Privacy Policy

1. Data controller

Robin Carayol — contact@subkickcaption.com.

2. Data collected

• Email address — if you join our mailing list, receive a license, or start a subscription (to redirect you to checkout and email you the link).
• License data — device fingerprint (hashed hardware identifier), plugin version, operating system, country and IP address, recorded during license checks (anti-sharing security).
• Transcribed audio — when you start a transcription, your sequence's audio is sent to our transcription provider (Gladia) to be converted into text. This audio is not retained after transcription.
• Anonymous analytics — aggregated visit statistics via Cloudflare Web Analytics, without cookies and without an identifiable IP address. Arrivals via a campaign or affiliate link are counted in aggregate (campaign code, page, country), without cookies or IP address.
• Arrival source — when a free license is created, the site your first visit came from (e.g. a search engine) and the first page you viewed are linked to the license, for acquisition statistics. No cookies, no IP address.
• Free-trial counter — the number of generated words and transcription minutes used with a free license is tied to your computer's fingerprint (hashed hardware identifier). A word counter is also tied to your license (therefore to your email address) and follows it if you change computer, so that the free trial counts once per device and per license. These counters are kept for as long as the service exists.
• Fraud prevention — when a free license is created, we record the date, your email address in normalised form and your hashed IP address (never in clear text), in order to detect serial account creation aimed at bypassing the free trial. These records are deleted after 90 days.
• Mailing list — creating a free license subscribes you to our product news (legitimate interest, customer relationship). You can unsubscribe in one click from any of these emails.
• Referral source — if you arrive via an affiliate link, a referral identifier is kept to credit the partner if you subscribe.
• Support messages — when you write to us (contact form, feedback from the plugin), we keep your email address, the text of your message, and your IP address, browser and country at the time of sending (abuse prevention). If you tick the matching option in the plugin, a technical diagnostic is attached (plugin version, system, error log) — we use it to reproduce the issue. Retention: for as long as it takes to handle your request, then archived.
• Instagram interactions — if you comment on a @subkick.caption post or reply to one of its automated messages, Meta may provide us with the comment text and identifier, your technical Instagram identifier, your username when supplied, the post or message identifier, the button action and the timestamp. This automation never asks for your Instagram password and does not collect your email address.
• Facebook interactions — if you comment on a post from the Subkick Caption Page or interact with its automated Messenger messages, Meta may provide us with the comment text and identifier, your Page-scoped technical identifier, your public name when supplied, post or message identifiers, button actions and timestamps. The automation is restricted to this Page, never asks for your Facebook password and does not collect your email address.

3. Purposes & legal bases

• Send you product news, with one-click unsubscribe in every email (mailing list) — legitimate interest (customer relationship).
• Issue and validate licenses, send you a key-recovery code — performance of the license agreement.
• Transcribe the audio you submit into text (the software's core feature) — performance of the contract.
• Protect the software against sharing / fraud and improve the product — legitimate interest.
• Detect a keyword in a comment posted on @subkick.caption, prevent duplicate replies, publish a reply and privately send the requested link — legitimate interest (responding to requests from our community).
• Detect a keyword in a comment posted on the Subkick Caption Facebook Page, prevent duplicate replies, publish a reply and send the requested link through Messenger — legitimate interest (responding to requests from our community).

4. Retention

Mailing-list emails are kept until you unsubscribe. License data is kept for the lifetime of the license. Verification logs are kept for security purposes for a limited time, then deleted. Fraud-prevention records (normalised email, hashed IP) are deleted after 90 days; the free-trial counter tied to the device fingerprint is kept for as long as the service exists. Technical logs relating to the Instagram and Facebook automations are automatically deleted within 90 days. Comments and messages already retained by Instagram, Facebook or Messenger remain subject to Meta's retention rules and deletion tools.

5. Providers, platforms & transfers

We rely on the following providers and platforms:

• Cloudflare — hosting, storage (databases, files) and analytics.
• Resend — sending transactional emails (recovery codes). Processed in the EU region.
• Lemon Squeezy — subscription payment, billing and VAT (Merchant of Record) and affiliate program.
• Gladia — automatic (AI) transcription of the audio you submit. The audio is not retained after transcription.
• Meta / Instagram / Facebook / Messenger — receiving comment and messaging events, publishing replies and sending the requested link on Subkick Caption accounts.

Some providers may process data outside the European Union; such transfers are covered by appropriate safeguards (standard contractual clauses).

6. Cookies

This site does not use advertising or tracking cookies. Analytics is cookieless. Strictly necessary local storage is used to remember your access — and, where applicable, the referral identifier from an affiliate link (to credit the partner); a functional use that does not require consent.

7. Instagram and Facebook automations

Data received through the Instagram, Pages and Messenger APIs is not sold or used to create advertising profiles. We only process events needed for keyword detection, the requested reply, duplicate prevention and error diagnosis. The Facebook automation verifies the Page identifier and ignores events originating from any other Page.

8. Your rights

Under the GDPR, you have the right to access, rectify, erase, object to and port your data. To exercise them, write to contact@subkickcaption.com. For Instagram-related data, see our Instagram data deletion procedure. For Facebook or Messenger data, see our Facebook data deletion procedure. You may also lodge a complaint with the French data protection authority (CNIL, cnil.fr).