Privacy Policy for Silestis

Version: 1.0 Effective date: 20 August 2026 Provider: Silestis Labs UG (haftungsbeschränkt), Munich, Germany

Welcome to Silestis. This Privacy Policy explains what personal data we process when you use Silestis, our website, our web application, our browser extension, our AI features, our export and sharing features, or our support.

Silestis is an AI-powered service for transcribing and further processing audio and video content. Depending on the plan and feature, this includes transcription, translation, summarisation, chapters, flashcards, tasks, semantic search, chat over transcripts, exports, and sharing features.

This Privacy Policy applies worldwide to natural persons who use Silestis, visit our website, communicate with us, or whose personal data is processed in connection with Silestis. If you use Silestis for business purposes or process the personal data of other individuals in the course of your own business activities, you may yourself bear data protection responsibility for that content. In such cases, additional data protection agreements may be required, in particular a data processing agreement (Auftragsverarbeitungsvertrag) or a Data Processing Addendum. Where we enter into such an agreement with you, it takes precedence over this Privacy Policy for the processing governed by that agreement.

  1. Who is the controller and how can you reach us?

The controller responsible for the processing of personal data is:

Silestis Labs UG (haftungsbeschränkt) Dachauer Straße 264 80992 Munich Germany Email: hello@silestis.com Phone: +49 176 6313 1365 Commercial register: Amtsgericht München, HRB 309539

In this Privacy Policy we refer to ourselves as “Silestis Labs”, “we” or “us”.

Based on our current assessment, we have not appointed a Data Protection Officer, as we are not currently required to do so under Art. 37 GDPR and § 38 BDSG. If this assessment changes, we will update this Privacy Policy. You may submit data protection requests at any time to hello@silestis.com.

  1. What data do we process?

2.1 Data you provide directly to us

This includes in particular:

  • Account data, such as email address, password hash, language settings, display name or profile picture, to the extent you provide such information;
  • Contract and plan data, such as selected plan, credits, subscription status, booked add-ons, and contract confirmations;
  • Payment and billing data, to the extent we receive this from our payment service provider, such as Stripe customer ID, subscription ID, invoice reference, billing address, or payment status;
  • Content that you upload, enter, or have retrieved, such as audio, video, text, prompts, URLs, documents, file names, metadata, transcripts, and chat messages;
  • Feedback, support, and communication data, such as emails, error reports, ratings, support requests, or data protection requests.

2.2 Data generated through use

This includes in particular:

  • Output generated by Silestis on your behalf, such as transcripts, translations, summaries, chapters, flashcards, tasks, search results, chat responses, and exports;
  • Usage data, such as which features, models, exports, or sharing options you use, which credits are consumed, and which plan limits are reached;
  • Technical data, such as IP address, device and browser information, timestamps, log data, error data, security events, session and authentication data;
  • Data from sharing features, such as folder names, roles, invited email addresses, share links, access information, and expiry dates;
  • Embeddings and search indexes, when you use semantic search or similar features. This data is generated from your transcripts. We treat it as personal data to the extent that the underlying text is personal in nature or an individual remains identifiable by reasonable means.

2.3 Data from third-party sources

If you use content via a URL, a third-party platform, or the browser extension, we may process the URL you have provided, content retrieved from it, technical retrieval data, and associated metadata. You are responsible for ensuring that you are lawfully entitled to use such content.

If you use our browser extension, additional technical data may be processed depending on the feature used, such as the URL currently selected by you, page title, media URL, file name, platform metadata, technical retrieval data, extension version, browser information, and error messages. The browser extension is not designed to continuously monitor your general browsing history. Page content is only processed where this is necessary for a feature triggered by you, for example by starting a transcription or an import.

Where a media source is only available within your existing browser session, the extension may locally pass session information scoped to that exact media domain to the native Silestis app on the same device. It is not sent to Sentry as diagnostic information and is not transmitted to our cloud services. This local handoff is used solely for the media retrieval you initiated.

Silestis is not designed to circumvent technical protection measures, access restrictions, paywalls, or DRM systems. We do not ask you for passwords or login credentials for third-party platforms.

If you log in via third-party providers or connect third-party services, we may process the data required for that connection. Where such a feature is offered, we will inform you within the service about the key data flows.

