Legal

Privacy Policy

Revision 6
Effective: October 20, 2026

LW Agency Limited, Hong Kong (“Hushscript”, “we”, “us”), is responsible for the personal data described here. This Policy covers our website, application, Chrome extension, API, MCP server, and related services. We handle personal data under Hong Kong’s Personal Data (Privacy) Ordinance (PDPO) and other data-protection requirements applicable to our processing.

Contact: support@hushscript.com · Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong.

Privacy safeguards and your choices

• Your recordings and transcripts are not sold or used to train machine-learning models. Our processing arrangements for speech recognition and optional generated outputs restrict model-training use.
• Stored transcript content is encrypted. Access controls help keep it private. The Service and relevant processing providers still need access to process your requests; encryption is a safeguard, not a claim of end-to-end encryption.
• Audio is kept temporarily for transcription, then deleted. Files awaiting minutes have a separate short waiting period. Cleanup can require retries, so deletion may not finish at the exact moment processing ends; the details are below.
• Additional features are optional. You choose whether to use Insights, cleanup, translations, private mode, previews, the extension, referrals, or third-party sign-in. Features you enable in your settings may run automatically, without a new request each time.
• Analytics and advertising are optional. They can be disabled through Cookie settings. Their regional defaults and server-side processing are explained below.

You choose what to submit. Please include only the information you need for the task and make sure you have permission to record and process it.

Data we collect and why

The data depends on the features you choose. Temporary audio processing and saved transcript content have different lifecycles, as explained here and under “Retention and deletion.”

You do not need to use every feature. Account and payment details are needed only for the account or payment functions that depend on them. If you choose not to provide data needed for a particular feature, that feature may be unavailable.

We use data for these purposes, related security and administration, and compliance with law. Where applicable law requires a legal basis, we rely on contract necessity, legal obligations, legitimate interests in operating and securing the Service where permitted, or consent where required. You can withdraw consent for processing that relies on it. This applies going forward; necessary legal, payment, or security records may still need to be kept on another lawful basis.

Recordings, transcripts, and optional generation

For local video files, the browser prepares audio before upload; the original video is not sent for transcription. Link imports are fetched by our servers. Submitted audio is sent to our speech-to-text provider. We delete that audio after transcription completes or fails. If a deletion attempt fails, cleanup retries it; this does not turn the upload into permanent recording storage.

If you upload without enough minutes, the file waits for credit. Unstarted waiting files and their preview data are scheduled for deletion within 4 hours; cancellation initiates earlier deletion. Adding minutes in time can start transcription without another upload.

An eligible new personal account can choose one free in-app preview of up to 5 minutes. The selected clip is sent for speech recognition before payment. Its result is linked to the account, is not a saved or exportable transcript, and is removed when full transcription finishes or the waiting file is deleted. Link imports, merged files, and private mode are excluded from this preview.

Insights, cleaned-up transcripts, and translations are optional. When you request them or enable automatic generation, transcript text, timestamps, and speaker labels are sent to our AI provider. We do not attach your audio, account email, or account identifiers to these requests. Content itself can contain personal details, including names or email addresses spoken in a recording. Our requests turn off saved responses and are subject to no-training terms. Separate provider retention for security or legal purposes may still apply; turning off saved responses does not remove those separate requirements or authorize model training. Generated outputs are stored encrypted and follow the transcript’s deletion rules.

Private mode is optional. It avoids saving a transcript to your account. It still needs temporary server-side processing and our speech-to-text provider to produce your result. An encrypted result is temporarily available for download for up to 24 hours, with deletion after download acknowledgment or expiry cleanup. Please save the downloaded archive and its password if you want to keep the result.

For Teams: the in-app preview described above is not available in a Teams workspace.

Free browser tools and Audio Self Check

Free browser tools process files on your device without uploading their contents. The website preview uploads a recording only when you choose transcription. If a tool fails, a limited error report helps us investigate; it does not upload the tool’s file or include its filename in diagnostic fields.

Where supported, the free voice recorder uses your browser’s private file storage for recovery. On a later visit, it offers the most recent eligible interrupted recording and removes older or expired leftovers, including those over 7 days old. Temporary tool outputs are cleared when the tool releases them or during later cleanup. Browser storage can be cleared or unavailable, so recovery is not guaranteed. You can remove local files by clearing site data.

