Privacy

Privacy Policy

Plain-English summary first, GDPR-compliant detail underneath. We are the data controller; if anything here is unclear, write to privacy@lazytype.io.

TL;DR

We collect the minimum data needed to bill you and enforce your license.
Audio you dictate is sent to Groq for transcription and immediately discarded. We never see it.
Your transcripts stay on your Mac. They are not sent anywhere unless you copy them.
We do not sell or share your data.
You can request deletion or export of your data anytime: privacy@lazytype.io.

1. Controller

D.CRAMER ESOLUTIONS LTD, Istanbul 10, Athanasia Court, Office No. 6, CY-6025 Larnaca, Cyprus. Reg. HE469716. VAT CY60126352Y. Contact: privacy@lazytype.io.

2. Data we process

2.1 When you visit lazytype.io

Standard server log data via Cloudflare: IP address, user agent, requested URL, timestamp, referrer. Retained 7 days.
No third-party analytics, no cookies for tracking, no fingerprinting scripts.
One technical cookie (lt_admin) is set only when an administrator logs into the dashboard. Visitors do not receive it.

2.2 When you buy LazyType

Stripe handles the payment. We never see your card number. We receive: email, country (for VAT), payment status, transaction ID.
We store your email + plan + Stripe session ID in our customer database to deliver and validate your license. Retained for the duration of the contract plus statutory tax periods (10 years, Cyprus tax law).

2.3 When you use the desktop app

Audio: streamed to Groq Inc. (USA), transcribed, and discarded. Groq does not retain audio for training. We do not retain audio at all.
Transcripts: stored locally on your Mac in a JSON file under ~/Library/Application Support/LazyType. Not transmitted to us.
License check: every launch + before each transcription, the app sends a SHA-256 hash of your machine's hardware UUID + hostname + MAC to /api/verify on our server. We use this to enforce your 7-day trial and to bind your license to up to 3 devices. The hash cannot be reversed to identify you personally.

3. Legal basis (GDPR Art. 6)

Contract performance (Art. 6(1)(b)) - license issuance, activation, customer support.
Legal obligation (Art. 6(1)(c)) - Cyprus tax retention, VAT reporting.
Legitimate interests (Art. 6(1)(f)) - minimal server logs for security and abuse prevention; license-binding via device fingerprint to prevent license sharing.

4. Sub-processors

Cloudflare, Inc. (USA / EU edge): web hosting, edge functions, KV storage, R2 object storage, DNS. EU-US Data Privacy Framework certified.
Stripe Payments Europe Ltd. (Ireland): payment processing.
Resend, Inc. (USA): transactional email delivery (license keys, support replies).
Groq, Inc. (USA): speech-to-text inference. Audio is not stored.

5. International transfers

Some of the sub-processors listed above are based in the United States. Transfers are safeguarded by Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework.

6. Your rights (GDPR Art. 15-22)

Access - request a copy of all data we hold on you.
Rectification - fix inaccurate data.
Erasure - delete your account and all associated data.
Portability - receive your data in a machine-readable format.
Objection - object to processing based on legitimate interest.
Complaint - lodge a complaint with the Cyprus Data Protection Commissioner (dataprotection.gov.cy) or your local supervisory authority.

To exercise any of these, email privacy@lazytype.io. We respond within 30 days.

7. Retention

Server logs: 7 days.
License + customer records: duration of contract + 10 years (Cyprus tax law).
Trial fingerprints: 90 days after expiry, then deleted.
Email correspondence: 3 years.

8. Security

Data in transit is TLS-encrypted. Data at rest in Cloudflare KV is encrypted. Payment data never touches our servers. License keys are signed with Ed25519 and verified offline by the desktop app.

9. Children

LazyType is not directed at children under 16. We do not knowingly collect data from minors.

10. Changes

We will email registered customers if we materially change this policy. The last-updated date is at the bottom of this page.

Last updated: