Privacy Policy

Last updated: 18 October 2026

In short

This policy explains what personal information Granwel Technologies LTD collects when you use valtrinity.com, why we collect it, who else handles it, how long we keep it, where it goes and what rights you have. It is written in plain English. If anything is unclear, email [email protected].

• You can use many tools without an account. If you make an account we keep your email address, a scrambled version of your password (or your Google sign in identifier), and the state of any plan or pass you buy.
• Card payments are handled by Stripe. Your card details never reach our servers.
• The lookup tools send what you type to our servers so that we can run the check. We do not keep those targets in any account or database record, except where you ask us to save a domain for alerts or a site for the weekly report.
• We count lookups each day, against your account or a keyed hash of your IP address, to apply daily allowances and stop abuse. Those counters are deleted after 35 days.
• If you use the Video Transcriber you must be signed in. Your uploaded file is deleted within 24 hours (usually within minutes), and your transcript is deleted after 30 days or as soon as you press Delete. We never use uploads or transcripts to train anything.
• Ads appear on tool pages for visitors without a plan. Google's consent message asks for your choice first. Ads are personalised only if you agree. The ad script itself loads only after you have made a choice.
• We measure visits on our own servers with no cookies. Those records are kept for 90 days. If you agree in the cookie message, we also use Google Analytics, which sets two cookies (_ga and _ga_ followed by our container ID) that last 2 years, to help us understand how the site is used.
• We send service emails only (for example email confirmation, password reset, purchase confirmation and the alerts and reports you ask for). We do not send marketing emails.
• We do not sell personal information.
• You have rights over your information, including access, correction and deletion, and you can complain to the Information Commissioner's Office or your local regulator.

Contents

1. Who we are
2. What this policy covers
3. What we collect and why, activity by activity
4. How long we keep information
5. Who we share information with
6. Sending information outside the UK
7. Video and audio uploads in detail
8. Region detection and your region choice
9. Cookies and browser storage
10. Advertising and your consent choices
11. How we look after information
12. Your rights in the UK
13. Your rights in the European Economic Area
14. California residents
15. Residents of other US states
16. How to make a request, and how long it takes
17. Automated processing
18. Children
19. Changes to this policy
20. Contact and complaints

1. Who we are

valtrinity.com is run by Granwel Technologies LTD, a company registered in England and Wales under company number 17419846. Our registered office is Suite Ra01, 195-197 Wood Street, London, England, E17 3NU.

For almost everything in this policy we are the "controller", which means we decide why and how your personal information is used and we are responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The exception is where a Team, Business or Enterprise customer asks us to handle content on its behalf. In that case we act as a "processor" under our Data Processing Agreement.

Questions about this policy go to [email protected]. For general help use [email protected]. We have not appointed a data protection officer. The privacy address is the right place for every data protection question.

2. What this policy covers

This policy covers valtrinity.com and the tools, accounts, purchases, alerts, reports, emails and the Video Transcriber that go with it. It does not cover other sites we link to, or the services of the companies named in our list of subprocessors and other recipients, which have their own policies.

"Personal information" means anything that relates to a person who can be identified, such as an email address or an IP address. Some things we hold look anonymous but can still be linked back to you, for example a keyed hash of an IP address. We treat them as personal information.

This policy should be read with our Terms of Service, Cookie Policy, Fair Use Policy, Refunds and Cancellation page and Security page.

3. What we collect and why, activity by activity

Each table below covers one activity. It states what we collect, why, our legal basis under the UK GDPR, how long we keep it, who receives it and whether it leaves the UK. Our legal bases are: contract (we need it to provide what you asked for), legitimate interests (our interest in running, protecting and improving the service, balanced against your rights), consent, and legal obligation. Retention periods are collected in one table in Section 4.

3.1 Your account

3.2 Service emails

We do not send marketing emails.

3.3 Purchases and billing

3.4 Daily allowances, abuse prevention and bot checks

A keyed hash is a one way scramble made with a secret key we hold. It means we do not store your IP address in the counters. It is still personal information, because someone holding the key could test whether a given address produced a given hash, so we treat it as such.

3.5 Using the lookup and check tools

Please do not type personal information about other people into the tools unless you need to.

