Legal and privacy

Controller

This website

heyaside.com is a static page hosted by Vercel Inc. (USA). Vercel processes standard server request data, such as your IP address and browser metadata, to deliver the site and keep it secure. The legal basis is our legitimate interest in operating the site (Art. 6(1)(f) GDPR). Vercel Inc. is certified under the EU-US Data Privacy Framework, so the transfer to the USA is covered by the European Commission’s adequacy decision for that framework. Contacting us by email or on X is entirely voluntary. Some illustrations on this site were created with AI image tools.

Analytics

We use Vercel Web Analytics to see how many people find this site and where they arrive from. It records a page view with the referring site, a country, and a device class such as phone or desktop, and reports all of it to us as aggregate numbers. It sets no cookies, it stores no identifier that could follow you to another site, and it does not build a profile of you. None of it is sold or shared with anyone. We also count four actions on the site, a click on a download button, the start of a checkout, a view of the pricing page and a wallpaper download, each recorded with the page it happened on and which button it was, and with no identifier of you attached. A wallpaper download is counted per wallpaper, so we know which pictures people want, and nothing about you is recorded with it. Our own counter, which runs on Cloudflare Workers and a Cloudflare D1 database in the EU region (Cloudflare, Inc., USA), records the same shape of thing next to those actions, as daily aggregate numbers and nothing else: the referring site, a country, a device class, a browser and an operating system family. It also counts how many distinct people came by on a day, by running your address and browser description through a one-way hash whose salt changes every day and feeding the result into a counting sketch that can be asked how many, never who, and cannot be read back. Nothing of that is stored, there is still no cookie and still no identifier on your device. The legal basis is our legitimate interest in knowing whether the site is working (Art. 6(1)(f) GDPR).

If your browser sends Do Not Track or Global Privacy Control, our own counter sends nothing at all.

Usage data from the app

The Aside app sends anonymous usage events to our relay. An event carries a random install id, the app version, the update channel, the name of the event and a coarse category such as “meeting recorded”, “dictation used”, “paywall shown” or “licence activated”, and a bucket for how long the app has been installed. Some events carry one coarse detail of the same kind, such as the two-letter language code a dictation ran in, or a bucket for how long a meeting was. It never carries transcript text, note content, names or email addresses. The install id is random, belongs to the install and not to you, and is not connected to your licence or your email address. The events are stored as daily counters and kept for 90 days. The legal basis is our legitimate interest in knowing whether the app works (Art. 6(1)(f) GDPR). You can switch it off in the app under Settings, Privacy, where the control reads “Share anonymous usage stats”.

The switch under it, “Share crash reports”, is a separate one. Turning one off leaves the other on. A crash report carries the technical trace of the crash, which can include file paths, and a file path can hold a note’s date and title. Neither the usage events nor the crash reports ever include audio, transcripts or note contents.

The launch list

Before Aside was released, the pages offered a field for your email address. Addresses left there sit in a mailing list at Resend, Inc. (USA), which is also the service that sends our mail, and they are used for exactly one message: the one telling you Aside is out. There is no newsletter, the address is passed to nobody else, and it is never used to identify you on this site. The legal basis is your consent (Art. 6(1)(a) GDPR), given by submitting the address. Resend is certified under the EU-US Data Privacy Framework, so the transfer to the USA is covered by the European Commission’s adequacy decision for that framework. Email hey@heyaside.com to have it deleted at any time, before or after that one mail.

Paying for Aside

Buying Aside runs through Stripe Managed Payments. Stripe is the merchant of record, which means Stripe is the seller of your licence, issues your receipt and handles the tax. To do that, Stripe Payments Europe, Ltd. in Ireland and Stripe, Inc. in the USA process your email address, your payment details and the country you buy from. The legal basis is the performance of that contract (Art. 6(1)(b) GDPR). What Stripe does with the data is set out in Stripe’s privacy policy. Where Stripe passes data on to the USA, that transfer is covered by the EU-US Data Privacy Framework for the Stripe entities certified under it, and by the EU Standard Contractual Clauses for the rest. From the payment we receive your email address and the confirmation that it went through, which is what we need to send you your licence key and to answer your support mail.

The Aside app

Aside runs on your Mac and is built to keep your meetings on your machine. Audio is transcribed on-device and is never uploaded. Your notes are written as Markdown files into a folder you own, not to our servers. Using the app requires no account, and we do not collect your recordings, transcripts, or notes.

Writing the note

Transcription runs on your Mac and the audio never leaves it. Writing the note does leave: to write it, Aside sends transcript text to the AI you picked, which is Aside AI by default, your own API key with a provider you choose, or a local model. That text is sent to produce that note and for nothing else. Point Aside at a local model with Ollama and nothing is sent anywhere at all.

The AI, the model and the service are yours to change at any time in the app.

When Aside AI writes the note, that transcript text is processed on our behalf by Anthropic, PBC (USA), which runs the model. We pass the text through, we do not store it, and we do not use it for anything but writing your note or answering the question you asked. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Anthropic is not certified under the EU-US Data Privacy Framework, so this transfer to the USA rests on the EU Standard Contractual Clauses; email hey@heyaside.com for a copy of them. If you would rather this did not happen at all, use your own API key with a provider you choose, or run a local model with Ollama.

Asking the copilot

When you ask the in-app copilot a question during or after a meeting, the relevant transcript text (not audio) is sent to the AI model provider that answers it, solely to generate that answer. On Aside AI that provider is Anthropic, PBC (USA), the same one that writes the notes. You can see and control this in the app.

How long Anthropic keeps it

Anthropic's published policy for the interface Aside AI uses is that they automatically delete inputs and outputs on their backend within 30 days of receipt or generation. Their commercial terms state that Anthropic may not train models on Customer Content. We have no zero data retention agreement with them, so the 30 days is the term that applies to Aside AI, and we cannot promise you a shorter one.

Their published exceptions apply to us as well. If their automated trust and safety systems flag a request as violating their usage policy, they retain the inputs and outputs for up to 2 years and the classification scores for up to 7 years. They may also retain material for longer where the law requires it.

Our own relay stores no transcript text at all. It passes the request to Anthropic and streams the answer back to your Mac, and the only things it writes to its own storage are per-day call counters, an install id and its access token.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and to object to processing, as well as the right to lodge a complaint with a supervisory authority. To exercise any of these, email hey@heyaside.com.

Operator

Represented by

Dominik Martin, Managing Director

Contact

Email: hey@heyaside.com

Register

Commercial register: Amtsgericht Passau
Registration number: HRB 13070

VAT ID

VAT identification number pursuant to § 27 a UStG: DE360600174

Responsible for content (§ 18 Abs. 2 MStV)

Dominik Martin, address as above.