Circla Privacy Policy

This document explains what data we collect about you, why, who we share it with, how long we keep it and what you can do about it. It describes what our system actually does, not general good intentions.

§ 1. Data controller

1.1. The controller of your personal data is Mateusz Czerwiński, a sole trader registered in the Polish Central Register and Information on Business Activity (CEIDG), trading as "Mateusz Czerwiński", service address: ul. Twarda 18, 00-105 Warsaw, Poland, tax ID (NIP) 9571051219, statistical number (REGON) 362940234 (Circla, we).

1.2. Data protection contact: [email protected].

1.3. No Data Protection Officer has been appointed. The obligation to appoint one (Art. 37 GDPR) applies to public authorities and bodies, to controllers carrying out large-scale monitoring, and to those processing special categories of data on a large scale — Circla falls into none of these: recordings are processed on the instruction of, and in the interest of, the User who uploaded them, not as part of regular, systematic monitoring of outside individuals. For all personal data matters, write to the address in § 1.2. We review this assessment periodically as the business scales.

§ 2. The capacity in which we act

This distinction matters, because it determines who is responsible for the data.

2.1. We are the controller of data relating to:

• your Account and use of the Service,
• payments and billing,
• correspondence and complaints,
• security and abuse prevention,
• website and app analytics (with your consent).

2.2. We are a processor in relation to the personal data of third parties contained in recordings uploaded by business customers. There the customer is the controller and we process the data on their behalf, on the terms of the Data Processing Agreement (/dpa) and Art. 28 GDPR.

2.3. Consumers' recordings containing third-party data — this situation needs separate assessment. A Consumer recording a conversation with another person, or recording a screen showing someone else's data, may be acting within the household exemption (Art. 2(2)(c) GDPR), but may not be — particularly where the material is published on social media.

Our position: regardless of whether your own act of recording a given conversation or screen falls within the household exemption, our processing of that data — storage, transcription, AI analysis — happens in order to provide you the Service, on your instruction and solely for that purpose, exactly as with your own data described in § 2.1. We do not enter into a separate Data Processing Agreement (/dpa) with Consumers — that document is reserved for business customers (§ 2.2), since that formality would be atypical and disproportionate for a relationship with a Consumer. Responsibility for the lawfulness of processing any third-party data you yourself record and upload rests with you, per the representations in Terms § 10.5.1.

§ 3. Purposes, data, legal bases and retention

3.1. Our legitimate interest (Art. 6(1)(f) GDPR)

Where we rely on this basis, the interest is:

a) abuse prevention — limiting each phone number to one live Account (where verification is required), blocking attacks on sign-in, and protecting the infrastructure from overload. Without this we could not sustain a free plan;

b) security of the Service and of all Users' data;

c) accountability — being able to demonstrate that we processed data lawfully, in particular that we carried out your deletion request;

d) establishing and pursuing claims, and defending against them.

In each case we balance that interest against your rights and keep the scope and retention to the necessary minimum. You have the right to object — see § 7.6.

§ 4. Where we get your data

4.1. From you — at registration, in Account settings, when uploading recordings, in correspondence.

4.2. Automatically from your device and browser — the IP address and the User-Agent header your browser sends with every request. We do not read your device's characteristics (we use no browser fingerprinting).

4.3. From the payment processor — Stripe passes us payment and subscription status and a customer identifier. We do not receive card numbers.

4.4. We do not buy data and do not obtain it from external marketing databases.

§ 5. Who we share data with

Below is the full list of entities that process data on our behalf or receive it as separate controllers. The list comes from a code audit, not from a template.

5.1. We do not pass User Content to any entity for any purpose other than providing the Service. In particular we do not sell data and do not share it for advertising purposes.

5.2. Stripe acts partly as a separate controller — it processes data in its own right to prevent payment fraud, meet regulatory obligations and develop its services. In that respect its own privacy policy applies: https://stripe.com/privacy.

5.3. Google acts as a separate controller to the extent it processes data for its own purposes: https://policies.google.com/privacy.

5.4. We may disclose data to public authorities where required by law — for example at the request of a court, a prosecutor or a tax authority. We check the legal basis for every such request.

5.5. We also publish the current list of processors in the Data Processing Agreement (/dpa) and update it whenever a provider changes.

§ 6. Transfers outside the European Economic Area

6.1. Important: the Service's infrastructure is located in the United States. Our servers, database and file storage run in the AWS us-east-1 region (Virginia). This means your recordings, transcripts and Account data are stored and processed in the USA.

6.2. Data also goes outside the EEA to the providers listed in § 5.

6.3. Transfers to a third country require a basis under Chapter V GDPR. For each provider the basis is:

How we verified this. We checked certification status in September 2026 against each provider's own GDPR-compliance pages and the dataprivacyframework.gov registry. Data Privacy Framework certification requires annual renewal by the provider, so for every provider above that is currently certified, its own data processing agreement additionally provides for Standard Contractual Clauses as a safeguard should the certification lapse. We will repeat this check at the next material update of this document.

6.4. You can obtain a copy of the safeguards we apply by writing to the address in § 1.2.

§ 7. Your rights

You have the following rights. We honour them free of charge, without undue delay and no later than within one month of receiving your request (we may extend this by a further two months for complex matters, telling you if we do).

7.1. Right of access (Art. 15 GDPR) — you can find out what data we process and receive a copy. You can do part of this yourself, immediately: Account Settings → Privacy → "Download my data".

7.2. Right to rectification (Art. 16 GDPR) — Account data can be corrected in Settings; for anything else, write to us.

7.3. Right to erasure (Art. 17 GDPR) — Account Settings → Danger zone → delete Account. § 8 describes the effects. This right does not extend to data we must keep by law (e.g. invoices).

7.4. Right to restriction of processing (Art. 18 GDPR).

7.5. Right to data portability (Art. 20 GDPR) — a JSON export is available in Account Settings. Download video files from the Library.

7.6. Right to object (Art. 21 GDPR) — you can object to processing based on our legitimate interest (§ 3.1). We will consider the objection individually; if we have no overriding grounds, we will stop the processing.

7.7. Right to withdraw consent (Art. 7(3) GDPR) — at any time, as easily as you gave it. Change cookie consent using the "Cookie settings" link in the footer. Withdraw marketing consent using the link in any message. Withdrawal does not affect the lawfulness of processing before it.

7.8. Right to lodge a complaint — you may complain to the supervisory authority:

President of the Personal Data Protection Office (UODO) ul. Stawki 2, 00-193 Warsaw, Poland https://uodo.gov.pl

If you live in another EEA country, you may complain to the authority in your country of habitual residence.

§ 8. What exactly happens when you delete your Account

We describe this in detail, because "we delete your data" without explanation is usually untrue.

8.1. Immediately: the Account is disabled, all sessions are invalidated and your recordings are marked for deletion. The 30-day recovery window begins.

8.2. After 30 days we permanently delete:

• recording, clip, transcript and auxiliary files from storage,
• the Account row, including e-mail, password hash and phone-number hash,
• session tokens,
• subscription data and usage counters,
• your customer record in Stripe,
• semantic vectors of transcripts,
• identifying data in the audit log (records are anonymised).

8.3. What remains — and why:

8.4. Data held by third-party providers — an honest caveat. Deleting your Account removes data from our systems and your Stripe customer record. It does not automatically remove:

• session recordings and error reports in Sentry,
• events, session recordings and error reports in PostHog,
• message delivery logs in Resend,
• verification records in Twilio,
• language-model call traces in LangSmith.

Deleting this data at these providers is not yet automated. Until it is, we carry it out manually on request — a request to the address in § 1.2 triggers that procedure.

8.5. If you want your data deleted at the providers in § 8.4 as well, write to us — we will do it as part of honouring your Art. 17 GDPR right.

§ 9. Is providing data mandatory

9.1. E-mail address and password — a contractual requirement. Without them we cannot operate an Account or provide the Service.

9.2. Your name — optional. Leaving it out has no consequences.

9.3. Phone number — required only where we ask for verification on suspicion of abuse. Refusing may limit access to some features.

9.4. Invoicing details — a statutory requirement when buying a paid plan.

9.5. Consent to analytics and diagnostics cookies, and to marketing — entirely voluntary. Refusing does not restrict access to the Service in any way. We do not use cookie walls.

§ 10. Automated decision-making and profiling

10.1. Virality Score. The Service automatically analyses your recording's transcript and assigns a numeric rating to proposed segments. This is an analysis of content you give us for processing — it is not a decision producing legal effects concerning you or similarly significantly affecting you. Art. 22 GDPR therefore does not apply. The result has no bearing on your access to the Service, your price or your contract terms.

10.2. Abuse prevention. We do not profile you or your device to detect abuse. We use simple technical measures: request rate limiting, e-mail verification, and — where abuse is suspected — phone verification (one live phone number corresponds to one Account). We do not read your device's characteristics and do not build an identifier for it.

If any of these measures restricts your access, you have the right to request human intervention and an explanation by writing to the address in § 1.2, and to contest the decision — we will review it individually.

10.3. Content moderation is not automated. We do not scan User Content for legality. Decisions to remove content are made by a human, following a report (see Terms § 12).

10.4. We do not profile you for marketing purposes and do not build advertising profiles.

§ 11. Face and speaker recognition — an explanation

This section exists because the question is natural and the answer is not obvious.

11.1. The smart reframing feature detects the position of a face in the frame so that a vertical clip does not cut off the speaker's head. The output is only rectangle coordinates (time, position, width, height).

11.2. We do not create biometric templates, do not recognise identity and do not compare faces against any database. That data cannot be used to identify anyone. In our assessment this is therefore not processing of biometric data within the meaning of Art. 4(14) GDPR, which requires processing that allows the unique identification of a natural person. Art. 9 GDPR does not apply.

11.3. Detection runs locally on our servers — this data is not passed to any third party, and the result is deleted together with the recording.

11.4. We do not perform speaker diarisation — we do not separate speech by individual and do not build voice profiles.

Our internal technical documentation previously treated this feature more cautiously, describing it as "biometric-adjacent" — but the code audit behind § 11.2 does not support the view that any identifier of a person is created, so we maintain the assessment in § 11.2 as our position.

§ 12. Security

12.1. We use, in particular:

• encryption in transit (HTTPS/TLS) for all traffic,
• encryption at rest in the database and cache,
• a full block on public access to file storage — files are reachable only through signed links, valid for 1 hour by default,
• passwords stored as bcrypt hashes, never in clear text,
• session tokens in httpOnly, Secure, SameSite cookies,
• CSRF protection,
• a web application firewall and request rate limiting,
• logging of security events and administrative access.

12.2. Only authorised people can access User data, and only to the extent needed for their duties. Every use of the Account-impersonation feature by an administrator is logged.

12.3. No safeguard is absolute. In the event of a personal data breach likely to result in a high risk to your rights, we will inform you without undue delay and notify the President of UODO within 72 hours (Art. 33 and 34 GDPR).

§ 13. Minimum age

13.1. The Service is intended only for people aged 18 or over. We do not market to anyone younger and do not knowingly collect their data.

13.2. If we learn that an Account belongs to someone below that age, we will delete it along with the data.

13.3. If you are a parent or guardian and believe your child has created an Account, write to the address in § 1.2.

§ 14. Changes to this Policy

14.1. We may amend this Policy, in particular where the scope of processing, the list of providers or the law changes.

14.2. We will notify you of material changes at least 14 days before they take effect — by e-mail and by a notice in the Service. Editorial changes are communicated by updating the version number and date.

14.3. If a change concerns processing based on your consent, we will ask for consent again.

14.4. We provide archived versions on request.

§ 15. Related documents

• Terms of Service — /terms
• Cookie Policy — /cookies
• Data Processing Agreement, for business customers — /dpa

This Policy exists in a Polish and an English version. In the event of any discrepancy, the Polish version prevails.