DictionAid
My RecordingsRequest a Role

Privacy

What we collect, and who sees it

This describes the actual behaviour of this website, service by service. Last reviewed 28 August 2026.

Who is responsible

DictionAid GbR, Solen Mainguené and Mario Grünkorn. Postal address and contact details are in the Impressum. For anything in this notice, write to info@dictionaid.com.

We have not appointed a data protection officer; at our size we are not required to.

Visiting the site

Our host, Vercel Inc., processes the usual request data — IP address, browser and operating system, the page requested, the referring page, and the time — so the site can be delivered and kept working. Legal basis: Art. 6(1)(f) GDPR, our interest in running the service securely.

We use Vercel Web Analytics for aggregate page counts. It sets no cookies and stores nothing on your device.

Cookies

We set three cookies, all first-party, all read only by our server:

  • da_session — set when you sign in, so the library knows it is you. Expires after 90 days.
  • da_ipa_quota and da_translate_quota — a signed daily counter for the IPA and translation tools, so they cannot be used without limit. They contain no identifier. Expire after 24 hours.

These are necessary for functions you asked for, so no consent is required for them under § 25(2) TDDDG. We use no tracking cookies and no advertising cookies.

One third-party script does load: Gumroad's checkout script, which makes the buy buttons work. It can set its own cookies on gumroad.com. We are reviewing loading it only on pages where you can actually buy something.

When you buy something

Purchases run through Gumroad, Inc., which acts as the seller of record. Your name, payment details and billing country are given to Gumroad, not to us — we never see a card number. Gumroad is a separate controller for that data; their notice applies alongside this one.

After a sale, Gumroad notifies our server. We store your email address, which product you bought, and a copy of that notification, so that the recordings appear in your library. Legal basis: Art. 6(1)(b) GDPR, performing the contract.

Signing in and the library

To reach your library you enter your email address and we send a sign-in link. We store the address and what you are entitled to. When you play a recording, our storage provider receives the request — including your IP address — in order to deliver the audio.

If you save a role for offline use, the recordings and their text are stored in your browser on your own device and nowhere else; signing out removes them. If you record yourself in the player, the browser asks for your microphone and keeps the recording on your device only. Nothing you record is uploaded or heard by us unless you download it and send it to us yourself.

When you write to us

The contact, role-request, coaching, review and wishlist forms send us an email. What you type is what we receive. These messages are not written to a database; they sit in our mailbox. Legal basis: Art. 6(1)(b) GDPR where you are asking about a purchase or a commission, otherwise Art. 6(1)(f).

The forms carry a hidden field and a timing check to stop automated spam, and briefly hold your IP address in memory — for at most a minute — to limit repeated submissions. Nothing of this is stored or sent on.

Coaching requests

A coaching request is forwarded to the coaches who teach that language, so they can offer times. Your name and email address are deliberately left out of that forward. The coach receives the musical facts — language, repertoire, voice type, level, goal, deadline, time zone, availability and your notes — and nothing that identifies you. Introductions happen through us.

The IPA and translation tools

These send the text you enter — and nothing else — to OpenAI to be transcribed into IPA or translated. No account details, no name, no email address. Legal basis: Art. 6(1)(f) GDPR, providing the feature you invoked.

Who receives data

  • Vercel Inc. (USA) — hosting and delivery.
  • Supabase Inc. — database and recording storage.
  • Brevo (Sendinblue SAS) (France) — sending our email.
  • OpenAI — the IPA and translation tools only.
  • Gumroad, Inc. (USA) — sales and payment, as a separate controller.
  • Our coaches — coaching requests only, without your name or address.

Several of these are in the United States. Transfers rest on the EU Commission's adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses, depending on the provider.

We use no advertising network, no tag manager, no session recording, no external fonts and no embedded players. Everything you see and hear is served from our own domain.

How long we keep things

Account and purchase records are kept for as long as you can reach what you bought — that is the point of them — and are deleted on request unless a statutory retention period applies. Messages you send us are kept as long as the matter is open and for a reasonable period afterwards. Quota cookies expire after a day, the session cookie after 90 days.

Your rights

You may ask what we hold about you, have it corrected, have it deleted, restrict or object to its processing, and receive it in a portable form (Art. 15–21 GDPR). Write to info@dictionaid.com and we will do it by hand — we are small enough that there is no automated process, and no automated decision-making takes place here.

You may also complain to a supervisory authority in the member state where you live or work.

Changes

When the site changes what it does with data, this page changes with it. The date at the top says when it was last checked against the code.