Last updated October 21, 2026
This policy explains how your personal data is collected, used, stored and protected when you use Instableep — the website at instableep.com and the application at app.instableep.com (together, the “Service”). Instableep lets you upload audio or video, have it transcribed by AI, choose which words to bleep, and download the censored result. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).
The data controller for the Service is Renārs Dāvids Bitenieks, a self-employed individual (saimnieciskās darbības veicējs) registered with the State Revenue Service (VID) of the Republic of Latvia, operating Instableep. There is no company; the Service is run by an individual based in Riga, Latvia.
You can reach us about anything in this policy, or to exercise any of your rights, at instableep@gmail.com.
We collect only what we need to run the Service and your account:
utm_source and utm_medium) of the link that brought
you to the sign-in page, such as a page of our website and the name of a blog post, and nothing more precise than
that. If you accept advertising cookies in the cookie banner, your browser keeps the tags of the first such link in
its local storage until you sign in, as described in our Cookie Policy, and we record
those. If you have not accepted them, we record only the tags of the link that opened that same sign-in page,
carried to our server with your email sign-in link request or through the Google sign-in redirect, without
storing anything on your device. We support sign-in by one-time email link and Google sign-in
only; we do not store passwords.
We do not collect your GPS or precise-location data, and the Service is not designed to gather any special-category data deliberately. Note, however, that voice recordings you upload may incidentally reveal sensitive information depending on what is said in them; you control what you upload.
For each purpose, the GDPR legal basis we rely on is named below.
| Purpose | Legal basis |
|---|---|
| Creating and running your account; storing your media; transcribing it; bleeping and exporting your files; providing your library and presets | Performance of our contract with you (Art. 6(1)(b)) |
| Taking payment and managing your subscription | Performance of our contract with you (Art. 6(1)(b)) |
| Keeping accounting and tax records of the payments you make | Compliance with a legal obligation under Latvian accounting and tax law (Art. 6(1)(c)) |
| Sending account and transactional email (sign-in links, receipts, support replies, failed payment notices) | Performance of our contract with you (Art. 6(1)(b)) |
| Answering your support messages | Performance of our contract, and our legitimate interest in supporting users (Art. 6(1)(f)) |
| Keeping security and audit logs, preventing abuse, and keeping the Service reliable | Our legitimate interest in operating and securing the Service (Art. 6(1)(f)) |
| Understanding where the Service falls short, such as the step where users stop or the offer they turn down, so we can improve it; and occasionally emailing you a question about a problem you ran into | Our legitimate interest in improving the Service (Art. 6(1)(f)); you can object at any time (Section 10) |
| Delivering our website and showing its tutorial video when you interact with it (Netlify hosting, jsDelivr, YouTube) | Our legitimate interest in running and presenting our website (Art. 6(1)(f)) |
| Recording the source and medium tags of the link that brought you to the sign-in page, such as a page of our website, when you signed up (the first such link if you accept advertising cookies, otherwise the link that opened that same sign-in page; see Section 2) | Our legitimate interest in understanding which links bring users (Art. 6(1)(f)); keeping the tags in your browser before you sign in relies on your consent, given through the cookie banner (Art. 6(1)(a)) |
| Measuring the effectiveness of our advertising by sending hashed sign-up and purchase events to Google (see Section 5) | Your consent, given through the cookie banner (Art. 6(1)(a)) |
| Setting Google Ads cookies on our website | Your consent, given through the cookie banner (Art. 6(1)(a)) |
We do not sell your data. We use the following service providers (processors and, where they act for their own purposes, independent controllers) to run the Service. Each receives only the data it needs:
| Provider | What it does | What it receives |
|---|---|---|
| AssemblyAI | Speech-to-text transcription | The audio extracted from your uploaded media, processed to produce a transcript. Processed via AssemblyAI’s EU (Dublin, Ireland) endpoint. Your audio is contractually excluded from training their models. |
| Cloudflare, Inc. (Cloudflare R2) | Media file storage | Your uploaded audio and video files, the thumbnails generated from them, the bleeped output files, and any custom bleep sound you upload. Stored in Cloudflare R2 with the European Union jurisdiction restriction, so the data is stored only in EU data centres, under Cloudflare’s Data Processing Addendum. |
| Stripe | Payments and subscription billing | Your name, email, billing address and card details, which you enter directly with Stripe. We never receive or store your full card number. If you start a checkout after clicking one of our Google ads and have accepted advertising cookies, we also pass Stripe the ad click identifier (gclid) with the checkout. Stripe processes payments globally under its own privacy terms and applicable transfer safeguards. |
| Fly.io | Application hosting, database and bleeping | Your account record, transcripts, presets and subscription state, held in our PostgreSQL database, plus your media while it is processed to produce the bleeped output. Our production database and the servers that do the bleeping run in Fly.io’s Paris (France) region. |
| Netlify, Inc. | Website hosting and the website support form | Your IP address and browser details on every visit to instableep.com, as with any web host, plus the first name, last name, email address, subject and message you send through the support form on instableep.com, which Netlify Forms stores for us. Netlify operates from the United States and serves the website from a global network, under Standard Contractual Clauses; see the note on international transfers below. |
| Discord Inc. | Support requests | The message and email you send us through the support form are posted to our private support channel so we see them promptly. Discord Inc. operates from the United States under Standard Contractual Clauses; see the note on international transfers below. |
