Whisperstream Privacy Policy

Version 1.4

Effective 2026-08-11

This Privacy Policy explains how Lanreal Technologies Inc. ("Lanreal," "we," "us," or "our") collects, uses, shares, and retains personal information in connection with the Whisperstream desktop application for Microsoft Windows (the "Software"). It also describes the rights you have with respect to that personal information and how to exercise them. By installing and using the Software, you acknowledge that you have read and understood this Privacy Policy.

Whisperstream is a local, on-device dictation application for Microsoft Windows. It captures microphone audio when you press a push-to-talk hotkey, transcribes that audio on your own computer using a speech recognition model that runs entirely on your CPU, and types the resulting text into the focused window. The Software keeps your voice recordings and your transcribed text on your device. The only personal information that leaves your device by default consists of narrow operational metadata (a license key, a hostname, and standard HTTP headers) sent to Polar and Cloudflare for license validation, software updates, and the required first-run model download (see Section 3). Additional data may leave your device when you select a model download; submit a review, feedback, or Featurebase request; deliver text to a destination application; or enable optional cloud cleanup. Imported audio remains local, although its resulting transcript may enter cloud cleanup if you enabled it. Agent Speak exchanges content with Claude Code over the local loopback interface; Claude Code separately controls any transmission to its configured model provider. Each flow is described in detail in this Privacy Policy.

This Privacy Policy covers the Whisperstream desktop application only. It does not cover the marketing website at whisperstream.io, which is governed by a separate website privacy notice published at https://whisperstream.io/privacy-website. If you reached this document from the marketing site, please refer to the website privacy notice for information about how the site itself is operated.

This Privacy Policy also does not cover your relationship with Polar Software Inc., the Merchant of Record that handles the purchase of your Whisperstream license. When you buy the Software, Polar separately collects your email address and payment information through its own checkout flow. That information is governed by your relationship with Polar and by Polar's own privacy policy at https://polar.sh/legal/privacy; it is not transmitted by the Software and is not covered by this Privacy Policy.

In this Privacy Policy, 'personal information' means information about an identifiable individual, encompassing 'personal data' as defined by the GDPR (Article 4(1)), 'personal information' as defined by the CCPA (Cal. Civ. Code s.1798.140(v)), and 'personal information' as defined by Canadian federal privacy law (s.2(1)).

The data controller responsible for the personal information described in this Privacy Policy is:

Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Lanreal is a corporation incorporated under the Business Corporations Act (Ontario). Our registered office is in the Province of Ontario, and our operations are governed by Canadian federal and provincial law applicable therein.

Privacy Officer designation. In accordance with Canadian federal privacy law (the Personal Information Protection and Electronic Documents Act), Lanreal Technologies Inc. has designated a Privacy Officer responsible for compliance with this Privacy Policy. The Privacy Officer can be contacted at support@whisperstream.io. Throughout the remainder of this document, "Canadian federal privacy law" refers to the statute named above.

Under the European Union General Data Protection Regulation (GDPR), Lanreal is the "controller" of the personal information described in this Privacy Policy. Under the California Consumer Privacy Act (CCPA), Lanreal is a "business" that collects personal information about California residents through the Software.

All privacy-related communication, including data subject rights requests, complaints, and general questions about this Privacy Policy, should be directed to support@whisperstream.io. This is Lanreal's single privacy contact channel for the Software.

EU Representative. Lanreal is in the process of designating a representative in the European Union in accordance with Article 27 of the General Data Protection Regulation. Until a representative has been designated, individuals in the European Economic Area may direct any questions or requests relating to the processing of their personal data under the GDPR to Lanreal directly at support@whisperstream.io. This policy will be updated with the representative's contact details once the designation is complete.

The Software is intentionally narrow in the information it handles. This section enumerates every category of information associated with your use of the Software, in the order in which the underlying network activity happens.

