Last updated June 14, 2026
This policy explains how your personal data is collected, used, stored and protected when you use Instableep — the website at instableep.com and the application at app.instableep.com (together, the “Service”). Instableep lets you upload audio or video, have it transcribed by AI, choose which words to bleep, and download the censored result. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).
The data controller for the Service is R. D. Bitenieks, a natural person based in Riga, Latvia, operating under the brand “Instableep”. There is no company; the Service is run by an individual.
You can reach us about anything in this policy, or to exercise any of your rights, at instableep@gmail.com.
We collect only what we need to run the Service and your account:
We do not collect your GPS or precise-location data, and the Service is not designed to gather any special-category data deliberately. Note, however, that voice recordings you upload may incidentally reveal sensitive information depending on what is said in them; you control what you upload.
For each purpose, the GDPR legal basis we rely on is named below.
| Purpose | Legal basis |
|---|---|
| Creating and running your account; storing your media; transcribing it; bleeping and exporting your files; providing your library and presets | Performance of our contract with you (Art. 6(1)(b)) |
| Taking payment and managing your subscription | Performance of our contract with you (Art. 6(1)(b)) |
| Sending account and transactional email (verification, password reset, receipts, support replies) | Performance of our contract with you (Art. 6(1)(b)) |
| Answering your support messages | Performance of our contract, and our legitimate interest in supporting users (Art. 6(1)(f)) |
| Keeping security and audit logs, preventing abuse, and keeping the Service reliable | Our legitimate interest in operating and securing the Service (Art. 6(1)(f)) |
| Measuring the effectiveness of our advertising by sending hashed sign-up and purchase events to Meta and Google (see Section 5) | Your consent, given through the cookie banner (Art. 6(1)(a)) |
| Sending marketing email about Instableep | Our legitimate interest in promoting our own Service to our users, subject to your right to unsubscribe at any time (Art. 6(1)(f)) |
| Setting Google Ads cookies on our website | Your consent, given through the cookie banner (Art. 6(1)(a)) |
We do not sell your data. We use the following service providers (processors and, where they act for their own purposes, independent controllers) to run the Service. Each receives only the data it needs:
| Provider | What it does | What it receives |
|---|---|---|
| AssemblyAI | Speech-to-text transcription | The audio extracted from your uploaded media, processed to produce a transcript. Processed via AssemblyAI’s EU (Dublin, Ireland) endpoint. Your audio is contractually excluded from training their models. |
| Amazon Web Services (AWS S3) | Media file storage | Your uploaded audio and video files, including any thumbnails generated from them. Stored in Amazon S3 in the EU (Paris, France — eu-west-3 region), under AWS’s GDPR Data Processing Addendum. |
| Stripe | Payments and subscription billing | Your name, email, billing address and card details, which you enter directly with Stripe. We never receive or store your full card number. Stripe processes payments globally under its own privacy terms and applicable transfer safeguards. |
| Fly.io | Application hosting and database | Your account record, transcripts, presets and subscription state, held in our PostgreSQL database. Our production database runs in Fly.io’s Paris (France) region. |
| Mailgun | Email delivery | Your email address and name, used to send account, billing and marketing email. Email is processed by Mailgun in the United States under Standard Contractual Clauses; see the note on international transfers below. |
| Plausible Analytics | Privacy-friendly website analytics | Aggregated, anonymous usage statistics. Plausible is cookieless and does not track you across sites or build a profile of you. Plausible is operated within the EU. |
| Meta (Facebook) | Advertising measurement | A SHA-256 hash of your email address plus the event name (sign-up or purchase), sent server-side via the Conversions API only if you accept advertising cookies. Meta Platforms, Inc., a US company, under applicable transfer safeguards. |
| Advertising measurement and ad cookies | A SHA-256 hash of your email address plus the event name (sign-up or purchase), sent server-side via Ads Data Manager only if you accept advertising cookies. Google Ads cookies likewise load only if you accept. Google LLC / Google Ireland, under applicable transfer safeguards. |
To measure how well our advertising performs, when you sign up and when you make a purchase we send a server-side event to Meta (via its Conversions API) and to Google (via Ads Data Manager). The event contains the action that occurred — a sign-up or a purchase — together with a SHA-256 hash of your email address. The hash lets these platforms match the event to an ad click without us sharing your email in readable form. These server-side events are sent only if you accept advertising cookies; if you reject or later withdraw that consent, no further events are sent. You can change your choice at any time from the cookie banner or the cookie settings controls described in Section 7, and you can also object using the contact details in Section 1.
When you create an account, we add your email address to our marketing list and send you a welcome email about an hour after sign-up. You may receive occasional further email about Instableep. You can unsubscribe at any time using the link in any marketing email; deleting your account also removes you from the list. Unsubscribing from marketing does not stop the transactional email you need to use the Service (such as receipts and password resets).
Our analytics provider, Plausible, is cookieless and does not set any cookie or build a profile of you. Advertising
cookies (Google Ads) load only after you accept them in the cookie banner; until then they are
blocked. Your choice is remembered in a single cc_cookie consent cookie. The banner offers
“Accept all” and “Reject all” with equal prominence, plus a preferences screen where you can toggle the advertising
category on or off. You can reopen that screen at any time from the “Open cookie settings” button on our
Cookie Policy page (and, in the app, from the “Cookie settings” button in your account’s
Privacy settings) to change or withdraw your choice; that page also has the full detail on every cookie we use.
We keep your data within the EU/EEA where we can. Specifically, your media files are stored in Amazon S3’s Paris (eu-west-3) region, transcription runs through AssemblyAI’s EU (Dublin) endpoint, and our database is hosted in Fly.io’s Paris region.
Some providers process data outside the EEA. Stripe, Meta, Google and Mailgun operate from or transfer data to the United States. These transfers rely on the European Commission’s Standard Contractual Clauses, which form part of each provider’s data processing terms, or another lawful safeguard under the GDPR.
Under the GDPR you have the right to:
To exercise these rights, email us at instableep@gmail.com and we will respond within the time the GDPR requires (normally one month). You can also delete your account, or edit your username, directly from your account settings at any time.
If you are unhappy with how we handle your data, you can lodge a complaint with the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija), at www.dvi.gov.lv. If you live in another EEA country, you may instead contact your local data protection authority. We would, of course, appreciate the chance to address your concern first.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you. Transcription is automated, but it only generates a transcript of your media — it makes no decision about you.
We take reasonable technical and organizational measures to protect your data: traffic is encrypted in transit, access to stored media is granted only through short-lived signed URLs, payment card details are handled entirely by Stripe, and access to our systems is limited. No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security, but we work to keep your data protected and to address any issue promptly.
The Service is not directed at children. It is intended for users aged 16 and over, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy from time to time. We revise it manually and update the “Last updated” date at the top whenever we do. If we make a significant change, we will take reasonable steps to let you know. Please check back occasionally to stay informed.
Questions about this policy or your data? Email instableep@gmail.com. We are based in Riga, Latvia.