Privacy Policy

Jansen Cadorna Viray, operating as Abstruck ("Abstruck", "we", "us", or "our"), operates abstruck.space and the Abstruck application, a knowledge workspace for turning recordings into transcripts and useful study materials.

We collect the following information when the relevant feature is used:

• Account and profile information: your email address, Auth0 user identifier, display name, and an optional profile image.
• Waitlist information: your normalized email address, signup time, confirmation-delivery state, and Resend contact-sync state.
• User content: uploaded audio or video, transcripts, speaker and timestamp data, summaries, notes, flashcards, chat messages, and citations. Export files are generated when you request them and downloaded by your browser; Abstruck does not currently store them as separate files.
• Usage and generation records: processing status, errors, model and prompt versions, generation timestamps, and token-usage metadata used to operate and control the cost of AI features.
• Technical and security information: hosting, authentication, and infrastructure providers may process IP address, browser or device details, request times, and security logs as part of delivering and protecting the service.

We use information for specific purposes, including to:

• create and secure user accounts and profiles;
• accept, store temporarily, and process recordings;
• produce transcripts, summaries, notes, flashcards, and cited chat responses;
• save and display a user's personal recording library;
• operate exports and other user-requested product features;
• diagnose failures, prevent abuse, and protect the service;
• respond to support or privacy requests; and
• manage the waitlist and send early-access or product announcements requested through the waitlist form. You may unsubscribe from those announcements.

We do not use personal information for an unrelated, unspecified business purpose.

Abstruck sends uploaded recording content to AssemblyAI to create asynchronous transcripts, including timestamps and speaker labels when available. Transcript-derived text and instructions may also be sent through AssemblyAI's LLM Gateway to generate summaries, cited answers, descriptions, or flashcards that you request.

For uploaded files, Abstruck creates a time-limited signed link to a private temporary storage object so AssemblyAI can retrieve the media. After a recording is submitted, the server-side processing flow can continue through provider callbacks and recovery checks even if you close the browser.

AI-generated and machine-generated results may be inaccurate. We do not currently claim that Abstruck's AssemblyAI account has a provider-specific retention period, zero-retention setting, or model-training opt-out. AssemblyAI's handling depends on its terms, the applicable contract, and account configuration.

Only upload content that you have the legal right and any required participant permission to process.

Abstruck uses service providers to perform necessary product functions:

• Auth0 for authentication and session management.
• Supabase for application data and private file storage.
• AssemblyAI for speech-to-text and transcript-based AI generation.
• Resend for waitlist confirmations, contact management, and future early-access announcements.
• Cloudinary for optional profile-image storage and delivery.
• Vercel for hosting the Next.js web application.
• Sentry for error monitoring. The current configuration is designed to omit request and user fields from reported error events.
• PostHog for limited beta product analytics as described in the Cookies and tracking section below.

We may also disclose information when required by law, to protect the service or its users, or as part of a business reorganization subject to appropriate notice and safeguards.

Based on current product practices, Abstruck does not sell personal information or share it for cross-context behavioral advertising.

For users in the Philippines, we process personal information in line with the principles of transparency, legitimate purpose, and proportionality under the Data Privacy Act of 2012 and its implementing rules. Depending on the activity, processing may be necessary to provide the service you request, based on your consent, required by law, or necessary for legitimate interests such as security and service reliability.

Where the GDPR applies, our legal bases may include performance of a contract for account and product features, consent for optional communications, legitimate interests in security and improvement, and compliance with legal obligations. You may withdraw consent for future waitlist announcements by using the unsubscribe option in an email.

We keep personal information only as long as reasonably necessary for the purpose for which it was collected, to provide the service, to maintain security and integrity, and to meet legitimate or legal obligations.

• Uploaded media is kept in private temporary storage while it is needed for processing. Abstruck attempts to remove it after a recording reaches a completed or terminal failed state, and a recovery process retries pending cleanup. We do not promise a specific deletion deadline.
• If an upload is rejected or finalization fails, Abstruck attempts to remove the temporary object. A configured recovery process is also intended to clear abandoned temporary uploads; failed cleanup can remain pending until that process succeeds.
• Recording records and related summaries, chats, notes, and flashcards remain until the user deletes the recording or the data is otherwise removed as part of service administration.
• Users can delete recordings from the library, and can delete notes, flashcards, and profile images in the product. Account-wide self-service deletion is not currently available; contact us for a data or account-deletion request.
• Deleting a recording removes its Abstruck record and related workspace data, and triggers temporary-media cleanup when an object remains. It does not currently send a deletion request for the corresponding AssemblyAI transcript artifact.
• Waitlist records remain while early-access communication is relevant, unless you unsubscribe or request deletion.

Abstruck uses reasonable technical and organizational safeguards appropriate to the current beta, including authenticated ownership checks, private storage, short-lived signed media URLs, server-side credentials, database access controls, and cleanup of temporary media. No internet service can guarantee absolute security.

You are responsible for protecting your account access and for telling us if you believe your account or content has been accessed without permission.

Depending on where you live and the law that applies, you may have the right to be informed about processing, access your information, correct inaccurate information, object to certain processing, request erasure or blocking, receive portable data, withdraw consent, and complain to a regulator. Philippine law may also provide rights to damages in appropriate cases. EEA users may additionally have rights to restriction of processing and data portability under the GDPR.

We may need to verify your identity before fulfilling a request. Some requests may be limited where information must be kept for security, legal, or other permitted reasons.

Philippine users may learn more or lodge a complaint with the National Privacy Commission. This reference does not imply endorsement of Abstruck.

Abstruck's cloud and AI providers may process information in countries other than your own. Privacy and data-protection laws can differ between countries. We require a review of provider contracts and applicable transfer arrangements before broader international launch and do not claim a specific transfer mechanism that has not been verified.

Abstruck uses strictly necessary cookies or similar storage for Auth0 authentication, session security, and essential interface state. When configured for the beta, Abstruck also uses PostHog for limited product analytics such as successful waitlist joins and core workflow outcomes.

We do not use PostHog for advertising, session replay, autocapture, transcript analysis, chat-message analysis, or recording-content tracking. It is configured to avoid full page URLs and form values, and the application is designed not to send uploaded media, raw transcripts, chat content, or email addresses in analytics events. A browser Do Not Track signal does not currently change this limited beta analytics behavior. Infrastructure providers may still process routine request and security information under their own policies.

Abstruck is a general learning and productivity tool and is not designed specifically for children under 13. You must be at least 13 to create an account. If you are under the age at which you can consent to data processing in your country, use Abstruck only with authorization from a parent or guardian where required by law. If we learn that we collected personal information from a child under 13, we will take reasonable steps to delete it.

We may update this policy as Abstruck changes. We will revise the “Last updated” date and provide additional notice when a change is material or when applicable law requires it. Your information will be handled under the policy in effect when the relevant processing occurs, subject to required notices and choices.

For privacy questions or requests, email contact@abstruck.space.