Privacy Policy

Last updated: 2026-07-15

This Privacy Policy explains how LW Agency Limited (“Hushscript”, “we”, “us”) collects, uses, and protects personal data when you use the Hushscript website, application, and services (the “Service”). We handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the “PDPO”).

Who we are

The data user responsible for your personal data is LW Agency Limited, a company incorporated in Hong Kong.

• Registered office: Unit 2A, 17/F, Glenealy Tower, 1 Glenealy, Central, Hong Kong
• Correspondence: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong
• For any privacy question or request: support@hushscript.com

What we collect

• Account data – your email address and, if you set one, a securely hashed password. We never store your password in readable form.
• Profile and preferences – your language preference and the approximate country we associate with your account.
• Payment data – limited billing information from our payment processor, such as a customer reference, the fact that you have a valid payment method on file, and a record of your purchases (amount, currency, and date). For each purchase we also record the IP address and browser details it was made from and the version of the purchase terms shown to you, as evidence of the transaction. We never receive or store your full payment card number.
• Referral data – a random referral code, the relationship between referring and referred accounts, referral-credit events, and a keyed one-way representation of the payment-method fingerprint supplied by Stripe. We never store the raw fingerprint. We use the one-way representation across Hushscript regions only to determine whether a payment method was first used by that account and therefore qualifies both accounts for referral credits.
• Recordings and transcripts – the audio you submit for transcription (stored only until your transcript is finished, then deleted) and the transcripts produced from it, including any titles or speaker labels you add.
• Technical and security data – your IP address, the approximate location derived from it, device and browser information, and the signals we use to apply rate limits and detect abuse, together with limited diagnostic logs. This includes the IP address from which your account was created.
• Analytics and advertising data – information about how you reached and used our marketing website, together with limited, server-confirmed product-action metadata from our API. Product analytics includes stable action names and broad duration categories; it excludes app page views and browser clicks, filenames, transcript text and titles, speaker names, tags, prompts, questions, answers, form contents, and clipboard contents (see “Cookies, analytics, and advertising” below).

Our free in-browser tools process your files locally on your device and do not upload them to us, so we do not receive the files you use with those tools.

How we handle your recordings

Your browser extracts and compresses the audio from your file before it is uploaded, so the original video file is not sent to us. Your audio is processed by a third-party speech-to-text provider for the sole purpose of generating your transcript; we do not use your audio for any other purpose and do not use it to train machine-learning models. Your uploaded audio is stored only until your transcript is finished and is deleted afterwards; audio for jobs that fail is deleted as well. Your transcripts are stored privately to your account and remain available to you until you delete them or your account is closed.

How and why we use your data

We use personal data to:

• provide, operate, and maintain the Service, including transcription and your account;
• process payments and keep records of purchases;
• protect the Service – to apply rate limits, prevent fraud and abuse, confirm that requests come from a human rather than an automated system, screen for sanctioned jurisdictions, and document and, where necessary, contest fraudulent or disputed payments;
• communicate with you, including sign-in links and service messages;
• understand and improve how our website and Service are used, and to measure and deliver our advertising; and
• comply with our legal obligations and enforce our terms.

We rely on the grounds permitted by the PDPO, including your provision of data in order to obtain the Service, your consent where we ask for it (for example, for certain cookies), our legitimate business interests in operating and securing the Service, and compliance with applicable law.

Cookies, analytics, and advertising

Our marketing website (hushscript.com) uses cookies and similar technologies. We use Google Tag Manager to load Google Analytics (to measure traffic and usage), Google Ads (to measure and deliver advertising, including remarketing), and Ahrefs Web Analytics (to measure website traffic without cookies). Some of these tools may set cookies and collect identifiers and usage data.

Our application (app.hushscript.com) does not load analytics pixels, advertising scripts, analytics cookies, or a browser product-telemetry collector. Product measurement is derived from successful API requests and backend outcomes. We send selected content-free product actions and server-confirmed registration, payment-method verification, checkout, and purchase events to Google Analytics. Selected GA4 events are then imported into our linked Google Ads account for advertising measurement; our API does not send these events directly to Google Ads. We use the first-touch identifiers captured on the marketing website to connect those milestones to the originating visit. Where prior consent is legally required, the shared consent choice controls browser and server-side analytics/advertising delivery before it starts; elsewhere, both are enabled by default until the visitor changes the setting. For details and your choices, see our Cookie Policy; you can change your choice at any time via the “Cookie settings” link in our website footer.

Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our sign-in, sign-up, and submission forms against automated abuse. When you interact with a protected form, Turnstile receives your IP address and information about your interaction in order to determine whether you are a human. This processing is carried out by Cloudflare, Inc. and is governed by the Cloudflare Turnstile Privacy Policy, available at https://www.cloudflare.com/en-gb/turnstile-privacy-policy/.

Service providers and disclosure

We share personal data only as needed to run the Service:

• with our payment processor, Stripe, to take and record payments – and, when a payment is disputed, to contest the dispute with records of the purchase, its delivery, and your use of the Service (which the processor may pass to the card networks and the card issuer);
• with Cloudflare, our hosting, edge, storage, and bot-protection provider;
• with AssemblyAI, our speech-to-text provider, to generate your transcripts (audio from EU/EEA/UK/Swiss users is processed on AssemblyAI’s EU infrastructure);
• with Mailgun, our email provider, to send sign-in links and service messages;
• with Sentry, our error-monitoring provider, which receives diagnostic information about errors (such as error type, the page involved, and browser type); we scrub personal identifiers before sending and do not send your IP address to it; and
• with our analytics and advertising providers (Google Analytics, Google Ads, and Ahrefs Web Analytics) as described above. Google Analytics receives limited website and product-action events, and Google Ads receives selected conversion events imported from GA4; neither receives transcript or recording content.

We require our providers to protect personal data and to use it only to provide their service to us. We may also disclose personal data where required by law, to enforce our terms, or to protect our rights, our users, or the public. We do not sell your personal data. For a full list of our sub-processors, including purpose, data categories, and processing region, see our Sub-processor List.

International transfers

We and our service providers operate internationally, so your personal data may be processed and stored outside Hong Kong. Where we transfer personal data, we take reasonable steps to ensure it remains protected to a standard consistent with the PDPO.

Retention

We keep account and transcript data for as long as your account is active. If you close your account, sign-in is disabled immediately and your account data, transcripts, saved-card reference, referral code, referral relationships, and payment-fingerprint representations are scheduled for permanent deletion after 30 days. We may keep a non-reversible deletion marker to prevent delayed system messages from recreating deleted referral data. We automatically delete your transcripts after approximately 24 months of account inactivity. Logging back in, uploading a file, or making a purchase resets the inactivity clock so your transcripts are kept for as long as you remain active. Uploaded audio is stored only until your transcript is finished and is deleted afterwards. Anonymous preview and pending uploads expire automatically. We keep payment and transaction records – including the purchase evidence described under “What we collect” – for as long as required to meet legal, accounting, and tax obligations and to resolve payment disputes. Security and diagnostic logs are kept for a limited period.

Security

We protect personal data with measures including encryption in transit, access controls, and hashing of passwords. No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.

Your rights

Under the PDPO you have the right to ask whether we hold your personal data, to request a copy of it, and to request correction of any data that is inaccurate. To make a request, contact support@hushscript.com; we may need to verify your identity, and we may charge a fee permitted by the PDPO for complying with a data-access request. You may also withdraw any consent you have given. You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

You can delete your transcripts at any time from within the Service, and you can close your account from the account screen. Account closure disables sign-in immediately and schedules permanent deletion after 30 days.

International use

You may use the Service from a range of countries, and you are responsible for complying with the laws that apply where you access it. Wherever you use it, your personal data is handled as described in this Policy, and you may contact us at support@hushscript.com to exercise any rights available to you under the law that applies to you.

Changes

We may update this Policy from time to time. We will post the updated version here with a new “last updated” date.

Contact

• LW Agency Limited – support@hushscript.com
• Registered office: Unit 2A, 17/F, Glenealy Tower, 1 Glenealy, Central, Hong Kong