This page is a courtesy translation. Only the French version is legally binding.
Privacy policy
Last updated: May 2026
Data controller
Ramaje Studio \nEmail: contact@zekast.studio
Data collected
In connection with the use of Zekast and zekast.studio, we collect the following data:
When purchasing a license
- First and last name
- Email address
- Payment information (processed exclusively by Stripe; we do not store any banking data)
- Billing address
When using the plugin
- Email address associated with the license (for validation and management)
- URL of the WordPress site on which the plugin is activated (for license management)
When hosting podcasts
Zekast offers two audio hosting modes:
- “BYO” (Bring Your Own): the user connects their own Bunny.net account via an API key. Audio files are stored on the Bunny.net infrastructure of the user’s account, and the user remains the sole data controller for them. In this case, Zekast has no access to the files.
- Zekast shared hosting (included in paid plans): audio files are stored on a Bunny.net account operated by Zekast, in a storage zone located in the European Union.
In all cases, listening analytics (number of plays on the site, number of downloads by listening apps for files hosted by Zekast, country-level geographic area, type of listening app, device type) are aggregated and stored without any persistent individual identifier. A cryptographic fingerprint rotated daily (SHA-256) is used for the anonymous deduplication of listens.
When transcribing audio (optional feature, deducted from your tokens)
Zekast offers automatic transcription of your episodes, provided by our processor Gladia, whose processing takes place in France. The service includes identifying the different speakers in an episode.
- How the file travels: when a transcription is started, a copy of the episode is placed in our storage space (Bunny.net, EU zone) and its address is sent to Gladia, which downloads the file to transcribe it. Gladia does not retain the audio file beyond processing. Only the transcribed text, with its timestamps and speaker labels, is sent back to your WordPress site, where it is stored in your database.
- No transfer outside the European Union takes place for audio transcription. The “bring your own OpenAI key” mode, which existed with the Whisper engine, has been removed: transcription now runs exclusively through the Zekast service.
- Associated text processing (optional): cleaning up a transcript and generating social media posts (Zekast Clips add-on) rely on an OpenAI language model. In both cases, only text is sent (title, description, transcript excerpt), never the audio file. This processing involves a transfer to the United States governed by standard contractual clauses (SCC).
Browsing data (zekast.studio website)
- IP address (anonymized)
- Browser type and operating system
- Pages visited and visit duration
Purposes of processing
| Data | Purpose | Legal basis |
|---|---|---|
| Email + name | License management and customer support | Performance of the contract |
| Payment data | Billing via Stripe | Performance of the contract |
| WP site URL | License validation and management | Legitimate interest |
| Audio files | Podcast hosting and distribution | Performance of the contract |
| Audio files (transcription) | Automatic transcript generation and speaker identification, via Gladia (France) | Performance of the contract (subscription to the service) |
| Text (transcript, title, description) | Transcript cleanup and social media post generation, via OpenAI | Performance of the contract (optional features) |
| Browsing data | Website improvement | Legitimate interest |
Retention period
- License data: Duration of the subscription + 3 years (legal accounting obligation)
- Billing data: 10 years (legal obligation)
- Audio files: Duration of the active subscription. Files are deleted from Bunny.net’s servers within days of cancellation, with no minimum duration commitment.
- Listener cryptographic fingerprint (“listener_hash”): 90 days maximum. This fingerprint (SHA-256 rotated daily, computed from the IP + User-Agent + a daily salt) makes it possible to count unique listens over short time windows. After 90 days, it is replaced with a null value in the database, making any deduplication or individual re-identification impossible.
- Aggregated listening analytics (total number of plays and downloads per episode, country-level geographic breakdown, app and device type): retained indefinitely. This data contains no directly or indirectly identifying information and is considered anonymous within the meaning of the GDPR (Recital 26: there is no reasonable means of tracing it back to a natural person).
Processors and transfers
We use the following service providers, which act as processors:
| Provider | Role | Country |
|---|---|---|
| Railway Corporation | Application and database hosting | EU (Amsterdam, Netherlands) |
| Bunny.net | Audio hosting and distribution (EU storage zone) | EU |
| Stripe, Inc. | Online payment | United States (SCC) |
| Resend, Inc. | Sending transactional emails (login links, invoices, notifications) | United States (SCC) |
| Cloudflare, Inc. | Content delivery network (CDN) in front of zekast.studio, caching and DDoS protection | United States (SCC) |
| Gladia | Audio transcription and speaker identification. The audio file is downloaded by Gladia from our storage space, transcribed, and then not retained. | France (EU) |
| OpenAI, L.L.C. | Text processing only, for optional features: cleaning up a transcript and generating social media posts (Zekast Clips add-on). No audio files are sent to OpenAI. | United States (SCC) |
Country lookup from the IP address (for listening analytics) is performed locally on our servers using a GeoLite2 database (MaxMind) that is downloaded periodically. No personal data is sent to MaxMind during this lookup.
Transfers to the United States (Stripe, Resend, Cloudflare, and OpenAI for optional text processing) are governed by standard contractual clauses (SCC) in accordance with the GDPR. The application, the database, the audio files, and transcription are processed in the European Union.
Your rights
In accordance with the GDPR (EU Regulation 2016/679), you have the following rights:
- Right of access: obtain a copy of your personal data
- Right to rectification: correct inaccurate data
- Right to erasure: request the deletion of your data
- Right to data portability: receive your data in a structured format
- Right to object: object to certain processing
- Right to restriction: temporarily restrict processing
To exercise your rights, contact us at: contact@zekast.studio
If a disagreement persists, you may file a complaint with the CNIL (the French data protection authority): cnil.fr