Privacy Policy

The controller of the data described in this policy is Litchi Solutions S.r.l. (“Litchi”, “we”), which develops and sells Dettami.

We have not appointed a data protection officer (DPO). For any privacy question, or to exercise your rights, write to info@litchisolutions.com.

This policy covers the personal data we process when you:

• visit the website dettami.litchiserver.com and use the portal, where you manage your account, team and subscription;
• use the Dettami app for Mac or Windows, which talks to our service at api.dettami.litchiserver.com;
• write to us.

When an organisation uses Dettami

Everyone in Dettami belongs to an organisation: when you sign up, one is created for you, and if you join the team of a company or a firm you move to theirs. For the data the organisation processes in the service — members and their roles, invitations, team usage, the shared glossary and snippets, synced meeting notes — the organisation is the controller, and Litchi processes that data on its behalf as a processor (Article 28 GDPR), under the Data Processing Addendum. For this data you can also contact the organisation; if you contact us, we involve them.

We remain the controller of your account data, billing data and the technical data we process to keep the service secure.

Dettami is built so that the most personal things never leave your computer. The app processes this data only on your computer (the Mac or PC where you use it): Litchi neither receives nor sees it.

• Audio. Transcription happens on the computer, with a speech model that runs there: on Apple silicon Macs Whisper and, as a fallback on Macs with macOS 26, Apple's speech recognition, which also runs on the Mac; on Intel Macs, Parakeet; on Windows, Parakeet by default or, if your PC has a graphics card and you choose it, Whisper large-v3-turbo, which also runs on the PC. Audio is not kept unless you turn on “Keep audio”, which is off by default on both Mac and Windows: it then stays in the history, on the computer, for the number of days you choose (1 to 90, 14 by default) and is then deleted automatically; if you turn it off, any audio already kept is deleted and the text stays.
• The text of your dictations and your history.
• Your personal glossary and personal snippets.
• Your AI provider keys, stored in the macOS Keychain on a Mac and in Windows Credential Manager on a PC.
• Scratchpad notes.
• Notetaker meeting notes, until you choose to sync them (section 5).
• Detailed statistics about your usage.

This data stays under your control and depends on the security of your computer: we have no copy of it and cannot recover it.

To format your text, and for features such as transforming selected text (Transforms), styles, commands and meeting summaries, Dettami can use an artificial intelligence model. This happens only if you enter your own key for one of the supported providers: Google (Gemini), Groq, Anthropic (Claude) and OpenAI.

In that case the app sends the provider text only, never audio:

• the dictation, already transcribed;
• the name of the app you are using and the title of its window;
• the text near the cursor and some terms from your glossary, so the result fits what you are writing;
• with vibe coding, file and variable names, so the provider spells them correctly;
• for Transforms, styles and commands, the text you selected;
• for the Notetaker, the transcript of the meeting to summarise.

The request leaves your computer and goes directly to the provider, with your key and under the contract you have with them. It does not pass through our servers: Litchi does not see that text and does not store it. For this reason the provider you choose is not our sub-processor: it processes the data under its own terms and privacy policy, which you accept and are responsible for, including any costs. Read them before choosing: for example, anyone using Gemini's free tier from the European Union falls under the conditions Google sets for the European Economic Area.

Without keys, nothing goes to the cloud: Dettami formats the text with rules that run on the computer. And in password fields Dettami sends nothing to the cloud and saves nothing in the history.

On Litchi's servers, in Germany, we process the data needed for you to use Dettami. For each group you will find what it is for, the legal basis and how long we keep it.

Account data is required to use Dettami: without it we cannot create the account. Billing data is required to activate the paid subscription and issue the invoice.

• Performance of the contract (Art. 6(1)(b) GDPR): the account, the service, the team, the subscription, the referral programme.
• Legal obligation (point c): invoices and accounting records, requests from authorities.
• Legitimate interest (point f): service security, technical logs, prevention of abuse and fraud, service emails. These are limited processing activities that anyone using an online service expects; you can still object (section 12).
• Consent (point a), where needed: for example, we only send you promotional messages if you consent. You can withdraw it at any time, with no consequences for anything else.

• We do not sell your data or hand it to anyone for their own purposes.
• We do not run advertising, ours or anyone else's, and we do not profile people.
• We do not use dictations, audio or notes to train artificial intelligence models, ours or anyone else's. We do not even receive the audio or the text of your dictations.
• We do not send you marketing without your consent.
• We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR), apart from the automatic consequences set out in the contract: for example, if a payment fails, Dettami stops after a 7-day grace period.

Within Litchi, data is processed only by the people who need it for their work, who are authorised and bound by confidentiality. Outside Litchi, we share it only with those described here.

Providers working for us

They process data on our behalf, only on our instructions and under a contract that binds them to the GDPR (Article 28). For customer organisations they are sub-processors; if we change one, we tell customers at least 15 days in advance.

Independent controllers

• Stripe, for card and payment data, under its own privacy policy.
• Google, only if you choose “Sign in with Google”: it gives us your name, email and account identifier, and handles the sign-in under its own privacy policy.
• The AI providers you choose with your own key (section 4).

Legal obligations

Electronic invoices go through the Italian Revenue Agency's exchange system (Sistema di Interscambio), and accounting data is seen by the professionals who assist us with tax obligations. We disclose data to authorities only when the law requires it.

Within your organisation

Your team's admins see the members, their roles and the team's aggregate usage; per-person usage detail only if they turn it on (it is off by default). The team sees the shared glossary and snippets and, in the weekly leaderboard, only those who choose to appear.

Downloads on first launch

On first launch the app downloads, once, the speech model from Hugging Face; on a Mac also some Python tools from GitHub and PyPI, while Windows needs no Python. Like any site you download a file from, those services see your computer's IP address; they receive no other personal data.

Dettami's servers and database are in Germany, in the European Union. Backups stay in Germany, and their off-site copy is kept in the European Union (Cloudflare R2 with EU jurisdiction).

Some providers are companies based outside the European Economic Area (EEA): Resend and Cloudflare in the United States. Where processing involves a transfer of data outside the EEA, it takes place with the safeguards of Chapter V of the GDPR, such as the Standard Contractual Clauses approved by the European Commission. You can ask us for information about these safeguards, and for a copy, by writing to info@litchisolutions.com.

If you use your own AI key, the provider you choose may process the text outside the EEA under its own terms: that relationship is between you and them (section 4).

• Account, team, linked computers and usage counts: as long as the account exists. When you delete it, the account and the counts are gone.
• Synced meeting notes: until you or an admin delete them.
• Invitations and invite links: they expire after 14 days.
• Billing data and invoices: 10 years, as required by Article 2220 of the Italian Civil Code, even after the account is deleted.
• Technical logs: 30 days.
• Backups: database backups rotate. They are kept for 7 days on the server, 30 days on object storage and up to 90 days in the off-site copy, then overwritten.

This means deleted data can remain in a backup for up to 90 days before disappearing completely. Meanwhile it stays protected and we do not use it, except to restore the service after a failure.

• Connections between the app, the website and our servers are encrypted (TLS).
• Passwords are stored with bcrypt: not even we can read them.
• Sign-ins use tokens that expire after 8 hours, renewed with refresh tokens that change at every use.
• The app licence is digitally signed.
• Access to the servers is limited to those who need it and uses cryptographic keys.
• Backups on object storage are encrypted.
• The service's keys and passwords are never in the code.
• The data on our servers stays in the European Union.

No system is one hundred percent secure. If a personal data breach occurs, we do what Articles 33 and 34 GDPR require: notify the Italian Data Protection Authority within 72 hours, where required, and tell you if there is a high risk to your rights.

You have these rights over your data (Articles 15–22 GDPR):

• access: to know what data we process and get a copy;
• rectification: to correct or complete it;
• erasure: from the portal (Privacy → Delete account) or from the app;
• restriction of processing;
• portability: from the portal (Privacy → Export my data) you download, as a JSON file, everything the server knows about you;
• objection to processing based on legitimate interest;
• withdrawal of consent, where processing is based on consent, without affecting what was done before.

The text and audio of your dictations are not in the export because we do not have them: they are on your computer.

To exercise your rights write to info@litchisolutions.com. We reply within one month; for complex requests this can extend to three months, in which case we tell you within the first (Article 12 GDPR). We may ask you to confirm your identity.

If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the EU country where you live or work, and go to court.

For data we process on behalf of an organisation (section 2), the request is handled with them: if it reaches us, we forward it and help them respond.

The Dettami website uses no tracking cookies, nor profiling or advertising cookies.

It stores in your browser, using local storage (a technology similar to cookies), only what it needs to work:

• access tokens, to keep you signed in to the portal;
• the language you chose;
• the referral code, if you arrive from someone's link, to apply it when you sign up;
• the page to return to after signing in with Google, only while the tab is open.

These are technical tools, strictly necessary for the service you ask for: under Italian law (Article 122 of the Italian Privacy Code and the Garante's guidelines of 10 June 2021) they do not require consent. That is why the site shows no cookie banner: there is nothing to accept. If we ever add tools that require consent, we will ask you first.

When you pay or manage your subscription you move to Stripe's pages, and when you sign in with Google to Google's: their cookies and privacy policies apply there.

Dettami is for people aged 16 or over. We do not knowingly collect data from younger people: if you think this has happened, write to us and we will delete it.

If we change this policy, we publish the new version here with the updated date. If the changes are significant — for example a new use of data or a new provider receiving it — we tell you in advance, by email or in the portal.

For anything about your data write to info@litchisolutions.com, or by post to Litchi Solutions S.r.l., Via Carlo Torres 17/13, 31029 Vittorio Veneto (TV), Italy. The conditions of use are in the Terms of Service; for organisations the Data Processing Addendum also applies.