3.6 Alerts and the weekly report

3.7 The Video Transcriber

3.8 Enquiries and support

3.9 Region and display currency

3.10 Analytics and logs

3.11 Advertising and consent choices

Subscribers with an active plan see no ads and no consent message. We do not show ads on the Video Transcriber page. More detail is in Section 10.

3.12 Legal claims, tax and compliance

3.13 The writing, text and image tools

4. How long we keep information

When we delete an account we remove the user record, the email index record, the transcription records and files for that account, its counters, and any saved domains or sites. We also ask Stripe to remove the customer record where the law allows. Stripe and our accountants keep what the law requires them to keep.

5. Who we share information with

We do not sell personal information. We share it only with the following, and our subprocessor list gives the name, service, data, location and safeguard for each:

• Service providers acting on our instructions (processors): Microsoft (Azure hosting, storage, speech to text, a hosted language model service, email sending, Application Insights), Stripe (payments), Cloudflare (Turnstile bot checks) and ForwardEmail (inbound email forwarding).
• Independent controllers: Google, for advertising and the consent platform and, if you choose it, Google sign in. Google also receives analytics data if you agree to analytics cookies. Stripe, for its own fraud prevention and regulatory duties.
• Professional advisers such as accountants and lawyers, under duties of confidentiality.
• Authorities and courts where the law requires or allows disclosure, and to protect our rights.
• A buyer or successor if our business is sold or reorganised, who would have to honour this policy.

6. Sending information outside the UK

Our data and the Video Transcriber run on Microsoft Azure in the UK South region. Some recipients are elsewhere, as set out below. Where information is sent from the UK to a country without a UK adequacy decision, we rely on an approved safeguard: the UK Addendum to the European Commission's Standard Contractual Clauses (EU SCCs), the International Data Transfer Agreement, or, for US recipients that are certified, the UK Extension to the EU US Data Privacy Framework (the "UK US data bridge"). For transfers from the EEA we rely on the EU SCCs or, for certified US recipients, the EU US Data Privacy Framework.

You can ask us for a copy of the relevant safeguard by emailing [email protected]. Before relying on the SCCs for any transfer we consider whether the destination country's law lets the recipient meet them, and we carry out a transfer risk assessment where required.

7. Video and audio uploads in detail

The Video Transcriber is available only to signed in users. This section describes exactly what happens to a file.

1. Preparation. Where the browser can read the file, it converts the audio to a 16 kHz mono WAV file before uploading, so less data is uploaded. Where it cannot, the original file is uploaded.
2. Upload. Your browser uploads the file straight to Microsoft Azure Blob Storage in the UK South region, using a link that is valid for one hour, can write only that one named file, and cannot read, list or delete anything.
3. Transcription. Our server starts a job with the Microsoft Azure AI Speech service (in UK South) and gives it a read only link to that one file, valid for 25 hours because jobs can queue for many hours at busy times. The Speech service is not given your name, email address or IP address. The job name is a random identifier.
4. Speaker labels. If you tick the speaker labels option, the Speech service analyses voice characteristics to separate speakers. Microsoft states that these voice signals are discarded after use and that speakers are not identified or tracked. The transcript labels speakers as numbers (Speaker 1, Speaker 2).
5. Deletion of the upload. The uploaded file is deleted as soon as transcription finishes or fails. A maintenance task deletes any upload older than 2 hours that was never completed, and anything older than 24 hours. A storage lifecycle rule that deletes anything older than one day is a further backstop.
6. Deletion at Microsoft. Right after we save the transcript, we delete the job and Microsoft's copy of the result. If that fails, Microsoft deletes it automatically 24 hours after the job finished.
7. The transcript. Your transcript is stored for 30 days, then deleted. If you press Delete on the page, we remove the transcript, any media and the speech job at once.

Who can access an upload. Your browser (write only link for that file); the Microsoft Speech service (read only link); our API, using the storage account key held in our platform settings; and Granwel Technologies LTD, through the Azure portal. We do not routinely look at uploads or transcripts. We would do so only where needed to investigate a fault or abuse report, to comply with the law or at your request. Transcripts are returned only to the signed in account that uploaded them, and every request checks ownership.

Encryption. Azure Storage encrypts data at rest with 256 bit AES and the Speech service encrypts the result data it holds. Data is sent over TLS.