If users upload, link, or share content that contains personal data of other individuals, such data typically originates from the user themselves, from the source they have specified, or from the content provided. The categories of data affected may include in particular names, voices, statements, communication content, metadata, and other information contained in audio, video, text, documents, URLs, transcripts, or AI-generated results.

  1. Why do we process your data and on what legal basis?

We only process personal data where there is a legal basis for doing so. Where the GDPR applies, the main legal bases are the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR), and consent (Art. 6(1)(a) GDPR). The main purposes are:

Provision of Silestis. We process account, contract, content, output, usage, and technical data in order to provide Silestis, generate transcripts, execute AI features, store content, enable exports, manage credits, and make sharing features available. The legal basis is the performance of a contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR).

Payment and subscription management. We process contract, plan, payment, and billing data in order to manage paid plans, add-ons, invoices, payment status, cancellations, and refunds. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). For legally required retention, in particular obligations under tax and commercial law, the legal basis is our legal obligation (Art. 6(1)(c) GDPR).

Support, communication, and service messages. We process contact, account, support, contract, and content data to the extent necessary to respond to your requests, investigate errors, send security or contract notices, or handle data protection rights. The legal bases are the performance of a contract, legal obligation, and our legitimate interest in providing good support and secure operations (Art. 6(1)(b), (c), and (f) GDPR).

Error diagnostics. Only when a technical error occurs, we may process minimised diagnostic data: pseudonymous user and transcript IDs, provider origin without URL path or query parameters, the affected Silestis route, file type and size, media duration, selected model, processing stage, error code, and app, extension, browser, operating system, and device versions. Cookies, credentials, authorisation headers, complete media URLs, and transcript content are removed from diagnostics. In the web app, optional Sentry diagnostics are enabled only after your consent. In browser extensions and backend services, strictly technical error diagnostics are based on our legitimate interest in security and reliability (Art. 6(1)(f) GDPR); you may object on grounds relating to your particular situation.

Security, abuse prevention, and moderation. We process account, technical, usage, content, and sharing data to the extent necessary to protect Silestis, prevent misuse, handle unlawful content, enforce our Acceptable Use Policy, detect fraud, spam, attacks, circumvention of plan limits or security incidents, and fulfil legal obligations. The legal bases are the performance of a contract, legal obligation, and our legitimate interest in operating a secure service (Art. 6(1)(b), (c), and (f) GDPR).

Reports and legal proceedings. If you or third parties report content, share links, accounts, or uses — for example through a reporting channel under the Digital Services Act — we process the reporting data required for that purpose. This may include contact details, share links, content IDs, reasons, evidence, communication content, processing status, and our decision. The legal bases are legal obligations and our legitimate interest in handling unlawful or abusive content (Art. 6(1)(c) and (f) GDPR).

Product improvement without model training. We may use feedback, usage data, and statistics to improve Silestis, identify errors, develop features, and understand the performance of the service. To the extent that statistics are anonymised, we only use them in a form in which we cannot re-identify individual persons by reasonable means. To the extent that data is not anonymised, we process it only on the legal bases set out in this Privacy Policy. Where personal data is involved, the legal basis is our legitimate interest in a secure, reliable, and improved service (Art. 6(1)(f) GDPR). We do not use your input or output to train our own or third-party AI models, unless you have given your express consent or a legal obligation permits or requires a particular type of processing.

Marketing. We send you marketing communications only if you have given your consent or a statutory exemption applies (Art. 6(1)(a) or (f) GDPR, as applicable). You may withdraw your consent at any time. Contract, security, billing, and service messages are not marketing messages.

Legal enforcement and dispute resolution. We process the data necessary for this purpose to assess, assert, defend against, or resolve claims or disputes. The legal basis is our legitimate interest in legal enforcement and defence, as well as, where applicable, a legal obligation (Art. 6(1)(f) and (c) GDPR).

Legitimate interests. Where we rely on legitimate interests, we assess whether our interests in security, abuse prevention, product stability, support, legal enforcement, or product improvement outweigh the interests, fundamental rights, and fundamental freedoms of the individuals affected. In doing so, we take into account in particular the nature and sensitivity of the data, the reasonable expectations of the individuals concerned, potential risks, and protective measures such as data minimisation, access restrictions, short retention periods, encryption, and the right to object.

Automated decisions. We do not make solely automated decisions that produce legal effects or similarly significant effects on you.

Requirement to provide data. Certain data is required for us to provide Silestis. This includes in particular account, contract, payment, security, and content data, to the extent required for the features you have selected. Without this data, you may not be able to create an account, use paid plans, or use certain features. Optional information, voluntary content, feedback, and marketing consents are not legally required and may be provided voluntarily. Legally required data, in particular tax- and invoice-related information, must be processed and retained by us to the extent that applicable law obliges us to do so.

  1. Special categories of personal data

Silestis is not designed to deliberately collect special categories of personal data. However, your audio, video, or text content may voluntarily contain such data, for example health data, religious beliefs, political opinions, biometrically relevant information, or information about sexual orientation.

When you upload a file, submit a URL, or start a feature in Silestis, you are instructing us to process the relevant content only to the extent required for the feature you have selected. This does not constitute consent to any use beyond that, and it does not replace the rights, consents, or other legal bases that may be required for the content.

If content contains special categories of personal data and the GDPR applies, we process such data only where an exemption under Art. 9(2) GDPR additionally applies. Where special categories of personal data that you knowingly provide about yourself are concerned, this may in particular be your explicit consent to the processing you have requested. Where special categories of personal data of other individuals are affected, you must ensure that a sufficient legal basis also exists for those individuals, such as their explicit consent or another legally recognised exemption. During the upload, import, or URL flow, we briefly draw your attention to the fact that you may only have content processed if you are authorised to do so.

We do not identify individuals based on their voice, do not create voice profiles or voiceprints for identification or authentication purposes, and do not use Silestis to recognise individuals across multiple recordings. Speaker diarisation, where offered, is solely intended to technically distinguish speakers within a single recording.

  1. AI processing and model training

Silestis uses AI models and technical infrastructure provided by third-party service providers to transcribe audio and video, translate text, summarise content, generate chat responses, provide search features, and perform similar functions.

In doing so, input, output, technical metadata, and usage information may be transmitted to AI or infrastructure providers to the extent required for the respective feature. Providers are only permitted to process this data for the purpose of delivering the service we have commissioned.

We do not use your input or output to train our own or third-party AI models, unless you have given your express consent or a legal obligation permits or requires a particular type of processing. We generally select AI providers in a way that excludes the use of your content to train the providers’ models, or ensures that such training only occurs with your explicit consent.

AI output may be incorrect, incomplete, or misleading. This Privacy Policy governs data processing; information on responsibility for content can be found in our Terms and Conditions and our Acceptable Use Policy.

Where required by law, we may use notices, labels, metadata, or other technical or visible markings to make the use of AI systems or AI-generated content transparent. This applies in particular where transparency obligations under Art. 50 of Regulation (EU) 2024/1689 (the AI Act) apply to Silestis or to certain uses of Silestis.

  1. Cookies, local storage, and similar technologies

We use cookies, local storage, session storage, or similar technologies only to the extent necessary for the operation of Silestis, for example for login, security, language settings, session management, plan features, cart functionality, or technical preferences.

To the extent that we use non-essential cookies, tracking technologies, analytics tools, advertising technologies, or comparable means of accessing your end device in the future, we will obtain your prior consent where required by law — in Germany in particular pursuant to the TDDDG.

We do not sell personal data to advertising networks and do not currently engage in behavioural advertising tracking.

  1. To whom do we disclose data?

We only disclose personal data where this is necessary for the purposes described in this Privacy Policy or where a legal obligation requires it.

Recipients may include in particular:

