1. Who we are
Too Long To Listen is operated by STX Soluções LTDA, CNPJ 52.905.175/0001-41, Rua Visconde de Mauá, 25, apto 201, São Cristóvão, Criciúma/SC, CEP 88802-530, Brasil. Under Brazil's General Data Protection Law (Law 13,709/2018, LGPD) we are the controller of the data processed in the service.
Privacy contact: privacy@toolongtolisten.com.
2. Data we process
- Account: the name, e-mail and photo of your Google profile, received when you sign in with Google, and the internal account id.
- Audio: the files you upload for transcription. For videos, the audio is extracted in your browser and only the audio is uploaded.
- Transcripts: the text, timed segments, detected language, summary, folders and favorites you create.
- Billing: plan, minute balance, subscription status and customer and payment identifiers. Card and Pix details are handled directly by the payment processors and never reach our servers.
- Usage and security: technical logs (date, file size, duration, errors), an anonymous browser identifier and an irreversible hash of your IP address, used only to limit abuse, prevent bonus fraud and investigate failures.
- Referrals and no-signup demo: the referral code you use or share and, for the demo, the hash of the IP and browser used to apply the daily limit. Demo audio is not stored.
3. Purposes and legal bases
We do not sell your data and we do not use your audio or transcripts to train AI models.
- Transcribing, summarizing and delivering the results you asked for: performance of a contract.
- Billing, granting credits, preventing fraud and abuse: contract, legitimate interest and legal obligation.
- Service e-mails (job finished, payment failed, account notices): contract.
- Improving the product with aggregate metrics: legitimate interest. Consent-based cookies and measurement tools are only enabled after you accept.
- Handling requests, tax obligations and defense in proceedings: legal obligation and regular exercise of rights.
4. Where and how audio is processed
Transcription and summaries are produced by open speech recognition and language models (Whisper and a local language model) running on our own private server rented from Contabo GmbH, in a European datacenter (Germany). Audio and text are not sent to third-party AI services.
The transcription server only receives audio while it is processing, uses a temporary file deleted afterwards and does not write content to logs. The original file and the transcripts are stored on Google Cloud (Firebase), in the United States.
Because the server and the Google infrastructure are outside Brazil, there is an international data transfer under art. 33 of the LGPD, relying on the safeguards offered by the processors below.
5. Processors and sub-processors
- Google LLC (Firebase Authentication, Firestore, Cloud Storage, App Hosting, Secret Manager): sign-in, database, files and site hosting. United States.
- Contabo GmbH: the server that runs transcription and summaries. Germany, European Union.
- Stripe Payments: card payments and subscriptions.
- Mercado Pago: Pix payments. Brazil.
- Transactional e-mail provider (Resend): service e-mails, with your e-mail address and the message text only. United States.
- Google LLC (Google Analytics 4): aggregate audience measurement, only after your consent and only while the tool is enabled. United States.
6. Audience measurement (Google Analytics)
When audience measurement is enabled we use Google Analytics 4 (Google LLC, United States) to understand, in aggregate, which pages and features are used. It is only loaded after you click Accept in the cookie notice. Before that, no measurement cookie is stored and no data is sent to Google Analytics. If you decline, nothing is sent.
With your consent, Google Analytics stores cookies (such as _ga) and receives events such as page views, transcription started, plan clicks and subtitle downloads. Events never contain file names, audio or transcript content, e-mail addresses or your account identifier. The IP address is anonymized and we use no advertising signals or ad personalization.
You can withdraw consent at any time: use the "Cookie preferences" link in the site footer (the notice comes back and you can decline) or ask us at the privacy e-mail. After withdrawal nothing new is sent; data already measured in aggregate follows the tool's retention period.
7. Retention
- Uploaded audio: deleted automatically 7 days after upload on the free plan and 30 days on paid plans. You can delete it earlier by deleting the transcript.
- Transcripts, summaries, folders: kept until you delete them or delete your account.
- Account and balance: until you delete the account.
- Billing records: for the period required by tax and accounting law (generally 5 years), kept only at the payment processors and in our tax records, never with audio content.
- IP and browser hashes used for limits and fraud prevention: up to 180 days.
- Google backups may retain deleted data for up to 30 days before final erasure.
8. Your rights
At any time you may confirm that we process your data, access it, correct it, request anonymization, blocking or deletion, request portability, learn who we share it with, withdraw consent and petition the ANPD (art. 18 LGPD).
In Account on the site you can download all your data as a JSON file and use "Delete my account", which immediately erases your account, audio, transcripts, folders and balance and cancels active subscriptions. We also handle requests sent to the e-mail above within 15 days.
9. Security
We use encrypted connections (HTTPS), access rules that let each user read only their own data, server credentials kept in a secrets vault, usage limits and signature verification on payment webhooks. No system is fully immune; in case of an incident with relevant risk we will notify you and the ANPD as the LGPD requires.
10. Children
The service is not intended for people under 18. If we find a minor's data without a guardian's consent we will delete it.
11. Changes
We may update this policy. Relevant changes will be announced on the site or by e-mail and the date above will be updated.
12. Contact
Questions and data subject requests: privacy@toolongtolisten.com.