Privacy Policy
This policy explains what personal data Bespoken collects, why, who we share it with and what rights you have. It covers the editor at app.bespoken.fm, podcast hosting and RSS feeds, and the website at bespoken.fm.
1. Controller
The controller of your personal data is Bespoken AB. Full company details are in our terms. For anything about privacy, contact privacy@bespoken.fm.
2. Data we collect
Account and sign-in
Your email address, a hashed password or the identity details from your Google sign-in, your user id and your plan.
Audio and recordings
The audio you upload or record in Bespoken, including the voices of your guests, plus the projects, edits and exports you create.
Transcripts and AI suggestions
Transcripts of your audio and the edit suggestions our AI features generate from them.
Audio and episode settings
The processing settings you choose, such as sound presets, EQ, compression, noise reduction and loudness, and your episode settings, such as export format and length.
Podcast and RSS metadata
Show and episode titles, descriptions, cover art and the other details you add to your feed. Published feeds are public by design.
Billing
Payments are handled by Paddle, our Merchant of Record. Paddle collects your payment details and billing address. We never see or store your card number. We receive your subscription status, plan, purchase history and the country you bought from.
Listener download analytics
When someone downloads an episode or a podcast app checks a feed hosted on Bespoken, we record the country, continent and, where available, region derived from the IP address, the podcast app and device type derived from the user agent, and a hash of the IP address and user agent with a salt that changes every day. We never store the raw IP address or the raw user agent, and the daily hash cannot be linked across days. We use this to count downloads in line with the IAB podcast measurement guidelines and show podcasters aggregated numbers.
Product analytics (only with consent)
If you accept analytics cookies, we use PostHog to collect usage events and session replays. All text and form inputs are masked in replays, and we identify signed-in users only by a pseudonymous id, never by email. If you decline, no usage events or replays are collected. See our cookie policy.
Logs and error reports
Our servers keep technical logs, such as request details, to run the service and fix problems. When a server error happens, we also send an error report with the error and the request method and address to PostHog. Error reports are not tied to your account and are sent whether or not you accepted analytics cookies. We filter secrets and transcript text out of logs.
3. Why we use it and our legal bases
- To provide the service (account, editing, transcription, AI suggestions, hosting, feeds and support): performance of our contract with you.
- Billing and accounting: performance of the contract and our legal obligations under Swedish bookkeeping law.
- Listener download analytics, security, logs and error reports: our legitimate interest in measuring downloads for podcasters, keeping the service secure and fixing errors.
- Improving our audio processing: we analyse audio and episode settings to tune our processing engines, for example to pick better default presets. We use the settings only in aggregated or pseudonymised form, never the audio itself. This is based on our legitimate interest in improving Bespoken, and you can object at any time.
- Product analytics and session replay: your consent, which you can withdraw at any time.
- Handling notices about illegal content: our legal obligations.
We do not sell your personal data, and we do not use your audio or transcripts to train AI models or to tune our processing. For that we only use your settings, as described above.
4. Processors
We use these service providers to run Bespoken. They process personal data on our behalf under data processing agreements.
- Supabase: database and sign-in.
- Cloudflare: audio and feed storage (R2), the download and feed service (Workers) and DNS.
- Render: hosting for our audio processing server.
- Vercel: hosting for the editor and the website.
- AssemblyAI: speech-to-text transcription of your audio.
- OpenRouter: routes transcript text to the AI models that generate edit suggestions. We only allow model providers that neither keep nor train on the text: Microsoft Azure in the EU for chapter titles, and TypeSafe for detecting filler words.
- PostHog (EU cloud): product analytics and session replay, only with consent, and server error reports.
- Axiom (EU region): server logs.
- Paddle: payments, taxes and invoicing. For purchases Paddle is also an independent controller under its own privacy policy.
5. International transfers
Some of these providers are based in, or process data in, countries outside the EU and EEA, such as the United States. When that happens we rely on the EU Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework.
6. How long we keep data
- Account data, audio, transcripts and podcast data are kept until you delete them or delete your account from the Account page. Deleting your account removes your projects, audio, transcripts and published feeds and cancels any subscription. If a published file can't be removed right away, we keep retrying automatically until it is gone. You can always contact us at privacy@bespoken.fm about it.
- Individual listener download events are deleted after 45 days. After that only aggregated counts remain.
- Aggregated statistics about audio and episode settings, which cannot identify you, may be kept after you delete your account.
- Server logs are kept for around 30 days.
- Product analytics is kept for the retention period of our PostHog plan, and you can ask us to delete it at any time.
- Billing records are kept by Paddle, and by us where needed, for as long as bookkeeping law requires.
7. Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted, which you can do yourself by deleting your account;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting earlier processing.
Email privacy@bespoken.fm to use any of these rights. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se, or to the data protection authority where you live.
8. Guests and listeners
If you appear in a podcast made with Bespoken, the podcaster who published it decides how your voice is used and is responsible for having your permission. We process that audio on their behalf. You can still contact us, and we will pass your request on or help where we can.
9. Changes
We will update this policy when our processing changes and tell you about significant changes by email or in the editor. The date at the bottom shows the latest version.
10. Contact
Last updated October 17, 2026