  • Authorised team members and contracted individuals who require access to carry out their tasks for Silestis;
  • Cloudflare, Inc. (USA/EU) for hosting, networking, security features, CDN, Workers, Workers AI, and R2 object storage; R2 source media and our configured containers are stored or executed in EU-regional configurations;
  • Supabase, Inc. (USA/EU) for database, authentication, and backend services; the primary production database is configured in the EU region Dublin;
  • Google LLC (USA/EU) through Google Cloud for Gemini transcription and selected generative features as well as text embeddings; production model calls are configured through the Google Cloud enterprise path with an EU endpoint;
  • Mistral AI SAS (France) for Voxtral transcription and selected summarisation, chat, and text functions; Zero Data Retention is enabled for the stateless APIs used by our organisation;
  • Stripe Payments Europe, Ltd. (Ireland) and, where applicable, Stripe, Inc. (USA) for checkout, payment processing, invoices, subscription management, and fraud prevention; Stripe acts as an independent controller for parts of the payment processing;
  • Functional Software, Inc. d/b/a Sentry (USA/EU) for error analysis and security diagnostics; where configured, we use the EU region Frankfurt;
  • Brevo / Sendinblue SAS (France) for transactional emails, and login, account, billing, and service communications;
  • Better Stack, Inc. for availability monitoring of our public health endpoints; no audio, video, or transcript content is transmitted for this purpose;
  • Professional advisors, courts, authorities, regulatory bodies, or law enforcement agencies, to the extent this is necessary or required by law;
  • Individuals with whom you share content, such as invited users or persons with access to a share link.

To the extent that service providers process personal data on our behalf, we enter into data processing agreements in accordance with the requirements of the GDPR. We select service providers carefully and restrict access to what is necessary. To the extent that providers act as independent controllers, they process data in accordance with their own privacy notices.

We maintain a current list of our key sub-processors, including purpose, data categories, region, and transfer mechanism, on our website.

  1. International transfers

Our core infrastructure is oriented towards processing within the European Union or the European Economic Area. Based on our current configuration, key database, storage, email, error-analysis, and AI processing operations are located within the EU or EEA, in particular with Supabase in Dublin, Cloudflare R2 and container execution in EU configurations, Google Cloud through EU endpoints, Sentry in the EU region Frankfurt, Brevo in France, and Mistral AI in France.

The use of global providers or their intra-group support, security, and billing processes may nevertheless require access or a transfer to countries outside the EU or EEA, in particular the United States. This can affect Cloudflare, Google, Stripe, Sentry, Better Stack, or their corporate groups. An EU storage region alone does not automatically exclude such access.

Where a provider is covered by an adequacy decision, such as the EU-US Data Privacy Framework, we rely on that decision where its certification and the specific processing activity are covered. Where no adequacy decision applies, we use in particular the European Commission’s Standard Contractual Clauses and any required supplementary safeguards. The specific mechanism is documented in our subprocessor list.

Further details on the service providers used, processing regions, and transfer mechanisms are available in our sub-processor list or upon request. You may request information about the safeguards in place by contacting hello@silestis.com; we will provide copies of relevant agreements or extracts to the extent this is legally permissible and does not compromise trade secrets or third-party rights.

Government and authority requests. We assess government and court requests for their legality. We only disclose personal data where we are legally required to do so or where another permissible legal basis exists. Requests from authorities in third countries are only recognised within the scope of the GDPR to the extent permitted under Art. 48 GDPR, an international agreement, a mutual legal assistance procedure, or another permissible basis under Chapter V GDPR. To the extent permitted by law, we will inform affected users about such requests.

  1. How long do we store data?

We retain personal data only for as long as is necessary for the respective purposes, unless a longer statutory retention obligation applies.

The main retention periods are:

  • Account and profile data: until you delete your account or for as long as required for contractual, security, billing, or legal purposes;
  • Transcripts, translations, summaries, chat histories, embeddings, folders, and sharing data: until you delete them or your account is deleted;
  • Original audio and video files: generally only until processing is complete, unless they are required for longer by a feature you are using, for error resolution, export, playback, or legal obligations;
  • Playback or storage copies: until you delete them, delete the associated transcript, delete your account, or the contract ends, unless statutory obligations require otherwise;
  • Recycle bin: deleted content may be retained for up to 30 days for recovery purposes and then permanently deleted;
  • Technical security, abuse, and rate-limiting data: generally up to 12 months, unless a security incident, suspected abuse, legal dispute, or statutory obligation requires longer retention;
  • Error and support data: until the matter is resolved, and thereafter generally up to 3 years, to the extent required for traceability, security, warranty, enforcement of rights, or defence against claims;
  • Invoice and tax-relevant data: in accordance with the statutory retention periods applicable at the relevant time, in particular under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO);
  • Data protection requests and records of rights-related processing: for as long as necessary for handling, documenting, and defending our decisions.

Where we are required to retain data for longer due to statutory retention obligations or for the purposes of legal enforcement, we restrict further processing to those purposes. Technical backup copies may remain in backups for a limited period and will be deleted or overwritten in accordance with our standard backup cycles, unless statutory obligations, security reasons, or the enforcement of rights require longer retention.

  1. Your rights

To the extent that the GDPR or other applicable data protection law applies, you have in particular the following rights:

  • Access to information about whether and which personal data we process about you (Art. 15 GDPR);
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR);
  • Erasure of your data (Art. 17 GDPR);
  • Restriction of processing (Art. 18 GDPR);
  • Data portability (Art. 20 GDPR);
  • Objection to processing based on legitimate interests (Art. 21 GDPR);
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR);
  • To lodge a complaint with a data protection supervisory authority (Art. 77 GDPR);
  • Not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects on you (Art. 22 GDPR).

To the extent provided for under the law applicable to you, you may also give us instructions regarding how we should handle your personal data after your death.

You may exercise your rights by contacting hello@silestis.com. Where corresponding features are available within the service, you can export, delete, or modify stored transcripts, AI results, exports, sharing configurations, share links, and other content directly within your account. You may also request the deletion of your account through the account functions available within the service or by emailing hello@silestis.com. We generally respond to requests within one month, unless applicable law provides for a different timeframe. We may ask you to verify your identity where this is necessary to protect your data.

The data protection supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany Website: https://www.lda.bayern.de

You may also contact another competent data protection supervisory authority, in particular in the EU or EEA member state in which you are habitually resident.

  1. Security

We use appropriate technical and organisational measures to protect personal data. Depending on the nature of the data and the processing involved, these include transport encryption, access restrictions, permission frameworks, logging of security-relevant events, data segregation, backup copies, and careful selection of service providers.

No system is completely secure. If you believe that your account, a share link, or Silestis as a whole is being misused, please contact us at hello@silestis.com.

  1. Minors

Silestis is not directed at minors, and we do not knowingly create accounts for minors. Persons under the age of 16 may not use Silestis independently, create an account, or book a paid plan. The age of consent for data protection purposes may vary by country; this does not affect our position that we do not offer Silestis to minors as a standalone service.

If we learn that an account has been created contrary to these requirements, we may delete or suspend the account. If you believe that a minor has submitted personal data to us, please contact us at hello@silestis.com.

  1. Data of other individuals

If you use audio, video, text, URLs, documents, or other content containing personal data of other individuals in Silestis, you are responsible for ensuring that you are entitled to do so. This applies in particular to recordings of conversations, meetings, interviews, lectures, phone calls, voices of identifiable individuals, confidential content, and special categories of personal data.

Additional rules under criminal law, personality rights law, data protection law, and the law on the secrecy of communications may apply to audio and video recordings. In Germany, § 201 of the Criminal Code (StGB) may in particular prohibit the unauthorised recording, use, or disclosure of the non-publicly spoken word. Comparable rules may apply in other countries. Only use Silestis for such content if you have the required rights, consents, or other legal bases.

We are generally unable to determine whether all individuals concerned have been informed or have given their consent. You must therefore ensure for yourself that any required consents, notices, or other legal bases are in place.

  1. Additional information for users in the United States

If you reside in the United States, additional data protection rights may apply depending on your state. These notices apply in particular to users in US states whose data protection laws are applicable to us and, where applicable, also serve as a “Notice at Collection”. Such rights may include in particular the right to know, access, correct, delete, and port your data, to opt out of certain types of processing, to appeal our decisions, and the right not to be discriminated against for exercising these rights.

We do not sell personal data. We do not “share” personal data for cross-context behavioural advertising and do not engage in targeted advertising within the meaning of common US state privacy laws, to the extent these terms are defined therein.

If you wish to exercise a US privacy right, please contact us at hello@silestis.com. Depending on applicable law, you may also use an authorised agent. We may require proof of identity or authorisation to the extent necessary to protect your data. If the law applicable to you provides for a complaint or appeal process against our decisions, you may also contact hello@silestis.com and mark your message “US Privacy Appeal”.

  1. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when Silestis, our service providers, our data processing practices, or legal requirements change.

The current version is always available on our website. We will notify you of material changes in an appropriate manner, for example by email or within the service. If a change requires new consent or grants you a new choice under applicable data protection law, we will obtain that consent or provide you with that choice before relying on the change for the relevant processing.

Deutsche Fassung