Privacy Policy

This policy explains what personal data Vibhaga Group collects through the Dictate Safe app and the dictatesafe.com website, why, who receives it, how long we keep it, and what you can do about it. It applies to everyone who uses Dictate Safe, wherever they live.

1. The short version

2. Who we are

Dictate Safe is made and sold by Vibhaga Group, a sole proprietorship of Umesh Yellaboina, 11-3-451, New Ashok Nagar, Parsigutta, Secunderabad, Hyderabad 500061, Telangana, India. In this policy "we", "us" and "our" mean Vibhaga Group. We decide why and how the personal data described here is used, which makes us the controller of that data (the "data fiduciary" under Indian law).

If we form a company to carry on the business, we may transfer this policy and your data to it, as section 9 explains.

Contact: privacy@dictatesafe.com. Postal address: as above.

3. What we collect

3.1 What you give us

• Account. Your email address, your password (we store it in a protected form, never as plain text), your name and profile picture if you add them, and the sign-in method you use. If you sign in with Google or GitHub, they send us your email address, name and profile picture URL and tell us the address is verified.
• Purchases and billing. The licences you buy, the amount, currency, tax, payment status and method type (for example card or UPI), your country, and, for Indian buyers, your state. A business buyer may add a business name, address and GST number. Razorpay handles your card, UPI and bank details; we never see them.
• Unfinished purchases. If you start a purchase and do not finish it, we keep a record of the attempt (the order and its technical details), as we do for every order. We use it to understand failed payments and to send the reminders described in section 8. Section 11 explains.
• Messages. What you write to us through the Contact page, your dashboard or email, any file you attach, and your phone number if you give it. If you are signed in, your message goes straight to our support team, with a note of your licences and computers at that moment. If you are not signed in, we hold your message, address, phone number and any file on our own server and send that address one email with a link. Nothing reaches our team until you open the link and press Confirm, and a message nobody confirms is deleted after 24 hours, with its file. Before an anonymous message is accepted, your browser does a short calculation on your own device that involves no other company and no cookie. To limit misuse we keep, for about a day, a scrambled form of the internet address it came from and counts of messages per internet address and links per email address.
• Chats and calls with our AI agent. If you write or talk to the AI agent on the website: your messages and its replies, the words of a call as text, the time, the page you were on and the country (worked out from your internet address, which we do not keep with the chat). Also anything you give it, such as an email address so that it can send you a link or a code. If you are signed in, or you prove your email address with a one-time code, the chat is linked to your account. We do not keep the audio of a call. Section 5.4 explains.
• Licence gifts. If you give a licence to someone, we keep their email address and the short note you write. We email them once to offer the licence.
• News and offers, and the waiting list. Your email address and the date you signed up, whether you ticked the box for news and offers, and the record of your consent.
• Download link requests. If you press Download on a phone, a tablet or another device that cannot install Dictate Safe, and ask us to email you the link, your email address and the time you asked, with a note that you asked for the link, and the record of your consent if you also tick the box for news and offers.
• Refund requests. The reason you give, if any. A reason is never required.

3.2 What is created when you use Dictate Safe

• Licence and computer records. When you sign in, activate a licence, renew it, sign out, or use the prompt Library or the free account, the app sends our servers a code that identifies your computer (a one-way code, not your hardware identifier), your computer's name as you set it, whether it runs macOS or Windows, and your licence or free-account pass. The app also sends a record of the version of the Licence Agreement you accepted and when. We keep these records to enforce the two-computer limit, to show you your devices, and to prove what you agreed to. When you ask for the prompt Library, the same code lets our website count the free Library saves each computer has made (up to 10 per computer) and limit how often a computer can ask. A computer's name can contain your own name. You can change it in your system settings.
• Where a purchase started. When the app opens our pricing page, the link says which part of the app it came from (for example the card shown after the free dictations). An order records that name. We also keep daily totals of visits and checkouts by that name, with nothing that identifies you.
• Downloads and visits. We count downloads by platform and source, without storing your address. Our own visit counter (section 7) counts first visits in the same way.
• Website and security data. Our servers record your IP address, the time, the pages or files requested, your browser type and the address you came from. We also keep short-lived records of requests (including your IP address or email address) to stop abuse, such as repeated sign-in attempts.
• Update checks. When the app checks for updates it contacts our website, which sees your IP address and the request details.
• Cookies and similar technologies. See section 7 and the Cookie Policy.

3.3 What we receive from others

• Razorpay: whether a payment succeeded, failed or was refunded, the payment method type and reference, and any dispute.
• Google and GitHub: the sign-in details in section 3.1.
• AppSumo: if you buy through AppSumo, your licence key, plan and redemption status. AppSumo is responsible for its own handling of your purchase and payment.
• Microsoft: if you install from the Microsoft Store, Microsoft handles that download under its own terms. We receive only what Microsoft's reports show us.
• Analytics and advertising providers: reports about how people use our website and how our ads perform (section 7). These are summaries, not records of named people.
• Advertising platforms (lead forms): if you fill in a lead form that we run on Meta (Facebook and Instagram), Google Ads or another social or advertising platform, the platform passes us what you typed into the form, normally your email address and name and sometimes a phone number, with the name of the form. Section 8 explains what we do with it.
• Email providers: whether an email was delivered, bounced or was marked as spam. Which link in an email you clicked we count ourselves (section 8).
• Our AI and voice providers: what each charges for a conversation or a call, the length of a call, and the words of a call as text (section 5.4).

3.4 What we do not collect

From the app we do not receive your audio, transcripts, History, notes, snippets, vocabulary, prompts, tasks, goals, Assistant chats, files you attach to the Assistant, or the API keys you save in the app. The only audio we handle is a call you choose to make to our AI agent on the website, and we do not keep its audio (section 5.4). We do not collect voiceprints and we do not use your voice to identify you. If you send us something of that kind in a support message or a chat, you have chosen to share it with us, and we treat it as a message under this policy.

4. How we use personal data, and our reasons

We need a reason in law for each use. The table gives ours. "Contract" means we need the data to supply what you bought or asked for. "Legitimate interests" means a reasonable interest of ours that does not override your rights. "Legal duty" means a law requires it. "Consent" means you agreed and can withdraw. For people in India, "contract", "legal duty" and "legitimate interests" correspond to the uses Indian law allows without separate consent, and we ask for consent wherever the table says so.

We do not make decisions about you by automated means that have legal or similarly significant effects. Our systems apply fixed rules, for example to stop a licence being used on more computers than it allows.

5. Dictation, cloud providers and the Assistant

5.1 The default: on your computer

Out of the box, Dictate Safe turns speech into text with models that run on your computer. The recordings, transcripts, History, notes, snippets, vocabulary, prompts, tasks and Assistant chats are stored in a folder on your computer that your operating system limits to your own user account. We cannot access it. You decide how long audio is kept and when to delete History. You can turn on encryption of this data in the app's settings. If you lose your key and your recovery passphrase, nobody can open it, including us. If you back the data up or use a folder that a cloud service syncs, that service receives the copy.

The app can download AI model files when you press a download button. They come from third-party hosting services, which see your IP address and the request. Apart from those models, the prompt Library, licence certificates and updates, the app downloads nothing.

5.2 Optional cloud providers (your choice, your key)

You can switch on a cloud provider by saving your own key and choosing the provider in the app. We do not provide keys, accounts or servers for this, and the data does not pass through us. The app sends it straight from your computer to the provider, who handles it under your agreement with them. Read their terms before you turn one on:

Your dictation History, Scratchpad notes and snippet list are never sent to a cloud provider. Your vocabulary list goes only as the table says. A snippet you speak is expanded before cleanup, so its expanded text can be part of the text a cleanup provider receives. We do not control what a provider does with what it receives, and we cannot delete it for you. Ask the provider.

The "Offline Lock" switch stops every connection the app makes itself, including these providers, until you turn it off. It lets through one licence check, and only if you allow it. It does not stop buttons that open your web browser, and it does not stop the programs on your own computer that the app uses for local processing.

5.3 The Assistant

The Assistant is a Beta feature that is off until you turn it on. It uses artificial intelligence, so you are talking to a computer program, not a person, and its answers can be wrong. It can create and change your tasks, goals and reminders on your computer. It runs on your computer unless you choose a cloud engine as described above. The Assistant is not a counsellor or adviser. If you tell it that you are in crisis, it shows a help card with helpline directories.

5.4 The AI agent on our website (chat and voice)

The website has a chat window with an AI agent. You can write to it and, where a microphone button is shown, talk to it. It is an AI system and not a person, and it says so at the start of every chat and call. It answers questions about Dictate Safe, gives prices from our own price list, can email you a link or a one-time code, and can give you a discount code from a short list we set. It cannot refund, change a price or change your account. A person on our team can read any conversation, step in and answer.

• When anything is stored. Nothing is stored, and no cookie is set, until you write your first message or start a call. Then we store the conversation on our servers in India: your messages and the replies, the time, the page, the country, and what the agent did for you (for example sending a code or giving a discount code). A written chat sets one cookie, ds_chat, for 30 days, so that the window finds your chat again (see the Cookie Policy). A call sets no cookie.
• Who receives it. To answer, we send the conversation so far, the page you are on and whether you are signed in to an AI provider that acts for us. At any time we use one or more of Anthropic, OpenAI, Google (its Gemini service) and Groq, which we choose in our own settings. The sub-processors page lists them and what each receives. If you sign in, or prove your email address with a one-time code, the provider also receives a short summary of your account: whether you hold licences, their status, how many computers each allows and uses, your last purchase and your open support cases. It never receives a licence key, a password or card details.
• Voice calls. Your browser sends your voice, as you speak, to Retell, a voice platform that acts for us. Retell turns your speech into text, passes the text to an AI model, and turns the answer into speech. We have told Retell not to keep a recording, a transcript or logs of the call beyond basic details such as its length. Retell sends us the words as text while the call runs, which is how the captions appear on your screen, and when it ends. We keep that text with the conversation and we do not keep the audio. Your browser asks before it uses the microphone, and a call stops after 10 minutes.
• Support in your dashboard. The same agent may answer a support case you open in your dashboard before a person does. For that, it receives your case messages and the account summary above, and a person can step in at any time.
• What we do not do. We do not use conversations to train AI models. Our team reads them to answer you, to keep the service safe and to improve the agent's instructions. We also use AI to help our team write the first version of an email, and that tool receives our instructions for the email, not your personal data.
• Take care. An AI agent can be wrong, so check what it tells you before you rely on it, and do not give it card details or passwords. A price it quotes is from our price list at that moment, and the pricing page and checkout decide what you pay.
• How long. Section 11 gives the period.

6. How the app talks to our servers

The app contacts dictatesafe.com only to do the following: sign you in or out; activate, renew and release a licence; create a free account; fetch the prompt Library and save a Library prompt; and check for and download updates. Section 3.2 lists what each sends. The app does not contain advertising, analytics or crash-reporting code, and it does not send us your usage. Buttons in the app that open your web browser (for example to our pricing page) send nothing until your browser loads the page.

7. Cookies, analytics and advertising

The website sets a few cookies that it needs to work, such as keeping you signed in, protecting sign-in forms and, once you write to our AI agent, keeping your chat together. The Cookie Policy lists them.

Our own visit counter. We count visits to the website on our own server. The counter sets no cookie on your device and stores no IP address. It counts first visits, the country of the visit, the source of the visit (the campaign tags and advertising click identifiers in the web address) and the choice made in the cookie box (accept all, necessary only or customise). Our server logs, described in section 3.2, are separate.

Analytics and advertising tags. The website can also load:

• Google Analytics (Google), to count visits and understand which pages and downloads are used.
• Microsoft Clarity (Microsoft), which records how people use our pages (clicks, scrolling and page layout) so we can fix confusing screens. We switch on masking of text you type and we do not use Clarity on account, checkout or support pages.
• Meta Pixel (Meta) and Google's advertising features, to measure whether our ads work and to show our ads to people who visited our site.

When they load depends on where you are. We work out your region from your internet address on our server when you open a page.

• In the European Union, the European Economic Area, the United Kingdom and Switzerland, they load only after you choose "Accept all" or turn on the matching switch in the cookie box.
• In India and the United States, they load by default. They stop as soon as you press "Necessary only" or your browser sends the Global Privacy Control signal. In the United States, the bottom of every page also shows "Your privacy choices".
• In every other place, the stricter rule applies: they load only after you accept.

We expect to move India to the stricter rule when the duties of India's Digital Personal Data Protection Act begin.

"Necessary only" loads none of them. You can change your mind at any time with "Cookie settings" at the bottom of every page. If your browser sends the Global Privacy Control signal, advertising tags stay off wherever you are, and in India and the United States analytics tags stay off as well.

We promote Dictate Safe through advertising on Google (Google Ads) and on Meta's services (Facebook, Instagram and the other places Meta shows ads). We do not control where those platforms show our ads, or how they pick who sees them. If you click an ad and arrive on our site, the platform and we may each receive information about the click. Their rules apply to what they do:

• Google: privacy policy, how Google uses data from sites that use its services, ad settings, Google Ads policies, Analytics opt-out add-on.
• Meta: privacy policy, advertising standards.
• Microsoft Clarity: terms, Microsoft privacy statement.

You can also opt out of interest-based advertising in general through Your Online Choices (Europe), the Digital Advertising Alliance (United States) and the Network Advertising Initiative.

We do not sell personal data. When advertising tags run, Meta and Google may receive information about your visit. California law calls that "sharing" for cross-context behavioural advertising. You can stop it at any time with "Cookie settings" at the bottom of every page, with "Your privacy choices" where it is shown, or with the Global Privacy Control signal.

8. Marketing email and lead forms

Service messages. We send service email because the Services need it: verification, receipts, licence emails, security and account notices, replies to your messages, the single launch email to the waiting list, and the one email with the download link you asked for from a phone or tablet.

Product emails. If you create an account, start the free trial or buy a licence, we may send a short series of emails about it: how to set up and use Dictate Safe, a note about what a licence includes, and after a purchase how to activate, a request for an honest review, and a note about a second computer, gifting or a team licence. If you start a purchase and do not finish it, we may send up to four reminders over about a week, the first after an hour, with answers to common questions and sometimes a discount code. These emails are sent automatically when the event happens. Each carries an unsubscribe link and the preferences link, and we stop when you unsubscribe from all email.

News and offers. We send marketing email, such as newsletters, product updates and offers, only to people who ticked the box for news and offers on the sign-up form or the waiting-list form, who subscribed in some other way, or who gave us their email address on an advertising lead form that carried our consent line (see below). The box is unticked by default. It is not part of checkout. If you did not tick it, we send you only service messages.

The waiting-list form says we will email you when Dictate Safe is ready to download. If you also ticked the box for news and offers, you stay on our list after the launch email and we also send you updates about the product and about future products from the same business.

For about 30 days after you sign up or join the waiting list with the box ticked, we send a series of introductory emails. After that you receive our normal newsletters until you unsubscribe, ask us to stop by writing to Support or by any call or message, or the law requires us to stop.

People who started a purchase. If you start a purchase and do not finish it, we keep the record of the attempt with our order records, for as long as you have an account. If you ask us to delete your account, the record of an attempt that did not become a sale is deleted with it. The reminders described above come from this record, and they stop if you buy or unsubscribe.

Unsubscribing and your choices. Every one of these emails has an unsubscribe link and a link to a preferences page where you can choose which kinds you get. You can also tell us in any way you like, for example through Support, at privacy@dictatesafe.com, or by any call or message. We keep a do-not-email list so that an address that unsubscribed is never emailed again. We keep a record of your consent and, after you unsubscribe, enough of your address to make sure we do not email you again.

Counting clicks. Each link in our emails goes through our own address, so that we can count how many people clicked it. We keep the click with the record of the email sent to you. We do not put tracking images in our emails to see whether you opened them, and our email provider's own open and click tracking is switched off.

Provider. We send all our email, service and marketing, through Resend, from our own domain. We keep our lists in our own system and give Resend only the address, subject and text of an email when we send it. An address on our do-not-email list is never sent anything.

Lead forms on advertising platforms. We collect email addresses through lead forms that we run on Meta (Facebook and Instagram), Google Ads and other social and advertising platforms.

• Source. You type your details into a form on the platform, and the platform passes them to us.
• What we do. We reply to you and send what the form promised, such as a guide or a link. We send marketing email only if the form carried our consent line and a link to this Privacy Policy. We note the platform, the form and the time with each lead.
• The platform. The platform is a separate controller for what it collects and does with your data in its own right. Its own terms and privacy policy apply (the links are in section 7).
• Unsubscribing. Use the unsubscribe link in any marketing email or write to us as above. You can also ask the platform to delete your form entry.

Phone numbers. If you give us a phone number, in a lead form, in the chat window, in a call with our AI agent, in a message or in your account, we keep it with your contact record. A person on our team may phone you on it only if you asked for a call or agreed to be phoned. A yes to emails is not a yes to calls, and you can say no to calls at any time by writing to us as above. We do not make automatic or AI-made calls today. If that changes, we will say so here before it does. If you ask us to delete your data, the number goes with it.

9. Who receives personal data

We do not sell personal data. We share it only as follows.

• Service providers acting for us (our "processors"): hosting (Amazon Web Services), email delivery (Resend), and the tools our team uses for email and office work. They may use the data only to provide their service to us. The sub-processors page lists them.
• AI and voice providers acting for us, for the AI agent on the website and the AI answers in Support (section 5.4): Anthropic, OpenAI, Google (its Gemini service) and Groq, of which we use one or more at any time, and Retell for voice calls. We use their business services, under their commercial terms and not their consumer chat products. The sub-processors page lists what each receives.
• Payments: Razorpay processes payments and refunds. Razorpay is also responsible for its own handling of your payment details under its own terms and privacy policy.
• Sign-in providers: Google and GitHub, when you choose them. Their own privacy policies apply to what they hold (Google, GitHub).
• Analytics and advertising providers: Google, Microsoft and Meta, only as section 7 describes, and the advertising platforms that host our lead forms, as section 8 describes.
• Distribution partners: Microsoft (the Microsoft Store) and AppSumo, for purchases you make through them. We may list or promote Dictate Safe on other platforms, such as Product Hunt and social networks. When you interact with us there, that platform's rules govern what it collects, and we receive only what it shows us, such as your username and the review or comment you post.
• Professional advisers and authorities: our lawyers, accountants and auditors, and tax, court, police or other authorities when the law requires or allows us to disclose, or to protect our rights, our users or others.
• A successor. If we transfer the business, in whole or in part, to a company or another person (for example a company the owner forms to run it), your data goes with it. We will tell you before your data becomes subject to a different privacy policy.

10. Where data is handled

We are in India and our servers are in India (Amazon Web Services, Asia Pacific (Mumbai) region). When you use the Services from another country, you are sending data to India. Some of our providers process data in other countries, including the United States. That includes our AI and voice providers, which handle the words of a chat or a call where they operate. Where the law of your country limits sending personal data abroad, we rely on the safeguards that apply, such as the standard contractual clauses that our providers commit to, and certification under the EU-US Data Privacy Framework where a provider holds it. You can ask us how, by writing to privacy@dictatesafe.com.

11. How long we keep it

Where a longer period is shown, it is because a law or a legal claim needs the record. When a period ends we delete or anonymise the data.

Deleting your account and your licence. Deleting your account ends your licence, because the licence belongs to the account. Before we delete anything we tell you this and ask you to confirm. If you are still inside the 30 day refund period, you may ask for a refund instead. We keep the sale record as the table above says.

If the business closes. We keep the billing and compliance records for the period in the table, even if the business closes. We delete all other data within 1 year after the closing date, unless the law or a dispute needs it for longer.

