Guide
GDPR and Dictation Apps: What to Check
Before you hand a dictation app your voice, settle six things: where the audio is processed, whether it’s stored, whether anyone trains on it, who the subprocessors are, whether there’s a data processing agreement, and which region it all runs in. This page is that checklist, with SpeechDone’s answers next to it.
Updated
First: what this page is and isn’t
This is orientation, not legal advice. We don’t offer a seal: we state facts, and you judge them for yourself and your work. The privacy policy is the binding text.
The list fits any dictation app, not just ours. If you dictate content covered by professional secrecy, as a doctor, lawyer or tax advisor, get every point answered in writing.
The checklist
1. Where is the audio processed?
On the device or on the provider’s servers? If servers: whose, and in which country? According to Apple, Dictation requests on iPhone are processed on the device in many languages. For other providers’ apps, the answer is in their privacy policy.
2. Is the audio stored?
Ask whether the recording is deleted after recognition, where it sits briefly and for how long. Texts and history count too: where does the result end up?
3. Does anyone train on it?
Can providers use your recordings to improve their own models? That’s a question for every provider in the chain, not only the app itself.
4. Who are the subprocessors?
A dictation app is several services: server, speech recognition, text processing. Ask for a list of who gets what.
5. Is there a data processing agreement?
If you dictate other people’s personal data, you need a DPA under Art. 28 GDPR. For professions with a duty of confidentiality, a confidentiality undertaking often comes on top.
6. Which region, and who decides?
Does it stay in the EU? Does the app switch regions on its own, say when a service is down? Or do you decide?
How SpeechDone answers the six points
| SpeechDone’s answer | |
|---|---|
| 1. Where is it processed? | On servers, not on your iPhone. Our server is hosted at Hetzner in Germany. Recognition runs only on EU servers: Deepgram (Deepgram, Inc., USA, processing on EU servers) and Mistral AI (Paris). |
| 2. Stored? | Your recording isn’t stored on our server, it’s only processed in memory during recognition. Your history lives in your own iCloud. |
| 3. Training? | Not by any provider: we opt out with Deepgram on every request, and with Mistral training is switched off in our account. |
| 4. Subprocessors? | There is a public list of subprocessors. |
| 5. DPA? | You sign the DPA under Art. 28 GDPR with us in text form. A confidentiality undertaking under § 203 of the German Criminal Code comes with it. |
| 6. Region? | Always the EU. There is no switch to the US, and SpeechDone does not fall back there when something is down. |
As of October 16, 2026. The privacy policy is the binding text.
The answers in more detail
Two recognizers. Deepgram transcribes live so you see the text while you speak. Mistral (Voxtral) recognizes the recording again in sections, and that text is what gets inserted. If Mistral doesn’t answer in time, the text from Deepgram is used. Both receive the recording only for recognition.
We say no more than we can back up. That’s why you won’t find a line like “everything stays in Germany” here. Our server is in Germany, while some providers are based outside the EU and process on EU servers. And we say “no training” only where we know it for that provider.
Your history. It lives in your own iCloud by default. Style learning is something you can switch off: it keeps your latest dictations as text on our server for 30 days at most.
What SpeechDone reads. SpeechDone doesn’t read your screen. To set the tone, it only needs to know which app you’re writing in. In Edit mode it reads the text in the current field, because that’s the text it’s meant to rewrite.
Documents you can look at
The contract text is on the DPA page, the service providers are on the subprocessors page. What SpeechDone does with which data is in the privacy policy.
SpeechDone isn’t in the App Store yet. If you join the waitlist, we email you once when it is, then delete your address.
Common questions
Is a dictation app GDPR compliant?
You can’t say that for an app across the board. It depends on what you dictate and how you use it. Check processing, storage, training, subprocessors, DPA and region.
Does SpeechDone store my recording?
Not on our server: the recording is only processed in memory during recognition. Your history lives in your iCloud.
Where is SpeechDone’s server?
At Hetzner in Germany. Recognition runs only on EU servers from Deepgram and Mistral AI.
Can I sign a DPA?
Yes. You sign the DPA under Art. 28 GDPR with us in text form. The text is at /en/dpa/.
Does SpeechDone process dictations in the US?
No. Recognition and text processing never run in the US, not even as a fallback.
Who else processes my data besides SpeechDone?
See the public subprocessor list at /en/subprocessors/.
Sources
- 1Apple: Dictate text on iPhone (iOS 26), retrieved October 16, 2026