| Resend | Email delivery | Your email address, used to send transactional email only: sign-in links, replies to your support messages, and a notice when a credit pack payment fails. Email is sent from Resend’s Ireland region, but Resend (Plus Five Five, Inc.) stores email metadata and logs in the United States under Standard Contractual Clauses and the EU-US Data Privacy Framework; see the note on international transfers below. |
| Plausible Analytics | Privacy-friendly website analytics | Aggregated, anonymous usage statistics. Plausible is cookieless and does not track you across sites or build a profile of you. Plausible is operated within the EU. |
| Advertising measurement and ad cookies | A SHA-256 hash of your email address, the event (sign-up or purchase), its time and a reference; for a purchase also the amount excluding tax, the currency and, if you came from one of our Google ads, its click identifier (gclid). Sent server-side via Ads Data Manager only if you accept advertising cookies. Google Ads cookies likewise load only if you accept. Google LLC / Google Ireland, under applicable transfer safeguards. | |
| Google (YouTube) | Tutorial video on our home and landing pages | Nothing until you interact with the video: pointing at or focusing it opens connections to Google’s servers (YouTube, google.com and Google’s DoubleClick ad domains), which receive your IP address, and pressing play loads YouTube’s player, which receives your IP address and browser details and may store data on your device under Google’s privacy policy. Google LLC / Google Ireland, under applicable transfer safeguards. |
| jsDelivr | Delivers the script that shows the tutorial video | Your IP address and browser details, which any file download sends, when you open our home or a landing page. jsDelivr serves files from a global content delivery network, so the request may be answered outside the EEA. |
To measure how well our advertising performs, when you sign up and when you make a purchase we send a server-side
event to Google (via Ads Data Manager). The event contains the action that occurred (a sign-up or a purchase), its
time and a reference (your account number for a sign-up, the Stripe checkout or invoice ID for a purchase),
together with a SHA-256 hash of your email address. A purchase event also contains the amount of
the sale excluding tax and its currency and, if you started the checkout after clicking one of our Google ads, the
ad click identifier (gclid) that the Google Ads cookie _gcl_aw holds in your browser, which the app
passes to Stripe with the checkout so that it reaches us with the payment. A subscription renewal or upgrade
payment is sent as a purchase without a click identifier. The hash lets Google match the event to an ad click
without us sharing your email in readable form. These
server-side events are sent only if you accept advertising cookies; if you reject or later withdraw
that consent, no further events are sent. You can change your choice at any time from the cookie banner or the
cookie settings controls described in Section 7, and you can also object using the contact details in Section 1.
We do not send marketing email and do not keep a marketing list. The only email you receive from us is the transactional email you need to use the Service (sign-in links, receipts, support replies and failed payment notices).
Our analytics provider, Plausible, is cookieless and does not set any cookie or build a profile of you. Advertising
cookies (Google Ads) load only after you accept them in the cookie banner; until then they are
blocked. Your choice is remembered in a single cc_cookie consent cookie. The banner offers
“Accept all” and “Reject all” with equal prominence, plus a preferences screen where you can toggle the advertising
category on or off. You can reopen that screen at any time from the “Open cookie settings” button on our
Cookie Policy page (and, in the app, from the “Cookie settings” button in your account’s
Privacy settings) to change or withdraw your choice; that page also has the full detail on every cookie and other
browser storage we use.
We keep your data within the EU/EEA where we can. Specifically, your media files are stored in Cloudflare R2 under its European Union jurisdiction restriction, so they sit only in EU data centres, bleeping runs on our servers in Fly.io’s Paris region, transcription runs through AssemblyAI’s EU (Dublin) endpoint, and our database is hosted in Fly.io’s Paris region.
Some providers process data outside the EEA. Stripe, Google, Resend, Discord and Netlify operate from or transfer data to the United States, jsDelivr may answer from a server outside the EEA, and Cloudflare is a US company, although the European Union jurisdiction restriction on our storage means your media itself does not leave the EEA. These transfers rely on the European Commission’s Standard Contractual Clauses, which form part of each provider’s data processing terms, or another lawful safeguard under the GDPR.
Under the GDPR you have the right to:
To exercise these rights, email us at instableep@gmail.com and we will respond within the time the GDPR requires (normally one month). You can also delete your account, or edit your username, directly from your account settings at any time.
If you are unhappy with how we handle your data, you can lodge a complaint with the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija), at www.dvi.gov.lv. If you live in another EEA country, you may instead contact your local data protection authority. We would, of course, appreciate the chance to address your concern first.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you. Transcription is automated, but it only generates a transcript of your media — it makes no decision about you.
We take reasonable technical and organizational measures to protect your data: traffic is encrypted in transit, access to stored media is granted only through short-lived signed URLs, payment card details are handled entirely by Stripe, and access to our systems is limited. No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security, but we work to keep your data protected and to address any issue promptly.
The Service is not directed at children. It is intended for users aged 16 and over, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy from time to time. We revise it manually and update the “Last updated” date at the top whenever we do. If we make a significant change, we will take reasonable steps to let you know. Please check back occasionally to stay informed.
Questions about this policy or your data? Email instableep@gmail.com. We are based in Riga, Latvia.