Legal

Privacy Policy

Revision 5
Last updated: 2026-09-03

This Privacy Policy explains how LW Agency Limited (“Hushscript”, “we”, “us”) collects, uses, and protects personal data when you use the Hushscript website, application, and services (the “Service”). We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”).

Who we are

The data user responsible for your personal data is LW Agency Limited, a company incorporated in Hong Kong.

• Registered office: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong
• For any privacy question or request: support@hushscript.com

What we collect

• Account data – your email address and, if you set one, a securely hashed password. We never store your password in readable form.
• Profile and preferences – your language preference, your timezone and date/time display preferences, and the approximate country we associate with your account.
• Payment data – limited billing information from our payment processor, such as a customer reference, the fact that you have a valid payment method on file, and a record of your purchases (amount, currency, and date). For each purchase we also record the IP address and browser details it was made from and the version of the purchase terms shown to you, as evidence of the transaction. We never receive or store your full payment card number.
• Referral data – a random referral code, the relationship between referring and referred accounts, referral-credit events, and a keyed one-way representation of the payment-method fingerprint supplied by Stripe. We never store the raw fingerprint. We use the one-way representation across Hushscript regions only to determine whether a payment method was first used by that account and therefore qualifies both accounts for referral credits.
• Recordings and transcripts – the audio you submit for transcription (stored only until your transcript is finished, then deleted), the transcripts produced from it, including any titles or speaker labels you add, and the outputs you generate from a transcript, such as translations, insights, and a cleaned-up version.
• Technical and security data – your IP address, device and browser information, and the signals we use to apply rate limits and detect abuse, together with limited diagnostic logs. This includes the IP address from which your account was created.
• Analytics and advertising data – information about how you reached and used our marketing website, including campaign details and advertising click identifiers from the platforms we advertise on, together with limited, server-confirmed product-action metadata from our API. Product analytics includes stable action names and broad duration categories; it excludes app page views and browser clicks, filenames, transcript text and titles, speaker names, tags, prompts, questions, answers, form contents, and clipboard contents (see “Cookies, analytics, and advertising” below).

Our free in-browser tools process your files locally on your device and do not upload them to us, so we do not receive the files you use with those tools.

The voice recorder in our free tools and in the preview widget also runs entirely in your browser. Audio you record with a free tool stays on your device and is never uploaded to us. A recording you make in the preview widget is uploaded only if you choose to transcribe it; from that point it is handled exactly like an uploaded file under this Policy, and the audio is not kept after processing.

How we handle your recordings

Your browser extracts and compresses the audio from your file before it is uploaded, so the original video file is not sent to us. If you import a recording from a link, our servers fetch the linked file directly, and it is handled the same way from that point. Your audio is processed by a third-party speech-to-text provider for the sole purpose of generating your transcript; we do not use your audio for any other purpose and do not use it to train machine-learning models. Your uploaded audio is stored only until your transcript is finished and is deleted afterwards; audio for jobs that fail is deleted as well. Your transcripts are stored privately to your account, encrypted at rest, and remain available to you until you delete them or your account is closed.

If you generate insights, a cleaned-up transcript version, or a translation, the transcript text – with its timestamps and speaker labels, including any speaker names you have assigned, but never your audio, email address, or account identifiers – is sent to a third-party AI provider solely to generate that output. We send these requests with provider-side storage disabled, under terms that do not allow the provider to use your content to train its models. The generated outputs are stored encrypted in your account like your transcripts and are deleted with them.

How and why we use your data

We use personal data to:

• provide, operate, and maintain the Service, including transcription and your account;
• process payments and keep records of purchases;
• protect the Service – to apply rate limits, prevent fraud and abuse, confirm that requests come from a human rather than an automated system, screen for sanctioned jurisdictions, and document and, where necessary, contest fraudulent or disputed payments;
• communicate with you, including sign-in links and service messages;
• understand and improve how our website and Service are used, and to measure and deliver our advertising; and
• comply with our legal obligations and enforce our terms.

We rely on the grounds permitted by the PDPO, including your provision of data in order to obtain the Service, your consent where we ask for it (for example, for certain cookies), our legitimate business interests in operating and securing the Service, and compliance with applicable law.

Cookies, analytics, and advertising

Our marketing website (hushscript.com) uses cookies and similar technologies for analytics and advertising: Google Analytics and Google Ads, as well as tags from the other advertising platforms we run campaigns on (Meta, LinkedIn, X, Microsoft Advertising, and LY Corporation). When you arrive from an ad or a campaign link, we also store campaign details, advertising click identifiers, and related cookie identifiers in your browser so we can attribute signups and purchases to the visit that led to them.

