Privacy Policy

1. Who We Are

Distl (distl.app) is operated by Insaltix Ltd ("Insaltix", "we", "us", or "our"), a company registered in England and Wales under Company Registration Number 17123911, with its registered office at 20 Wenlock Road, London, England, N1 7GU.

For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Insaltix Ltd is the data controller. If you have any questions or wish to exercise your privacy rights, please contact our data privacy team at hello@insaltix.com.

2. What Information We Collect

We collect only the information necessary to provide, support, and secure the Distl service:

• Account Information: Your name, email address, and authentication identifiers when you register or sign in (via email or Google OAuth).
• Content Inputs & Outputs: Written notes, speech-to-text transcripts, and your saved LinkedIn content including short-form posts, long-form articles, document carousels, and generated visual assets.
• Billing Details: Subscription tier, credit balance, and transaction history. Payment card numbers and sensitive financial information are handled directly by our payment processor, Stripe; we never store or have access to your full payment card details.
• Technical, Diagnostic & Aggregate Product Telemetry: Essential security and diagnostic information, including device type, operating system, browser type, and privacy-minimized aggregate product telemetry (free of persistent advertising cookies, IDFA, or individual profiling) to evaluate platform performance and feature reliability.

3. Voice Recordings & Ephemeral Processing

Distl does not save or store voice recordings in our database.

When you record or upload audio, the audio stream is transmitted securely in real time to our speech-to-text transcription service solely to produce text transcripts. Once transcription is complete, the audio is immediately discarded and is not retained on our servers.

4. The Distillation Workflow & Purpose of Processing

Distl is designed to help professionals turn spoken ideas and rough notes into polished LinkedIn content. Our "distillation workflow" refers to the automated process that transforms your speech-to-text transcripts or written notes into refined, ready-to-publish content—including short-form posts, long-form articles, multi-slide document carousels, and visual assets.

We process your data under the following lawful bases:

• Contractual Necessity: To deliver the Distl service, operate your account, run the content distillation workflow, and publish approved content to LinkedIn.
• Legitimate Interests: To safeguard our service from fraud, abuse, and automated attacks; to maintain service availability; and to measure aggregate product and website interaction to continually improve Distl's quality and features (subject to your statutory right to object at any time).
• Legal Obligation: To retain statutory financial and transaction records required under UK law.
• Consent: When you choose to connect your LinkedIn account to publish content or opt in to optional communications.

5. AI Processing & Third-Party Service Providers

We do not sell, rent, or trade your personal data. We share information only with essential third-party service providers necessary to operate Distl. Please note that Insaltix Ltd accesses third-party API services under standard commercial developer and service terms; we do not have bespoke or organizational-level custom enterprise contracts with third-party API providers:

• Cloud Infrastructure: Google Cloud Platform / Firebase for secure cloud hosting, authentication, and database storage located in regional European data centers, governed by Google Cloud's standard commercial terms and data processing terms.
• Audio Transcription (Deepgram): Used for real-time speech-to-text transcription under Deepgram's standard commercial API terms of service. When you record or upload audio, it is streamed to Deepgram solely to generate text transcripts; Distl does not store or retain voice recordings on our servers. Under Deepgram's standard paid API terms, audio submitted via the API is not used to train their models.
• Artificial Intelligence Models: AI model providers accessed via standard commercial APIs (including OpenRouter and underlying foundational model providers) solely to transform your notes and transcripts into draft content during distillation. Processing is subject to the providers' standard commercial API terms and developer privacy policies, which generally exclude customer API inputs and outputs from model training. We do not maintain custom organizational-level agreements with OpenRouter or individual model providers.
• Payment Processing: Stripe for PCI-DSS compliant subscription billing and invoicing under Stripe's standard commercial service terms. We never store or handle your full payment card details.
• Social Media Publishing: LinkedIn, solely when you explicitly authorize connecting your account to publish content, governed by LinkedIn's standard developer APIs and platform terms.

6. Data Retention & Account Deletion

We retain your account details, transcripts, and saved LinkedIn content for as long as your account remains active.

You can permanently delete your account at any time directly within the application settings (Settings → Delete Account). Deleting your account permanently erases your personal information, transcripts, drafts, and saved content from our active systems. Statutory financial records are retained only for the period required by UK tax authorities (HMRC).

7. Your Privacy Rights

Under the UK GDPR and Data Protection Act 2018, you have statutory rights regarding your personal data:

• Right of Access: Request confirmation of whether we process your data and receive a copy of that data.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data when it is no longer needed.
• Right to Restrict Processing: Request temporary restriction of data processing under certain circumstances.
• Right to Data Portability: Request your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including our optional product and website analytics. You can disable product analytics at any time directly in your application Settings → Privacy, or via the public objection toggle on our Cookie Policy page.

To exercise any of these rights, contact us at hello@insaltix.com. We respond to all verified requests within one calendar month, free of charge.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.