Privacy Policy
Who we are
Say2Go is a voice dictation product made by RoraLabs, United Kingdom. We are the data controller for all personal data collected through Say2Go.
If you have any questions about this policy or how we handle your data, contact us at [email protected].
RoraLabs is registered with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. [ICO registration pending — reference number to be added on completion.]
What data we collect
We collect the minimum data needed to run your licence. That means:
- Email address — provided by you when you activate your Say2Go licence. We use this to identify your account and send essential licence-related communications (e.g. renewal notices, expiry warnings).
- Device identifier — a one-way hash of your machine's hardware ID. This is non-reversible: we cannot identify you, your device make, or its location from it. We use it only to detect unusual activity such as a licence being activated on an abnormal number of devices.
- IP address — your IP address is temporarily processed by our servers for security rate-limiting purposes and is not stored.
- Trial word count — a running count of words you have dictated during your free trial, linked to your email address.
- Your name or physical address
- Payment card details — all payment processing is handled entirely by Paddle, our Merchant of Record. We never see or store card numbers.
- Voice recordings or audio of any kind
- Transcriptions of what you dictate
- Browsing behaviour or usage analytics
Why we collect it — and our legal basis
Your email address is collected solely to activate and manage your Say2Go licence. Without it, we cannot deliver the software licence you have purchased.
The device identifier serves the same purpose: protecting the integrity of your licence and preventing abuse. It is processed under the same contract performance basis.
How long we keep your data
- Active licence holders — your email and device identifier are retained for the duration of your subscription plus 7 years. The 7-year period is required under UK tax and financial record-keeping law.
- Deleted accounts — if you request deletion, your email address is anonymised immediately. We retain a deletion log containing only a timestamp and an anonymous internal ID (no personal data) for legal accountability purposes.
- Trial users who do not subscribe — your email address and trial word count are deleted after 90 days of inactivity (no login or dictation activity).
Who we share your data with
We only share your data with the sub-processors listed below, and only to the extent necessary to operate the service. We do not sell your data.
Paddle acts as the Merchant of Record for Say2Go purchases, handling payment processing, VAT collection, and associated compliance obligations. Paddle has its own privacy policy and operates as an independent data controller for payment data. We share only the email address needed to issue a licence.
Your licence data is stored on RoraLabs own UK-based server infrastructure. Supabase Inc. has no access to this data — we run the open-source database software ourselves on our own hardware. Your data never leaves RoraLabs controlled servers.
Cloudflare provides network routing and DDoS protection for saytogo.com. Data passes through Cloudflare in transit only — no personal data is stored on Cloudflare's infrastructure by us.
Resend delivers transactional emails from Say2Go (e.g. licence confirmations sent to [email protected]). Resend operates from the USA; transfers are covered by Standard Contractual Clauses (SCCs) in place with Resend. Only your email address is shared for the purpose of email delivery.
Your rights under UK GDPR
You have the following rights regarding your personal data:
How to exercise your rights
We will respond to all data rights requests within 30 days. We will not charge a fee for reasonable requests.
Cookies
The Say2Go website does not set any tracking or analytics cookies.
Paddle's payment checkout — which opens in a separate context when you purchase — may set session cookies that are strictly necessary to complete the payment. These are Paddle's cookies and are governed by Paddle's privacy policy.
Changes to this policy
If we materially change how we collect or use your personal data, we will update this page and revise the "last updated" date at the top. For significant changes, we will also notify active licence holders by email.
Continued use of Say2Go after a policy update constitutes acceptance of the revised policy.