# Whisperstream Privacy Policy **Version 2.0** **Effective 2026-09-13** **Last updated 2026-09-13** This Privacy Policy explains how Lanreal Technologies Inc. ("Lanreal," "we," "us," or "our") collects, uses, shares, and retains personal information in connection with the Whisperstream desktop application for Microsoft Windows (the "Software"). It also describes the rights you have with respect to that personal information and how to exercise them. By installing and using the Software, you acknowledge that you have read and understood this Privacy Policy. ## 1. Introduction and Scope Whisperstream is a local, on-device dictation application for Microsoft Windows. It captures microphone audio when you press a push-to-talk hotkey, transcribes that audio on your own computer using a speech recognition model that runs entirely on your CPU, and types the resulting text into the focused window. **Speech recognition runs on your device.** Version 2.0.0 is the final free edition with Pro functionality included. It does not activate or validate licenses or submit in-app ratings, reviews, feedback or feature requests. A temporary route may offer optional critical corrective updates before the fixed cutoff shown in the Software, as described in Section 3.2. This does not promise ongoing development or change continuing EULA obligations. Model downloads disclose your IP address, ordinary HTTP headers and the requested model URL to Hugging Face or, for speech-model backup downloads, GitHub and their delivery infrastructure. There is no Cloudflare R2 fallback, remote model-availability manifest or online cloud-model catalog request. Other data may leave your device when you deliver text to a destination application or enable optional cloud cleanup. Imported audio remains local, although its resulting transcript may enter cloud cleanup if you enabled it. Agent Speak exchanges content with Claude Code over the local loopback interface; Claude Code separately controls any transmission to its configured model provider. Each flow is described in detail in this Privacy Policy. This Privacy Policy covers the Whisperstream desktop application only. It does not cover the marketing website at `whisperstream.io`, which is governed by a separate website privacy notice published at `https://whisperstream.io/privacy-website`. If you reached this document from the marketing site, please refer to the website privacy notice for information about how the site itself is operated. Earlier releases may have contacted Polar, Cloudflare, Supabase or Featurebase. Cloudflare also serves the temporary current update route in Section 3.2. Historical processing descriptions below preserve information about those flows and records still retained; they do not describe new Version 2.0 transmissions except for the expressly identified temporary update route. Removing a feature does not mean records have been deleted, providers have been terminated or earlier rights have ended. Retained data remains subject to this policy's purpose limits, rights and safeguards. This policy does not cover the separate checkout and payment information Polar collected directly for earlier purchases under its own privacy policy at `https://polar.sh/legal/privacy`. Version 2.0 requires no purchase. In this Privacy Policy, 'personal information' means information about an identifiable individual, encompassing 'personal data' as defined by the GDPR (Article 4(1)), 'personal information' as defined by the CCPA (Cal. Civ. Code s.1798.140(v)), and 'personal information' as defined by Canadian federal privacy law (s.2(1)). ## 2. Who We Are The data controller responsible for the personal information described in this Privacy Policy is: **Lanreal Technologies Inc.** 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada Lanreal is a corporation incorporated under the *Business Corporations Act* (Ontario). Our registered office is in the Province of Ontario, and our operations are governed by Canadian federal and provincial law applicable therein. **Privacy Officer designation.** In accordance with Canadian federal privacy law (the Personal Information Protection and Electronic Documents Act), Lanreal Technologies Inc. has designated a Privacy Officer responsible for compliance with this Privacy Policy. The Privacy Officer can be contacted at `support@whisperstream.io`. Throughout the remainder of this document, "Canadian federal privacy law" refers to the statute named above. Under the European Union General Data Protection Regulation (GDPR), Lanreal is the "controller" of the personal information described in this Privacy Policy. Under the California Consumer Privacy Act (CCPA), Lanreal is a "business" that collects personal information about California residents through the Software. All privacy-related communication, including data subject rights requests, complaints, and general questions about this Privacy Policy, should be directed to `support@whisperstream.io`. This is Lanreal's single privacy contact channel for the Software. **EU Representative.** Lanreal is in the process of designating a representative in the European Union in accordance with Article 27 of the General Data Protection Regulation. Until a representative has been designated, individuals in the European Economic Area may direct any questions or requests relating to the processing of their personal data under the GDPR to Lanreal directly at `support@whisperstream.io`. This policy will be updated with the representative's contact details once the designation is complete. ## 3. Information We Collect The Software is intentionally narrow in the information it handles. This section enumerates every category of information associated with your use of the Software, in the order in which the underlying network activity happens. ### 3.1 License activation and validation data Version 2.0 does not contact Polar or require a license key, activation, periodic validation or device allowance. Historical trial and activation state does not limit this edition's functionality. Earlier releases sent a license key, static Whisperstream organization identifier, operating system family and device hostname to Polar's license API during activation. Periodic validation and deactivation sent the key, organization identifier and activation identifier, without retransmitting the hostname. Polar also received ordinary HTTP headers and the connection IP address. These requests did not include transcript or audio content, usage data or hardware serial numbers. Validation ordinarily occurred about once per seven days while online. Polar returned customer name and email to the earlier app, which stored them with the key in local HMAC-protected state. Earlier voluntary review and feedback submissions could include that email as described in Section 3.5. Those local and provider-held records may remain; Section 8 governs retention. Version 2.0 does not send them to Polar or a feedback service. ### 3.2 Update-check data Before the fixed transition cutoff shown in the Software, Version 2.0 may automatically check `https://releases.whisperstream.io/latest.json` for a critical corrective update. If you choose to install an available update, it downloads the signed update artifact from `releases.whisperstream.io`. Cloudflare receives your connection IP address, ordinary HTTP headers and the requested URL. An artifact URL identifies the release being downloaded. The Software does not attach a license key, account identifier, device identifier, microphone audio or transcript to these requests. Checks and update downloads are unavailable while the cutoff is unset or after it is reached. The route is blocked in Lockdown, before onboarding is complete, and while acceptance of the applicable EULA is pending. Corrective releases use the same cutoff. The Software verifies the update signature before installation; installation requires your action. Offline or unavailable update services do not disable local dictation with installed compatible models. After the cutoff, you may choose to open the discontinued-product/download page in your browser. That visit is governed by the website privacy notice and the destination's practices; the app does not silently visit the page. The cutoff does not delete earlier connection records or prove that older-client endpoints have been retired. Sections 5, 7 and 8 describe recipients, transfers and retention. ### 3.3 Speech-recognition model download data During setup, or after you select a language or speech-recognition engine, the Software downloads the required model if it is not already installed. Parakeet, Qwen and Cohere model files use pinned public Hugging Face URLs. Requests can redirect through Hugging Face's file-delivery infrastructure, including its Xet/CDN delivery hosts. For Parakeet v2/v3, Qwen and Cohere, if the source remains unavailable after retries, the Software tries the matching upstream sherpa-onnx release archive at github.com and release-assets.githubusercontent.com. The archive is verified against a packaged checksum before extraction and required files are verified before installation. Cancellation, disk, integrity and download-policy failures do not trigger a backup. The serving hosts receive your IP address, ordinary HTTP headers including the download library's User-Agent, and the requested URL, which identifies the model. The Software does not attach a Hugging Face authentication token, Lanreal account identifier, license key, device identifier, microphone audio, transcript, generated speech or cloud-provider API key to these requests. Each file is verified locally against a pinned cryptographic checksum before installation. There is no Cloudflare R2 fallback. The model catalog is packaged with the app; opening model settings does not request an R2 availability manifest. Already installed compatible models remain usable without a replacement download. Cohere Transcribe performs speech recognition on your device. Its model URL identifies the Cohere artifact, but your selected language remains local and is not included in the request. No audio or transcript is sent to Cohere or Hugging Face or GitHub for speech recognition. Optional cloud cleanup is separate (Section 6). Model-host roles and international transfers are described in Sections 5 and 7. ### 3.4 Data that stays on your device The following information is handled on your own computer and is not transmitted to Lanreal. User-directed delivery to a destination application and the optional outbound flows identified below are the specific exceptions to local-only handling: - **Audio recordings.** Microphone audio is held in random-access memory while each push-to-talk capture is transcribed on your CPU, and is never uploaded to any server. If you keep the local transcript history enabled with audio saving on (both are on by default, and both can be turned off), a copy of the recording is also stored, encrypted, on your own device, as described in the "Local transcript history" entry below. No audio data is ever transmitted off your device. **Voice data is not biometric data.** The speech recognition model processes your voice solely to convert speech into text. It does not create a voiceprint, does not perform speaker identification or authentication, and does not extract or store any biometric identifier from your voice. Under the GDPR (Article 9), biometric data is subject to enhanced protections only when processed for the purpose of uniquely identifying a natural person. Because the Software processes voice exclusively for transcription and not for identification, the voice data handled by the Software does not constitute biometric data within the meaning of Article 9. - **Transcribed text.** The text produced by the speech recognition model is typed into the window you have focused. If you keep the local transcript history enabled (it is on by default and can be turned off), the transcribed text (both the raw transcript and, if you use the optional AI cleanup feature, the enhanced version) is also stored, encrypted, on your own device, as described in the "Local transcript history" entry below. Transcribed text is never transmitted to Lanreal or retained by Lanreal in any form. - **Local transcript history.** The Software keeps a searchable history of your past dictations on your own device so that you can review, copy, and replay them. This history is enabled by default and can be fully disabled. It stores your transcribed text (the raw transcript and, where you used AI cleanup, the enhanced version) and, when audio saving is enabled, the recorded audio. The transcribed text and the audio are encrypted at rest using AES-256-GCM. The AES key is itself sealed using the Windows Data Protection API, bound to your Windows user account on the specific device, so the history can be opened only by the same Windows user on the same device. The raw transcript, enhanced transcript, saved audio, and waveform peaks used by the player are encrypted separately. Lightweight index metadata (such as a record identifier, timestamp, duration, model name, source type, and relative audio-file location) is stored unencrypted so the list can be sorted and displayed without decrypting its content. The history is kept inside your Windows user profile under `%LOCALAPPDATA%\Whisperstream\` (a `transcripts.db` index and a `recordings\` folder). Nothing in the history is ever transmitted off your device. You control it: a master "Save transcripts" toggle and a separate "Save audio" toggle let you keep a text-only history or turn history off entirely, and a retention window (1, 7, or 30 days, or forever, with 7 days as the default) automatically removes older entries. You may also delete an individual entry or clear the entire history at any time. See Section 8 for retention and deletion details. - **Local diagnostic logs.** In ordinary use, voluntary Lockdown Mode, and administrator-managed Lockdown Mode, the Software writes content-free operational events to a local `whisperstream.log` file under `%LOCALAPPDATA%\Whisperstream\logs\`. The active file and up to three backups are each limited to approximately 2 MiB. The Software excludes transcript, voice/audio, and Agent Speak content; passwords; recovery codes; API, transcript-encryption, and license keys or secrets; full email addresses; foreground process identity; imported-audio filenames and paths; browser hosts; and raw error text that could carry user content. Each application window also keeps a bounded in-memory frontend log buffer (up to 500 entries, 2 KiB per entry, and 128 KiB total). The backend re-sanitizes synchronized frontend entries and keeps at most 128 KiB across windows in process memory. A supplemental Lockdown diagnostic file accepts only code-defined event and field names, retains at most 256 events and 128 KiB, and contains no arbitrary user-supplied strings. These logs are never transmitted automatically. Lockdown does not pause, clear, or disable the diagnostic log, frontend capture, or support export. - **Usage statistics.