12. Your rights

You can ask us to do the following. Wherever you live, we will honour a request that the law of your country gives you, and where yours gives you nothing on a point we will still consider it.

• Tell you whether we hold personal data about you and give you a copy, with who received it.
• Correct or complete data that is wrong or incomplete.
• Delete your data. We delete or anonymise everything except the billing and compliance records described in section 11, and deleting your account ends your licence.
• Restrict or object to a use that rests on our legitimate interests, and stop direct marketing at any time.
• Give you the data you gave us in a common, machine-readable format, or send it to another provider where that is technically possible.
• Withdraw your consent at any time. This does not affect what we did before you withdrew. You can withdraw cookie consent in "Cookie settings", and consent to news and offers with the unsubscribe link or by telling us in any other way.
• Nominate another person to exercise your rights if you die or cannot act (India).

How to ask. Write to privacy@dictatesafe.com or use the Contact page, from the email address on your account if you have one. We may ask for details to confirm it is you. We reply within 30 days. Where the law allows us more time we will tell you why. We do not charge a fee unless a request is clearly excessive, and we explain if we refuse.

Complaints. Please use our grievance process first (section 17). You can also complain to the authority in your country:

• India: the Data Protection Board of India, once the Digital Personal Data Protection Act is in force for us and after you have used our grievance process.
• European Union: your national data protection authority.
• United Kingdom: the Information Commissioner's Office.
• California: the Attorney General or the California Privacy Protection Agency.
• Elsewhere: the authority responsible for data protection in your country.

13. Children

Dictate Safe is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to privacy@dictatesafe.com and we will delete it.

14. Security

We use technical and organisational measures that we consider reasonable for the data we hold. They include encrypted connections to our website, protected storage of passwords, access limits and two-step sign-in for our team, and regular backups. No system is completely secure, and we cannot promise that data will never be accessed without permission. If a breach affects your personal data, we will tell you and the authorities as the law requires. To report a weakness, see our security page.

15. Third-party sites

The Services link to other sites and platforms, including those named in this policy. We do not control them and are not responsible for their content or privacy practices.

16. Notices for particular places

European Economic Area and United Kingdom. The reasons for each use are in section 4. Your rights are in section 12. Transfers are described in section 10. You may object to processing based on legitimate interests and withdraw consent whenever you like.

California and other US states. In the last 12 months we collected these categories of personal information, for the purposes in section 4:

We collect it from you, from your use of the Services, and from the providers in section 3.3. We keep it for the periods in section 11. We do not sell personal information. We share it for advertising only when advertising tags run (section 7), and you can stop that at any time. You may ask to know, delete, correct, and opt out of sharing, and we will not treat you worse for asking. An authorised agent can ask for you if you give us written permission. We reply within 45 days. If we refuse and you disagree, reply to say you appeal. We will review it and answer within 60 days, and you may then contact your state's attorney general.

India. Indian law gives you rights to information, correction, completion, updating and erasure of your personal data, and to a grievance process. Section 12 describes how to use them. Your Grievance Officer is in section 17. Where this policy asks you to consent, the consent is voluntary and you can withdraw it as easily as you gave it.

Elsewhere. We apply the rights in section 12 in the way the law of your country allows.

17. Contact and Grievance Officer

Questions, requests and complaints about personal data: privacy@dictatesafe.com, or use the Contact page at https://dictatesafe.com/contact.

Grievance Officer: Umesh Yellaboina, Vibhaga Group, 11-3-451, New Ashok Nagar, Parsigutta, Secunderabad, Hyderabad 500061, Telangana, India. Email: privacy@dictatesafe.com and legal@dictatesafe.com. We acknowledge a complaint within 48 hours and resolve it within 30 days. The Contact and Grievance page at https://dictatesafe.com/contact-and-grievance has the full complaint process.

18. Changes to this policy

We may change this policy. When a change matters, we will tell you by email or in the app before it applies, and we will update the version and date above. Earlier versions are kept, and you can ask us for a copy.

Document history