Last updated: 10 March 2026
This Privacy Policy explains how Strategic Minds Group Limited, trading as Tota ("we", "us", "our"), collects, uses, and protects your information when you use the Tota application ("the App") and the website at https://www.heytota.com ("the Website").
We are registered in England and Wales. Our registered office is at 57 Nine Elms Lane, London, SW11 7DF. For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, we are the data controller.
1. Our Privacy Commitment
Tota is designed with privacy at its core. The App performs all voice transcription entirely on your device using the OpenAI Whisper speech recognition model and WhisperKit by Argmax, Inc. These open-source components run locally on your device's hardware. Your audio recordings and transcribed text are never sent to our servers, to OpenAI, to Argmax, or to any other third party. We do not have access to, and cannot retrieve, any content you create using the App.
2. Information We Collect
2.1 Information We Do Not Collect
Through the App itself, we do not collect:
- Audio recordings or voice data
- Transcribed text or notes
- Personal data, account information, or login credentials (the App does not require an account)
- Device identifiers or usage analytics from within the App
2.2 Information Collected via the Website
When you visit our Website, we may collect limited information through cookies and similar technologies, as described in our Cookie Policy. This includes:
- Google Analytics data: anonymised information about how visitors use our Website, such as pages visited, session duration, approximate geographic location (city/region level), device type, browser, and referring website. Google Analytics uses cookies to collect this data. IP addresses are anonymised.
- Google Ads data: if you arrive at our Website via a Google advertisement, Google Ads may use cookies to measure the effectiveness of the advertisement and to serve relevant ads. This may include conversion tracking data.
2.3 Information Collected via Purchases
If you purchase the App through our Website, payments are processed by Lemon Squeezy (Lemon Squeezy LLC), who acts as the Merchant of Record. Lemon Squeezy may collect:
- Your name and email address
- Payment information (processed securely by Lemon Squeezy; we do not see or store your full card details)
- Billing address and VAT number (where applicable)
- Transaction records
Lemon Squeezy processes this data as a data controller in its own right for payment processing and tax compliance purposes. Please refer to Lemon Squeezy's privacy policy for details on how they handle your data.
We receive from Lemon Squeezy a limited set of information relating to your purchase, including your name, email address, and transaction details. We use this information to fulfil your order and provide customer support.
2.4 Customer Emails
Transactional emails related to your purchase (such as order confirmations, receipts, and licence keys) are sent by Lemon Squeezy on our behalf. We may also use the email address associated with your purchase to respond to support enquiries you initiate. We may send the occasional marketing or product update email once you become a customer of Tota. You can unsubscribe from these emails at any time by using the unsubscribe link included in each email.
3. Legal Basis for Processing
Under the UK GDPR, we rely on the following legal bases:
- Contract: to process purchase information necessary to fulfil your order and provide customer support (Article 6(1)(b)).
- Legitimate interests: to operate and improve our Website, including through analytics data, and to send occasional marketing or product update emails to existing customers in accordance with the soft opt-in under the Privacy and Electronic Communications Regulations 2003, where our interests do not override your rights and freedoms (Article 6(1)(f)). You can opt out of marketing emails at any time.
- Consent: for the placement of non-essential cookies (such as Google Analytics and Google Ads cookies) on your device when you visit our Website. You can withdraw consent at any time through our cookie banner or your browser settings (Article 6(1)(a)).
- Legal obligation: to retain transaction records as required by tax and accounting regulations (Article 6(1)(c)).
4. How We Use Your Information
We use the limited information we collect for the following purposes:
- To process and fulfil purchases made through the Website
- To provide customer support and respond to your enquiries
- To understand how visitors use our Website so we can improve it
- To measure the effectiveness of our advertising
- To send occasional marketing or product update emails to existing customers
- To comply with legal and tax obligations
5. Data Sharing
We do not sell your personal data. We share information only with the following categories of third parties, and only to the extent necessary:
- Lemon Squeezy: payment processing, tax collection, invoicing, and transactional emails (as Merchant of Record).
- Google: website analytics (Google Analytics) and advertising measurement (Google Ads). Data is processed in accordance with Google's privacy policy.
- Apple: iOS app distribution and payment processing for App Store purchases, governed by Apple's privacy policy.
We may also disclose your information if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
6. International Data Transfers
Some of our third-party service providers (including Google and Lemon Squeezy) are based outside the United Kingdom. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or that the transfer is to a country that has been deemed to provide an adequate level of data protection.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
- Purchase records and transaction data: retained for up to 7 years to comply with UK tax and accounting requirements.
- Customer support correspondence: retained for up to 2 years after the last communication.
- Google Analytics data: retained in accordance with our Google Analytics settings (currently set to 14 months). IP addresses are anonymised upon collection.
- App data: as all App data is stored locally on your device, we have no data to retain or delete. You may delete your data at any time by removing content within the App or by uninstalling the App.
8. Your Rights
Under the UK GDPR, you have the following rights in relation to the personal data we hold about you:
- Right of access: you can request a copy of the personal data we hold about you.
- Right to rectification: you can ask us to correct inaccurate or incomplete data.
- Right to erasure: you can ask us to delete your personal data, subject to our legal obligations.
- Right to restrict processing: you can ask us to limit how we use your data.
- Right to data portability: you can request your data in a structured, commonly used, machine-readable format.
- Right to object: you can object to our processing of your data where we rely on legitimate interests.
- Right to withdraw consent: where we process data based on your consent (e.g. cookies), you can withdraw consent at any time.
To exercise any of these rights, please contact us at team@heytota.com. We will respond within one month of receiving your request. If we need more time (up to an additional two months for complex requests), we will let you know.
9. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: https://ico.org.uk
Telephone: 0303 123 1113
10. Children's Privacy
The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided us with personal data, please contact us at team@heytota.com and we will take steps to delete that information.
11. Security
We take appropriate technical and organisational measures to protect the personal data we process. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
The App's on-device processing model is itself a key security measure: because your voice and transcription data never leave your device, there is no risk of that data being intercepted in transit or compromised in a server breach.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email: team@heytota.com
Post: Strategic Minds Group Limited, 57 Nine Elms Lane, London, SW11 7DF
