The short version
- Without an account, nothing leaves your browser. Your plan, history and settings stay on your device.
- Recordings never leave your device, with or without an account. Transcribe works on them in your browser.
- With a Plus account we keep your email (optional with passkeys) and your practice data, to sync and back it up. Nothing else, no ads, no selling, no tracking.
- You can download everything or delete your account at any time, and deletion is immediate.
This summary helps you read the policy; the numbered sections below are the full notice.
Who is responsible
Graph Software s.r.o. is the controller of the personal data described here. Write to [email protected] with any question or request about your data. We have no data protection officer, because the law does not require one for what we do; a person at the company answers.
- Company
- Graph Software s.r.o.
- Registered office
- V Hájích 341/47, 149 00 Praha 4, Czech Republic
- IČO
- 24934691
- VAT number
- CZ24934691
- Register
- Commercial register of the Municipal Court in Prague, section C, file 445084
- [email protected]
- Phone
- +420 705 915 164
Using Practice Lab without an account
- Everything you do is stored in your browser (in its local storage and IndexedDB) on your device. We do not receive it and cannot see it.
- Recordings you open in Transcribe are read from your device and processed in your browser. They are never uploaded, also not with an account.
- To load the app, your browser requests its files from Cloudflare, which hosts Practice Lab. Like any web host, Cloudflare sees your IP address and browser details for each request, to deliver the files and protect the site from attacks. We do not use them to identify you.
What we keep when you have an account
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email address (optional if you use a passkey) | Sign-in links, receipts for what you bought, notices about your account | Contract | While the account exists |
| Passkey public keys | Signing you in; the private key never leaves your device | Contract | Until you remove the passkey or the account |
| Practice data: plans, history, settings, notes, devices | Sync between your devices and the account backup | Contract | While the account exists; 12 months after Plus ends (or after creation, if it never had Plus), with warnings 30 and 7 days before |
| Sessions, passkeys and devices: a random device id, your browser’s name and version (user agent), sign-in method and times | Keeping you signed in, showing your sessions, passkeys and devices so you can recognise and remove them, knowing which device made a change | Contract | Sessions: 30 days after last use, or until you sign out. Passkeys and devices: until you remove them |
| Request logs: address called, result, duration (no IP address, no email) | Finding errors and stopping misuse | Legitimate interest in a working, secure service | 14 days |
| Purchases, refunds and withdrawals, as Paddle reports them | Knowing whether your account has Plus; accounting | Contract; legal obligation (accounting) | While the account exists (they are your Plus). After the account is deleted, 10 years, as Czech accounting law requires, linked to the Paddle customer only and without the reason you gave for a withdrawal |
| Payment notifications from Paddle (as Paddle sends them) | Recording purchases correctly and fixing errors | Contract; legitimate interest in correct billing | 90 days |
Backups of the account database are encrypted and kept for 30 days at Cloudflare R2 in the EU, and for up to 8 days in our server's infrastructure backups at Cloudflare R2, encrypted at rest. Deleted data disappears from all backups within 30 days. We do not use your data for advertising, profiling or automated decisions, and we do not sell it.
Counting visits
- To know how many people visit Practice Lab and its pages, we use Cloudflare Web Analytics. It sets no cookies, stores nothing on your device, and does not fingerprint your browser; it counts page views and gives us totals by page, country and browser type.
- For accounts, we count events we handle anyway, such as sign-ins, sync requests and purchases, as totals. We do not build profiles from them.
Who else handles your data
We use a few providers to run Practice Lab. They process data only on our instructions:
- Hetzner Online GmbH (Germany): the servers and database for accounts and sync, in data centres in the EU.
- Cloudflare, Inc. (USA): hosting of the app, network and attack protection, and sending sign-in emails. Cloudflare is certified under the EU–US Data Privacy Framework.
Paddle.com Market Ltd (UK) sells Plus as our reseller and is a separate controller for your payment: it collects your payment details, address and tax information under its own privacy policy. Paddle tells us what you bought, your email and your country, and never gives us your card details.
We share data with authorities only when the law obliges us to, and we would tell you unless that is forbidden.
Cookies and storage on your device
- Practice Lab stores its own data in your browser’s local storage and IndexedDB. That is the app itself (your plan, history and settings), so it needs no consent.
- With an account, a session cookie keeps you signed in, and a random device id lets your account list your devices and sync between them. Both are strictly necessary for the account you asked for and exist only while you are signed in.
- There are no advertising, tracking or third-party cookies, so there is no cookie banner.
Your rights
You can at any time:
- download everything your account holds, in your account › Manage account (in a machine-readable file);
- delete your account in your account › Manage account; deletion is immediate and complete;
- ask us what data we hold about you, and have it corrected;
- restrict or object to processing based on our legitimate interest, such as security logs;
- complain to the Czech data protection authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7 (uoou.gov.cz), or the authority where you live.
We answer requests within a month. Email us from the address on your account, or sign in first.
How we protect it
All connections are encrypted. Sign-in uses passkeys or single-use email links, so there are no passwords to steal. The account database is separate from our other products, access is limited to the people who run Practice Lab, and backups are encrypted. If a breach puts your data at risk, we tell you and the authority as the law requires.
Changes to this policy
When we change this policy in a way that matters, we email account holders before it applies and update the version at the top. Earlier versions stay available on request.