Privacy Policy

Last updated: August 31, 2026Effective date: August 31, 2026

This policy describes what Xuula collects, why, who else sees it, and what you can do about it. It is written to match what the product actually does. Where a detail depends on a provider agreement that has not been finalised, this policy says so instead of making a claim.

1. Who is responsible for your data

ArtFixPro LLC, a LLC organised under the laws of New York, United States, with a business address at 228 Park Ave S #167371, New York, NY 10003, United States, is the controller of the personal data described in this policy. ArtFixPro LLC develops and operates Xuula and this website.

For privacy questions and for any request about your data, write to support@xuula.com.

We are established in the United States. We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR, and we have not appointed a data protection officer. We say so rather than naming one we do not have. If you are in the EEA or the UK you can still exercise every right in section 11 by writing to support@xuula.com, and you can complain to the data protection authority in the country where you live.

2. What we collect

The categories below are exhaustive for the current release. If we start collecting something new, this policy changes first.

Account data

Your email address, which is how you sign in and how we contact you.
A hash of your password. We never store the password itself and cannot recover it.
An optional display name.
Your interface language, the languages you expect to dictate in, and your time zone.
Your preferences: recording mode, theme, and whether AI cleanup is on.

Billing data

Your subscription state: plan, status, billing period and renewal date.
An identifier linking your account to your customer record at our payment processor.
We do not receive or store your card number, expiry date or security code. Those are entered directly into the payment processor’s hosted checkout page.

Device data

For each computer you authorise: a name you can edit, an installation identifier generated by the app, the application version, and the Windows version.
The installation identifier is generated on first run and changes if you reinstall. It is not a hardware fingerprint.
When each device was authorised and when it was last used.

Usage records

For each dictation: the number of words, a timestamp, which device reported it, and the language tags that were detected.
We do not receive the words themselves. Usage reporting sends a count, not text.
These records form an append-only ledger. That is what lets us enforce the free plan’s weekly allowance and answer a billing dispute with evidence.

Audio and transcripts

While you are recording, audio is streamed from your PC to a speech recognition provider. It does not pass through, and is not stored on, Xuula servers.
If AI cleanup is enabled, the recognised text is sent to an AI provider to be edited, together with your selected writing style and any relevant personal-dictionary terms. If cleanup is disabled, no text is sent anywhere.
The edited text is returned to your PC and inserted into the field you were typing into. Xuula servers do not store it.
Your dictation history is stored on your own computer. In this release there is no cloud history and nothing is uploaded.

Meetings, recordings and Projects

When you start a meeting recording, the Windows app captures your microphone and, if you enable it, the audio your PC is playing. Both are mixed into one recording saved on your computer.
That audio is streamed to the speech recognition provider while the recording runs, so it can produce a transcript with separated speakers and, if you enable it, a translation. It does not pass through, and is not stored on, Xuula servers.
The recording, the transcript, any translation, your notes, the speaker labels and names you assign, and word-level timestamps are written to local files on your computer, organised into Projects you create.
AI meeting insights — summary, key points, to-do items, speaker quotes and assistant answers — are produced only when you request them. The transcript text is sent to the AI provider for that request; the recording is not.
The recognition context and vocabulary you attach to a Project are sent to the speech provider as recognition hints for meetings saved to it.
None of this meeting content is uploaded to Xuula servers in this release. There is no cloud sync, no server-side copy, and no sharing with other accounts. The files are yours to back up or delete.

Personal dictionary and writing styles

The terms you add — names, brands, technical vocabulary — and any spelling variants, along with the language each belongs to.
Your writing-style names and instructions.
Dictionary terms relevant to a dictation are sent to the speech and AI providers as recognition and editing context. Do not put anything in the dictionary that you would not want sent to those providers.

Google Calendar (optional)

If you connect Google Calendar in the Windows app, the event details described in section 10 are read from your calendar, and those of events you link to a work note are saved on your computer with that note. They are not stored on Xuula servers, except where an AI answer you asked for repeats them (section 10).

