Privacy policy

nyra health GmbH, Salzgries 19/3–4, 1010 Vienna, Austria, is the controller for all processing described here. Contact: info@nyra.health. Full company details are in the imprint.

Everything this site processes, in one list. Only the first two rows happen on an ordinary visit; the rest happen only when you act.

• Server logsIP address, browser and device information, requested page, timestamp.Processor: Vercel · every visit, no consent needed
• GitHub star countThe navbar shows how many stars CrisperWhisper has. Your browser asks GitHub for that number directly, which means GitHub sees your IP address and browser information.Processor: GitHub · every visit
• Product analyticsHow the site is used: pages viewed, how far down a page you scroll, how long a page stays open, which links and buttons you click, how you use the CrisperWhisper demo (which sample or language, how long the audio was, how long the model took), and how far you get in a form. Aggregate usage only, never the content you type and never the audio or transcript itself.Processor: Amplitude (EU servers) · only after you accept
• CrisperWhisper demo audioIf you record or upload audio in the live demo, that audio is transcribed by our own CrisperWhisper models running on our servers in the EU, and the transcript comes back to your browser. No third-party speech recognition service ever receives it. Kept for up to 7 days to investigate errors and abuse, then deleted.Processor: nyra health, on Google Cloud (EU region) · only when you use the demo
• Contact and licensing inquiry formsYour name, email address, company, and the message or answers you enter on /contact, /license, or the CrisperWhisper licensing dialog.Processor: Resend, Google Workspace · only when you use a form
• Bot protectionWhen you submit a form, technical browser signals are evaluated by Vercel BotID to tell humans from spam bots. No profile is built and nothing is used for any other purpose.Processor: Vercel · only when you submit a form

We do not use advertising trackers, social plug-ins, session recording, heat maps, or cross-site tracking of any kind, and we never sell personal data.

This site is hosted by Vercel Inc. When you visit, Vercel processes the technical data any web server needs - your IP address, browser and device information, requested pages, and timestamps - in short-lived server logs to deliver the site securely and reliably. Legal basis: our legitimate interest in operating the site (Art. 6(1)(f) GDPR). Vercel acts as our processor; where data is processed outside the EU, transfers rest on EU standard contractual clauses and the EU–U.S. Data Privacy Framework.

We use Amplitude with EU data residency (servers of Amplitude, Inc. located in the EU) to understand how this site is used in aggregate. It records page views and sessions, how far down a page you scroll and how long it stays open, which links and buttons you click (including links that lead off this site), how the CrisperWhisper demo is used, and how far you get in the contact and licensing forms. Amplitude runs only after you choose “Accept all” in the cookie banner or switch analytics on in the cookie settings; before that, no analytics code loads and no analytics cookie is set. Legal basis: your consent (Art. 6(1)(a) GDPR).

What analytics never sees is the content you produce. Text you type into a form is reduced to its length before it is reported, an email address to its domain (so we can tell a university from a hospital), and the demo to technical facts about the request - which sample or language, how many seconds of audio, how long the model took. The audio itself, the transcript, your messages, and your name are never sent to Amplitude.

You can withdraw consent at any time via “Cookie settings” in the footer. Withdrawing opts you out and deletes the cookies and browser storage Amplitude created on this device.

Cookies on this site fall into exactly two categories, and the cookie banner’s “Customize” option (or “Cookie settings” in the footer) lets you switch each one individually:

Essential. Your cookie choice itself, stored as a single entry in your browser’s local storage so we do not have to ask again on every visit. Storing the choice is technically necessary, sets no tracking cookie, and needs no consent. This category is always on.

Analytics. Amplitude’s cookies and browser storage, which exist only after you switch analytics on (or choose “Accept all”), and are removed if you later decline. There are no functional, marketing, or advertising cookies of any kind.

The CrisperWhisper pages let you record yourself or upload an audio file to see the model transcribe it. When you do, your browser sends that audio to our own inference service (nyra-research-dev.com, operated by nyra health GmbH) and receives the transcript back. Nothing is sent until you press record or pick a file, and the bundled example clips involve no audio of yours at all. Legal basis: performing the demo you asked for and our legitimate interest in offering it (Art. 6(1)(b) and (f) GDPR).

The transcription runs on our own CrisperWhisper models, on servers we operate in the European Union (Google Cloud Compute Engine, EU region, with Google acting as our infrastructure processor). Your audio is not sent to any third-party speech recognition provider and does not leave the EU. We keep it for up to 7 days so we can investigate errors and abuse of the demo, and it is deleted automatically after that. Legal basis for that short retention: our legitimate interest in keeping the demo working and free of abuse (Art. 6(1)(f) GDPR). Even so, this is a public research demo: please do not upload recordings of other people, or audio containing health data or other sensitive information.

If you use the form on /contact or the commercial licensing dialog on the CrisperWhisper page, we process the name, email address, company, and message you enter in order to answer you. The submission is delivered to our mailbox as an email by Resend, Inc. as our processor, and is written to our server logs so an inquiry is never lost if delivery fails. Legal basis: steps prior to entering a contract at your request (Art. 6(1)(b) GDPR), otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). Transfers to the United States rest on EU standard contractual clauses.

To keep spam bots out of these forms, submissions are checked by Vercel BotID, which evaluates technical signals from your browser session to distinguish people from automated scripts. This runs only for form submissions, builds no profile, and is used for nothing else. Legal basis: our legitimate interest in preventing abuse of our contact channels (Art. 6(1)(f) GDPR).

If you fill in the commercial licensing wizard on /license, we process what you enter - your email address, role, a description of what you are building, and your answers on capabilities, use-case type, deployment, and volume, plus any notes - to respond to and process your request. Legal basis: steps prior to entering a contract at your request (Art. 6(1)(b) GDPR). Submissions are stored in our lead-management tooling (Google Workspace, provided by Google Ireland Limited as our processor).

Please note that the wizard saves your answers step by step as you move through it, so if you enter an email address and then abandon the form, the answers you already gave still reach us. Write to us at licensing@nyra-labs.com and we will delete them. We keep inquiries for as long as needed to handle them and any resulting contract, then delete them.

If you email us (for example at licensing@nyra-labs.com), we process your address and the content of your message to answer you. Legal basis: Art. 6(1)(b) GDPR for contract-related requests, otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR).

The navbar shows the public star count of the CrisperWhisper repository. To display it, your browser requests that number from GitHub, Inc. on every page, which means GitHub receives your IP address and browser information even if you never click anything. Legal basis: our legitimate interest in showing the current state of our open-source work (Art. 6(1)(f) GDPR). No cookie is set by us for this, and no other content on the site is loaded from third parties.

Beyond that, the site links to external services such as GitHub, Hugging Face, LinkedIn, and nyra.health. Merely displaying those links transmits nothing; once you follow one, the privacy policy of the respective provider applies.

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR), and to withdraw any consent at any time with effect for the future. To exercise these rights, email info@nyra.health. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

We update this policy when the site’s data flows change - for example if a new processor is added. The date at the top reflects the latest revision.