** The Software keeps aggregate counters of how many transcriptions you have run, how many words you have transcribed, and how much recording time you have accumulated. These counters are stored locally in your Windows user profile and are never transmitted. - **Configuration.** Your settings, including your chosen hotkey, audio device, and word-override dictionary, are stored locally in a configuration file under your Windows user profile and are never transmitted. - **Lockdown access log.** While Lockdown Mode is effective, the Software keeps a separate content-free access log that records the time and an allowlisted operation type for transcript-history access and Lockdown state changes, together with a sanitized short record identifier when applicable. It never records transcript or audio content, your password or recovery code, or health information. The active `access.log` file and up to five backups are each limited to approximately 2 MiB. This audit log is stored only under `%LOCALAPPDATA%\Whisperstream\logs\`, is not included in support exports, and is not created for ordinary transcript operations outside Lockdown Mode. Lanreal does not automatically receive the local stores described in this Section 3.4. Particular content may nevertheless leave your device through a separate, user-directed flow described elsewhere in this Policy: finished text is delivered to the destination application under Section 3.10; a transcript may be sent to the cloud-cleanup provider you configure under Section 6; an Agent Speak reply is returned to Claude Code under Section 3.11; and historically submitted review, feedback, or Featurebase content was sent only through the voluntary submission flows described historically in Sections 3.5 and 3.12. Those recipients control their own copies under the terms identified in the applicable section. If you choose to download a diagnostic archive, the backend builds it in memory and streams it to the destination you select; it does not write an app-managed ZIP file. That downloaded copy is under your control. If you then send it to Lanreal as part of a bug report (for example, by attaching it to an email to `support@whisperstream.io`), Lanreal processes the information you send to diagnose the issue and retains it for the duration of that support interaction. A summary of the categories above, mapped to the CCPA categories of personal information, is provided in Section 13 of this Privacy Policy. ### 3.5 In-app ratings, reviews, and feedback (voluntary submissions) Version 2.0 does not display or submit the in-app rating, review or private feedback forms, or open their G2/AlternativeTo review prompts. Earlier releases allowed voluntary one-tap ratings and private feedback. Supabase received the selected star rating or typed feedback, the associated email address, the app version and ordinary HTTP connection information. The email could come from a Polar activation response or be entered by the user. Earlier written testimonial forms could additionally collect a display name, testimonial and separate public-display consent flag. These fields, including historical public-display consent, remain relevant to retained records. They are not a description of a future form planned for this edition. The review request did not attach a license key, dictation content, hostname, operating system, usage statistics or configuration. Lanreal used submissions to respond to feedback and improve the Software; public testimonial display required separate consent. You may withdraw that consent and request deletion under Section 10. Retained submissions are subject to the wind-down purpose limits and retention rules in Section 8. Removal of the submission feature is not evidence that the database was deleted. Earlier releases could open a fixed G2 or AlternativeTo URL in your browser after a five-star rating. The URL did not contain the rating, email or app version. Those sites separately received browser connection information and anything you submitted under their own policies; the app received no review completion signal. Direct visits to external sites remain governed by those sites' policies. ### 3.6 Lockdown Mode (optional hardening) Lockdown Mode is an optional setting you can turn on to harden the Software for privacy-sensitive and HIPAA-conscious workflows. It is off by default. Lockdown Mode is designed to support HIPAA-conscious workflows; it is not a HIPAA certification, it does not make the Software HIPAA compliant, and it does not replace your own compliance obligations. When Lockdown Mode is on: - **AI cleanup runs on your device only.** The cloud providers and self-specified endpoints described in Section 6 are disabled, and AI cleanup is forced to the on-device model, so Whisperstream does not send that transcript to a configured cleanup provider. - **Your transcript history is locked behind a password.** A key derived from a password you choose additionally wraps the transcript encryption key, on top of the AES-256-GCM encryption at rest and the Windows Data Protection API sealing already described in Section 3.4 (see Section 12 for the details). A one-time recovery code is created when you turn Lockdown Mode on and is the only other way to unlock your history. The history locks again automatically after an idle period you set, and repeated failed unlock attempts trigger escalating delays. - **Or you can choose to save nothing.** Instead of a password-protected history, you may turn Lockdown Mode on without saving transcripts at all, in which case no transcript history is written to your device. - **Safe diagnostic logging remains available; the content-free access log is separate.** The bounded local diagnostics described in Section 3.4 remain active so you can troubleshoot problems and prepare a useful bug report. The separate local access log records allowlisted transcript-history and Lockdown operations (never their content) and is not included in support exports. Whisperstream never uploads either log automatically. **Data-loss warning.** Your Lockdown Mode password and your recovery code are held only on your own device. Lanreal never receives your password, your recovery code, or your transcripts. If you set a transcript password and lose both your password and your one-time recovery code, you will not be able to unlock your transcript history through the Software, and Lanreal cannot unlock or recover it for you. There is no Lanreal-side backup. The Software offers a destructive reset that removes the still-locked transcript history through ordinary database and file deletion and turns off Lockdown Mode; it cannot restore the old records or securely overwrite the storage device. In Lockdown Mode, Whisperstream's audio, transcription, history, and AI cleanup pipeline stays on your device and Lanreal never receives that content. Lockdown Mode does not prevent the text from being delivered to the destination application you selected, and it does not disable Agent Speak or control Claude Code's provider connection. Those destinations handle data under their own terms. Section 14 of the Whisperstream End User License Agreement sets out the related disclaimers, including that Lockdown Mode is not a HIPAA certification and that, for this on-device workflow, Lanreal is not a business associate and there is no Business Associate Agreement to sign. Turning Lockdown Mode off and choosing a cloud AI provider would send transcribed text to that provider and change this; Lockdown Mode blocks the cloud providers to keep the Whisperstream pipeline on your device. ### 3.7 Optional voice feature model downloads Whisperstream includes an optional voice feature that reads an artificial-intelligence coding assistant's text replies aloud on your device. The feature is off by default and does nothing until you turn it on. Supertonic 3 INT8 is the default voice engine in Version 2.0. A complete Kokoro model already cached on your device remains usable in standard builds, including through an existing Kokoro or Automatic selection. Only new Kokoro downloads require experimental opt-in. If an existing Kokoro selection has no complete cached model, it changes to Supertonic; the speech-enabled setting and existing files are preserved. The engines have different voices and output characteristics. Updated EULA acceptance is required before content processing. If a required voice model is absent, enabling the feature downloads it, subject to the experimental opt-in required for new Kokoro downloads, from pinned public Hugging Face URLs through the delivery infrastructure described in Section 3.3. The hosts receive your IP address, ordinary HTTP headers and the model-specific URL. No spoken text, generated audio, license key, account information, authentication token or device identifier is attached. Files are verified against pinned checksums before installation. There is no R2 fallback. The Voice Models run entirely on your device. The Software does not transmit the text sent to the Voice Models or the audio they generate off your device for speech synthesis. Lanreal does not receive that text or audio and sends no separate feature-use telemetry. The model host can retain the ordinary access-log record described in Section 8, which can show that a model-specific file was requested. Turning the feature off stops the Software from using the Voice Models. You can remove a downloaded model from your device by deleting its applicable model directory under `%LOCALAPPDATA%\Whisperstream\models\`. If you selected a custom model storage location, delete the corresponding `models` or `local-llm` directory from that custom location instead. The Voice Models have different third-party license terms. Kokoro 82M is distributed under Apache License 2.0 and is not subject to the behavioural use restrictions described below. If you download, enable, or use Supertonic 3, your use of that model is subject to its OpenRAIL-M behavioural use restrictions. Those restrictions are set out in Section 27 of the Whisperstream End User License Agreement and reproduced in full in the `THIRD_PARTY_LICENSES.txt` file bundled with the Software. ### 3.8 Optional on-device AI cleanup model download Local cleanup can use S1-mini by Superwhisper or Gemma 4 E2B Instruct. When you set up Local cleanup, the Software can download missing model files for both models from their pinned Hugging Face sources and benchmark each model independently on your Device. The download hosts receive the connection information described in Section 3.3, including the requested model URL. Download requests do not include your transcript, cleanup instructions, user-supplied context, license key, account information, authentication token or device identifier. Files are verified locally before installation. The models and benchmarks run locally. Selecting S1-mini does not send your dictation to Superwhisper for processing. The private Stream-1 and Stream-1 Lite models are not offered by this edition. Cloud provider choices use a packaged/local catalog rather than an R2 catalog request; user-configured cloud processing remains governed by Section 6. ### 3.9 Trial, activation, and acceptance state stored on your device Earlier trial and activation records may remain in the current user's Windows registry under `HKCU\Software\Whisperstream` or in a development-state file. They may contain trial times, clock-rollback state, activation status, a license key, activation identifier, validation time and the customer name and email returned by Polar. Their HMAC detects modification but is not encryption. Version 2.0 does not use these historical records to limit functionality or contact Polar. They remain until you remove them as described in Section 8. The Software separately stores local records of the EULA version and content hash you accepted, the acceptance time, the Software version, the type of acceptance event, and any cloud-processing consent. EULA acceptance evidence is kept in an append-only local ledger: accepting a later agreement updates the current acceptance fields while preserving earlier exact acceptance records in the same file. These records are used to identify the current legal notice and consent state. They are not sent to Lanreal. ### 3.10 Imported audio, app/site routing, and text delivery When you import audio, the Software reads and decodes each file in place, transcribes it on your device, and stores the resulting entry under the same history settings as a microphone dictation. The selected path is used only while the import is active; its base filename may be shown in the active progress interface but is not written to diagnostics. The Software does not modify, delete, or make a plaintext path-based copy of your source file. If cloud AI cleanup is enabled, the resulting transcript may be sent to the provider you selected under Section 6. The imported audio itself is not uploaded. Foreground and browser information is read only when a configured app or site rule, manual route, Pin Mode, or destination-delivery operation can use it. App routing uses local process identity. A configured browser site rule may cause the Software to read only the normalized active host from a supported browser's address bar; it does not collect the full URL through this route. Pin Mode keeps the selected window handle and process identifier in bounded process memory for activation. No foreground or host probe is performed when routing cannot affect the current operation. These transient values are not written to diagnostics or sent to Lanreal. The app paths and host rules you choose to save remain in your local settings. When you choose a site-routing rule, the Software may read matching favicon data from the local Chrome, Edge, or Firefox favicon database to display the rule. It first uses a read-only database connection. If the browser has locked that database, it may create an attributable copy in the operating-system temporary directory. The Software closes