Support messages

What you write to us through the contact form or by email, and our replies.
The email address you asked us to reply to, and the topic you selected.

Technical and security data

A short summary of your browser and operating system, such as “Chrome on Windows”, for the list of active sessions. We do not store the full user-agent string.
The country and network operator your connection comes from. These are worked out on our own servers from a location database we host; your IP address is never sent to a lookup service.
Your IP address, stored with a record of each network you sign in from. It is erased from that record after the period in the retention table below, leaving the country, the operator and a one-way fingerprint that cannot be turned back into an address. We keep it to answer questions about account sharing, abuse and disputed charges.
Rate-limiting counters and authentication events, used to detect abuse.
Location is derived using the IP to Country Lite and IP to ASN Lite databases by DB-IP (db-ip.com), licensed under CC BY 4.0. DB-IP receives nothing from us: the databases are downloaded and read on our own servers.

3. Why we use it

We use the data above only for the purposes listed here.

To run your account: authenticate you, keep you signed in, and let you authorise and revoke devices.
To provide dictation: transmit audio for recognition and, when enabled, text for editing.
To link a work note to a scheduled visit, if you connect Google Calendar.
To enforce plan limits: count dictated words against the free plan’s weekly allowance and against Pro’s monthly allowance.
To take payment and manage subscriptions, including renewals, failed payments and refunds.
To answer support requests and to contact you about your account, billing or security.
To keep the service secure: rate limiting, abuse detection and investigating suspicious activity.
To meet legal obligations, such as retaining invoicing records for tax purposes.
To send product updates, only if you opted in, and only until you opt out.

We do not sell personal data. We do not use your dictation content for advertising, and we do not build advertising profiles.

4. Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases.

Performance of a contract: running your account, providing dictation, and taking payment for a subscription you bought.
Legitimate interests: keeping the service secure, preventing abuse, and enforcing the published plan allowances. We have weighed your interests and rights against ours in each case.
Legal obligation: retaining billing records and responding to lawful requests.
Consent: optional AI cleanup, the optional Google Calendar connection, optional marketing email, and any optional analytics. You can withdraw consent at any time, and withdrawal does not affect processing that already happened.

5. Who else processes your data

We use the providers below. Each is listed with what is sent to it, why, and what we can and cannot truthfully say about how long it keeps that data.

Where a provider’s retention or model-training terms have not yet been confirmed against a signed agreement, this policy says so. We will not make a claim about a third party that we cannot evidence.

Providers involved	Sent to cloud services	How long things are kept
SonioxTerms not verifiedSpeech-to-text transcription, including mixed-language recognition, meeting transcription with speaker separation, and optional translation.	Microphone audio captured while dictation is active During a meeting recording: microphone audio and, when enabled, Windows system audio, mixed into one stream Language hints and, when configured, personal-dictionary terms and per-project vocabulary used as recognition context	How long Soniox keeps audio, and whether it may use it to improve its own models, is governed by the Soniox terms and the account agreement in force — not by this policy. We have not verified those terms against a signed agreement, so nothing here should be read as a promise that your audio is excluded from retention or from training. Soniox’s own privacy terms are what it commits to. ↗
OpenAITerms not verifiedOptional AI processing: dictation cleanup (grammar, filler removal, punctuation, writing style), final meeting-transcript polish, and on-demand meeting insights (summary, key points, to-dos, speaker quotes, assistant answers).	The raw transcript text of the current dictation The selected writing style and personal-dictionary terms relevant to that dictation When an AI meeting action is used: the speaker-labelled meeting transcript text (never the audio)	How long OpenAI keeps the text sent to it, and whether it may use it for training, is governed by the OpenAI API terms and the account agreement in force. We have not verified those terms against a signed agreement, and zero-data-retention is not confirmed for this account — so nothing here should be read as a promise that your text is excluded from retention or from training. The text now reaches OpenAI through Xuula servers rather than directly from the Windows application — nobody supplies a key of their own any more — and each request asks OpenAI not to retain it. Xuula does not store the text: it is held for the length of one request and dropped. Audio is never sent to OpenAI, and turning AI cleanup off stops text being sent at all. ↗
StripePayment processing, subscription management, invoicing and tax calculation.	Email address and account identifier Billing details and payment method entered directly into Stripe Subscription and invoice records	Card numbers never reach Xuula servers; they are entered into Stripe-hosted Checkout. Stripe acts as an independent controller for fraud prevention and regulatory purposes, and keeps payment records for as long as its own obligations require. Payments are switched off on this deployment, so no customer data has been sent to Stripe yet. ↗
RailwayTerms not verifiedHosting the website and running the application server. The production service runs in Railway’s us-east4 region, in the United States.	Every request to the site, including IP address and request metadata in the platform’s own access logs All data the application processes, because the application runs there	Railway operates the servers and holds platform-level logs under its own terms; we have not verified a retention period for those logs against a signed agreement and do not state one here. The application’s own records keep no full IP addresses — see the retention table. ↗
PostgreSQL on RailwayStoring account, subscription, device, usage-ledger and billing-event records. Same vendor and same us-east4 region as the application server.	All persisted application data	A PostgreSQL instance on a Railway volume, reachable only on Railway’s private network and never exposed to the public internet. It is not a separate managed-database vendor: the data stays with the hosting provider named above, under the same terms. ↗
ResendTerms not verifiedSending transactional email: address verification, sign-in links, security notices and billing notifications.	Your email address The content of the transactional message itself	Resend is the application’s outbound mail provider. How long it keeps message content and delivery logs is governed by its own terms, which we have not verified against a signed agreement. Receiving mail is a separate job: the mailboxes named on this site are hosted by the domain’s inbound mail provider, and Resend is not involved in them. ↗
Cloudflare R2Off-site storage of encrypted logical database backups, held with a different vendor from the database itself.	An encrypted archive of the application database: account, subscription, device, usage-ledger and billing-event rows No audio, transcripts, meeting recordings or Projects — those never reach this server	Each archive is encrypted with AES-256-GCM on our own server before it is uploaded, so Cloudflare holds ciphertext and never holds the key. Off-site backups are switched off on the current deployment and no archive exists yet; this row is here because R2 is where they will go the moment they are switched on. ↗

We do not transfer your data to anyone else except where required by law, or as part of a merger or acquisition — in which case we would notify you before your data became subject to a different policy.

6. Model training

Xuula does not train models. We have no speech or language models of our own, and we do not use your audio, transcripts or dictionary to train anything.

Whether a provider we send data to may use it for its own training depends on the agreement in place with that provider. Those terms are stated in the provider table above where they have been confirmed. Where the table says a claim is unconfirmed, treat it as unconfirmed: we are not asserting that your data is excluded from training by that provider.

If you would rather no transcript text left your PC at all, turn AI cleanup off in your settings. Speech recognition still requires audio to be sent, because recognition does not run locally.

7. How long we keep things

Retention is per category, not a single global period.

Account records after a deletion request	30 days
Invoicing and tax records	7 years
Usage ledger (word counts only)	24 months
Audio on Xuula servers	Not stored
Transcripts on Xuula servers	Not stored — kept on your PC
Ask AI answers (the question and context are not stored)	30 days
Opt-in cloud dictation history	Not applicable — no such feature in this release
Support messages	24 months
Authentication logs, rate-limit counters and connection records	90 days

Deleting your account revokes every authorised device straight away and stops the account being used. The records are then held for the grace period above so that an accidental deletion can be undone: signing back in cancels it, whichever way you sign in. At the end of that period a scheduled job erases them — the account, its sessions and devices, the usage ledger, your personal dictionary and writing styles, your settings, any linked sign-in identities, and any support messages sent from your address. Invoicing and tax records are the one exception the table above sets out: they are kept for the stated period with your name, address and account identifier removed, reduced to the payment processor’s own references. Authentication and rate-limit log entries are kept for their own period but no longer identify you. Backups are overwritten on their own cycle, so a deleted record can persist in a backup for a short further period before it is cycled out.

8. What you control

AI cleanup: turn it off and no transcript text is sent for editing.
AI meeting insights: they run only when you ask for one. Nothing is generated in the background.
Meeting recording: start and stop it yourself, pause it, and mute your microphone while it runs. System-audio capture and live translation are each switched on or off by you.
Meeting files: the recording, transcript, notes and insights are ordinary local files. Delete a conversation or the whole folder and it is gone from your computer.
Local history: clear it at any time from the Windows app. It is on your computer, so it is yours to delete.
Cloud storage: there is none for dictation or meeting content in this release. If we add opt-in cloud storage or sync, it will be off by default and this policy will change before it ships.
Personal dictionary: add, edit and remove terms at any time.
Google Calendar: connect or disconnect it at any time, and delete saved work notes separately. See section 10.
Devices: see every authorised computer and revoke any of them. Revocation takes effect within minutes.
Sessions: see every browser signed in to your account and sign out of any of them.
Export: download everything your account holds as a JSON file, from your account settings.
Deletion: delete your account from your account settings. Every device is revoked immediately; the records are erased after the grace period in the table below, on request to support@xuula.com.
Marketing email: opt out at any time. Account, billing and security emails are not optional, because they are part of running your account.

10. Google Calendar integration

The Windows app includes an optional Google Calendar integration. It is being introduced gradually and may not yet be available in your version of the app; this section describes how it works where it is available.

Connecting Google Calendar is voluntary and separate from signing in to Xuula with Google. Signing in with Google does not give Xuula access to your calendar, and you can use Xuula without connecting one.

What the app can access

When you connect, Google asks you to grant one permission: read-only access to your calendar events (https://www.googleapis.com/auth/calendar.events.readonly). Xuula never sees your Google password.
The app currently reads only your primary calendar, and only for the date you choose for a work note. For each event on that date it reads the title, the start and end time and time zone, the location, the description, and the attendees — their names and email addresses as they appear in the event.
The app does not create, change or delete events in Google Calendar.

What it is used for

To match a work note with the visit you had scheduled. For example, “finished installing the TV at Mike’s” can be linked to the matching event that day. If more than one event could match, or the match is uncertain, you choose the visit yourself.
The calendar supplies context about a scheduled visit. It is not treated as proof that the work was done; your own note is the record of that.
Calendar data is not used for advertising. Xuula does not train models, as section 6 explains.

Where it is stored

Your work note and a copy of the linked event’s details — the fields listed above, as they were when the note was linked — are saved in a file on your computer, separately for each Xuula account used on that computer. Events that are not linked to a note are read for matching and not saved: the app does not keep an archive of your calendar.
Work notes and linked event details are not uploaded to Xuula servers, and they are not in Xuula’s server backups.
The permission Google issues to the app (a refresh token) is stored in Windows Credential Manager, under your Windows user and tied to your Xuula account. The short-lived access token is kept only in the app’s memory while it runs. Neither is written to the app’s settings or included when you export them.

When and to whom it is shared

When the app reads your calendar, the data travels between your computer and Google.
It leaves your computer in one other case: when you ask Xuula’s AI a question and include context that contains a work note — by choosing to ask about that note, or by including matching sources from your Memory. The app shows that context for you to review before you send it, and you can leave it out. What is sent can include the linked event’s title, time, location, description and attendees. It passes through Xuula servers to OpenAI, the AI provider listed in section 5, to produce the answer.
Xuula servers do not store the question or the context. The answer is kept for the period shown in the retention table in section 7, so that a response lost in transit can be recovered, and it may repeat details from the context. Each request asks OpenAI not to retain it; how long OpenAI keeps data and whether it may use it for training is governed by its own terms, which, as section 5 says, we have not verified against a signed agreement.
We do not sell calendar data. Apart from the cases above, we do not transfer it to anyone, except as described at the end of section 5.

