Privacy policy

1. Who we are

Loheden AI Solutions AB, a Swedish company, makes Prokoll and runs prokoll.com. We are responsible (the controller) for the personal data this policy describes. Our contact details are at the end.

2. Your meetings never reach us

Prokoll records, transcribes and writes notes on your Mac. The sound of your meetings, the transcripts, the notes, the names of the people in them and your corrections are processed only on your Mac, are kept there encrypted, and are never sent to us or anyone else. The recording itself is deleted once it has been transcribed.

You decide what is recorded and what happens to it, so you are responsible (the controller) for the personal data in your meetings. We never receive it, so we do not process it on your behalf either.

3. What the app sends

Prokoll contacts us only for these things, and sends nothing about your meetings:

• When you choose your languages, it downloads the files it needs to work on your Mac, from download.prokoll.com.
• Once a day, it checks download.prokoll.com for a new version of Prokoll and fetches the list of licences that have ended from prokoll.com.
• When you activate your licence or move it to another Mac, it sends prokoll.com your licence key, which holds your name, your email address and the licence number, and a code for your Mac. The code is made on the Mac from its hardware number together with the licence, so we never learn the hardware number itself.
• After a crash, if you click Send, it sends prokoll.com a crash report, described below.

Like any request over the internet, each of these shows your IP address and the versions of Prokoll and macOS. We keep that only in the security logs described in section 7. For each licence we keep which Mac code it is active on and since when, so that it is active on one Mac at a time, and a code we email you to move a licence is kept for 30 days after it is used or expires.

Prokoll sends no usage statistics, and it needs no account.

Crash reports

The next time Prokoll opens after a crash, it offers to send us a report, and sends it only if you click Send. The report holds the version of Prokoll and of macOS, the model of your Mac, the error, where in the code Prokoll stopped and when, and anything you choose to write in it. It holds nothing from your meetings.

We use the report only to find and fix the error. Clicking Send is your consent, for that one report, and Prokoll works just the same if you do not send it. You can withdraw your consent at any time by writing to us, and we then delete the report. Our server passes the report on to us as an email and keeps no copy of it.

4. Our website

No analytics script runs on our pages, and nothing on them reports back about you. We count visits, downloads and sales ourselves on our server: by day, by country as our network provider reports it, by the language of the page, and by the website that brought the visit and the first page it opened. That source travels from page to page in the addresses of our own links, so nothing is stored on your device for it, and nothing in the counts is made from your IP address or identifies you.

Your country, as our network provider reports it, chooses the price you are shown and which language a line at the top of a page may offer you. It is read for that moment and not kept, except as the country in the counts and in a purchase.

Cookies

• language: set only when you choose a language in the menu, so the website opens in it next time. It holds the language and lasts a year.
• theme: set only when you switch between light and dark mode with the round button at the end of the menu bar, so the website opens in that mode next time. It holds light or dark and lasts a year.
• __cf_bm: may be set by Cloudflare, our network provider, to tell people from automated traffic. It lasts 30 minutes.

We set no other cookie for visitors, and none for tracking, advertising or analytics.

5. When you buy Prokoll

You pay through Link, a service of Stripe, which takes the payment as the merchant of record. Stripe collects your payment details and billing address and handles them as a controller in its own right, under its own privacy policy. We never see your card number.

We keep, for each purchase: your name and email address, the licence and its key, whether you bought as a private person or a business, your billing country and the country the price was chosen for, a tax number if you gave one, the amount, the currency and the payment's reference at Stripe, the language you bought in, the version of the terms you accepted and when, your request to have the licence delivered at once, if you made one, the IP address and browser you bought from, and the website that brought your visit and the first page it opened.

We use them to deliver and manage your licence (our contract with you), to keep our books as the law requires (a legal obligation), and to prove the purchase and its terms if it is ever disputed or a payment is reversed (our legitimate interest in defending our rights).

We send you only the emails a licence needs: the licence itself, a link to your licence when you ask for it, a code when you move the licence to another Mac, and a receipt if you withdraw from a purchase. We send no marketing.

6. When you write to us

If you email us, we use your message and address to answer you and to help with your licence (our contract with you, or our legitimate interest in answering questions). We keep the conversation as long as it is needed for that.

7. Security

Our server keeps logs of requests, with the IP address, to find and stop attacks and abuse, and deletes them within 30 days. We count requests from each IP address for up to a day, to limit how often anyone can ask for an email or a licence, or send a crash report. An address that sends what only attack tools send is blocked for 12 months, renewed if it tries again; an address that asks for many pages that do not exist within a few minutes is blocked for 24 hours, and longer if it does it again. Our record of a block keeps a code made from the address, never the address itself, and is deleted 30 days after the block ends. Cloudflare keeps a blocked address on a block list for at most 30 days at a time while the block lasts, which also protects our other websites. This rests on our legitimate interest in keeping the website and its users safe.

8. Who else handles your data

• Cloudflare, Inc. carries every request to prokoll.com and download.prokoll.com, serves the files the app downloads, sends our emails, and keeps the backups of our database in the EU. It works for us as our processor.
• Hetzner Online GmbH runs our server, in Helsinki in Finland. It works for us as our processor.
• Google provides our email inbox, where your messages to us and the crash reports you send arrive. It works for us as our processor.
• Stripe, through Link, takes your payment as the merchant of record and is a controller in its own right for it.

Cloudflare and Google may handle data outside the EU and the EEA. Where they do, the transfer rests on the EU's adequacy decision for the EU-US Data Privacy Framework or on the EU's standard contractual clauses. We do not sell your data, and we share it with authorities only when the law requires it.

9. How long we keep it

• Purchases and their licences: seven years from the end of the year of the purchase, as Swedish bookkeeping law requires, and longer while a dispute about the purchase is open.
• Which Mac a licence is active on: as long as we keep the licence.
• Codes to move a licence: 30 days after they are used or expire.
• Crash reports: until we have fixed the error, and at most 90 days.
• Server logs: up to 30 days. Blocks: while they last, and 30 days after.

10. Your rights

You can ask us for a copy of the personal data we hold about you, have it corrected, have it deleted where we are not required to keep it, have its use restricted, receive it in a form a computer can read, and object to a use that rests on our legitimate interest. Write to the address below. We do not make decisions about you automatically.

You can also complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority, at imy.se, or to the authority in your own country.

11. Changes

When this policy changes, we change the date at the top.

12. Contact

Loheden AI Solutions AB
Vretavägen 26
71993 Vintrosa
Sweden

Email us