The optional Audio Self Check sends aggregate compatibility results after you press Start: browser/OS major versions, device class, successful audio features, failure step, and month. The statistics contain no recording, IP address, or user identifier. Its connection test sends generated test data that is counted and discarded. Hosting and bot protection still receive connection data needed to handle the request; that data is not kept in the compatibility statistics.

Optional third-party sign-in

You can use email sign-in instead. If you choose an external sign-in provider, we receive its user identifier, email address, and verified-email status. We do not request or store your provider profile name. The Sub-processor List explains what each sign-in provider exchanges with us.

We keep the linked identity and link/use timestamps so we can recognize your chosen sign-in. Where the provider supports a private relay address, we also keep relay status and an encrypted token used to revoke the connection. The provider forwards mail to a relay address and may notify us about relay changes, revoked access, or account deletion. Notification receipts are kept for 30 days to avoid applying the same notice twice. Tokens are retained only for the sign-in method that needs them, as detailed in the provider list.

An existing account must confirm a proposed link; matching email addresses alone do not merge accounts. You can link or unlink providers in account settings if another sign-in method remains. Where provider revocation is supported, unlinking or requesting account closure starts that process, with limited retries if it fails. Linked identities are included in scheduled account deletion. You can also manage access with your sign-in provider, which handles its own account data under its own privacy policy.

Optional Chrome extension

Recording starts when you initiate it by click or shortcut. The extension records a tab, microphone, or both and uploads only when you choose. Uploaded content follows the processing and retention rules above.

On your device: recordings and imported files, recording-list metadata, optional tab titles/icons, the recorded tab’s site name (hostname only, kept until the upload is accepted), access token and email, preferences, transcription defaults and per-site transcription settings, and temporary export files. Uploaded audio stays in local recording storage until its transcript is ready, then is removed (at the latest 7 days after upload); uploaded list entries are kept for up to 30 days, limited to the newest 100. Copies you download or save to a folder remain under your control. Sign-in data is not synced to other devices.

Sent for Service use: selected audio and its size, duration, title, processing options, and access token; requests for balance, jobs, transcripts, dictionaries, and presets. Signing out clears sign-in data, uploaded-list entries, and most settings. If token revocation fails, the token is retained locally only for revocation retries.

Optional error reports: enabled unless you turn them off in the Account screen. They contain masked error details, code location, recent extension steps, software versions, OS type, the format of an added file, broad size/duration ranges, how far a failed upload got and how long it took, and an upload job reference where relevant. Reporting excludes audio, transcript text, titles, filenames, page addresses, email, and access tokens. Up to 20 unsent reports can remain locally for 24 hours. Reports pass through our relay before reaching the diagnostics provider. The relay removes IP addresses and tells the provider not to infer one from the connection.

The extension has no content scripts, advertising, or analytics and does not collect browsing history or page content. It may use the active tab’s title and icon for recording labels when that optional setting is enabled, and the recorded tab’s hostname to reuse your transcription settings for that site. Links from the extension to our website and application carry campaign tags naming the extension and the link, so the measurement described below can count visits and signups that come from it. It uses Hushscript’s sign-in page and does not connect separately to your third-party sign-in account.

Hushscript’s use and transfer of extension user data adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use that data to provide the extension’s visible features and diagnose errors, not for advertising, sale, or model training.

Cookies, analytics, and advertising

The marketing website uses optional analytics and advertising measurement, including remarketing. The Sub-processor List identifies the providers and the data each receives. Campaign/click identifiers and related browser records can connect a visit to a later signup or purchase.

The application has no browser analytics or advertising scripts. Our API can send content-free action and transaction events to analytics providers and conversion events to advertising providers using stored click identifiers or hashed identifiers. Hashed identifiers can still be matched by the receiving provider, so they remain subject to your advertising choice rather than being treated as anonymous. Recording content, transcripts, filenames, titles, prompts, and form or clipboard contents are excluded from these events.

Where prior consent is required, optional analytics and advertising remain off until consent. Elsewhere, they are enabled by default until you change your choice. An explicit choice controls subsequent processing; Global Privacy Control opts out of advertising, not analytics. Use Cookie settings in the website footer. See our Cookie Policy for technologies, retention, and controls.

Bot protection helps keep selected forms and tests free from automated abuse. It receives IP addresses and interaction signals under the bot-protection privacy notice. This security processing supports the feature you use and is separate from optional analytics and advertising.

Providers, disclosures, and international processing

We use providers for hosting and storage, speech recognition, optional text generation, payments, service email, security, diagnostics, and optional analytics/advertising. Our Sub-processor List is part of this disclosure and identifies each provider, its role, the data it receives, and processing regions.