Disconnecting, and deleting what is saved

Disconnect Google Calendar in the app’s account settings. This removes the stored permission from your computer and asks Google to revoke Xuula’s access. If the revocation fails or cannot be confirmed, the app tells you so, and you can remove the access yourself in your Google Account at https://myaccount.google.com/permissions.
You can also revoke Xuula’s access from your Google Account at any time. The app then cannot read your calendar until you connect it again.
Disconnecting stops new calendar reads. It does not delete the work notes you saved or the event details stored with them — those stay on your computer until you delete them. Delete a work note in the app and its saved event details are removed with it.
Because work notes are stored on your computer and not on our servers, deleting your Xuula account does not delete them either. Delete them in the app before you uninstall, or remove them from your computer yourself.

11. Your rights

Depending on where you live, you may have some or all of the following rights. You can exercise most of them yourself from your account settings; for anything else, write to support@xuula.com.

Access: a copy of the personal data we hold about you.
Rectification: correction of anything inaccurate.
Erasure: deletion of your data, subject to records we must keep by law.
Restriction: limiting how we process your data while a dispute is resolved.
Portability: your data in a structured, machine-readable format — this is what the export feature produces.
Objection: objecting to processing based on legitimate interests.
Withdrawal of consent: for anything we do on the basis of consent.
Complaint: to the data protection authority in the country where you live. Because we have no establishment in the EEA or the UK, there is no single lead authority for us — your own national authority is the one to write to.

We will respond within the deadline that applies to you — one month under the GDPR, which can be extended for complex requests. We do not charge for a first request, and we will ask you to confirm your identity before acting on one.

12. Security

Passwords are stored as memory-hard hashes with per-account salts. A database dump does not reveal them.
Session cookies, device tokens and reset links are stored only as hashes, so they cannot be replayed from a database copy.
Card details never reach our servers; they go directly to the payment processor.
Access tokens issued to the Windows app are short-lived, and revoking a device invalidates them.
We do not log access tokens, API keys, transcripts or audio.
Data is encrypted in transit. Encryption at rest is provided by the hosting platform named above; we do not run a separate encryption layer over the database, and we do not claim a security certification of any kind.

No system is perfectly secure. If you find a vulnerability, please report it to support@xuula.com rather than disclosing it publicly, and give us a reasonable chance to fix it.

13. International transfers

Your account data is processed in the United States. The application server and its database both run in the us-east4 region of our hosting platform, in the United States, and our other providers process data in their own countries — including outside yours.

If you are in the EEA or the UK, that means your personal data is transferred out of it. Where a transfer needs a safeguard, we rely on the mechanism in the provider’s own terms — typically the standard contractual clauses each of them publishes. We have not put separate transfer agreements in place beyond those, and we do not claim otherwise.

14. Age requirements

Xuula is not for children. You must be at least 16 to hold an account, or at least 13 if you are in the United States, where a lower statutory floor applies.

If we learn that an account belongs to someone below the applicable age, we delete it. If you believe a child has created an account, tell us at support@xuula.com.

15. Cookies

We set one cookie: your session cookie, which keeps you signed in. It is strictly necessary — without it, signing in would not work — so it does not require consent.

Your theme and language preferences are stored in your browser, not sent to us as tracking data.

Analytics is disabled in this release. If we enable it, it will be a provider that does not require a consent banner, or we will add one.

16. Changes to this policy

If we change this policy in a way that materially affects you, we will email account holders before the change takes effect and update the date at the top of the page.

Changes that only clarify wording take effect when published.

17. Contact

Write to support@xuula.com. That one address takes everything: privacy and data-subject requests, security reports, billing questions and anything else. It is a monitored mailbox, not a routing menu, and a person reads it.

Tell us in the first line what kind of request it is — “access request”, “deletion request”, “security report” — so it reaches the right person quickly. Nothing depends on you getting that right; it only makes it faster.

Postal address: ArtFixPro LLC, 228 Park Ave S #167371, New York, NY 10003, United States

No data protection officer and no EU or UK representative has been appointed. Requests go to support@xuula.com and are handled by the company directly.

Questions about this document

Write to support@xuula.com.