Privacy Policy

Last updated: September 30, 2026

About this Privacy Policy

This Privacy Policy explains how DritaLabs e.U. (“DritaLabs,” “Ardi,” “we,” “us,” or “our”) processes personal data in connection with:

• the Ardi website at ardiapp.com; and
• the Ardi application at dash.ardiapp.com.

The website provides information about Ardi, including product and pricing information.

The application allows users to create an account, upload or otherwise provide supported audio and recordings, generate transcripts, manage their account, and access free or paid functionality.

We process personal data in accordance with the General Data Protection Regulation (“GDPR”) and applicable Austrian data protection law.

1. Data Controller

The data controller is:

DritaLabs e.U. Flachgasse 24/18 1150 Vienna Austria

Email: drilon.buzuku@dritalabs.com

Where a business customer uses Ardi to process personal data contained in recordings or other content on behalf of that customer, the business customer may be the controller and DritaLabs may act as a processor.

Where required by Article 28 GDPR, such processing may be governed by a Data Processing Agreement (“DPA”).

2. Visiting ardiapp.com

When you visit ardiapp.com, your browser sends technical information necessary to deliver the website.

This may include:

• your IP address;
• the requested URL;
• date and time of the request;
• browser and user-agent information;
• HTTP request headers;
• referring page information; and
• technical information necessary to deliver website resources.

We process this information to provide the website, maintain its security and reliability, diagnose technical problems, and prevent abuse.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in providing a secure, reliable, and functional website.

The information website does not itself provide account registration, file uploads, transcription, or payment processing. Those functions are provided through dash.ardiapp.com.

3. Infrastructure

Ardi uses third-party cloud and infrastructure providers to operate the Service.

Bunny.net

We use Bunny.net for hosting, content delivery, networking, storage, and related infrastructure.

Depending on the service and configuration involved, Bunny.net may process technical information such as:

• IP addresses or anonymized IP information;
• requested URLs;
• timestamps;
• country or network-location information;
• browser and user-agent information;
• HTTP request information; and
• content transmitted or stored using the infrastructure where applicable.

Bunny.net generally processes this information on our behalf as a data processor.

According to Bunny.net, traffic logs are stored within the European Union and IP anonymization for traffic logs is enabled by default. Where IP anonymization is disabled, Bunny.net states that traffic logs remain stored within the European Union.

We use this infrastructure to deliver Ardi, route network traffic, store and serve content where applicable, maintain performance, and protect the Service against security and technical threats.

OVHcloud

We use OVHcloud to provide cloud computing and infrastructure used to operate Ardi’s transcription systems.

Ardi deploys and operates its own transcription models on this infrastructure. OVHcloud provides the underlying computing and hosting infrastructure and does not provide the transcription model used by Ardi.

User Content may be temporarily processed on OVHcloud infrastructure where necessary to perform a transcription requested by the user.

Ardi uses OVHcloud infrastructure located within the European Economic Area for this processing.

Scaleway

We use Scaleway to provide cloud computing and infrastructure used to operate Ardi’s transcription systems.

Ardi deploys and operates its own transcription models on this infrastructure. Scaleway provides the underlying computing and hosting infrastructure and does not provide the transcription model used by Ardi.

User Content may be temporarily processed on Scaleway infrastructure where necessary to perform a transcription requested by the user.

Ardi uses Scaleway infrastructure located within the European Economic Area for this processing.

OVHcloud, Scaleway, and other infrastructure providers acting on our behalf process personal data subject to applicable data-protection requirements and contractual arrangements.

The legal basis for infrastructure processing is Article 6(1)(b) GDPR where processing is necessary to provide the Service requested by you and Article 6(1)(f) GDPR where processing is necessary for security, reliability, abuse prevention, and protection of our infrastructure.

4. Account Data

When you create or use an account at dash.ardiapp.com, we process information necessary to create, authenticate, secure, and administer your account.

Depending on your use of Ardi, this may include:

• your email address;
• account and user identifiers;
• authentication and session information;
• account settings;
• subscription or plan information; and
• technical information associated with your account activity.

We process this information to create and maintain your account, authenticate you, provide Ardi, protect your account, administer subscriptions, and communicate with you about the Service.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide Ardi or take steps at your request before entering into a contract.

For processing necessary to prevent abuse, investigate security incidents, or protect accounts and infrastructure, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure and reliable service.

Providing information required to create an account is necessary if you wish to use account-based functionality. Without that information, we cannot provide an Ardi account.

5. Recordings, Uploaded Content, and Transcripts

When you use Ardi for transcription, we process the content you provide to the Service (“User Content”).

This may include:

• audio and recordings;
• uploaded files;
• file and recording metadata;
• information contained in recordings;
• generated transcripts; and
• technical information necessary to process the content.

Recordings may contain personal data relating to you or other individuals, including voices, conversations, names, professional information, or other information contained in the recording.

We process User Content to:

• receive and process your uploads;
• perform automated transcription;
• generate transcripts;
• make your content and transcripts available through your account;
• store your content where required to provide the Service; and
• operate and maintain Ardi.

For individual users, the legal basis is generally Article 6(1)(b) GDPR where processing is necessary to provide the transcription service requested by you.

Where Ardi processes personal data contained in User Content on behalf of a business customer, DritaLabs may act as a processor rather than as the controller of that personal data.

6. How Transcription Works

Ardi performs automated transcription using transcription models deployed and operated by DritaLabs.

We do not send User Content to third-party AI companies for them to perform transcription through their AI models.

The computing infrastructure used to run Ardi’s transcription models is provided by OVHcloud and Scaleway. These companies provide infrastructure on which Ardi operates its transcription systems.

When you submit audio or another supported recording for transcription, the content may therefore be processed on OVHcloud or Scaleway infrastructure as necessary to generate the requested transcript.

Our transcription infrastructure used for this processing is located within the European Economic Area.

7. Your Responsibility for Recordings

You are responsible for ensuring that you are legally permitted to record, upload, store, transcribe, share, or otherwise process the content you provide to Ardi.

Where a recording contains personal data relating to another person, you are responsible for having any consent, legal basis, permission, or authorization required by applicable law.

Ardi’s technical ability to process a recording does not mean that you have legal permission to make or process that recording.

If DritaLabs processes personal data solely on behalf of a business customer, individuals whose personal data appears in that content may need to direct privacy requests concerning that processing to the relevant business customer as controller.

8. No AI Training on User Content

DritaLabs does not use your recordings, uploaded content, or transcripts to train AI or machine learning models.

We do not provide User Content to third parties for the purpose of training their AI or machine learning models.

User Content is processed only to the extent necessary to provide, operate, secure, maintain, and technically support the Service, subject to applicable law and contractual arrangements.

The fact that Ardi uses machine learning models to generate a transcript does not mean that your content is used to train those models.

9. Service Providers and Subprocessors

We use service providers where necessary to operate Ardi.

Depending on how you use the Service, these providers may provide:

• cloud computing and hosting;
• networking and content delivery;
• storage;
• authentication;
• email delivery;
• payment and subscription processing;
• security and abuse prevention; and
• other technical infrastructure necessary to operate Ardi.

Important providers currently used in connection with Ardi include:

Bunny.net

Purpose: Hosting, networking, content delivery, storage, and related infrastructure.

Depending on the services used, Bunny.net may process technical request information and content transmitted or stored using its infrastructure.

OVHcloud

Purpose: Cloud computing and infrastructure used by Ardi to operate transcription models and related technical systems.

OVHcloud provides infrastructure. Ardi operates the transcription models used to generate transcripts.

Scaleway

Purpose: Cloud computing and infrastructure used by Ardi to operate transcription models and related technical systems.

