A downloaded local model can keep the speech-recognition step on your computer. That can reduce one external data flow; it does not certify Voicetypr or your workflow as GDPR compliant.
Last verified: July 27, 2026
Publisher and method: Voicetypr publishes this page. We reviewed the official GDPR text, European Commission and EDPB guidance, the public Voicetypr source, and the current privacy policy. This was not outside-counsel review, a DPIA, a security audit, or a GDPR certification.
Role-based verdict
Local processing is a useful architecture choice. GDPR accountability attaches to the real processing activity, including the people, settings, devices, recipients, contracts, and destination systems around it.
Independent professional
Use a downloaded local model when you want recorded audio processed on the same computer. You still control the device, local history, destination app, backups, and whether optional network features are enabled.
Organization acting as controller
Local recognition can support a data-minimisation decision. Your organization still owns the lawful basis, transparency, retention, security, rights handling, processor contracts, transfer review, and evidence of accountability.
DPO, security, or procurement reviewer
Review the signed build, active model and settings, privacy policy, vendor list, destination application, endpoint controls, contracts, and any optional providers. This page is source review, not a DPIA or vendor approval.
Processing map
The public product evidence supports a narrow claim: a downloaded local model performs speech recognition on the device. The rest of the workflow must be assessed separately.
Recorded audio is recognized on the current device
Controller check: Secure the endpoint; define local history, destination-app, sync, backup, access, and deletion rules.
Operational data follows separate product and service paths
Controller check: Read the current privacy policy and settings; identify recipients, purposes, retention, and transfer safeguards.
Recorded audio goes to the selected speech provider
Controller check: Assess the provider, lawful basis, Article 28 terms where applicable, retention, security, and Chapter V transfer position.
Transcript text goes to the configured AI provider
Controller check: Treat text as a distinct disclosure and vendor decision even though the original audio can remain local.
Audio travels to another machine on the private LAN
Controller check: Include both endpoints and the network in the trusted boundary; review the documented transport-security limits.
For the fuller technical boundary, read the local dictation data-flow guide. If another computer performs recognition, include the LAN transcription path in the review.
Controller checklist
Article 5 makes the controller accountable for the processing principles. Depending on the use, Articles 6, 9, 13, 25, 28, 30, 32, 35, and Chapter V may also be relevant. The correct analysis is specific to your facts.
Define why personal data is dictated, who determines the purposes and means, and which Article 6 basis applies. Special-category data can require an additional Article 9 condition.
Tell data subjects what is processed, why, for how long, which recipients receive it, whether transfers occur, and how rights and complaints can be exercised.
Choose a downloaded local model when that matches the policy. Control cloud speech, AI formatting, LAN sharing, diagnostics, sync, and destination-app features separately.
Local processing still needs access control, endpoint security, encryption decisions, backups, deletion schedules, resilience, and regular testing proportionate to risk.
For every external recipient, determine its role, Article 28 terms where applicable, subprocessors, processing locations, and Chapter V mechanism. Do not infer this from an 'EU-hosted' slogan.
Keep evidence for configuration, policies, contracts, training, rights handling, and risk assessment. Recheck after product, provider, workflow, or legal changes.
Limit of this guide
This page explains product architecture and points to primary law and regulator guidance. It is not legal advice and does not establish that Voicetypr, a particular organization, or a particular use is compliant. The controller must make and document that determination, with qualified advice where needed.
Legal statements were checked against official EU sources. Product-boundary statements were checked against Voicetypr's public repository and should be read alongside the current privacy policy. No independent legal or technical audit was performed for this page.
Direct answers based on the official GDPR text, regulator guidance, and currently documented Voicetypr data paths.
Need facts for an internal review? Start with the privacy policy and public source links above. For a legal conclusion about your organization, consult a qualified data-protection professional.
related pages
Move from the policy to the exact local, offline, and private-network boundary your workflow will use.
Policy
Review the current disclosures for local data, licensing, support, analytics, providers, retention, and rights requests.
Data flow
Separate local speech recognition from license checks, telemetry, cloud speech, formatting, and destination-app storage.
Buyer guide
Compare documented local-transcription options without treating offline capability as a compliance certificate.
Private LAN
See what crosses the LAN, which machine performs recognition, and which transport limits need review.
3-day free trial. No credit card. Select a downloaded local model, review every optional network feature, and validate the complete workflow before approval.