage Data

• Feature usage patterns
• Session duration and frequency
• Error logs for debugging (anonymized)

How We Use Your Information

We use your information solely to:

• Provide transcript editing and AI assistance services
• Process payments and manage subscriptions
• Improve our AI models (only with explicit consent)
• Send service updates and important notifications
• Provide customer support
• Limit repeated free signup grants using the signup device check described above; paid purchases and account creation remain available

Data Security

We implement security measures to protect your data:

• Encryption: Data encrypted in transit using HTTPS/TLS
• Access Control: Authentication through Clerk
• Infrastructure: Secure cloud hosting on trusted platforms
• Compliance: Our SOC 2 audit is in progress

Your Legal Data

We understand the sensitive nature of legal transcripts. Your transcript data:

• Is never used to train AI models — by us or any service processor we use
• Is never sold or shared with third parties for their own purposes
• Is processed by service providers (e.g., AssemblyAI, Google Gemini, Anthropic, OpenAI, OpenRouter, Modal) solely under our instruction to deliver the service you requested
• Is never accessed by our team unless you request support
• Can be permanently deleted at any time upon request

No AI Training — Explicit Statement

Customer transcripts and audio are never used to train AI models. Data is processed for the requested service only.

This applies to every AI service in our processing pipeline:

• AssemblyAI (speech-to-text transcription): Audio is submitted for transcription only, and we delete the transcript from AssemblyAI after processing. AssemblyAI processes data under data processing terms that restrict use of submitted audio and transcripts to performing the requested transcription service.
• Anthropic (Claude) (AI formatting, review, and editor chat): Transcript text is sent only to perform the feature you invoke. Under Anthropic's commercial API terms, data submitted through the API is not used to train Anthropic's models.
• OpenAI (GPT) (AI proofreading, formatting, review, and editor chat): Transcript text, and in some proofreading steps audio, is sent only to perform the requested task. Under OpenAI's API terms, data submitted through the API is not used to train OpenAI's models.
• Google Gemini (AI proofreading, formatting, review, and editor chat): Transcript text, and in some proofreading steps audio, is sent for the requested task only. Google processes this data under Google Cloud's data processing terms, which restrict use of submitted data to performing the requested service and do not permit training on it.
• OpenRouter (routing to AI model providers for proofreading fallback, formatting, review, and chat): OpenRouter forwards your request to the model provider selected for that task, such as Google, OpenAI, or Anthropic. Data is sent only for the requested task, and the data policy and terms of the provider that serves the request apply to it.
• HeyDonna internal models: Our own AI models are trained on anonymized behavioral signals (e.g., accept/reject patterns). See “Training Data” below for details on collection and your export controls.

When you process a transcript through HeyDonna, your data flows through these services solely to perform the task you requested — and no further.

Data Used to Improve HeyDonna AI

We distinguish between two categories of data:

Service Data (Required)

Transcript storage, audio processing, authentication, and sync are necessary to deliver the Service. This processing requires no additional consent beyond your acceptance of these terms.

Training Data

We collect anonymized behavioral signals — such as edit patterns, accept/reject decisions, and formatting corrections — to improve our AI proofreading and transcription models. Collection happens automatically as you use the Service.

• What is collected: Behavioral patterns only — feature usage, correction frequencies, accept/reject signals.
• Anonymization: All identifying information is stripped before any data enters a training pipeline. Data cannot be traced back to you, your clients, or specific cases.
• Export control: The training export toggle in your account settings controls whether your anonymized behavioral data is included in AI training datasets.
• No third-party sharing: Training data is used exclusively by HeyDonna to improve our own AI models and is never sold or shared with third parties.
• Retention: Anonymized training data is retained for up to 24 months, after which it is permanently deleted.
• Legal basis: Legitimate interests under GDPR Art. 6(1)(f) for the collection of anonymized behavioral signals used to improve service quality.

Data Retention

We retain your data as follows:

• Active accounts: Data retained while account is active
• Deleted accounts: Your account and the transcripts you own are deleted when the deletion completes
• Backups: Backups expire on our normal backup cycle
• Signup network security data: Network hashes, country and associated signup security logs are retained for 30 days, then deleted, with up to one scheduled cleanup interval of operational lag. Shared aggregate network records expire 30 days after their latest observation and are not cleared by deleting an individual account; they contain no account identifiers. Short-lived challenge receipts and their subject bindings expire with the receipt. Grant decisions remain separate and do not reopen automatic grant eligibility when security data expires.
• Signup browser hashes: Matching expires 180 days after the first accepted claim. Later matches, signups or key rotation do not extend that fixed expiry. Expired hashes are cleaned up, and account deletion erases associated claims, hash aliases and ownership links; we keep no permanent browser tombstone. Grant decisions and financial audit records are separate and do not restart an existing account's automatic grant eligibility.

Third-Party Services

We use the following services. Those that receive your content process it solely to deliver the feature you requested:

• Clerk: Authentication and user management
• Stripe: Payment processing
• Cloudflare R2: File storage
• Cloudflare Turnstile: Signup bot protection and security challenge processing
• Convex: Real-time database
• Modal: Cloud compute that runs our audio and document processing, including self-hosted speech models
• AssemblyAI: Speech-to-text transcription — data processed for transcription only, not used for training
• Google Gemini (Google Cloud): AI proofreading and formatting — data processed for the requested task only, not used for training
• Anthropic: AI proofreading, formatting, review and chat features — processed under the provider's API terms, solely to deliver the requested feature
• OpenAI: AI proofreading, formatting and review features — processed under the provider's API terms, solely to deliver the requested feature
• OpenRouter: Routing of AI requests to model providers — processed under the provider's API terms, solely to deliver the requested feature
• LangSmith: Tracing and quality monitoring of AI processing runs; traces are retained for 14 days
• Axiom: Operational logging and monitoring; logs are retained for 30 days
• Resend: Transactional email delivery

We evaluate each service for security best practices and data processing terms before integration.

Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request data deletion
• Export your data in standard formats
• Opt-out of marketing communications

Data Deletion Instructions

You can ask us to delete your HeyDonna account and the data in it at any time. There is currently no self-service delete button in the app, so deletion is handled by email:

1. Email privacy@heydonna.law with the subject "Delete my HeyDonna account".
2. Send the request from the email address on your HeyDonna account so we can verify it is yours. If you signed up with Facebook, include the email address shown on your HeyDonna profile.
3. We confirm by reply once the deletion is complete.

What is deleted: your account and profile, your projects, transcripts, uploaded audio, and exports.

Timeframe: your account and the transcripts you own are deleted when the deletion completes. Backups expire on our normal backup cycle, as described under Data Retention above. To request deletion, email privacy@heydonna.law from your account email.

Signed up with Facebook? Removing HeyDonna from your Facebook settings (Settings & privacy > Apps and Websites) only stops Facebook sharing information with us. It does not delete your HeyDonna account or data. To delete that data, follow the steps above.

GDPR Compliance

For EU residents, we aim to follow GDPR principles:

• Process data with user consent
• Provide data export capabilities
• Honor deletion requests
• Transparent data handling practices

We do not load FingerprintJS or collect a device fingerprint for EU or UK visitors, or when the region is unknown. Free-credit eligibility is reviewed through support; account creation and paid top-ups remain available. Elsewhere the device check follows signup acceptance of our Terms and this policy, without a separate checkbox. To request erasure of associated browser hashes, email privacy@heydonna.law. Erasure does not automatically issue another free grant to an existing account.

Cookies and similar technologies

Where permitted, the signup device check uses a five-minute first-party, Secure, HttpOnly cookie bound to the signed-in account to carry verification evidence. It contains no raw browser attributes or derived visitor identifier. EU, UK and unknown-region visitors receive no device-check evidence cookie. Website Cookie settings and analytics preferences do not authorize the signup device check.

The hd_theme first-party cookie stores your light, dark, or system theme preference for one year. It is functional and is not used for analytics.

Anonymous page counts (no consent needed). Unless Global Privacy Control is on, you chose Decline all, or you are visiting from the European Union, the European Economic Area, the United Kingdom, or Switzerland, we count visits without asking. We count page views, how long the page was visible in your tab (sent when you leave or switch away), the page you landed on, the site you came from (host name only), campaign tags in the link (utm_*, source, campaign), a device size bucket (desktop, tablet, or mobile), your country as read from the request by our network provider, and clicks on Start free and Book a call. A random identifier in your browser's session storage links the pages of one visit so we can count bounces. It is not a cookie, it is not kept in local storage, and it ends when you close the tab or after 30 minutes without activity. The Start free link carries the same random identifier (aid) to the sign-up page so we can count sign-ups that came from a visit; we do not use it to identify you. We do not store your IP address or user agent and we do not fingerprint your browser for these analytics. The signup device check is separate and is not used for analytics. Our own team browsers use a local opt-out flag (hd_internal) that turns this counting off and is never sent.

Optional analytics (only after you select Accept). Accepting adds the referral values present in the page URL (ref and countryHint, alongside source and campaign) to the same events. If you visit from the European Union, the European Economic Area, the United Kingdom, or Switzerland, your browser still sends the anonymous counts, but our server discards them: nothing is recorded until you select Accept, and the Start free link carries no aid. If our network provider cannot tell which country a visit comes from, nothing from it is recorded. Declining, or enabling Global Privacy Control, keeps all of it off and removes aid from the Start free link right away. Neither tier uses cookies or third-party trackers.

First-party signup-source attribution stores your first visit in browser local storage under hd_signup_attribution, including direct visits. It records campaign parameters (utm_*), ref, source, the referring HTTP(S) origin and path, and the landing path. Referrer credentials, query strings, and fragments, landing query strings and fragments, and unrelated URL parameters are not retained. The snapshot is passed only to our app in the _hd_signup_attribution query parameter on signup and sign-in links and saved with your account at signup so we can understand signup sources. Later visits do not replace the first touch. This uses no attribution cookies, third-party trackers, or additional network calls and is separate from the analytics counts above. You can clear the browser snapshot by clearing this site's local storage; account attribution follows the account retention and deletion policy above. If browser storage is blocked, navigation and signup still work.

To change your choice, use Cookie settings in the footer. You may also change your theme at any time.

Children's Privacy

HeyDonna is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of any material changes via email and update the "Last updated" date above.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@heydonna.law
• Address: Scribie Technologies Inc., Privacy Team, 2810 N Church St STE 89083, Wilmington, DE 19802, United States