the copy and makes up to three ordinary deletion attempts after use. At startup and before creating another owned copy, it also tries to remove only attributable Whisperstream copies older than 24 hours. A copy can remain longer after a crash or repeated deletion failure; the Software does not broadly delete older unattributable browser-database copies. It does not send the database, host, or favicon to Lanreal or a network favicon service. Whisperstream delivers finished text to the focused or pinned destination application using a clipboard paste or simulated keystrokes. The destination application then receives and controls that text under its own privacy and retention practices. Lockdown Mode does not prevent this user-directed delivery. ### 3.11 Agent Speak and Claude Code interactions Agent Speak is an optional, default-off local companion for Claude Code. When enabled, Whisperstream's Claude Code plugin forwards response text, structured questions and options, permission context, short replies, session-scoped identifiers, and a sanitized session name to the Software's loopback-only backend so the local HUD can display, speak, or answer them. When response display is disabled, the raw response is not sent to the HUD, although local speech or reply routing may still use it. The Software keeps active Agent Speak content in bounded process memory and does not write hook payloads, content-derived fingerprints, paths, session identifiers, or interaction content to diagnostic logs or support exports. Questions expire after approximately 15 seconds if they are not answered. Delivered decisions are discarded, and retained reply drafts expire after approximately 120 seconds and are subject to count and size limits. Completion acknowledgement, feature disablement, Lockdown Mode, or shutdown clears the applicable active state and bounded caches. To resolve an active display name, Whisperstream may reduce a working directory immediately to its base name or read a limited tail of a regular Claude Code transcript file confined to Claude Code's local projects directory. A project base name can itself be sensitive; it remains bounded active display state and is not logged or exported. Agent discovery writes only a local port number while the feature is enabled and removes that file on disablement, Lockdown Mode, or clean shutdown. A reply you dictate through Agent Speak passes through Whisperstream's ordinary local dictation pipeline. If "Save transcripts" is on, that reply is stored as an `agent_reply` history entry with the same encrypted content and retention controls as other saved dictations. Other Claude Code interaction content is not written to transcript history. Whisperstream does not automatically send these local records or interaction content to Lanreal. Agent Speak does not control how Claude Code sends prompts or receives responses from Anthropic or another provider you configured in Claude Code. That provider interaction occurs outside Whisperstream and is governed by your Claude Code and provider terms. Lockdown Mode blocks Whisperstream's optional cloud AI cleanup, but it does not disable Agent Speak or change Claude Code's own network behavior. ### 3.12 Feature requests on Featurebase Version 2.0 does not offer the Featurebase feature-request control. Earlier releases opened Lanreal's external board in the user's browser without attaching transcript content or other application data. Information users chose to submit could include requests, messages, attachments, contact or account identifiers, votes and ordinary service-usage data. Lanreal used these submissions to evaluate feedback and plan improvements. Retained records remain subject to Sections 5 and 8; this policy does not state that the board or its data has been deleted. Do not include dictation content, sensitive personal information or GDPR Article 9 special-category data in messages to Lanreal. If Lanreal becomes aware of such information in retained submissions, it will delete or restrict it as reasonably practicable, subject to legal retention obligations. ## 4. Why We Process Your Information The purposes and GDPR Article 6 bases below distinguish current operation from historical collection. A lawful basis for processing does not itself establish an international-transfer mechanism; see Section 7. - **Temporary update delivery.** Update connection information supports checking for and securely delivering critical corrective releases during the fixed transition. The basis is Article 6(1)(f), Lanreal's legitimate interest in secure software delivery. Updates require your installation choice and the route is bounded by the cutoff and the app's network restrictions. You may exercise your objection rights as described in Section 10. - **Model-download connection information.** The purpose is delivering the speech-recognition, local cleanup or voice model needed for a feature you request. The basis is Article 6(1)(f), Lanreal's legitimate interest in enabling local functionality. Hugging Face and GitHub determine their own purposes and bases for its separately controlled processing. Download hosts necessarily receive ordinary connection information; installed local models do not require recurring model-host communication for inference. - **Local product and legal state.** Local content, settings, routing and history support requested features under Article 6(1)(b). Exact acceptance evidence supports legal record-keeping under Article 6(1)(f). Lanreal does not receive these records through ordinary app operation. Historical trial state is not used to restrict Version 2.0. Logs you separately choose to send may be processed under Article 6(1)(f) to address the matter you raise, subject to continuing obligations and the retention limits in Section 8. - **Optional cloud post-processing.** Article 6(1)(a), your consent, covers transmission of eligible transcripts, configured instructions, credentials and connection information to your selected provider for the cleanup you request. You can withdraw it by disabling the feature. The provider receives the content, not Lanreal, and your provider relationship is direct. Section 6 describes the precise controls and boundaries. - **Historical licensing and updates.** Earlier activation, device labels, validation and deactivation used Article 6(1)(b) for the license contract; earlier update checks used Article 6(1)(f) for secure software delivery. Version 2.0 no longer initiates licensing flows; current temporary updates are described above. Retention of earlier records must remain necessary for an applicable contractual purpose, a legal obligation under Article 6(1)(c), or a documented legitimate interest such as resolving claims under Article 6(1)(f). - **Historical ratings, feedback and testimonials.** Original voluntary submissions used Article 6(1)(a); public testimonial display required separate consent. You may withdraw consent and request deletion. Ending development removes the basis for keeping records indefinitely merely for unspecified future product improvement. Section 8 governs wind-down review and any continuing necessary retention. - **Historical Featurebase submissions.** These were collected under Article 6(1)(f) to operate the board, respond to requests and improve the Software. Retained records must remain necessary for a disclosed purpose or legal obligation. Incidental sensitive content is handled under Section 3.12. - **Surviving rights and obligations.** Lanreal processes necessary transaction, refund, privacy-request and claim records to perform applicable contracts, comply with legal obligations or establish, exercise or defend claims under the corresponding Article 6(1)(b), (c) or (f) basis. Wind-down does not erase data-subject rights or permit unrelated new uses. **Obligation to provide personal data.** Version 2.0 requires no license key, hostname submission, purchase or activation to unlock functionality. Downloading missing models necessarily exposes ordinary connection information to the serving hosts. Optional cloud cleanup is not required for local dictation; disabling it stops that cloud processing without removing local functionality. No statutory obligation requires you to provide the optional information described here. Lanreal does not engage in automated decision-making or profiling producing legal or similarly significant effects under GDPR Article 22. ## 5. Who We Share It With (Service Providers and Other Recipients) This list covers current model delivery, temporary Cloudflare update delivery and historical recipients whose processing or retained records remain relevant. Polar, Supabase and Featurebase flows below are historical. Hugging Face and GitHub are current model-download recipients. These distinctions do not represent completed provider termination or deletion. Some act as processors on Lanreal's behalf; others determine their own purposes for limited connection data as identified below. The list is exhaustive for those application flows. If you enable the optional cloud post-processing feature described in Section 6, you establish a direct contractual relationship with the cloud provider you select, and that provider is not a Lanreal service provider or recipient within the meaning of this Section 5. Changes to this list are communicated via version bumps to this Privacy Policy (see Section 14), and are also published in advance via the public provider page and RSS feed described in Section 14. In accordance with Principle 4.1.3 of the *Personal Information Protection and Electronic Documents Act*, Lanreal uses contractual and other means to ensure that each listed recipient acting as a processor on Lanreal's behalf provides a comparable level of protection for personal information transferred for processing. Lanreal remains accountable for the protection of personal information transferred to third-party processors. Lanreal does not use or disclose personal information for purposes other than those described in this Privacy Policy, unless required by law. 1. **Polar Software Inc.** (Delaware, USA) -- historical license activation and Merchant of Record. Receives your license key, the Whisperstream organization identifier, your device hostname, and your operating system family. Polar's processing of this information is governed by Polar's privacy policy at `https://polar.sh/legal/privacy`. For the license activation and validation data described in Section 3.1, Polar acts as a data processor on Lanreal's behalf within the meaning of GDPR Article 28. For the separate checkout and payment data that Polar collects directly from you (email address, payment information), Polar acts as an independent data controller. Polar's Data Processing Addendum (at `https://polar.sh/legal/data-processing-addendum`), which forms part of the Polar Master Services Terms, designates Polar as the processor and incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area and the United Kingdom to the United States. Note: when you complete your purchase, Polar separately collects your email address and payment information directly from you through its checkout flow. That information is governed by your relationship with Polar and is not transmitted by Whisperstream. 2. **Cloudflare, Inc.** (United States) -- temporary software-update delivery and historical model distribution. The current update route uses `releases.whisperstream.io` as described in Section 3.2. Cloudflare receives connection information and requests needed to serve the manifest and selected update artifact. Its services may process traffic and security information and make customer logs available to Lanreal. Cloudflare's processor services are governed by the applicable customer agreement and Data Processing Addendum; its separate processing is described in its privacy policy at `https://www.cloudflare.com/privacypolicy/`. Section 7 addresses international transfers and Section 8 addresses retention. Version 2.0 model downloads do not use Cloudflare R2. Earlier model delivery through `models.whisperstream.io` and earlier update requests remain relevant to historical records. 3. **Supabase, Inc.** (Delaware, USA) -- historical reviews and feedback database. If you choose to submit a review or feedback through the in-app review popup described in Section 3.5, Supabase hosts the relational database tables (`reviews` and `feedback`) that store your submission. Supabase receives the submitted fields (rating, testimonial, display name, feedback text, the "feature on website" consent flag, the email address associated with the submission, and the Whisperstream application version) together with the standard HTTP headers automatically sent by the underlying HTTP library (including your IP address). Supabase's processing is governed by Supabase's privacy policy at `https://supabase.com/privacy`. Lanreal has executed Supabase's Data Processing Addendum (published at `https://supabase.com/legal/dpa`); the Standard Contractual Clauses (Controller-to-Processor, Module 2) incorporated into that Addendum are the transfer mechanism for personal information sent from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States. 4. **CORDNET OÜ (d/b/a Featurebase)** (Estonia) -- historical external feature-request board. If you choose the control described in Section 3.12 and submit information on the board, Featurebase processes feedback, messages, attachments, end-user identifiers, and workspace usage on Lanreal's behalf. Lanreal is the controller for this Customer Personal Data and Featurebase is the processor. Featurebase separately acts as an independent controller for its own account, billing, security, fraud-prevention, and service data. Its Data Processing Agreement is incorporated into its customer terms and is available through Featurebase's help centre at `https://help.featurebase.app`. Its privacy policy is at `https://help.featurebase.app/en/articles/4744036-privacy-policy`. Featurebase states that Customer Personal Data is primarily hosted in the European Economic Area and uses Standard Contractual Clauses, a UK Addendum, and a Swiss Addendum where an onward transfer requires them. 5. **Hugging Face, Inc.