Privacy policy
Updated on October 25, 2026
This policy explains how pegafala.com.br handles personal data. It follows Brazil’s General Data Protection Law (LGPD, Law 13,709/2018).
Summary
- No sign-up. The tool doesn’t ask for your name, email or phone number.
- Your audio is deleted as soon as the transcript is ready, whether it worked or not. Nothing is kept: not the audio, not the text, not the file name.
- Transcription runs on our own server. Groq, a US company, only steps in as overflow, when our server’s line is full or it’s down, and only if overflow is turned on. It receives the converted audio, never your IP.
- The transcript goes only to your device and stays in your browser for up to 15 minutes.
- Access logs (IP, date and time, port) are kept for 30 days, without file names or text.
- Ads are served by Google and use cookies. You can turn off personalization.
Who is responsible
The data controller is Isabele Morais, an individual based in Brazil who runs the site. For anything about personal data, email [email protected] with the subject “Privacy”.
As a small-scale processing agent (ANPD Resolution No. 2/2022), we have no appointed data protection officer. That email is the official channel with you and with Brazil’s data protection authority (ANPD).
The path of your audio
- You pick the file. Your browser checks the size and, when it can, the length, without sending anything.
- The file goes to our server over a secure connection (HTTPS). The site passes it straight to the transcription service, without writing it to disk.
- The transcription service writes the file to a temporary folder in memory (not on disk), checks that it really is audio and measures its length.
- The audio is converted to a light format, without the original file’s details such as name and date. The file you uploaded is deleted right after the conversion.
- The speech recognition AI (Whisper, running on our server) transcribes it. The temporary folder is deleted at the end, no matter what: success, error, timeout or if you leave. A safety sweep deletes any leftover older than 10 minutes every 2 minutes.
- The text stays in the server’s memory only until your screen fetches it, 10 minutes at most, and then goes to your device.
Audio and text never go into a cache, backup, message queue, analytics or log. Our logs only have the file format, a length range (like “1 to 5 min”), the size and how long the transcript took.
Overflow. When our server’s line is full or it’s down, and only if overflow is turned on, Groq (US) does the transcript. It receives only the converted audio, with no name and without your IP. Without overflow, a full line means the screen asks you to try again in 1 or 2 minutes, and the attempt doesn’t count.
Data we handle
| Data | When |
|---|---|
| IP, date and time, source port and page visited | Every visit (logs) |
| Technical browser and connection data | During the anti-bot check |
| The audio or video file you upload | Only during the transcript, then deleted |
| The transcript | Only until it reaches your screen (10 minutes at most in server memory) |
| Usage counters, tied to a code derived from your IP | When you transcribe, to apply the limits |
| A free-language-change mark, derived from your IP and the file’s content | When you transcribe, so the first language change of the same audio doesn’t count |
| Video link and public post data | Only in video link to text (Instagram and TikTok) |
| Device type and OS, the referring site (domain only) and a daily code derived from IP and browser | Each page view, to count visits without cookies |
| Analytics and ad cookies and identifiers | Every visit, until you decline in “Cookie preferences” |
| Name, email and message content | When you write to us |
The language-change mark mixes your IP and the file’s content in a way that can’t be reversed: it doesn’t keep the audio, the file name or the IP, and it’s gone within 2 days.
Why we use it and on what legal basis
| Purpose | Legal basis, in plain words |
|---|---|
| Transcribe the audio and make TXT, SRT and VTT | You asked for the service (LGPD, art. 7, V) |
| Stop bots, apply limits, investigate abuse and keep logs for 30 days | Legitimate interest: keep the site safe and defend ourselves in legal claims (art. 7, IX and VI) |
| Measure audience (Google Analytics) and show personalized ads | Legitimate interest: keep the site free, with the right to decline anytime in “Cookie preferences” (art. 7, IX). In the EEA, UK and Switzerland, only with your consent in Google’s message |
| Count visits without cookies | Legitimate interest: know whether the site is growing, with daily totals only (art. 7, IX) |
| Reply to messages and removal requests | Your request and the defense of rights (art. 7, V and VI) |
| Handle requests about your data | Legal obligation (art. 7, II) |
An audio file may contain other people’s data, such as their voice and what they said. Upload only audio that is yours or that you have the right to use, and don’t publish what someone said without permission.
How long we keep it
| Data | Time |
|---|---|
| Uploaded file | Deleted right after conversion, minutes at most |
| Converted audio | Deleted when the transcript is done |
| Transcript, on the server | Until your screen fetches it, 10 minutes at most |
| Transcript, in your browser | Up to 15 minutes, only on your device. Gone when you close the tab |
| Audio received through Android’s Share menu | Only on your device, until the page reads it, then deleted |
| Public video transcript, in video link to text | Up to 7 days, only with the video code, no IP |
| Usage counters and the language-change mark | Up to 2 days |
| Visit counts | Daily totals only, nothing that points to you |
| Access logs | 30 days, encrypted and access-restricted |
| Emails | Up to 12 months after the last reply |
Who we share it with
We don’t sell data. Only these providers receive any data, and only to run the site:
- Cloudflare (US): site delivery, DNS, anti-bot check (Turnstile) and rate limits. It sees your IP and technical browser data on every visit, and the file passes through its network, encrypted, on the way to our server.
- Groq (US): transcription overflow only, when turned on and our line is full or the server is down. Receives the converted audio, never your IP.
- Google (US): ads (AdSense) and analytics (Google Analytics). For ads, Google is an independent controller of the data it collects. See how Google uses data from partner sites.
- Hosting in Brazil: the servers for the site, the transcription and the logs.
- Instagram and TikTok: only in video link to text, they receive the video link to deliver the public audio.
Authorities only receive data with a court order or a request provided for by law.
International transfers
Cloudflare, Groq and Google are US companies and may process data there and elsewhere. The transfer is needed to deliver the service you asked for (LGPD, art. 33, IX) or depends on your consent for analytics and personalized ads (art. 33, VIII).
Cookies and ads
This site shows Google AdSense ads.
- Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this site or other sites.
- Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this and other sites on the internet.
- You can opt out of personalized advertising in Google Ads Settings.
- Other vendors and ad networks may also serve ads here and use cookies. To opt out of their personalized advertising, visit optout.aboutads.info or, in Europe, youronlinechoices.eu.
- Learn more at https://www.google.com/policies/technologies/ads/.
To change your choice, use “Cookie preferences” in the footer. Cookie list, durations and what stays in your browser: cookie policy.
Your rights
Under the LGPD (arts. 18 and 20), you can confirm whether we process your data, access and correct it, ask for anonymization, blocking or deletion of unnecessary data, ask for portability, withdraw consent, learn who we share data with and object to unlawful processing or ask for review of an automated decision, such as an anti-abuse block.
How to ask: email [email protected] with the subject “Privacy”. We reply within 15 days.
With no sign-up and no stored audio, almost nothing we handle points to you: at most, logs from the last 30 days and messages you sent. We can’t hand over or delete an audio or a transcript: they have already been deleted.
Outside Brazil
Visitors from the European Economic Area, the UK or Switzerland see Google’s consent message, which asks for your choice before turning on analytics and personalized ads. There, local data protection laws such as the GDPR and UK GDPR give similar rights, and you can complain to your local authority. In some US states, local laws give you similar rights too: write to [email protected].
Children
The site isn’t made for children. You must be at least 13 to use it. We don’t ask for age and don’t target ads at children or teenagers. If you’re under 18, tap “Cookie preferences” in the footer and then “Decline”.
Security
- HTTPS across the whole site, including the upload.
- Audio stays only in server memory, in a folder deleted at the end of each transcript.
- Encrypted logs, without file names or text, accessible only to whoever runs the site.
- No accounts, so no passwords to leak.
If an incident poses a relevant risk, we notify the ANPD (LGPD, art. 48) and post a notice on this page.
Changes and contact
When something changes, the update date changes. Important changes, like a new provider, also get a notice on the site. Questions about this policy: [email protected], with the subject “Privacy”.