Legal

Sub-processor List

Revision 2
Last updated: 2026-09-03

This page lists the third-party processors (“sub-processors”) that Hushscript (LW Agency Limited) uses to deliver the Service. We require each processor to protect personal data and to use it only to provide their service to us.

Hushscript has two surfaces, and the data a processor receives differs between them, so they are listed separately:

• the marketing website (hushscript.com) – the public pages, the free anonymous preview, and the free in-browser tools, used without an account.
• the application (app.hushscript.com) and its API – the product surface you use as a registered user.

We will notify users of material changes to this list in advance where required by applicable law. For questions, contact support@hushscript.com.

Marketing website (hushscript.com)

Cloudflare

• Purpose: Hosting, content delivery, edge computing, bot protection (Turnstile), first-party delivery of measurement tags, and DNS.
• Data categories: IP addresses, request metadata, cookies.
• Processing region: Global (Cloudflare edge network).
• Website: cloudflare.com

AssemblyAI

• Purpose: Speech-to-text for the free anonymous preview – converting the short preview clip into speaker-labeled text.
• Data categories: Preview audio (retrieved via a short-lived URL; deleted after processing, and unfinished previews expire automatically), preview transcript text. The provider-side copy is deleted when the preview completes, fails, or expires.
• Processing region: Audio from EU/EEA/UK/Swiss visitors is processed on AssemblyAI’s EU infrastructure. All other visitors: United States.
• Website: assemblyai.com

Mailgun

• Purpose: Transactional email – delivering the magic-link sign-in email you request from the website.
• Data categories: Email address, email content (sign-in link).
• Processing region: United States.
• Website: mailgun.com

Sentry

• Purpose: Error monitoring – capturing diagnostic information about website errors to help us identify and fix problems.
• Data categories: Error type, page URL (query strings removed), browser type, and breadcrumb events (personal identifiers are scrubbed before sending; IP address is not forwarded).
• Processing region: United States (Sentry’s US ingest).
• Website: sentry.io

Google

• Purpose: Website analytics (Google Analytics, loaded through Google Tag Manager) and advertising measurement including remarketing (Google Ads; selected GA4 events are imported into Google Ads).
• Data categories: Cookie identifiers, Google ad click identifiers (gclid, gbraid, wbraid), query-free landing/referrer/campaign data, content-free page events. Collected only with your consent where required by law.
• Processing region: United States (global infrastructure).
• Website: google.com

Advertising partners (Meta, LinkedIn, X, Microsoft Advertising, LY Corporation)

• Purpose: Measuring the performance of our advertising on those platforms. A partner’s tag loads only while we run campaigns there.
• Data categories: Cookie identifiers, the platform’s own ad click identifier (fbclid, li_fat_id, twclid, msclkid, yclid), content-free page events. Collected only with your consent where required by law; the browser’s Global Privacy Control signal is honored as an advertising opt-out.
• Processing region: United States (global infrastructure); LY Corporation: Japan.
• Websites: meta.com, linkedin.com, x.com, ads.microsoft.com, lycorp.co.jp

Application (app.hushscript.com), used as a registered user

Stripe

• Purpose: Payment processing – handling card authorization, payment records, and customer identity for billing.
• Data categories: Name (optional), card details (tokenized; we never see the raw card number), billing address (optional), purchase history, customer reference.
• Processing region: United States (global infrastructure).
• Website: stripe.com

Cloudflare

• Purpose: Hosting infrastructure.
• Data categories: IP addresses, request metadata, cookies, audio and transcript data at rest (encrypted), account and usage data.
• Processing region: Global (Cloudflare edge network); EU/EEA/UK/Swiss user data is primarily processed on Cloudflare’s EU infrastructure.
• Website: cloudflare.com

AssemblyAI

• Purpose: Speech-to-text transcription – converting uploaded audio into text, speaker labels, and language detection.
• Data categories: Audio content (retrieved via a short-lived URL; not stored by us after transcription), transcript text. The provider-side transcript copy is deleted right after your transcript is saved.
• Processing region: Audio from EU/EEA/UK/Swiss users is processed on AssemblyAI’s EU infrastructure (api.eu.assemblyai.com). All other users: United States.
• Website: assemblyai.com

OpenAI

• Purpose: AI generation – insights, the cleaned-up transcript version, and transcript translations.
• Data categories: Transcript text with its timestamps and speaker labels, including any speaker names the user has assigned; never your audio, email address, or account identifiers. Requests are sent with provider-side storage disabled, under terms that do not allow the provider to use your content to train its models.
• Processing region: United States.
• Website: openai.com

Mailgun

• Purpose: Transactional email – delivering magic-link sign-in emails and service messages.
• Data categories: Email address, email content (sign-in link, service notices).
• Processing region: United States.
• Website: mailgun.com

Sentry

• Purpose: Error monitoring – capturing diagnostic information about application errors to help us identify and fix problems.
• Data categories: Error type, page URL (query strings removed), browser type, and breadcrumb events (personal identifiers are scrubbed before sending; IP address is not forwarded).
• Processing region: United States (Sentry’s US ingest).
• Website: sentry.io

Google

• Purpose: Product and conversion measurement – our API sends server-confirmed, content-free events (registration, payment-method verification, purchase) to Google Analytics; selected GA4 events are imported into Google Ads.
• Data categories: Pseudonymous analytics identifiers, event names, broad duration categories, campaign attribution data, purchase value and currency. No transcript or recording content, filenames, titles, prompts, IP addresses, or browser details. Sent subject to your consent where required by law.
• Processing region: United States (global infrastructure).
• Website: google.com