** (United States) -- current public model delivery. Hugging Face and its delivery infrastructure receive the connection data described in Sections 3.3, 3.7 and 3.8, including downloads of S1-mini by Superwhisper and Gemma for local cleanup. Hugging Face determines its own purposes for operating, securing and maintaining its services and acts as an independent controller for those uses. Its privacy policy is at `https://huggingface.co/privacy`. The possible Lanreal exporter role and unresolved transfer posture are described in Section 7. No public-download agreement or safeguard is established merely by listing Hugging Face here. 6. **GitHub** (United States / Netherlands) -- speech-model backup delivery. GitHub and its release-asset infrastructure receive the connection data described in Section 3.3. Its privacy statement describes independently controlled service usage data and is available at `https://github.com/site/privacy`. The receiving entity and applicable transfer safeguards for this public download route remain subject to the assessment described in Section 7. Other than the six recipients listed above, Lanreal does not share personal information with any other recipients. In particular, Lanreal does not disclose personal information to advertisers, data brokers, or social media platforms, and Lanreal does not use third-party analytics, crash reporting, or error-reporting services (see Section 9 for the full enumeration of what the Software does not do). ## 6. Optional Cloud Post-Processing (Bring Your Own Key) The Software includes an optional AI cleanup feature that can route transcribed text through a Large Language Model for post-processing (for example, filler-word removal, spoken-correction handling, punctuation and number normalization, style adjustment, or custom formatting). This feature is **disabled by default** in every new installation. When it is disabled, the Software does not transmit transcribed text to any party, consistent with the default-state promise made in Section 9. When you enable AI cleanup, it can run on a Large Language Model hosted **on your own device**, in which case your transcribed text is processed locally and **does not leave your device**. Alternatively, under Bring Your Own Key, you may configure the feature to route your transcribed text to a third-party cloud provider that you select, using a credential that you supply. This Section 6 describes that optional cloud path: the providers you may select, what is transmitted, and your relationship with the provider. The on-device option involves no transmission of transcribed text and is covered by the default-state promises in Sections 3.4 and 9. ### 6.1 Supported providers If you enable the optional post-processing feature, you may configure the Software to route transcribed text to any one of the following providers. Lanreal does not host, operate, resell, or receive revenue from any of these providers. Your contractual relationship is directly with the provider whose credentials you supply. 1. **OpenAI, L.L.C.** (Delaware, USA) -- a cloud-based Large Language Model provider. Users outside North America may contract with a different OpenAI regional entity (for example, OpenAI Ireland Limited for users in the European Economic Area). See OpenAI's privacy policy at `https://openai.com/policies/privacy-policy/` and OpenAI's terms of use at `https://openai.com/policies/terms-of-use/` for information on how OpenAI handles content submitted to its API. 2. **Anthropic, PBC** (Delaware, USA) -- a cloud-based Large Language Model provider. Users outside North America may contract with a different Anthropic regional entity (for example, Anthropic Ireland Limited for users in the European Economic Area). See Anthropic's privacy policy at `https://www.anthropic.com/legal/privacy` and Anthropic's Commercial Terms of Service at `https://www.anthropic.com/legal/commercial-terms` for information on how Anthropic handles content submitted to its API. 3. **Google LLC** (Delaware, USA), via the Google Gemini API -- a cloud-based Large Language Model provider. The specific Google legal entity that contracts with you for Gemini API access depends on your location and your Google Cloud billing arrangement, and is determined by Google at `https://cloud.google.com/terms/google-entity`. For most individual users the contracting entity will be Google LLC (Delaware, USA). Canadian users contracting for paid Gemini API access may contract with Google Canada Corporation. See `https://ai.google.dev/gemini-api/terms` for the Gemini-API-specific additional terms and `https://policies.google.com/privacy` for Google's general privacy policy. 4. **A self-specified endpoint (Ollama-compatible or other OpenAI-compatible endpoint)** -- a Large Language Model server that you point the Software at by supplying its URL, together with a credential where the endpoint requires one. This covers both an Ollama server speaking the Ollama HTTP API and any other endpoint speaking the OpenAI-compatible chat API. If the endpoint is a process running on your own device (for example, an Ollama process at `http://localhost:11434`), transcribed text **does not leave your device** at all. If you configure the Software to connect to a non-local endpoint (for example, a self-hosted server on another machine, or an endpoint on a private network), transcribed text is transmitted to the URL you specify. The operator of that endpoint, which may be you or another party, is responsible for its own data handling, and Lanreal has no visibility into or control over that endpoint. ### 6.2 What is transmitted When the optional post-processing feature is enabled, for each eligible transcript the Software transmits to the provider you selected: - **The transcribed text produced by the speech recognition model**, as an input to the post-processing request. Transcripts of three words or fewer are excluded from this transmission and remain local to your device. - **The API key or credential** that you supplied for the selected provider, as an `Authorization` or equivalent request header, so that the provider can authenticate you and apply the usage limits of your account. - **Any instruction prompt that you have configured** in the Software (for example, a system prompt describing the post-processing style you want), as part of the request payload. - **Standard HTTP headers** automatically attached by the Software's HTTP library, including your IP address as it is seen by the provider. The Software does **not** transmit, as part of any optional post-processing request, any of the following: your audio recording, your license key, the Whisperstream organization identifier, your device hostname, your operating system family, your local diagnostic logs, your in-memory frontend log ring buffer, your usage statistics, your configuration file, or any other category of information listed in Section 3.4 as staying on your device. These remain on your device regardless of whether the optional post-processing feature is enabled. In addition to the per-transcript transmissions described above, while the feature is enabled and a credential is present the Software periodically sends a short connectivity probe to the provider you selected to verify that the credential is valid and the provider is reachable, so that the Software can display an accurate connection status in its settings interface. The probe transmits the same API credential, the same standard HTTP headers including your IP address, and a short fixed test prompt authored by Lanreal; it does not transmit any of your transcribed text, any prompt you have configured, or any other user content. The probe is covered by the same consent you give when you first enable the feature under Section 6.5, and the Software will not send a probe to any provider for which that consent has not been recorded. ### 6.3 Provider response handling After the provider processes your request, it returns the post-processed text to the Software as the response body. That response is then handled locally by the Software under the same rules as any other transcribed text: it is typed into the focused window and, if you keep the local transcript history enabled, stored encrypted on your own device as described in Section 3.4. Lanreal does not receive or retain a copy, and the Software does not transmit the provider's response to any other recipient. ### 6.4 Your credentials The API key or credential you supply for any of the providers listed in Section 6.1 is stored locally on your device within your Windows user profile, under `%LOCALAPPDATA%\Whisperstream\`. The key is encrypted at rest using the Windows Data Protection API (specifically, the `CryptProtectData` function), which derives the encryption key from your Windows user account credentials. As a consequence, the encrypted credential can only be decrypted by the same Windows user on the same device on which it was stored. A different Windows user logged into the same device, and any user on a different device, cannot decrypt the stored credential. The stored credential is transmitted only to the provider you selected, only over HTTPS with certificate verification enabled, and only as a request header on the post-processing requests described in Section 6.2. The Software does not transmit the credential to Lanreal, to any service provider or recipient listed in Section 5, or to any recipient other than the provider you selected. Lanreal does not receive, store, or have any ability to recover your credential. ### 6.5 How to enable, disable, and delete - **Enabling.** The optional post-processing feature is disabled by default in every new installation. To enable it, you must explicitly select a provider and supply a valid credential for that provider through the Software's settings interface. Before the feature begins transmitting transcribed text, the Software will display a blocking consent dialog that identifies the provider you selected, describes what data will leave your device, links to this Privacy Policy and to the provider's own privacy policy, and requires an affirmative click to continue. The Software will not begin transmitting transcribed text to any provider until you have completed all of those steps and confirmed the blocking consent dialog. - **Disabling.** To disable the feature, toggle it off in the same settings interface. After you disable it, the Software will not transmit any further transcribed text to any provider, and will resume the default behaviour described in Sections 3.4 and 9 of this Privacy Policy. - **Deleting your credential.** To delete a stored credential, use the "remove key" control in the same settings interface. This removes the encrypted credential from your Windows user profile in its entirety. - **Lockdown Mode override.** While Lockdown Mode (Section 3.6) is on, all of the cloud providers and self-specified endpoints listed in Section 6.1 are disabled and AI cleanup is forced to the on-device model, so no transcribed text leaves your device regardless of any provider you may have configured. ### 6.6 Relationship to Section 5 (service providers and other recipients) The four providers listed in Section 6.1 are **not Lanreal sub-processors, resellers, or agents** within the meaning of Section 5. This classification rests on four facts about how the optional cloud post-processing feature operates: 1. **You determine the purposes and means of processing.** You select the provider, you supply the credential, you configure the instruction prompt, and you trigger each transmission by enabling the feature and completing the consent gate described in Section 6.5. Lanreal's code is the transport; it does not select the destination, does not determine the purpose of the post-processing, and does not act on behalf of Lanreal in performing the transmission. 2. **Lanreal does not hold the transcribed text.** The transcript is generated on your device by the local speech-recognition model, transmitted directly from your device to the provider you selected, and is not routed through, copied to, or received by any Lanreal server. Lanreal has no possession, custody, or control of the transcript at any point. 3. **Lanreal has no contract with the provider.** Your credential is issued to you by the provider under the provider's own terms of service and privacy policy. Your contractual relationship is directly with the provider. Lanreal is not a party to that agreement, has no contract with the provider concerning the processing of your data, and does not assume any obligation owed to you by the provider. 4. **Lanreal receives no consideration from the provider.** Lanreal receives no revenue, referral fees, usage-based payments, or other valuable consideration from any of the four providers listed in Section 6.1, and Lanreal pays none of them. Because of these facts, for the optional cloud post-processing feature: (a) the provider is not processing personal data on Lanreal's behalf within the meaning of Article 4(8) of the GDPR and is therefore not a Lanreal processor under Article 28; (b) Lanreal does not transfer personal information to the provider "for processing" within the meaning of Clause 4.1.3 of Schedule 1 to Canadian federal privacy law, and accountability for the provider's handling of the transcript does not attach to Lanreal; (c) the transmission is not a "sale" under Cal. Civ. Code Section 1798.140(ad)(1) (Lanreal receives no consideration), not a "share" under Section 1798.140(ah) (the transmission is not for cross-context behavioural advertising), and not a disclosure to a service provider under Section 1798.140(ag) (no contract, no on-behalf-of relationship). To the extent the transmission could be characterised as a disclosure at all, it is a user-directed disclosure within the carve-outs at Cal. Civ. Code Sections 1798.140(ad)(2)(A) and 1798.140(ah)(2)(A). By enabling the feature and supplying a credential, you represent that you have read and agreed to the selected provider's terms of service and privacy policy, and that you have the legal right to submit the content you are submitting for post-processing. ## 7. International Data Transfers Because Lanreal is incorporated in Canada and the service providers and other recipients listed in Section 5 operate outside Canada, personal information forwarded through the Software may be transferred across international borders. This section summarizes the transfer mechanism or other transfer posture for each processor and other recipient under Chapter V of the GDPR. Polar, Supabase and Featurebase entries below describe historical flows and retained data. Cloudflare also serves the temporary update route. These descriptions do not establish completed provider termination. - **GitHub public release downloads.** Backup requests disclose connection data to GitHub and its delivery infrastructure. GitHub publishes its own international-transfer disclosures. Lanreal has not completed a route-specific assessment of the receiving entity, applicable safeguards or its possible exporter role. Listing the route is not a finding that EEA, UK or Swiss transfer requirements are satisfied. Ordinary EULA acceptance is not explicit consent to a transfer derogation. - **Hugging Face, Inc. (United States).** Public downloads can disclose connection information to Hugging Face and its delivery infrastructure in the United States or other processing locations. Hugging Face's French EU establishment does not by itself establish an exclusively EEA recipient. Lanreal has not established a transfer mechanism covering its possible role in initiating these disclosures. Hugging Face's Enterprise DPA offering does not establish coverage for independently controlled public-download connection logs. Lanreal does not rely on ordinary EULA acceptance or a model-selection action as explicit consent to a transfer derogation. The receiving entity, applicable safeguards and Lanreal's possible exporter role remain unresolved. Disclosure of this uncertainty is not a finding that the flow satisfies EEA, UK or Swiss transfer requirements. - **Polar Software Inc. (United States).** Polar is incorporated in Delaware, USA. Polar's Data Processing Addendum (at `https://polar.sh/legal/data-processing-addendum`), which forms part of the Polar Master Services Terms and applies automatically, incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area and the United Kingdom to Polar in the United States. Lanreal relies on these Standard Contractual Clauses for the license-activation and validation data described in Section 3.1. - **Cloudflare, Inc. (United States).** The temporary update route discloses connection information to Cloudflare and its delivery infrastructure. Cloudflare publishes a Data Processing Addendum with safeguards for applicable restricted transfers and separate privacy disclosures. Lanreal must confirm the agreement and safeguards applicable to its actual account, receiving entities and processing before activating this route. A reference to public terms or prior use of Cloudflare does not establish that assessment. Historical model and update records remain subject to applicable safeguards. - **Supabase, Inc. (United States).** Supabase is incorporated in Delaware, USA, and hosts the reviews and feedback database described in Section 3.5. Lanreal has executed Supabase's Data Processing Addendum (published at `https://supabase.com/legal/dpa`), which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States. - **CORDNET OÜ (Featurebase) (Estonia).** Featurebase primarily hosts Customer Personal Data in the European Economic Area. Its Data Processing Agreement incorporates the European Commission's Standard Contractual Clauses, the UK Addendum, and the Swiss Addendum for any transfer to a location that lacks an applicable adequacy decision. **Transfers to Canada.** The European Commission has recognized Canada as providing an adequate level of data protection (Commission Decision 2002/2/EC). Transfers of personal information from the European Economic Area to Lanreal in Canada are therefore covered by this adequacy decision. If you are located in the European Economic Area, the United Kingdom, or Switzerland and wish to receive further information about these transfer mechanisms, including copies of the relevant Standard Contractual Clauses where available, please contact Lanreal at `support@whisperstream.io`. **Foreign law enforcement access.** Because personal information may be transferred to service providers or other recipients in the United States for processing (as described in Section 5), that information may be accessible to the courts, law enforcement agencies, and national security authorities of the United States under the laws of that jurisdiction. **Optional cloud post-processing (Section 6).** If you enable the optional cloud post-processing feature described in Section 6 and select a cloud provider other than a local Ollama-compatible endpoint, transcribed text is transmitted to the provider's infrastructure, which is typically located in the United States. Three of the four providers listed in Section 6.1 (OpenAI, Anthropic, Google) are U.S.-incorporated entities whose processing infrastructure generally sits in the United States, and your contract for Gemini API access through Google may involve a Canadian or European Google entity depending on your location. Lanreal does not control the routing, the storage locations, or the onward transfer decisions those providers make once the data leaves your device, and Lanreal does not implement Standard Contractual Clauses or any other Chapter V transfer mechanism on your behalf for that transmission, because Lanreal is not the contracting party. Your contractual protection for any such cross-border transfer is governed by the privacy policy and terms of service of the provider you selected, and Lanreal encourages you to review both documents before enabling the feature. ## 8. How Long We Keep It (Retention) **Wind-down and surviving duties.** Lanreal reviews retained personal information and deletes or anonymizes information no longer needed for a disclosed purpose or applicable legal obligation. Necessary transaction, refund, rights-request and claim records may remain for those purposes. Ending product development does not end privacy rights, security safeguards or breach-notification duties. No deletion, anonymization, provider shutdown or completed review is represented by this policy; actual retention must remain purpose-limited and accountable. You can continue to contact `support@whisperstream.io` about retained information. Lanreal's retention strategy is hybrid. For information that the Software controls directly, we state concrete retention behaviour because the data flow is narrow enough to do so honestly. For information that a third-party service provider or recipient controls, we describe the retention category and point you to that party's own policy, because Lanreal cannot enforce a specific retention period on a third party's infrastructure. **Retention for information the Software controls directly:** - **Audio recordings:** not retained by Lanreal, and never transmitted off your device. Microphone audio is held in random-access memory while each capture is transcribed. If you keep audio saving enabled in the local transcript history (on by default, and separately disableable), a copy of the recording is also stored, encrypted, on your own device, and is removed on the same schedule as the rest of your history (see "Local transcript history" below). - **Transcribed text:** not retained by Lanreal. The output of the speech recognition model is typed into the focused window. If you keep the local transcript history enabled (on by default), the transcribed text is also stored, encrypted, on your own device and removed on the schedule you set (see "Local transcript history" below). If you have enabled the optional cloud post-processing feature described in Section 6 and the transcript is longer than three words, the text is transmitted to the provider you selected for the duration of the post-processing request; Lanreal does not retain a copy, and the provider's retention of your submitted content is governed by the provider's own terms of service and privacy policy (see the links in Section 6.1). - **Local transcript history (your transcribed text, encrypted waveform peaks, and, optionally, your audio):** retained on your own device only, encrypted at rest (AES-256-GCM with the data key sealed by the Windows Data Protection API), and never transmitted to Lanreal. You control how long it is kept: a retention window of 1, 7, or 30 days, or forever, with 7 days as the default, removes older entries, and you may delete any individual entry or clear the entire history at any time. Retention and orphan-audio cleanup run at startup, after live and imported saves, after a retention change, and after a successful Lockdown unlock. Cleanup that requires the history key is deferred while the history is locked and retried after unlock. Deletion uses ordinary SQLite deletion and file unlinking, not secure disk overwrite. A failed file deletion may be retried by a later cleanup; database free pages or journals, filesystem remnants, backups, shadow copies, and exported copies remain outside the Software's deletion control. If the history cannot be decrypted on your current Windows account (for example, after a profile reset or a move to a different device), it is not readable and no new entries are written to it. - **Local diagnostic logs:** the active file and up to three 2 MiB backups are retained locally by size-based rotation in ordinary use, voluntary Lockdown, and administrator-managed Lockdown. The supplemental Lockdown diagnostic file retains at most 256 events and 128 KiB. These files are never transmitted automatically. You may delete the local log directory at any time. - **Lockdown access log (Section 3.4):** while Lockdown Mode is effective, the active content-free file and up to five 2 MiB backups are retained locally by size-based rotation. The Software does not assign it a time-based purge period. It is never transmitted or included in the support archive. You may delete it with the local log directory. - **Frontend diagnostic buffers:** each application window keeps at most 500 entries, 2 KiB per entry, and 128 KiB total in memory; the backend keeps at most 128 KiB of re-sanitized frontend entries across windows. Ring eviction or process/window exit releases that state. Lockdown transitions do not clear the rings. - **Local usage statistics and configuration:** retained locally on your device until you uninstall the Software or delete the `%LOCALAPPDATA%\Whisperstream\` directory. - **Trial, activation, and legal-acceptance state (Section 3.9):** retained in the current user's Windows registry and application data until you remove those records. Uninstalling does not necessarily remove them. Historical trial state may persist across reinstallations, but Version 2.0 does not use it to restrict functionality. The HMAC detects modification; it is not encryption. Exact EULA acceptance events remain in the append-only local ledger so accepting updated terms does not erase prior evidence. - **Agent Speak interaction content (Section 3.11):** active responses, questions, permissions, session display state, and reply drafts remain in bounded process memory. They are discarded on the applicable delivery, acknowledgement, approximately 15-second question expiry, approximately 120-second retained-draft expiry, feature disablement, Lockdown Mode, or shutdown. Interaction content and content-derived fingerprints are not written to diagnostics or support exports. A reply you dictate through Agent Speak follows your ordinary encrypted transcript-history retention setting when that setting is enabled. - **Credentials you supply for the optional cloud post-processing feature (Section 6):** retained locally on your device, DPAPI-encrypted, inside your Windows user profile, until you remove the credential through the Software's settings interface (see Section 6.5) or until you uninstall the Software and delete the `%LOCALAPPDATA%\Whisperstream\` directory. Lanreal does not retain, store, or have any visibility into this credential. - **Diagnostic archives and logs:** the support ZIP is assembled in backend memory and streamed to your selected download destination, with no app-managed ZIP retention. The ZIP may contain recent sanitized backend and frontend diagnostics, bounded system information, and supplemental closed-schema Lockdown events. It excludes the separate Lockdown access log, transcript history, audio, imported source files, and Agent Speak stores. Your downloaded copy remains under your control. The Software never uploads the ZIP automatically; Lanreal receives it only if you separately choose to send it. Logs you voluntarily send to Lanreal with a bug report are retained only for the duration of the support interaction and deleted or anonymized once the issue is resolved. The DPAPI-encrypted credential you supply for the optional cloud post-processing feature (Section 6.4) is not part of the bug-report log export, so it is not inadvertently transmitted when you submit a bug report. - **Historical reviews, feedback and testimonials (Section 3.5):** retained only while needed for a disclosed purpose or applicable legal obligation, subject to the wind-down review above. They are not kept indefinitely merely for possible future development. You may withdraw public-display consent and request deletion at `support@whisperstream.io`. Valid requests are handled within Section 10's timelines, subject to its lawful exceptions. **Retention for information third-party providers and recipients control:** - **GitHub backup-download connection logs:** GitHub controls retention under its privacy statement linked in Section 5; the Software does not control or delete those host-held logs. - **Hugging Face public-download connection logs:** Hugging Face controls retention under `https://huggingface.co/privacy`. Lanreal has not established a fixed retention period for these logs. Retention statements for Inference Endpoints are not a representation about public model-download logs. - **Historical Polar activation-slot data** (your license key, the Whisperstream organization identifier, your hostname, and your OS family): retained by Polar for the duration of your active license, plus Polar's own retention period as governed by Polar's privacy policy at `https://polar.sh/legal/privacy`. Lanreal cannot enforce a specific retention number on Polar's side. When you deactivate a device, the slot is released, and any residual retention is governed by Polar's policy. - **Cloudflare update and historical delivery records.** Cloudflare may hold delivery and security records under its applicable service terms and privacy policy. Lanreal has not established this deployment's exact log fields, access settings, retention periods or deletion arrangements. The updater cutoff ends the app's new update requests; it does not itself delete provider-held records or any copies held by Lanreal. Lanreal-held records remain limited to necessary delivery, security and surviving legal purposes and the wind-down retention review described above. - **Featurebase feature-request data:** retained according to the board configuration and Featurebase's retention schedule until Lanreal or the submitting user deletes it, subject to legal-record and backup periods described in Featurebase's Privacy Policy and DPA. You may request deletion from Lanreal at `support@whisperstream.io`. **Retention by optional cloud post-processing providers (Section 6).** If you have enabled the optional cloud post-processing feature and selected a cloud provider, your transcribed text and any instruction prompt you have configured are submitted to that provider as part of each eligible request. How long the provider retains that submitted content, whether it is used to train the provider's models, and whether it is logged for abuse detection are governed entirely by the provider's own terms of service and privacy policy, which vary by provider and by account tier (for example, some providers offer a "zero-data-retention" enterprise tier that differs from their default consumer retention). Lanreal has no visibility into and no control over retention decisions at the provider, and Lanreal does not make representations about them. Please review the provider's published policies (see the links in Section 6.1) before enabling the feature. ## 9. What We Don't Do This section enumerates categories of information that the Software never collects, never transmits, and never retains. It is intended as an explicit companion to Section 3, so that you can see not just what the Software does, but also what it does not do. - **No audio recordings leave your device.** Microphone audio is processed by the speech recognition model on your CPU and is never uploaded to any server for any reason. If you keep audio saving enabled in the local transcript history (Section 3.4), a copy of the recording is stored encrypted on your own device only; it still never leaves your device. - **By default, no transcribed text leaves your device.** In the default configuration of the Software, the output of the speech recognition model is typed into the focused window, and the Software does not upload transcriptions to any server. The transcribed text may be stored in the local, encrypted transcript history on your own device (Section 3.4), which never leaves your device. If you explicitly enable the optional cloud post-processing feature described in Section 6 and supply a credential for a cloud provider, transcribed text longer than three words is transmitted only to the specific third-party provider you selected, only over HTTPS, and only for the duration of each post-processing request. No transcribed text is transmitted to Lanreal or to the service providers listed in Section 5 as part of Whisperstream's transcription or cloud-cleanup pipeline. Text you deliberately submit to a destination application, Claude Code, a feedback form, or Featurebase is controlled by that destination. - **No microphone input, typing, keystrokes, or clipboard contents are transmitted.** The Software does not intercept or transmit your keyboard or clipboard activity. - **No telemetry, no analytics, error reporting, crash reporting, no usage tracking, and no feature-flag service.** The Software does not integrate Sentry, PostHog, Mixpanel, Google Analytics, Plausible, or any comparable service. No automatic event streams, per-action tracking, or behavioural profiling are sent to any server. In Version 2.0, model-download connection data leaves your device through the model-host routes in Sections 3.3, 3.7 and 3.8. Optional cloud post-processing is separately controlled under Section 6. Temporary updater connection data is described in Section 3.2. Earlier licensing and feedback requests are historical flows only. Text you deliver to other applications and Agent Speak's local assistant interactions retain the boundaries described in Sections 3.10 and 3.11. Communication with the local backend uses only the loopback interface and does not leave your device. There is no "opt out" for telemetry because there is no telemetry to opt out of; the temporary updater and user-initiated flows follow the controls described in Section 3. The content-free local access log described in Section 3.4 is likewise stored only on your device and is never transmitted. - **No advertising identifiers.** The Software does not collect, generate, or transmit any advertising identifier (such as IDFA, AAID, or similar). - **No local network scanning.** The Software does not scan your local network, enumerate devices on it, or probe for other services. - **No persistent loopback-accessible endpoints beyond the local backend process.** The local backend process binds exclusively to the loopback interface (`127.0.0.1`) so that no other device on your network can reach it, and it exposes no outbound telemetry. - **No sale of personal information.** Lanreal does not sell or rent personal information. See Section 13 for the CCPA-specific disclosure on sale and sharing. - **No profiling or automated decision-making.** The Software does not profile you, score you, rank you, or make any automated decision that produces legal or similarly significant effects within the meaning of GDPR Article 22. - **No cookies or tracking technologies.** The Software does not use cookies, web beacons, pixel tags, local storage tokens, browser fingerprinting, or any other tracking technology to identify you, track your behaviour, or build a profile about you. The local communication between the Software's frontend and backend processes (over the loopback interface) does not use persistent cookies or session identifiers. ## 10. Your Rights Depending on where you live, you may have one or more of the rights listed in this section. Lanreal extends all of these rights to every Whisperstream user, regardless of jurisdiction, so that you do not have to prove residency in order to exercise a right. **Rights summary.** The most commonly exercised rights, with the statutory basis for each, are: - **Right to know** what personal information Lanreal holds about you and how we use it (GDPR Article 15 / CCPA Section 1798.110 / Canadian federal privacy law Principle 4.9). - **Right to delete or erase** personal information Lanreal holds about you (GDPR Article 17 / CCPA Section 1798.105). This includes deletion of any review or feedback you have submitted under Section 3.5. - **Right to correct** inaccurate personal information (GDPR Article 16 / CCPA Section 1798.106 / Canadian federal privacy law Principle 4.9.5). - **Right to data portability** in a structured, commonly-used, machine-readable format (GDPR Article 20). - **Right to withdraw consent** for the optional cloud post-processing feature (Section 6) and for the in-app review and feedback submissions (Section 3.5), which are the two pieces of processing described in this Privacy Policy that rely on your consent as the GDPR Article 6 lawful basis (GDPR Article 7(3)). - **Right to complain** to a privacy regulator (GDPR Article 77, CCPA, Canadian federal privacy law; see Section 15 for the supervisory authorities). To exercise any of these rights, email Lanreal's Privacy Officer at `support@whisperstream.io`. There is no charge, no account required, and no in-app rights-request form. Lanreal will respond within 30 days under Canadian federal privacy law and the GDPR and within 45 calendar days under the CCPA, with the extensions described in the timelines at the end of this Section 10. **Rights under the European Union General Data Protection Regulation (GDPR Articles 15 to 22):** - **Right of access (Article 15):** you may ask Lanreal to confirm whether we process personal information about you and, if so, to provide a copy of that information. - **Right to rectification (Article 16):** you may ask Lanreal to correct any inaccurate personal information we hold about you. - **Right to erasure (Article 17):** you may ask Lanreal to delete personal information we hold about you, subject to the statutory exceptions in Article 17(3). - **Right to restriction of processing (Article 18):** you may ask Lanreal to restrict the processing of your personal information in the circumstances set out in Article 18(1). - **Right to data portability (Article 20):** you may ask Lanreal to provide your personal information in a structured, commonly used, machine-readable format where the processing is based on consent under Article 6(1)(a) or contract under Article 6(1)(b) and is carried out by automated means. - **Right to object (Article 21):** you may object at any time, on grounds relating to your particular situation, to processing of your personal information that is based on Article 6(1)(f) (our legitimate interests). If you believe that any processing by Lanreal that is based on Article 6(1)(f) affects you, you may object on grounds relating to your particular situation, and Lanreal will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. - **Rights in relation to automated decision-making (Article 22):** not applicable. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of Article 22. - **Right to withdraw consent (Article 7(3)):** applies to the optional cloud post-processing feature described in Section 6 and to the in-app review and feedback submissions described in Section 3.5. These are the two pieces of processing described in this Privacy Policy that rely on your consent as the GDPR Article 6 lawful basis. For the cloud post-processing feature, you may withdraw your consent at any time by disabling the feature through the Software's settings interface as described in Section 6.5, which stops all further transmission of transcribed text to the provider. For reviews and feedback, you may withdraw your consent and request deletion of your previously submitted content by emailing Lanreal at `support@whisperstream.io`; where you check the "feature my review on the website" consent flag, that separate consent may be withdrawn the same way. Withdrawal of consent does not affect the lawfulness of processing already performed under your consent before withdrawal. The other processing described in this Privacy Policy does not rely on consent, so the Article 7(3) right to withdraw does not apply to any processing outside Sections 3.5 and 6. **Rights under the California Consumer Privacy Act (CCPA):** - **Right to know** what categories of personal information we have collected about you, the sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties with whom we shared it. - **Right to delete** personal information we collected from you, subject to the statutory exceptions in Cal. Civ. Code Section 1798.105(d). - **Right to correct** inaccurate personal information we maintain about you. - **Right to limit use of sensitive personal information:** Lanreal does not request or use sensitive personal information for a purpose that triggers this right. A voluntary Featurebase submission could nevertheless contain sensitive personal information despite the instruction in Section 3.12; Lanreal handles such incidental content as described there. - **Right to opt out of the sale or sharing of personal information:** not applicable. Lanreal does not sell or share personal information for cross-context behavioural advertising, as described in Section 13 below. The disclosure that this right is not applicable is nonetheless provided. - **Right to non-discrimination** for exercising any CCPA right. Lanreal will not deny you the Software, charge you a different price, or provide a different level of quality because you exercised a right under the CCPA. **Rights under Canadian federal privacy law:** - **Right of access** to personal information Lanreal holds about you. - **Right to correction** of inaccurate personal information. - **Right to challenge compliance** with this Privacy Policy and with Canadian federal privacy law generally. Challenges are directed to the Privacy Officer in the first instance (see Section 15). **How to exercise your rights.** To exercise any of the rights above, email Lanreal's Privacy Officer at `support@whisperstream.io` with a description of your request and enough information for us to verify your identity and locate your personal information (typically the license key you use with the Software, if any). Lanreal does not operate an in-app rights-request button in this version of the Software; the email channel above is the designated rights mechanism. **Verification.** Because Lanreal does not maintain a user account database, identity verification for most requests will consist of confirming that the email you use to contact us matches a license activation we can locate, or (if you have not purchased a Pro license) confirming enough details about your use of the Software that we can associate your request with specific personal information we hold. **Unresolved challenges.** If you challenge the accuracy of personal information Lanreal holds and the challenge cannot be resolved to your satisfaction, Lanreal will record the substance of the unresolved challenge alongside the information in question. **Response timeline.** Lanreal will acknowledge your request within a reasonable period and will respond substantively within **30 days** of receipt. Lanreal will respond to access and correction requests at no cost to you. Under GDPR Article 12(3), Lanreal may extend this period by up to an additional **60 days** where necessary, taking into account the complexity and the number of requests; if we need to do so, we will inform you of the extension and the reasons for it within the original 30-day window. **CCPA response timeline.** For requests submitted by California residents under the CCPA, Lanreal will respond within 45 calendar days. Lanreal may extend this period by an additional 45 calendar days (for a total of 90 calendar days) where reasonably necessary, and will inform you of any extension within the original 45-day window. **If Lanreal does not take action.** If Lanreal decides not to take action on your request, we will inform you within 30 days of receipt of the reasons for not taking action and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy. **Authorized agents.** California residents may use an authorized agent to submit a rights request on their behalf. If you do so, we may require the agent to provide written authorization from you and to verify their own identity. ## 11. Children's Privacy The Software is not directed to children. Lanreal does not knowingly collect personal information from children under the age of 13 in the United States (consistent with the Children's Online Privacy Protection Act, or COPPA), or from children under the age of 16 in the European Economic Area (consistent with GDPR Article 8). If you are a parent or guardian and you believe your child has provided personal information to Lanreal through the Software, please contact us at `support@whisperstream.io` and we will take reasonable steps to delete that information. The Software does not implement age verification because it does not require account creation, does not collect age or date-of-birth information, and is not directed to children. ## 12. Security Safeguards Lanreal implements security safeguards proportional to the sensitivity of the personal information the Software processes. The final edition limits model-download requests to ordinary connection information and keeps inference local except for separately enabled cloud cleanup. Historical licensing and feedback records remain subject to appropriate safeguards while retained. In particular: - The Software requires no Lanreal account registration or activation. Historical feedback databases may still contain voluntary submissions; removing the forms does not erase those records. - External network requests initiated by the Software use HTTPS with the certificate-verification behaviour of the underlying HTTP library. The Software does not disable certificate verification. - Downloaded model artifacts are verified against pinned cryptographic checksums before installation. Temporary app updates are signature-verified before installation and are subject to the controls in Section 3.2. - The local backend process binds exclusively to `127.0.0.1` on a fixed port, so that no other device on your network can reach it. - Local configuration, logs, and usage statistics are stored under your Windows user profile with the access controls your operating system provides. - The local transcript history described in Section 3.4 separately encrypts the raw transcript, enhanced transcript, waveform peaks, and, if enabled, audio using AES-256-GCM. The AES data key is itself sealed using the Windows Data Protection API, bound to your Windows user account on the specific device, so the history can be decrypted only by the same Windows user on the same device. Lightweight index metadata needed for lookup and playback remains unencrypted. Existing plaintext waveform peaks from an older database schema are transactionally migrated to separately authenticated ciphertext when the data key is available; if the history is locked, migration is deferred and retried after unlock. The replacement of a legacy database value uses ordinary SQLite updating and is not represented as secure erasure of storage remnants. - When Lockdown Mode (Section 3.6) is on, the Software adds a password layer to the transcript history. A key derived from a password you choose (using the scrypt key-derivation function) and a separate key derived from a one-time recovery code each wrap the transcript encryption key using AES-256-GCM, on top of the at-rest encryption and Windows Data Protection API sealing described above. The transcript history locks automatically after an idle period you set, and repeated failed unlock attempts trigger escalating delays. Lanreal never receives your password or your recovery code. - For the optional cloud post-processing feature described in Section 6, credentials (API keys) that you supply are encrypted at rest using the Windows Data Protection API (specifically, the `CryptProtectData` function), which binds the encrypted value to your Windows user account on the specific device where the credential is stored. A different Windows user on the same device cannot decrypt the stored credential, and neither can any user on a different device. The encrypted credential is stored under `%LOCALAPPDATA%\Whisperstream\` with the access controls your operating system provides, and is not part of the bug-report log export described in Section 8, so it is not inadvertently transmitted when you submit a bug report to Lanreal. - When the optional cloud post-processing feature is enabled, each request to the provider you selected travels over HTTPS with certificate verification enabled. Your credential is transmitted only as a request header on those requests, and only to the provider you selected. The Software does not transmit the credential to Lanreal, to any service provider or recipient listed in Section 5, or to any other recipient. No security program can guarantee absolute protection against all threats. If you become aware of a security issue affecting the Software, please contact Lanreal at `support@whisperstream.io`. ## 12a. Data Breach Notification In the event of a breach of security safeguards involving personal information under Lanreal's control that creates a real risk of significant harm to you, Lanreal will: (a) report the breach to the Office of the Privacy Commissioner of Canada in accordance with section 10.1 of the Personal Information Protection and Electronic Documents Act and the associated Breach of Security Safeguards Regulations (SOR/2018-64); (b) notify you of the breach as soon as feasible after determining that the breach has occurred, by email if we have your email address on file through a license activation, or by prominent notice on the Whisperstream website at `https://whisperstream.io` if we do not have a direct means of contacting you; (c) where required by the General Data Protection Regulation (Articles 33 and 34), notify the relevant European supervisory authority within 72 hours of becoming aware of the breach, and notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms; and (d) where required by the California Consumer Privacy Act or other applicable law, provide notice in accordance with the requirements of that law. Lanreal maintains a record of all breaches of security safeguards involving personal information under its control, as required by section 10.1(3) of the Personal Information Protection and Electronic Documents Act and the Breach of Security Safeguards Regulations (SOR/2018-64). This record is retained for at least 24 months and is available to the Office of the Privacy Commissioner of Canada upon request. ## 12b. Business Transfers If Lanreal Technologies Inc. is involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal information we hold may be transferred as part of that transaction. If such a transfer occurs, the acquiring entity's use of your personal information will remain subject to the commitments made in this Privacy Policy. We will notify you of any such transfer and of any changes to the applicable privacy terms by updating this Privacy Policy (see Section 14) and, where feasible, by notice on the Whisperstream website. Where required by applicable law, we will obtain your consent before transferring your personal information to the acquiring entity. ## 12c. Law Enforcement and Government Requests Lanreal may disclose personal information to law enforcement, regulatory authorities, courts, or other governmental bodies where we are legally required to do so (for example, in response to a valid subpoena, warrant, or court order), or where we reasonably believe disclosure is necessary to comply with applicable law or to protect the safety of any person. Lanreal will attempt to notify you of any such disclosure before it occurs, unless notification is prohibited by law or court order. Lanreal does not voluntarily provide personal information to any government surveillance programme. ## 12d. Survival Sections 8 (How Long We Keep It), 10 (Your Rights), 11 (Children's Privacy), 12 (Security Safeguards), 12a (Data Breach Notification), 12b (Business Transfers), 12c (Law Enforcement and Government Requests), 13 (CCPA Notice for California Residents), 14 (Changes to This Policy), 15 (How to File a Complaint), and 16 (Contact Us) of this Privacy Policy, and any obligations arising from a data breach that occurred before termination, survive the termination of your license or the uninstallation of the Software for as long as Lanreal retains any personal information about you. ## 13. CCPA Notice for California Residents This section supplements the rest of this Privacy Policy for California residents whose personal information is collected by Lanreal through the Software, and is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA"). **Current and historical scope.** Version 2.0 sends model-download IP addresses, ordinary request headers and model URLs to Hugging Face or GitHub and their delivery infrastructure for installing requested local models. The sources are your network connection and the app's model request; the relevant categories are identifiers and internet/network activity. The model hosts' roles and retention are described in Sections 5, 7 and 8. Version 2.0 makes no licensing, in-app review/feedback or Featurebase submission requests. Temporary update checks and downloads disclose IP addresses, ordinary HTTP headers and requested release URLs to Cloudflare. Their sources are your connection and the app request; their purpose is secure corrective-update delivery, and their categories are identifiers and internet/network activity. Cloudflare is also a current recipient for that finite purpose, with its role, transfer posture and retention described in Sections 5, 7 and 8. The detailed inventory below preserves the preceding-twelve-month disclosures for earlier releases, including conditional fields users could choose to submit. Those historical present-tense descriptions do not imply those features continue in Version 2.0 or that retained information has been deleted. **Categories of personal information collected.** In the preceding twelve months, Lanreal has collected the following categories of personal information from or about California residents through the Software, as those categories are defined by Cal. Civ. Code Section 1798.140(v): - **A. Identifiers** (such as real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, or similar identifiers): **device hostname**, forwarded to Polar as an activation label as described in Section 3.1; **license key**, forwarded to Polar as a unique activation credential; **IP address**, visible to Polar as an automatic byproduct of the HTTPS connection during license validation, to Cloudflare during speech and Voice Model downloads, to Cloudflare during update checks, and to Supabase as an automatic byproduct of the HTTPS connection during review or feedback submission; and, if you choose to submit a review or feedback through the in-app review popup (Section 3.5), the **email address** associated with the submission (either the customer email received from Polar or, for unlicensed or trial users, an email you type in the popup) and the **display name** you supply. Polar additionally returns to your device a copy of your customer email and customer name as part of the license-activation response, which are stored locally on your device and, if you choose to submit a review, may be transmitted to Supabase as described in Section 3.5. If you submit a feature request under Section 3.12, Featurebase may also receive the name, email, username, IP address, or other account identifier you provide or that its board ordinarily processes. - **B. Personal information categories listed in Cal. Civ. Code Section 1798.80(e)** (such as name, signature, social security number, physical characteristics, address, telephone number, passport number, or similar): **display name** if supplied in the review popup (Section 3.5), and a name or similar information if you voluntarily provide it to Featurebase (Section 3.12). Other information in this statutory category is not requested, but could appear in a voluntary freeform Featurebase submission despite the instruction in Section 3.12. - **C. Characteristics of protected classifications** under California or federal law (such as race, religion, sexual orientation, gender identity, marital status, medical condition, or similar): Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12. - **D. Commercial information** (such as records of personal property, products or services purchased, obtained, or considered, or other purchasing histories): Purchase processing is handled separately by Polar at checkout and is not transmitted by the Software. Reviews and feedback submitted through the in-app review popup are opinion content, not purchase histories. A voluntary Featurebase submission could nevertheless contain commercial information if you choose to include it. - **E. Biometric information:** None. Voice audio is processed by the on-device speech recognition model solely for the purpose of text transcription, not for the purpose of identifying you. The audio is processed in volatile memory for each push-to-talk capture and, if you enable audio saving in the local transcript history (Section 3.4), is also stored only on your own device, encrypted at rest. It is never transmitted to Lanreal, and is never used to create a voiceprint, template, or other biometric identifier. - **F. Internet or other electronic network activity information** (such as browsing history, search history, or interactions with a website, application, or advertisement): None beyond the network flows described in Section 3 (license activation, update check, required or user-selected model downloads, and in-app review or feedback submissions described in Section 3.5, and an optional Featurebase submission under Section 3.12). If you enable the optional cloud post-processing feature described in Section 6, additional network activity (the transmission of transcribed text to the provider you selected) also falls within this category; see Section 6 for details. - **G. Geolocation data:** None. - **H. Audio, electronic, visual, thermal, olfactory, or similar information:** Feature-request messages and attachments are electronic information disclosed to Featurebase when you choose to submit them. Do not attach audio, dictation content, or sensitive files. Voice data handled by Whisperstream remains on your device as described in category E above. - **I. Professional or employment-related information:** Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12. - **J. Education information:** Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12. - **K. Inferences** drawn from any of the above to create a profile reflecting preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, or aptitudes: None. - **L. Sensitive personal information** as defined by Cal. Civ. Code Section 1798.140(ae): Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12; incidental content is handled as described there. **Local transcript history is not collected by Lanreal.