Before forwarding diagnostic reports, we mask personal details, remove IP addresses, and disable the provider’s IP inference. App/API/MCP reports may include an opaque account reference and region/workspace tags to help investigate a fault; website and extension reports do not include an account identity. These reports are for troubleshooting, not a copy of your recordings or transcripts. Masking can miss unusual personal details in an error message, so it reduces exposure without guaranteeing that every identifier is removed.

We use contractual and technical safeguards appropriate to the provider’s role. Some providers, including sign-in and payment providers for their own purposes, also act independently under their own policies. We may disclose necessary data to comply with law, establish or defend claims, prevent fraud, or protect people and the Service. Payment disputes may involve sharing purchase, delivery, and usage evidence with processors, card networks, and issuers. We do not sell recordings or transcripts. Advertising disclosures remain subject to the controls above and applicable law, including any broader legal definition of sale or sharing.

We have signed HIPAA Business Associate Agreements (BAAs) with some subprocessors, as detailed in the Sub-processor List. These agreements do not cover the whole Service. For that reason, Hushscript does not sign BAAs with customers at this time; covered entities should not rely on it for protected health information under HIPAA. Please do not submit protected health information if your use requires a BAA with us. Vendor agreements alone do not establish compliance for your use.

Providers operate internationally, including outside Hong Kong and your country. EU/EEA/UK/Swiss speech recognition is routed to our provider’s EU infrastructure. That safeguard applies to speech recognition; other functions, such as payments, diagnostics, and optional text generation, can involve processing outside Europe. Applicable transfer requirements and safeguards depend on the processing and jurisdiction; contact us about a specific requirement before submitting affected data.

Retention and deletion

• Transcripts and outputs: retained until you delete them, an account or workspace retention rule applies, or account deletion applies. Optional retention settings and private mode let you limit storage.
• Inactivity: personal accounts and minutes remain, but transcripts are subject to deletion after approximately 24 months without qualifying activity. We send a warning about 30 days beforehand. Sign-in, completed transcription, purchases/credit grants, transcript access, and qualifying API-token activity reset the clock. A legal hold can prevent deletion.
• Account closure: disables sign-in and schedules deletion after 30 days. Limited records may still be needed for accounting, legal obligations, disputes, security, or fraud prevention. For example, a one-way card-deduplication record prevents repeated welcome-credit claims; it is not a card number or a copy of your content. Deletion markers help prevent delayed messages from recreating erased data.
• Optional quality feedback: deleting the associated transcript or your account clears feedback comments. Ratings, selected issue labels, account/transcript references, and copied processing metadata remain for quality analysis and Service improvement. These records retain references and are not anonymous; they do not retain the deleted recording, transcript body, or feedback comment.
• Audio and previews: removed through the completion, expiry, and cleanup processes described above. Provider deletion requests may require retries. If a cleanup attempt fails, the retry process can take longer than the scheduled period; we do not promise deletion from every system at the same instant.
• Other records: retained only as needed for their stated purpose, legal obligations, security, or claims. Diagnostic and browser records have separate limited lifecycles.

A deletion receipt helps you see which Service action was taken. It covers that action, rather than certifying erasure of every provider record. Copies you or another authorized person downloaded are outside our control and cannot be recalled by deleting the account copy.

For Teams: workspace retention settings and legal holds govern workspace content. The personal-account inactivity rule above does not apply to accounts that belong to a Teams workspace. Workspace content can remain in its custody after a member leaves or closes a personal account.

Security and your rights

We use encryption in transit, encryption of stored transcript content, access controls, and password hashing. These measures reduce risk, but no system can guarantee complete security. You can help protect your content by keeping credentials and archive passwords private and securing devices and exports.

Under the PDPO, you may request access to and correction of personal data. Other applicable laws may provide deletion, restriction, objection, portability, or consent-withdrawal rights. Contact support@hushscript.com; identity verification and lawful exceptions may apply. Any access fee is limited to what the law permits. You may complain to Hong Kong’s Privacy Commissioner for Personal Data or another competent authority.

Account controls support exports, transcript deletion, retention settings, and account closure. Legal holds may limit particular actions. Some service messages and processing are needed to keep an account or feature working, so they cannot be switched off while you use it.

For Teams: your workspace role and permissions may limit the actions you can take on workspace content.

Changes

We publish updates with an effective date and retain the preceding version. We provide further notice or seek consent where required by law.