Our application (app.hushscript.com) does not load analytics pixels, advertising scripts, analytics cookies, or a browser product-telemetry collector. Product measurement is derived from successful API requests and backend outcomes: our API sends selected content-free product actions and server-confirmed registration, payment-method verification, and purchase events to Google Analytics, and can report those milestones to the advertising platforms above using hashed identifiers and the stored click identifiers – never transcript or recording content.

Where prior consent is legally required, the shared consent choice controls browser and server-side analytics and advertising before either starts; elsewhere, both are enabled by default until the visitor changes the setting, and we honor the browser’s Global Privacy Control signal as an advertising opt-out. The technologies used on each surface and your choices are described in full in our Cookie Policy; you can change your choice at any time via the “Cookie settings” link in our website footer.

Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our sign-in, sign-up, and submission forms against automated abuse. When you interact with a protected form, Turnstile receives your IP address and information about your interaction in order to determine whether you are a human. This processing is carried out by Cloudflare, Inc. and is governed by the Cloudflare Turnstile Privacy Policy, available at https://www.cloudflare.com/turnstile-privacy-policy/.

Service providers and disclosure

We share personal data only as needed to run the Service, with:

• Stripe, our payment processor – to take and record payments and, when a payment is disputed, to contest the dispute with records of the purchase, its delivery, and your use of the Service (which the processor may pass to the card networks and the card issuer);
• Cloudflare – hosting, content delivery, storage, and bot protection;
• AssemblyAI – speech-to-text; audio from EU/EEA/UK/Swiss users is processed on AssemblyAI’s EU infrastructure;
• OpenAI – generating insights, cleaned-up transcripts, and translations from transcript text, as described under “How we handle your recordings”;
• Mailgun – sending sign-in links and service messages;
• Sentry – error monitoring; we scrub personal identifiers before sending and do not send your IP address to it; and
• our analytics and advertising providers – as described above and in our Cookie Policy.

Each provider’s purpose, the data categories it receives, and its processing region are listed per surface in our Sub-processor List. We require our providers to protect personal data and to use it only to provide their service to us. We may also disclose personal data where required by law, to enforce our terms, or to protect our rights, our users, or the public. We do not sell your personal data.

International transfers

We and our service providers operate internationally, so your personal data may be processed and stored outside Hong Kong. Where we transfer personal data, we take reasonable steps to ensure it remains protected to a standard consistent with the PDPO.

Retention

We keep account and transcript data for as long as your account is active. You can set an account-wide retention period so transcripts delete automatically after a period you choose, set or clear an auto-delete date on an individual transcript, and use private mode, in which no transcript is saved to your account at all. If you close your account, sign-in is disabled immediately and your account data, transcripts, saved-card reference, referral code, referral relationships, and payment-fingerprint representations are scheduled for permanent deletion after 30 days. We may keep a non-reversible deletion marker to prevent delayed system messages from recreating deleted referral data. We automatically delete your transcripts after approximately 24 months of account inactivity. Logging back in, uploading a file, or making a purchase resets the inactivity clock so your transcripts are kept for as long as you remain active. Uploaded audio is stored only until your transcript is finished and is deleted afterwards. Anonymous preview and pending uploads expire automatically. We keep payment and transaction records – including the purchase evidence described under “What we collect” – for as long as required to meet legal, accounting, and tax obligations and to resolve payment disputes. Security and diagnostic logs are kept for a limited period.

Security

We protect personal data with measures including encryption in transit, encryption of stored transcript content, access controls, and hashing of passwords. No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.

Your rights

Under the PDPO you have the right to ask whether we hold your personal data, to request a copy of it, and to request correction of any data that is inaccurate. To make a request, contact support@hushscript.com; we may need to verify your identity, and we may charge a fee permitted by the PDPO for complying with a data-access request. You may also withdraw any consent you have given. You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

You can delete your transcripts and their generated outputs at any time from within the Service – the transcript, AI-output, and account deletion flows return a downloadable deletion receipt, and each transcript has a data-journey view showing how its data was handled. You can download a copy of your account data and transcripts, and you can close your account from the account screen. Account closure disables sign-in immediately and schedules permanent deletion after 30 days.

International use

You may use the Service from a range of countries, and you are responsible for complying with the laws that apply where you access it. Wherever you use it, your personal data is handled as described in this Policy, and you may contact us at support@hushscript.com to exercise any rights available to you under the law that applies to you.

Changes

We may update this Policy from time to time. We will post the updated version here with a new “last updated” date.

Contact

• LW Agency Limited – support@hushscript.com
• Registered office: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong