Privacy Policy

Last updated: August 2026 — this policy is under legal review and may be refined. The German version prevails.

Controller

Dictalex is a project from PAKD, based in Switzerland (pakd.ch). Privacy contact: info@dictalex.com

As Dictalex is offered to law firms in the EU, we process personal data under the GDPR; the Swiss Data Protection Act (revFADP) applies alongside it.

What we process

Account data. Your name, email address, login credentials, and your firm membership.

Content data (processing on behalf). Your firm's dictations, meeting recordings, transcripts, documents, and cases are processed strictly on the firm's behalf as a processor (Art. 28 GDPR) — the firm remains the controller. Audio is encrypted in the browser before upload; the storage provider only ever receives ciphertext.

Usage data. Technical logs (timestamps, object IDs, statuses) are deliberately content-free — application and audit logs never contain client content.

Contact form. Name, email address, and message are transmitted to us by email solely to handle your inquiry.

Where processing happens

Database and storage are located in Frankfurt am Main (Supabase, AWS region eu-central-1). AI processing (transcription, summaries) happens exclusively at Mistral AI (Paris, EU) — contractually without training on your data. See our security page for details, including an honest treatment of the CLOUD Act question.

Transactional emails (login links, invitations — never client content) are currently sent via Postmark (USA); a switch to an EU provider is planned.

Audience measurement — on this website only. On dictalex.com we measure visits with Fathom Analytics: cookieless, without personal data and without cross-device tracking. Only aggregate values are recorded, such as the page visited, country of origin, and referring website. The provider is Fathom Analytics (Canada; the EU Commission has issued an adequacy decision for Canada). We use full EU isolation: all visits are processed exclusively on EU servers.

The application at app.dictalex.com carries no audience measurement whatsoever — no analytics script is loaded there. We use no advertising cookies anywhere.

Retention and deletion

Account data is kept while your account exists. Firms can configure automatic deletion windows for audio; deletion additionally destroys the encryption key (crypto-shredding). Deleting a case or firm removes all associated data including search indexes and version history.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability, and objection (Art. 15–21 GDPR). Contact info@dictalex.com. For content data belonging to a firm, please contact that firm as the controller.

You may also complain to a supervisory authority — in Austria the Datenschutzbehörde (dsb.gv.at), in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch).