AlecRae Voice is purpose-built for legal and accounting professionals who routinely handle sensitive, privileged, and confidential information. We understand the gravity of attorney-client privilege, professional confidentiality obligations, and regulatory compliance. This page explains precisely how your data is processed, stored, and protected when you use this platform.
01How Audio Is Processed
When you record a dictation, the audio is transmitted directly from your browser to the OpenAI Whisper API for transcription. Audio data is processed in real-time and is not stored permanently on our servers. No audio files are written to disk, cached, or retained beyond the duration of the transcription request.
Once the transcription is returned to your browser, the original audio data is discarded. We do not maintain audio archives, recordings, or any derivative audio content.
02How Text Is Processed
Transcribed text is sent to the Anthropic Claude API for AI-powered enhancement, formatting, and document structuring. Anthropic processes the text to fulfil the request and does not retain your input or output data beyond the scope of the individual API request, in accordance with Anthropic’s API data usage policy.
Neither the raw transcription nor the enhanced output is stored on our servers. All text processing is transient and stateless.
03Local Storage
Your dictation history, custom vocabulary, AI instructions, and application settings are stored in your browser’s localStorage. This data resides exclusively on your device and is never transmitted to or stored on our servers unless a server-side database has been explicitly configured.
Because this data is local to your browser, it is not accessible from other devices, browsers, or profiles. Clearing your browser data will permanently remove this information.
04Data Retention
- ■Audio recordings: Not retained. Discarded immediately after transcription.
- ■Raw transcriptions: Stored in browser localStorage only. Not transmitted to or held on any server.
- ■Enhanced text: Stored in browser localStorage only. Not transmitted to or held on any server.
- ■Session tokens: JWT cookies expire after 30 days. No session data is stored server-side.
05Encryption & Transport Security
All data transmitted between your browser and AlecRae Voice is encrypted via TLS 1.3. This includes audio uploads, transcription requests, enhancement requests, and authentication credentials.
Session authentication uses httpOnly, Secure, SameSite cookies containing signed JWT tokens. These cookies cannot be accessed by client-side JavaScript, mitigating cross-site scripting (XSS) attack vectors.
06Third-Party Data Processors
AlecRae Voice uses two third-party API services to provide its core functionality. No other third-party services receive your data.
OpenAI — Audio Transcription
Audio is sent to OpenAI’s Whisper API for speech-to-text conversion. OpenAI’s API data usage policy states that data submitted via the API is not used to train their models.
OpenAI Privacy PolicyAnthropic — Text Enhancement
Transcribed text is sent to Anthropic’s Claude API for document enhancement and formatting. Anthropic’s API data usage policy states that API inputs and outputs are not used to train their models.
Anthropic Privacy Policy07Attorney-Client Privilege
We recognise that legal professionals using AlecRae Voice may dictate content that is protected by attorney-client privilege or work product doctrine. The platform includes a dedicated Privacy Mode that, when enabled, disables all history storage for the duration of that dictation session.
When Privacy Mode is active, no transcription or enhanced text is written to localStorage or any other persistent storage. The dictation exists only in active memory and is lost when you navigate away or close the browser.
Important: While AlecRae Voice is designed to minimise data exposure, attorneys must independently assess whether the use of any cloud-based dictation tool is appropriate for their specific privilege and confidentiality obligations under applicable rules of professional conduct.
08GDPR & Data Rights
AlecRae Voice does not collect, process, or store personal data on its servers. All user-generated content is stored locally on your device. There are no user accounts, no tracking cookies, no analytics scripts, and no behavioural profiling.
You may exercise your data rights at any time:
- ■Right to access: All your data is visible in your browser’s localStorage and can be inspected via browser developer tools.
- ■Right to erasure: Clear all local data at any time via the application settings or by clearing your browser storage. No server-side data exists to delete.
- ■Right to portability: Export your dictation history and enhanced documents at any time using the built-in export functionality.
09Security Measures
- ■Password-protected access: The platform is gated behind admin authentication. No public access to dictation functionality.
- ■Session expiry: JWT sessions expire after 30 days. Expired sessions require re-authentication.
- ■Rate limiting: API endpoints are rate-limited to prevent abuse and denial-of-service attacks.
- ■No data monetisation: Your data is never sold, shared, licensed, or provided to any third party for marketing, analytics, or any purpose beyond the core transcription and enhancement services described herein.
- ■Secure hosting: The application is hosted on Vercel with automatic TLS certificate management, DDoS protection, and global edge network distribution.
10Contact
For questions regarding data handling, privacy practices, or to report a security concern, please contact us via the AlecRae website.
This privacy and data handling statement is provided for informational purposes and describes the current technical architecture of AlecRae Voice. It does not constitute legal advice and should not be relied upon as a substitute for independent legal counsel regarding your data protection obligations. AlecRae reserves the right to update this statement as the platform evolves. Material changes will be reflected in the “Last updated” date above.