Privacy Policy

Effective Date: April 13, 2026

1. Introduction

ScribeCam, Inc. ("ScribeCam," "we," "us," or "our") operates the ScribeCam platform, including our website at www.scribecam.com, mobile applications, and web application (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect information about you when you use the Service.

By using the Service, you acknowledge and understand how we collect, use, and disclose information as described in this Privacy Policy. If you do not agree with our practices, do not use the Service.

This Privacy Policy applies to all users of the Service, including registered account holders, report recipients, and visitors to our website. It does not apply to third-party websites or services that may be linked from our Service. We collect only the information necessary to provide and improve the Service. We process personal information based on your consent, performance of a contract with you, and our legitimate business interests in operating and improving the Service.

We do not use your data to profile you for advertising, credit, employment, insurance underwriting, or other automated decision-making purposes unrelated to the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account registration information: name, email address, and password.
• Subscription and billing information: processed by Stripe, Inc. on our behalf (see Section 6).
• User-generated content: video recordings, photographs, and audio narration you upload or capture through the Service.
• Report content: text, observations, findings, and metadata included in or generated from your uploaded content.
• Communications: messages you send to us via contact forms, email, or support channels.

2.2 Information Generated Automatically

• Device identifiers, browser type, operating system, and IP address.
• Usage data: pages visited, features used, timestamps, and interaction patterns.
• Log data: server logs associated with your account activity.
• Location data: approximate location derived from IP address; precise location only if you explicitly grant permission in our mobile application.
• Do Not Track: ScribeCam's Service does not currently respond to browser "Do Not Track" signals. We will update this disclosure if our practices change.

2.3 Information From Third Parties

• If you authenticate through a third-party service (such as Google SSO), we receive your name and email address from that provider.
• Report recipients who create a free Report Only account provide their email address.

2.4 Data We Do Not Collect

ScribeCam's Service is not designed or certified to receive, process, or store the following categories of regulated data. You are prohibited from uploading these data types under our Terms of Use:

• Protected Health Information (PHI) as defined under HIPAA. ScribeCam is not a HIPAA Business Associate and has not executed a Business Associate Agreement (BAA).
• Financial account numbers, payment card data (beyond subscription billing handled by Stripe), or bank routing numbers regulated under GLBA or PCI-DSS.
• Government-issued identification numbers, Social Security numbers, or biometric identifiers regulated under state biometric privacy laws.
• Personal data of EU or UK residents where processing would require ScribeCam to act as a data processor under GDPR or UK GDPR without an applicable Data Processing Agreement in place.

If you believe regulated data was inadvertently uploaded, contact privacy@scribecam.com immediately.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the Service, including generating automated reports from your uploaded content.
• To process your uploaded video, photos, and narration through our AI-powered report generation pipeline.
• To manage your account, process subscriptions, and deliver customer support.
• To send transactional communications, including report delivery notifications, account alerts, and service updates via Postmark.
• To generate and track report analytics as described in the Service (e.g., who accessed your report and when).
• To improve, test, and develop the Service using aggregated and de-identified operational metrics. De-identified data is processed in a form that cannot reasonably be used to identify any individual and is not treated as personal information. This does not include using identifiable customer content or User Content for model training or product development without your explicit written consent.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations and enforce our Terms of Use.

We do not use your personal information or User Content to train or fine-tune AI models without your explicit written consent.

4. Artificial Intelligence Processing

ScribeCam's core functionality relies on artificial intelligence and machine learning technology to convert your video, photographs, and narration into structured reports. By using the Service, you acknowledge and agree to the following:

4.1 AI Sub-Processors

To deliver our report generation Service, we transmit elements of your uploaded content — including video frames, photographs, audio transcriptions, and derived text — to third-party AI providers as sub-processors. These providers currently include:

• OpenAI, LLC (openai.com) — used for language processing and report structuring.
• Google LLC (Gemini) — used for multimodal analysis of visual and audio content.
• Anthropic, PBC — used for language processing and report generation.

ScribeCam requires its AI Sub-Processors to adhere to data use restrictions consistent with industry-standard API terms and contractual obligations, including restrictions on model training and secondary data use. Your content is transmitted to these providers solely for the purpose of processing your specific report generation request. We do not authorize these providers to use your content to train their general-purpose AI models without your explicit written consent. AI Sub-Processors are required to treat your data as confidential and are prohibited from disclosing it to third parties except as required by law or as necessary to deliver the processing service. Data transmitted to AI Sub-Processors is processed in the United States.

4.2 No Human Review

Report generation is fully automated. ScribeCam personnel do not review the content of your reports or your uploaded media as part of normal Service operations. We may access content solely in connection with a support request you initiate, a legal obligation, or an investigation into abuse or security incidents.

4.3 Automated Decision-Making

The report output is generated automatically from your inputs. ScribeCam does not make legally significant decisions about you based on automated processing. All report content is produced at your direction and for your use.

5. Data Storage and Infrastructure

Your data is stored and processed using the following infrastructure providers, all of which operate in the United States:

• Wasabi Technologies — primary cloud object storage for your uploaded video, photos, audio, and generated report files.
• Supabase — database infrastructure for account data, report metadata, and access records.
• Fly.io — application hosting and compute infrastructure.
• Vercel — web application delivery and frontend hosting.
• Cloudflare — DNS, network security, and content delivery.
• Postmark — transactional email delivery.

ScribeCam is designed to store and process data in the United States. We do not intentionally transfer personal data outside the United States for primary storage or processing purposes.

6. Payment Processing

ScribeCam does not collect or store your payment card information. Consumer subscription payments are processed by Stripe, Inc. ("Stripe"). By providing payment information, you authorize Stripe to process charges on our behalf in accordance with Stripe's Privacy Policy and Terms of Service. Payment card data is handled directly by Stripe in accordance with PCI-DSS standards.

For enterprise customers billed directly by ScribeCam, invoicing and payment processing is handled through a third-party billing platform. We collect billing contact name, company name, billing address, and email address for invoice delivery purposes only.

7. How We Share Your Information

We do not sell your personal information, as that term is defined under applicable law. We do not share your personal information with third parties for their independent marketing or advertising purposes. We share information only in the following circumstances:

7.1 Service Providers and Sub-Processors

We share information with vendors and service providers who perform services on our behalf, including the infrastructure providers listed in Section 5 and the AI sub-processors listed in Section 4. These parties are contractually prohibited from using your personal information for any purpose other than providing their services to ScribeCam.

7.2 Report Recipients

When you share a report, the recipient will have access to the report content you have chosen to share. Report recipients must create a free Report Only account to access the report. You control who has access to your reports and may revoke access at any time through the Service.

7.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of ScribeCam, our users, or the public. Where permitted by law, we will provide you with reasonable notice before complying with such requests.

7.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.

8. Data Retention

We retain your account information and User Content for the duration of your active account plus a minimum of ninety (90) days following account closure or termination. Following the expiration of the applicable retention period, ScribeCam will delete your User Content and generated reports within thirty (30) days, except for data we are required to retain under applicable law.

You may request deletion of specific content prior to the end of your retention period by contacting us at privacy@scribecam.com. We will process deletion requests within thirty (30) days of receipt, subject to our legal retention obligations.

9. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, destruction, and loss. These measures include encrypted data transmission (TLS), access controls and authentication requirements, role-based access management for internal personnel, and security monitoring of our infrastructure.

No method of transmission over the internet or electronic storage is completely secure. In the event of a data security incident affecting your personal information, we will notify you without undue delay and as required by applicable law.

10. Your Rights and Choices

10.1 Access, Correction, and Deletion

You may access and update your account information through your account settings. You may request deletion of your account and associated data by contacting us at privacy@scribecam.com. We will process account deletion requests within thirty (30) days of receipt, subject to our retention obligations.

10.2 Rights for All Users

Regardless of your state of residence, ScribeCam voluntarily extends the following rights to all U.S. users:

• The right to request access to the personal information we hold about you.
• The right to request correction of inaccurate personal information.
• The right to request deletion of your personal information, subject to our legal retention obligations.
• The right to receive a copy of the personal information you have provided to us in a portable format, where technically feasible.

To exercise any of these rights, contact us at privacy@scribecam.com.

10.3 Report Access Control

You control who can access your generated reports. You may revoke access for any report recipient at any time through the Service.

10.4 Communication Preferences

You may opt out of non-transactional marketing communications at any time by following the unsubscribe instructions in those messages. You cannot opt out of transactional communications necessary for the operation of the Service.

11. California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Privacy Policy. ScribeCam complies with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA").

11.1 Categories of Personal Information Collected

• Identifiers: name, email address, IP address, device identifiers, and account ID.
• Commercial information: subscription records and transaction history.
• Internet or other electronic network activity: usage data, log data, and interaction data.
• Audio and visual information: video recordings, photographs, and audio narration you upload.
• Geolocation data: approximate location derived from IP address.
• Inferences: report analytics and usage patterns derived from your activity.

11.2 Purposes for Collection

We collect the categories of personal information identified above for the business and commercial purposes described in Section 3 of this Privacy Policy.

11.3 Sharing and Disclosure

We do not sell personal information as defined under the CCPA/CPRA. We do not share personal information for cross-context behavioral advertising. All service providers and sub-processors are bound by written contractual restrictions prohibiting them from using your personal information for any purpose other than providing services to ScribeCam.

11.4 Your California Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted under CCPA/CPRA without your consent.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

11.5 How to Submit a California Rights Request

To submit a verifiable consumer request under the CCPA/CPRA, contact us at privacy@scribecam.com with the subject line "California Privacy Rights Request." We will verify your identity before processing your request and respond within forty-five (45) days of receipt.

11.6 Sensitive Personal Information

The audio, video, and photographic content you upload to the Service may constitute sensitive personal information under the CCPA/CPRA. We collect and use this content solely to provide the Services you have requested. We do not use this content to infer characteristics about you unrelated to the Service or for advertising purposes.

12. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that a child under 13 has provided personal information to us, please contact us at privacy@scribecam.com.

13. Third-Party Links and Services

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to the address associated with your account, by posting a prominent notice within the Service, or by updating the effective date at the top of this policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: