Privacy Policy

S&C Holding GmbH ("we", "us", "HeyDiane") operates the HeyDiane application and website (www.heydiane.ai). This Privacy Policy explains how we collect, use, and protect your personal data.

Where our data is processed, our complete sub-processor list, and our security measures are documented in the Trust Center.

1. Data Controller

S&C Holding GmbH
Halbgasse 1a, 1070 Vienna, Austria
Email: info@heydiane.ai
VAT ID: ATU70341613
Managing Director: Mag. Markus Höfinger

2. Data We Collect

2.1 Account Data

• Email address
• Name (optional)
• Authentication data (password hash or Google sign-in identity), processed on our own EU infrastructure

2.2 Recording Data

• Audio recordings you upload or connect
• Transcripts with speaker detection and word timestamps
• Extracted data: titles, summaries, timelines, participants, tags
• Questions you ask the Diane assistant and its answers

2.3 Usage Data

• Device information
• Browser type
• IP address
• Pages visited
• Feature usage patterns

2.4 Payment Data

• Subscription status
• Payment history (processed by Stripe)
• We do not store credit card details

3. How We Use Your Data

3.1 Service Delivery

• Processing and storing your recordings and transcripts
• Transcribing audio and generating summaries using AI models
• Answering questions about your conversations and generating documents
• Sending transactional emails

3.2 Service Improvement

• Analyzing aggregated usage patterns
• Improving transcription and summarization accuracy
• Developing new features

3.3 Marketing and Analytics

• Understanding user behavior
• Measuring feature adoption
• Marketing performance analysis

4. AI Processing

Your audio recordings and transcripts are processed by AI services to create transcripts, summaries and assistant answers. We use:

• Mistral AI, Paris (transcription with speaker detection, summaries and assistant answers)
• Google Cloud Speech-to-Text, EU multi-region (transcription with speaker detection)
• Azure OpenAI, Sweden Central (GPT models for summaries and assistant answers, inside Microsoft's EU Data Boundary)

All AI processing happens on EU-pinned endpoints. These services process your data solely to provide their results, under Data Processing Agreements, and none of them trains models on your content. The complete, current provider list with transfer bases is in our Trust Center.

Important: By using HeyDiane, you consent to your recording data being processed by AI services for transcription, summarization and assistant purposes.

5. Connected Cloud Storage & Google API Services

If you connect a cloud folder (Google Drive, Dropbox, OneDrive) or another source (email, HeyPocket), we access it only to detect and import new audio files from the folder you selected. We do not read, store or process any other files in your storage.

HeyDiane's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data (file listings and the audio files you chose to watch) is used only to provide the import feature you requested, is never used for advertising, and is never sold or transferred to third parties except as necessary to provide the feature or as required by law. AI models are not trained on Google user data.

6. Data Sharing

6.1 We Never Share

• Individual recordings or transcripts
• Personal conversation content
• Identifiable conversation details

6.2 We May Share

• Aggregated, anonymized statistics
• Marketing and analytics data with third-party tools

6.3 Service Providers

We use the following third-party services:

We have Data Processing Agreements (DPAs) in place with our service providers. For specific information about our contractual arrangements with individual providers, please contact us at info@heydiane.ai.

7. Data Security

7.1 Encryption

• All data is encrypted in transit (TLS/SSL)
• All data is encrypted at rest
• All backups are encrypted

7.2 Server Location

Your data is stored on servers in Frankfurt, Germany, within the European Union.

7.3 Access Control

• Only authorized personnel can access systems
• We use role-based access controls and tenant isolation on every database row
• Regular security audits

8. Data Retention

• Active accounts: Data retained while account is active
• Deleted accounts: Data deleted within 30 days
• Audio recordings and transcripts: Deleted with the workspace or account
• Aggregated analytics: May be retained indefinitely (anonymized)

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Delete your account and data
• Portability: Export your data
• Restriction: Limit how we process your data
• Objection: Object to certain processing
• Withdraw consent: At any time

To exercise these rights, contact us at info@heydiane.ai or use the workspace deletion and export features in Settings.

10. Cookies

We use cookies for:

• Authentication (required)
• Preferences (optional)

Our public landing page uses Umami Cloud for cookie-free, aggregated website analytics. The tracker is not loaded on authenticated app pages and does not receive account, workspace, recording, transcript or search-query data.

You can manage cookie preferences in your browser settings.

11. Children

HeyDiane is not intended for users under 16 years of age. We do not knowingly collect data from children under 16.

12. Recording Consent

You are responsible for complying with applicable laws when recording conversations, including obtaining any consent required from other participants before uploading a recording to HeyDiane.

13. International Transfers

Some of our service providers are located outside the EU (USA). We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs)
• EU-US Data Privacy Framework certification where applicable

14. Changes to This Policy

We may update this Privacy Policy. Significant changes will be communicated via email or in-app notification.

15. Contact

For privacy-related inquiries:

S&C Holding GmbH
Halbgasse 1a, 1070 Vienna, Austria
Email: info@heydiane.ai

You may also lodge a complaint with the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna
www.dsb.gv.at