Scaleway provides infrastructure. Ardi operates the transcription models used to generate transcripts.

Polar

Purpose: Paid subscriptions, checkout, billing, payment processing, and related transaction administration.

When you purchase a paid subscription, relevant account, order, billing, tax, and transaction information may be processed by Polar.

Polar operates as a Merchant of Record for transactions processed through its platform. Payment information provided directly to Polar or its payment partners is processed according to their applicable privacy information and contractual role.

Other technical providers

Where additional providers process personal data for authentication, email delivery, storage, security, or other technical functions, they receive data only to the extent necessary to perform the relevant service.

Providers processing personal data on our behalf are required to process that data in accordance with applicable data-protection requirements and our contractual arrangements.

We may update our providers and subprocessors as our infrastructure evolves.

We do not sell your personal data or User Content.

10. Paid Subscriptions and Billing

If you purchase a paid Ardi subscription, information necessary to process and administer the transaction is processed.

This may include:

• your email address;
• subscription or plan information;
• billing information;
• transaction identifiers;
• payment status;
• applicable tax information; and
• other information required to administer the subscription.

Payments are processed through Polar and its applicable payment infrastructure.

DritaLabs does not need to receive or store complete payment-card credentials where those credentials are submitted directly to the payment provider.

We process subscription and transaction information to provide paid functionality, administer subscriptions, provide customer support, maintain business records, and comply with applicable accounting and tax requirements.

The legal basis is Article 6(1)(b) GDPR for processing necessary to perform the subscription arrangement and Article 6(1)(c) GDPR where processing is required to comply with a legal obligation.

11. Service Communications and Contact

If you contact us, we process your email address, message, and any other information you provide.

We use this information to respond to your enquiry and provide support.

For contract-related enquiries, the legal basis is Article 6(1)(b) GDPR.

For other correspondence, the legal basis may be Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries and maintaining appropriate business communications.

We may also send communications necessary to operate your Ardi account, including:

• account-related messages;
• authentication or security messages;
• subscription information;
• important service changes; and
• responses to support requests.

We do not use these operational communications as a basis for unrelated marketing without an appropriate legal basis.

12. Technical, Security, and Log Data

When you use Ardi, we may process technical information necessary to operate and secure the Service.

This may include:

• IP address or anonymized IP information;
• request timestamps;
• URLs or application endpoints accessed;
• browser and device information;
• authentication and session events;
• error information;
• security events; and
• other technical logs.

We process this information to maintain security, prevent fraud and abuse, investigate incidents, troubleshoot technical problems, and maintain the reliability of Ardi.

The legal basis is Article 6(1)(f) GDPR, based on our legitimate interests in protecting and maintaining the Service.

13. Cookies and Browser Storage

ardiapp.com

We use Umami Cloud analytics only after you select “Accept analytics” in the consent banner. Before acceptance, the website does not load the Umami script or send analytics to Umami. You can select “Reject analytics” and continue using the website.

Analytics helps us understand website usage, including pages visited, referring pages, browser language, and screen dimensions. See Umami’s privacy policy for information about the provider.

We store your acceptance or rejection in your browser’s local storage under ardi.analyticsConsent. This preference remains until you change it or clear the website’s stored data. If browser storage is unavailable, your choice applies only to the current page.

You can change your choice at any time using “Cookie settings” at the bottom of every page. You can reject cookie consent at any time. Rejecting analytics stops future analytics events; it does not undo data already sent.

dash.ardiapp.com

The Ardi application may use cookies, browser storage, or similar technologies that are technically necessary for functions such as:

• authentication;
• maintaining sessions;
• account security;
• remembering application state; and
• providing functionality requested by the user.

Under applicable Austrian telecommunications law, technologies that are strictly necessary to provide a service expressly requested by the user may be used without prior consent.

If we introduce analytics, advertising, tracking, or other non-essential technologies requiring consent, we will provide appropriate information and obtain consent before activating them.

