Privacy Policy

Last updated: July 10, 2026

1. Introduction

FONTAINE68 SARL ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal data when you use the Dikto application and website ("Service").

We comply with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and French data protection laws (Loi Informatique et Libertés).

2. Data Controller

The data controller for your personal data is:

• Company: FONTAINE68 SARL
• SIRET: 928 649 243 00013
• Address: 123 Rue Principale
• Email: contact@dikto.ai

3. Data We Collect

3.1 Account Data

When you create or use an account, we process:

• Email address
• Account identifier, referral code, subscription plan, and account status
• Authentication data appropriate to the sign-in method, such as a hashed password, one-time or magic-link tokens, OAuth identifiers, and session or refresh tokens

3.2 Usage Data

We keep service usage and device records to operate quotas, secure the Service, support users, and understand product performance. These records are associated with your account or app installation and are not represented as anonymous. They include:

• Dictation minutes, word counts, sessions, actions, translations, text-to-speech usage, and aggregate correction or accuracy statistics
• A randomly generated installation or device identifier, platform, operating-system version, app version, build, update channel, and last-seen time
• Language settings, dictionary terms, and optional context you save to personalize processing
• Operational and security metadata, including timestamps and network information when needed for authentication, abuse prevention, and rate limiting

3.3 Voice and Text Data

Important: Dikto sends raw audio to our Scaleway-hosted backend and to Mistral AI for transcription. Transcribed or selected text, prompts, saved context, dictionary terms, and optional reference audio may also be sent to Mistral AI for cleanup, translation, text actions, or speech synthesis.

We do not intentionally write raw recordings or full transcripts to Dikto's application database, and we do not use them to train our own models. Mistral AI processes the inputs and outputs as our provider; any provider-side retention or model-improvement use is governed by Mistral's applicable terms, plan, and privacy settings, including whether Zero Data Retention or a training opt-out is enabled. Saved dictionary terms and context remain in Dikto's database until you change them or your account data is deleted.

3.4 Payment Data

Payment information is collected and processed by our payment provider, Paddle.com, which acts as Merchant of Record. We do not receive your complete payment-card details. Paddle provides the account and subscription information needed to grant and manage access, including:

• Your email address
• Subscription status (active, cancelled, expired)
• Customer, subscription, transaction, and webhook identifiers
• Billing-period and cancellation information

4. How We Use Your Data

We process your data for the following purposes and legal bases:

• Service delivery (contract performance): To provide the dictation and AI formatting service
• Account management (contract performance): To manage your account and subscription
• Service improvement (legitimate interest): To analyze account-linked and aggregate usage metrics, diagnose reliability, and improve the Service
• Security (legitimate interest): To detect and prevent fraud, abuse, and unauthorized access
• Communication (contract performance / legitimate interest): To send important service updates, security alerts, and subscription notifications

We do not use your data for marketing purposes unless you explicitly opt in.

5. Data Sharing

We disclose data to the following providers only as needed to operate the Service:

• Mistral AI (France) — Raw-audio transcription and processing of text, prompts, context, dictionary terms, and optional reference audio for AI and speech features. Provider-side retention and training controls depend on the applicable Mistral plan and settings.
• Paddle.com (United Kingdom and related entities) — Payment processing, tax handling, and subscription management as Merchant of Record.
• Scaleway (France) — Backend, database, storage, and transactional-email delivery through Scaleway Transactional Email (TEM).
• Vercel (United States and global infrastructure) — Website hosting and content delivery; Vercel necessarily processes website requests and related technical metadata.
• Plausible Analytics — Cookie-free website audience measurement and event analytics.
• Google or Apple — Authentication information when you choose the corresponding sign-in option.

We do not sell, rent, or share your personal data with advertisers or data brokers.

6. Data Storage & Security

Dikto's primary application database and backend are hosted by Scaleway in France. Other providers process data in the locations described in this policy and their own documentation. We use proportionate technical and organizational safeguards, including:

• HTTPS/TLS for data in transit
• Access controls, authentication, and restricted administrative access
• Hashing of passwords and sensitive authentication tokens where applicable
• Provider-managed infrastructure and backups according to the configuration and lifecycle of each service

No storage or transmission method is completely secure. We review and adjust safeguards as the Service changes.

7. Data Retention

• Account, dictionary, usage, and device data: Kept while needed to provide the Service, enforce limits, maintain security, meet operational needs, and handle disputes. When account deletion completes, this data is removed from the live application database unless a limited record must be retained for a legal, accounting, fraud-prevention, or dispute-resolution obligation.
• Backups and logs: Deleted data may remain temporarily in restricted backups or security and operational logs until their normal rotation or expiry.
• Voice and transient text: Dikto does not intentionally persist raw recordings or full transcripts in its application database. Retention by Mistral or another processor is governed by that provider's terms and the settings enabled for Dikto's provider account.
• Payment records: Retained by Paddle and, where applicable, by us for the periods required for subscription administration, accounting, tax, fraud prevention, or legal claims.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restriction: Request restriction of processing
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, withdraw at any time

You can request account deletion through the deletion control provided in the application or contact us at contact@dikto.ai to exercise any of these rights. We normally respond within one month. Deletion requests remain subject to the limited backup, security, accounting, and legal-retention exceptions described above.

You also have the right to lodge a complaint with the French data protection authority: CNIL (www.cnil.fr).

9. Cookies

The Dikto website uses limited browser storage:

• Essential cookies: Used for authentication sessions, security, and referral attribution.
• Analytics: We use Plausible Analytics for cookie-free audience and event measurement without cross-site advertising profiles.

We do not use advertising cookies or cross-site advertising trackers.

10. International Transfers

Your data is primarily processed in France and elsewhere in the European Economic Area. Paddle processes data in the United Kingdom and related locations, Vercel uses United States and global infrastructure, and Mistral states that some features or subprocessors may involve temporary processing outside the European Union.

Where personal data is transferred internationally, we rely on an applicable adequacy decision, contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism used by the relevant provider.

11. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the application. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact

For any privacy-related questions or to exercise your rights:

• Email: contact@dikto.ai
• Address: FONTAINE68 SARL, 123 Rue Principale