Privacy Policy

Data Controller

The Data Controller responsible for your personal data is:

For any questions regarding data protection, you may contact our Data Protection Officer at the email address above.

Information We Collect

Personal Data

We may collect personally identifiable information that you voluntarily provide when:

• Registering for an account (email address, username, password)
• Using our contact form (name, email, message content)
• Subscribing to our newsletter (email address)

Transcription Data

Information you add to your transcriptions, including:

• Images of historical documents you upload for transcription
• Upload batch names and metadata
• Original transcriptions in source languages
• English translations
• Structured data extracted from documents (names, dates, places, relationships)
• Detected languages and processing metadata
• Processing status and timestamps

Payment Information

• Credit purchase transactions
• Stripe payment intent and session IDs
• Transaction amounts and timestamps
• Note: We do not store credit card numbers or full payment details. Payment processing is handled securely by Stripe.

Automatically Collected Data (Technical Data)

When you access Metryki, we may automatically collect:

• Device information (browser type, operating system, device type)
• Usage data (pages visited, features used, time spent)
• IP address (may be anonymized for analytics)
• Referral source (how you arrived at our site)
• Account creation date and last login information
• Service tier selections
• Processing logs and error information

Authentication Data

• If you use Google or Microsoft OAuth, we receive your email address and name from the provider
• OAuth provider identifiers
• Authentication tokens (managed by ASP.NET Identity)

Legal Basis for Processing (Article 6 GDPR)

We process your personal data under the following legal bases:

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your requests and manage your account
• Send you technical notices and support messages
• Respond to your comments, questions, and requests
• Analyze usage patterns to improve user experience (with appropriate legal basis)
• Protect against fraudulent or unauthorized activity
• Comply with legal obligations

Data Storage & Security

Your data is stored securely using industry-standard encryption and security measures. We implement:

• HTTPS/TLS encryption for all data transmission
• Secure password hashing (passwords are never stored in plain text)
• Regular security audits and penetration testing
• Access controls and role-based authentication
• Regular backups with encrypted storage
• Staff training on data protection

While we implement appropriate technical and organizational measures to protect your information, no electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining appropriate protection standards.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this privacy policy, or as required by law.

When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain certain information for legal obligations or legitimate business purposes.

International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Adequacy decisions: Transfers to countries the European Commission has determined provide adequate protection
• Standard Contractual Clauses (SCCs): EU-approved contractual terms that provide appropriate safeguards
• Data Processing Agreements: Binding agreements with third-party processors

Our primary data storage is within the European Union. If you would like more information about international transfers, please contact us.

Third-Party Services

We may use third-party services that process personal data:

All third-party processors are bound by Data Processing Agreements (DPAs) that ensure GDPR compliance. We encourage you to review their privacy policies:

• Stripe: https://stripe.com/privacy
• Google: https://policies.google.com/privacy
• Microsoft: https://privacy.microsoft.com/privacystatement
• OpenAI: https://openai.com/policies/privacy-policy

Your Rights Under GDPR

Under the EU General Data Protection Regulation and Spanish data protection law, you have the following rights regarding your personal data:

How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@metryki.com or use our contact form.

We will respond to your request within one month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Spain, this is:

Cookies & Tracking Technologies

We use cookies and similar tracking technologies in accordance with EU cookie legislation (ePrivacy Directive) and GDPR requirements. Cookies are small text files stored on your device.

Types of Cookies We Use

Cookie Consent

When you first visit our website, you will be presented with a cookie consent banner. Non-essential cookies will only be placed after you provide your consent. You can:

• Accept all cookies
• Accept only strictly necessary cookies
• Customize your cookie preferences
• Withdraw consent at any time through your browser settings or our cookie settings panel

Managing Cookies

You can control and manage cookies through your browser settings. Note that disabling strictly necessary cookies may affect the functionality of the application.

Children's Privacy

In accordance with Article 8 of the GDPR and Spanish law (LOPDGDD), Metryki is not intended for children under 14 years of age. We do not knowingly collect personal information from children under 14.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@metryki.com. We will take steps to delete such information from our systems.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make material changes:

• We will update the "Last updated" date at the top of this page
• We will notify registered users via email for significant changes
• We may display a prominent notice on our website

We encourage you to review this privacy policy periodically. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.