Your browser may also cache website and application resources according to browser settings and server cache instructions.

14. Automated Transcription

Ardi uses automated processing to generate transcripts from audio and recordings submitted by users.

Automated transcription can produce inaccurate or incomplete results. Users should review generated transcripts before relying on them.

Automated transcription is performed to provide the functionality requested by the user.

DritaLabs does not use automated transcription by itself to make decisions about users that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR.

15. Data Retention and Account Deletion

We retain personal data only for as long as necessary for the purposes for which it is processed or as required by applicable law.

Account information is generally retained while your account remains active.

When you delete your Ardi account, User Content associated with the account will be deleted from our active systems within 30 days.

Residual copies may temporarily remain in backups or disaster-recovery systems and will be deleted or overwritten according to applicable backup-retention cycles.

Certain information may be retained for longer where reasonably necessary or legally required, including for:

• tax and accounting obligations;
• payment and transaction records;
• fraud prevention;
• security;
• dispute resolution;
• enforcement of agreements; or
• establishing, exercising, or defending legal claims.

Correspondence is retained for as long as reasonably necessary to handle the relevant enquiry and any applicable legal obligations or claims.

Cancelling a paid subscription does not by itself delete your Ardi account or User Content.

16. Data Location and International Transfers

Ardi operates the transcription models used to process User Content on OVHcloud and Scaleway infrastructure located within the European Economic Area.

Accordingly, Ardi does not rely on a third-party AI model provider located outside the EEA to perform transcription of User Content.

Other technical or commercial service providers used to operate Ardi may have operations or subprocessors in jurisdictions outside the EEA.

Where personal data is transferred outside the EEA and the GDPR requires safeguards for that transfer, we use an applicable lawful transfer mechanism.

Depending on the recipient and destination, this may include:

• an adequacy decision adopted by the European Commission;
• the European Commission’s Standard Contractual Clauses; or
• another transfer mechanism permitted by applicable data-protection law.

Bunny.net states that its traffic logs are stored within the European Union. Its network operates internationally, and the processing involved depends on the Bunny.net services and configuration used.

You may contact us for further information about safeguards applicable to transfers of your personal data.

17. Recipients of Personal Data

Depending on how you use Ardi, personal data may be disclosed to or processed using:

• Bunny.net for hosting, networking, content delivery, storage, and related infrastructure;
• OVHcloud for cloud computing infrastructure on which Ardi operates transcription systems;
• Scaleway for cloud computing infrastructure on which Ardi operates transcription systems;
• Polar for paid subscriptions, checkout, billing, payment processing, and related administration;
• authentication providers;
• email and communications providers;
• professional advisers where necessary;
• competent authorities where disclosure is required by law; and
• other service providers necessary to operate, maintain, or secure Ardi.

OVHcloud and Scaleway provide computing infrastructure used by Ardi. They are not third-party AI transcription services to which Ardi sends recordings for transcription by independently operated models.

We disclose personal data only where there is an appropriate purpose and legal basis for doing so.

We do not sell personal data or User Content.

18. Your Rights

Subject to the conditions and limitations provided by the GDPR, you may have the right to:

• request access to your personal data;
• request correction of inaccurate personal data;
• request erasure of your personal data;
• request restriction of processing;
• receive personal data in a portable format where the right to data portability applies;
• object to processing based on legitimate interests on grounds relating to your particular situation; and
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact:

drilon.buzuku@dritalabs.com

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) or another competent supervisory authority.

19. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to Ardi, our infrastructure, our service providers, our processing activities, or applicable legal requirements.

Where a change materially affects how we process personal data, we will take appropriate steps to inform affected users where required by law.

The date at the top of this Privacy Policy indicates when it was last updated.

20. Contact

If you have questions about this Privacy Policy or how DritaLabs processes personal data, contact:

DritaLabs e.U. Flachgasse 24/18 1150 Vienna Austria

Email: drilon.buzuku@dritalabs.com