** The searchable transcript history described in Section 3.4 (your saved transcribed text and, if you enable it, your audio), and the content-free local access log described in Section 3.4, are created and kept entirely on your own device, encrypted at rest where noted, and are never transmitted to Lanreal. Because Lanreal never receives them, they are not "collected," "sold," or "shared" by Lanreal within the meaning of the CCPA, and they do not add a new category of personal information to the list above. You retain full control of this on-device history and can delete its database records and associated files at any time (see Sections 3.4 and 8). **Sources of personal information.** The device hostname is supplied by your own computer at the time of license activation. The license key is issued to you by Polar Software Inc. upon purchase. The IP address is an automatic byproduct of the HTTPS connection to Polar's API during license validation and to Cloudflare during required or user-selected model downloads, to Cloudflare during update checks, and to Supabase when you submit a review or feedback. Your customer email and customer name are received from Polar Software Inc. as part of the response to a license activation or validation, and are then stored locally on your device; if you choose to submit a review or feedback through the in-app review popup (Section 3.5), the email associated with your submission is either that Polar-sourced customer email (for Pro licence holders) or an email you type directly into the popup (for unlicensed or trial users). Your review display name, testimonial, rating, feature-on-website consent flag, and feedback text are collected directly from you when you type them into the in-app review popup and click Submit. Featurebase feature-request data is collected directly from the text, attachments, account details, messages, and votes you choose to provide on the external board; Featurebase also receives ordinary connection and service-usage data from your visit to that board. **Business or commercial purposes for collecting personal information.** The device hostname is collected for the business purpose of labelling your license-activation slots so that you can distinguish one device from another in the Polar license dashboard. The license key is collected for the business purpose of activating, validating, and deactivating your Whisperstream Pro license. The IP address is not separately collected by Lanreal for a business purpose; it is an automatic byproduct of the HTTPS connection visible to the applicable recipient. The review and feedback fields described in Section 3.5 (email address, display name, testimonial, rating, feature-on-website consent flag, feedback text) are collected for the business purposes of improving the Software, responding to user feedback, and (where you have checked the "feature my review on the website" consent flag) publicly displaying testimonials for marketing purposes. Featurebase submissions are collected to evaluate and respond to feature requests, administer the feedback board, and plan product improvements. **Retention periods.** The retention periods for each category of personal information listed above are described in Section 8 of this Privacy Policy. In summary: Category A data (device hostname, license key, IP address) forwarded to Polar is retained by Polar for the duration of your active license plus Polar's own retention period. Reviews and feedback you voluntarily submit under Section 3.5 are subject to the purpose-limited wind-down retention and deletion provisions in Section 8; they are not retained indefinitely merely for possible future development. All other categories listed as 'None' above are either not collected or are retained only on your local device under your control. Featurebase feature-request data is retained under the board configuration and Featurebase retention schedule described in Section 8, until Lanreal or you delete it where the board permits. **Categories of third parties with whom we share personal information.** Hugging Face, Inc. and GitHub for current model delivery, and Cloudflare Inc. for temporary update delivery, and Polar Software Inc., Cloudflare Inc., Supabase Inc., and CORDNET OÜ (Featurebase) for historical flows and retained records, for the purposes described in Section 5. The license key, device hostname, and operating system family are shared only with Polar. The review and feedback fields (email, display name, testimonial, rating, feedback text, feature-on-website consent flag) are shared only with Supabase when you voluntarily submit a review or feedback. The IP address is visible to Polar during license validation, to Cloudflare during required or user-selected model downloads and update checks, and to Supabase during review submissions, as a standard byproduct of HTTPS connections. Information you choose to submit on the Featurebase board, together with ordinary board connection and service-usage data, is disclosed to Featurebase for feedback-board operation and product planning. **Categories of personal information disclosed for a business purpose.** In the preceding twelve months, Lanreal has disclosed the following categories of personal information to the following categories of third parties for business purposes: Identifiers (device hostname, license key, IP address) to Polar Software Inc. for license activation and validation; Identifiers (IP address) to Cloudflare Inc. for required or user-selected model downloads and update checks; and, for users who voluntarily submit a review or feedback, Identifiers (email, IP address), Personal information in Section 1798.80(e) (display name), and electronic network activity information (review or feedback submission itself) to Supabase Inc. for the reviews and feedback database; and Identifiers, electronic information, and ordinary network-activity information to Featurebase for the external feature-request board. If a user voluntarily includes them in a Featurebase message or attachment despite the instruction in Section 3.12, the Featurebase disclosure may also include personal information under Section 1798.80(e), characteristics of protected classifications, commercial information, professional or employment-related information, education information, or sensitive personal information. Lanreal does not disclose any other category of personal information to third parties for a business purpose. **Sale or sharing of personal information ("Do Not Sell or Share My Personal Information").** Lanreal does not sell your personal information to third parties in exchange for money or other valuable consideration, and Lanreal does not share your personal information for cross-context behavioural advertising. The transfer of your review content and email to Supabase, and of license data to Polar, are disclosures to service providers for the business purposes described above, not a "sale" or "sharing" within the meaning of Cal. Civ. Code Sections 1798.140(ad) or 1798.140(ah). Lanreal has not sold or shared personal information about California residents in the preceding twelve months and does not intend to do so. Because there is no sale or sharing, there is no "Do Not Sell or Share My Personal Information" link; this Privacy Policy, which discloses that the right is not applicable to Lanreal's practices, serves as the required disclosure under Cal. Civ. Code Section 1798.135. **Use of sensitive personal information.** Lanreal does not request or use sensitive personal information for a purpose that triggers the CCPA right to limit. A voluntary Featurebase submission could contain sensitive personal information despite the instruction in Section 3.12; incidental content is handled as described there. **How to submit CCPA requests.** California residents may submit a right-to-know, right-to-delete, right-to-correct, or non-discrimination request by emailing `support@whisperstream.io`. As a business that operates exclusively online and has a direct relationship with its customers through the Software, Lanreal uses email as its designated CCPA request method under Cal. Civ. Code Section 1798.130(a)(1)(A). ## 14. Changes to This Policy Lanreal may revise this Privacy Policy from time to time. When we revise it, we will change the version number, effective date, or last updated date at the top of this document. The version number of this Privacy Policy generally tracks the version of the Software it is bundled with and is an identifier only. Whether a change is material is determined by whether it changes how Lanreal collects, uses, shares, or retains personal information, not by how the version number changes. **How you learn about changes.** The current version of this Privacy Policy is the version bundled with the installer for the Software version you have installed. New installs always receive whichever version ships in the installer at the time of download. Existing users receive the updated Privacy Policy with the updated installer. If an updated End User License Agreement changes rights or obligations, the installed release blocks content processing until the user reviews the complete updated agreement and affirmatively accepts it; closing, deferring, installing, or continued use does not record acceptance. The most recent published Privacy Policy is also available at `https://whisperstream.io/privacy`. **Version 2.0 transition.** The Hugging Face restoration, GitHub speech-model backup addition, temporary Cloudflare update role and retirement of Version 2.0 licensing and feedback routes are prospective provider changes subject to the notice commitment below. An unpublished policy or code merge does not start that period. Actual notice and effective dates must be published through the canonical channels; this draft does not establish that notice has been delivered or that historical providers have been terminated. **Service-provider and recipient changes.** If Lanreal adds, removes, or replaces a party listed in Section 5, or materially changes that party's role or purpose, the change will be reflected in a new version of this Privacy Policy. Lanreal also publishes a public provider list at `https://whisperstream.io/subprocessors` and a companion RSS feed at `https://whisperstream.io/subprocessors/feed.xml`, both of which mirror Section 5 and the human-readable changelog Lanreal maintains for provider additions, removals, replacements, and material updates. Except for changes required for security, legal, or fraud-prevention reasons, Lanreal commits to publishing each prospective provider change to that page and feed at least thirty (30) days before it takes effect, so that you have a meaningful opportunity to exercise the right to object to processing under Article 21 of the General Data Protection Regulation, or the equivalent right of withdrawal of consent and accountability-based recourse under Canadian federal privacy law and the *Personal Information Protection and Electronic Documents Act*, before the change becomes operative. The page and feed are the canonical advance-notice channel; Section 5 of this Privacy Policy remains the authoritative source of truth for the current list. ## 15. How to File a Complaint If you believe that Lanreal has processed your personal information in a way that is inconsistent with this Privacy Policy or with applicable privacy law, please contact Lanreal first at `support@whisperstream.io` so that we have the opportunity to address your concern. Lanreal's Privacy Officer will investigate your complaint and respond within the timeline described in Section 10. Lanreal commits to investigating all privacy complaints received and, if a complaint is found justified, taking appropriate measures including amending policies and practices where necessary. If you are not satisfied with Lanreal's response, you may also have the right to lodge a complaint with a supervisory authority: - **European Economic Area, the United Kingdom, and Switzerland:** you have the right under GDPR Article 77 to lodge a complaint with the data protection supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement. - **California:** you may contact the California Privacy Protection Agency or the California Attorney General's Office for information about your rights under the CCPA. - **Canada (federal):** you may file a complaint with the Office of the Privacy Commissioner of Canada (the 'OPC') at `https://www.priv.gc.ca/en/report-a-concern/`, toll-free 1-800-282-1376. The OPC has the authority to investigate your complaint under section 11 of the Personal Information Protection and Electronic Documents Act, issue a Report of Findings, and make formal recommendations. If the matter remains unresolved after the OPC's investigation, section 14 of the Act grants you the right to apply to the Federal Court of Canada for a hearing. - **Canada (provincial):** if you are a resident of Quebec, British Columbia, or Alberta, your provincial regulator may have parallel jurisdiction. You may contact Quebec's Commission d'accès à l'information at `https://www.cai.gouv.qc.ca`, the Office of the Information and Privacy Commissioner for British Columbia at `https://www.oipc.bc.ca`, or the Office of the Information and Privacy Commissioner of Alberta at `https://www.oipc.ab.ca`. Nothing in this section limits any other right or remedy available to you under applicable law. ## 16. Contact Us Questions, requests, and complaints about this Privacy Policy and about Lanreal's handling of personal information should be directed to Lanreal's Privacy Officer: **Privacy Officer** Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada Email: `support@whisperstream.io` Lanreal Technologies Inc. is the data controller for the personal information described in this Privacy Policy. The Privacy Officer is the designated contact for Canadian federal privacy law, for GDPR Articles 13 and 14, and for CCPA consumer requests. **Accessibility.** This Privacy Policy is available in Markdown format bundled with the Software, in plain text format inside the installer, and in HTML format at `https://whisperstream.io/privacy`. If you need this Privacy Policy in an alternative format to accommodate a disability, please contact us at `support@whisperstream.io`. Copyright (c) Lanreal Technologies Inc. All rights reserved.