No training. We never use uploads or transcripts to train or improve any model. Microsoft states that it does not use customer data to improve its Speech models, and that where endpoint logging is off and no customisation is used no customer data is stored. We use neither endpoint logging nor custom models. Microsoft's statements are on its pages Speech service encryption of data at rest and Data, privacy, and security for Speech to text.

Where it is processed. In Microsoft's UK South region. Microsoft support staff elsewhere may have access in limited circumstances under Microsoft's terms (see Section 6).

Site wide limit. We apply a daily limit on the total minutes transcribed across the whole site. This is a counter without personal information.

What goes in the logs. The route, status and outcome. A stack trace on an unexpected error may include a job id. File names and transcript text are never logged. All transcription inputs are sent in the body of a request, not in a web address.

Please upload only content you have the right to upload and, where voices or personal information of other people are in it, make sure you have a lawful reason to process it. If you upload other people's personal information you are responsible for that use, and you should not use the Video Transcriber for special category information unless you have a lawful basis.

8. Region detection and your region choice

When you load a page, our servers read your country from a request header added by our hosting or network provider when one is present. If there is none, we assume the UK. We use it only to choose the currency and wording shown to you. Prices are shown in your local currency. If you choose a different region, we store your choice in the cookie vt_region (one year, set for this site only, not marked httpOnly so the page can read it, SameSite Lax) and cache it with the displayed prices in session storage for the visit as vt_region_cache and vt_prices_cache. We make no decision with legal effect from your country, and checkout is never blocked because of it. The one exception to country based handling is the block on requests from Russian IP ranges, described in Section 17.

9. Cookies and browser storage

The complete list, with durations, is in our Cookie Policy. In summary:

• vt_session keeps you signed in: signed cookie, 30 days, httpOnly, Secure, SameSite Lax.
• vt_human is a short lived cookie set after you pass the human check.
• vt_region remembers your region choice (1 year).
• vt_region_cache and vt_prices_cache in session storage cache your region and the prices shown.
• vt_theme in local storage remembers a light or dark choice.
• vt_job and related keys in local storage on the Video Transcriber page remember the current job and pass state.
• Google consent and advertising cookies (for example FCCDCF, FCNEC, __gads and __gpi) are set by Google only when permitted.
• Google Analytics cookies (_ga and _ga_ followed by our container ID, 2 years) are set only if you agree to analytics cookies.
• vt_lang is a cookie that remembers the language you chose (1 year), and vt_langbar_off in session storage remembers that you closed the language message.

An old browser storage item called vt_consent from an earlier version of the site is removed when a page loads. Analytics cookies are set only if you agree to them.

10. Advertising and your consent choices

Visitors without a plan see Google AdSense ads on tool pages. Subscribers see no ads and no consent message. There are no ads on the Video Transcriber page.

We use Google's certified consent management platform (Privacy and messaging) to show the right message in the UK, the EEA and the US states that require one. Consent Mode v2 starts with every purpose denied. The ad script loads only after you have made a choice. If you agree, Google and its partners may use cookies and similar technology to personalise ads and measure them. If you decline, you may still see ads, but they are limited ads that are not personalised using cookies. You can change your mind at any time with the Cookie settings link in the footer, which reopens Google's message. Google is an independent controller for ad personalisation and has its own policy at policies.google.com/technologies/ads.

11. How we look after information

We use TLS for data in transit, encryption at rest for stored data, hashed passwords, signed session cookies, server side enforcement of limits, outbound request guards, signature checks on payment webhooks and short lived storage links. Our Security page describes these in full and how to report a vulnerability. No system is without risk, and we cannot promise that information will never be lost or accessed without permission. If a breach is likely to put your rights at risk we will tell the Information Commissioner's Office within 72 hours where the law requires it, and tell you without undue delay where the law requires that.

12. Your rights in the UK

Under the UK GDPR you have the right to:

• be told how your information is used (this policy);
• access a copy of your information;
• have inaccurate information corrected;
• have information deleted in certain cases;
• restrict how we use it in certain cases;
• receive information you gave us in a portable form, where we use it under contract or consent and by automated means;
• object to use based on legitimate interests, and to any direct marketing (we do none);
• withdraw consent at any time, without affecting what was done before (use the Cookie settings link);
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we make none: see Section 17).

You can complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to put things right first, but you do not have to contact us before the ICO.

13. Your rights in the European Economic Area

If you are in the EEA, the General Data Protection Regulation (GDPR) gives you the same set of rights as the UK GDPR, as listed in Section 12. You may complain to the data protection authority in the country where you live, work or believe an infringement happened. A list is at edpb.europa.eu. We have not appointed a representative in the EU. If that changes we will update this policy. Our legal bases, retention periods and safeguards are the same as for UK users, and transfers from the EEA to the UK rely on the European Commission's adequacy decision for the UK.

14. California residents

This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

Categories collected in the last 12 months and the sources and purposes are as in Section 3:

We do not sell personal information. We do not share personal information for cross context behavioural advertising unless you agree to personalised ads through the consent platform. If you do, Google's use of the data collected through its cookies for personalised ads may be a "share" under California law. You can opt out at any time with the Cookie settings link in the footer, which is where you reach our Do Not Sell or Share choice. We honour the Global Privacy Control signal to the extent the consent platform does. We do not knowingly sell or share the personal information of anyone under 18.

Your rights: to know and access, to delete, to correct, to opt out of sale or sharing, to limit use of sensitive personal information (we use it only for the purposes allowed without a limit), to data portability and not to be discriminated against for using these rights. To use them, follow Section 16. You can use an authorised agent. We will ask for proof of the agent's authority and may verify your identity directly. We respond within 45 days, and may extend once by a further 45 days with notice. We keep personal information for the periods in Section 4.

15. Residents of other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with similar privacy laws, you may have the right to confirm whether we process your personal information and to access it, to correct it, to delete it, to receive a copy in a portable format, and to opt out of targeted advertising, the sale of personal information and profiling that has legal or similar effects. We do not sell personal information, we make no profiling decisions with legal or similar effects, and we use targeted advertising only if you agree to personalised ads through the consent platform. You can withdraw that agreement through the Cookie settings link.

Make a request as described in Section 16. We reply within 45 days and may extend by a further 45 days where reasonably necessary, telling you why. If we refuse a request you can appeal by replying to our decision, or emailing [email protected] with "Appeal" in the subject line. We will answer your appeal within 60 days (or the period your state sets) and explain the outcome. If you remain unhappy you can contact your state attorney general.

16. How to make a request, and how long it takes

Email [email protected] from the address on your account, saying which right you want to use. If you have no account, tell us how we can identify any records about you (for example the email address you used on the enquiry form). We may ask for more information to confirm who you are, and we will not use it for anything else.

We respond within one month of getting your request and your proof of identity. We can extend that by up to two further months for complex or numerous requests, and we will tell you within the first month if we do. We do not charge for requests unless they are clearly unfounded or excessive, in which case the law allows us to charge a reasonable fee or refuse, and we will explain why.

Account deletion is carried out by us manually on request. Access and portability requests are also handled manually. For a transcript you can press Delete on the page at any time.

17. Automated processing

We use automated processing for these purposes only:

• Rate limits and abuse blocks: requests from an IP address or account that exceed our limits are slowed or refused, and obviously automated traffic can be blocked, as explained in the Fair Use Policy.
• Country based price display: your country selects the currency shown (Section 8).
• Country block: requests from Russian IP ranges receive a 451 page, at page and API level, because we do not offer the service there. If you believe you have been blocked in error, contact us.
• Bot checks: Cloudflare Turnstile decides whether a request looks automated.
• Dormant account clean up: accounts with no sign in for 24 months and no active plan or pass are deleted after a warning email.

None of these has a legal effect on you or a similarly significant effect. We make no automated decision about credit, employment, insurance or similar matters. A person can review any block if you contact us.

18. Children

The service is for people aged 18 and over, as our Terms of Service say. We do not knowingly collect personal information from anyone under 18. If you think a child has given us information, email [email protected] and we will delete it.

19. Changes to this policy

We may update this policy, for example if we change what we collect or who handles it. The date at the top shows when it last changed. For a significant change we will tell you by email or on the site before it takes effect.

20. Contact and complaints

Privacy questions and requests: [email protected]. General help: [email protected].

Granwel Technologies LTD, company number 17419846, Suite Ra01, 195-197 Wood Street, London, England, E17 3NU.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113. EEA residents can complain to their local authority and US residents to their state attorney general or the relevant regulator.