3.1 License activation and validation data

When you activate, validate, or deactivate your Whisperstream license, the Software sends the following data to Polar Software Inc.'s license-key API at api.polar.sh:

• your license key,
• the Whisperstream organization identifier (a static value that identifies the Whisperstream product inside Polar, not an identifier of you),
• the operating system family string returned by your operating system (for example, "Windows"), and
• your device's hostname, which is forwarded in both the label and meta fields so you can distinguish which of your devices a given license slot is assigned to.

In addition to the fields listed above, each request includes the standard HTTP headers automatically sent by the underlying HTTP library (including your IP address as seen by Polar's server).

Validation occurs approximately once per seven days while you are online and running a Pro license, and each time you explicitly activate or deactivate a device. No email address, no full device fingerprint (no MAC address, no disk serial, no CPU serial, no motherboard identifier), no usage data, and no information about the content of your transcriptions are sent as part of these requests.

Your device hostname is transmitted at the time of activation (whether an initial activation or a re-activation of a previously deactivated device). Periodic validation checks and deactivation requests transmit only the license key, the Whisperstream organization identifier, and the activation identifier; they do not re-transmit the hostname.

Data received from Polar in response. When you complete a license activation or validation, Polar's API response returns to the Software your customer email address and your customer name (as supplied by you during Polar checkout). The Software stores these values locally on your device, inside your Windows user profile, in the same HMAC-protected state record as your license key. The customer email is used when you choose to submit a review or feedback through the in-app review feature (see Section 3.5) to associate the submission with your licence. Neither the customer email nor the customer name is ever transmitted by the Software to Lanreal except if you choose to send a review or feedback (Section 3.5) or a bug report (Section 3.4).

3.2 Update-check data

The Software periodically requests the file at https://releases.whisperstream.io/latest.json to determine whether a newer version of the Software is available. This request is a standard HTTP GET. No device identifier, Whisperstream application version number, or other identifying data is sent in the request URL, headers, or body beyond the standard Accept and User-Agent headers automatically added by the underlying HTTP library (including your IP address as seen by the update server). Specifically, the headers are User-Agent: tauri-plugin-updater/<crate-version> and Accept: application/json.

Update manifests are cryptographically signed using the minisign signing scheme, and the Software verifies the minisign signature locally on your device before installing any update. Although the request headers themselves do not identify you, the update server sees your IP address as part of the underlying network connection. Under the GDPR, IP addresses may constitute personal data (see Section 4 for the lawful basis applicable to this processing).

The Software does not currently provide a user-facing control to disable automatic update checks.

3.3 Speech-recognition model download data

During setup, or after you select a language or speech-recognition engine, the Software downloads the model required for that selection. The Software requests the model manifest and required files only from Lanreal's Cloudflare R2 model-distribution endpoint at https://models.whisperstream.io. No personal information is sent in this request beyond the standard HTTP headers (including your IP address, as with any ordinary HTTP download) automatically added by the underlying download library.

The Software does not attach a Lanreal account identifier, license key, or authentication token to a model request. The requested URL necessarily identifies the selected model to Cloudflare. Opening the Enhancement page can request the same manifest to check whether optional on-device models are available, without downloading a model file.

If you later select the Qwen speech-recognition engine, the Software downloads its model from the same Cloudflare endpoint. That user-selected download has the same connection-data treatment as the Parakeet downloads. Hugging Face repositories remain upstream provenance and attribution sources for the model artifacts, but the production Software does not contact Hugging Face to download them.

3.4 Data that stays on your device

The following information is handled on your own computer and is not transmitted to Lanreal. User-directed delivery to a destination application and the optional outbound flows identified below are the specific exceptions to local-only handling:

• Audio recordings. Microphone audio is held in random-access memory while each push-to-talk capture is transcribed on your CPU, and is never uploaded to any server. If you keep the local transcript history enabled with audio saving on (both are on by default, and both can be turned off), a copy of the recording is also stored, encrypted, on your own device, as described in the "Local transcript history" entry below. No audio data is ever transmitted off your device.

Voice data is not biometric data. The speech recognition model processes your voice solely to convert speech into text. It does not create a voiceprint, does not perform speaker identification or authentication, and does not extract or store any biometric identifier from your voice. Under the GDPR (Article 9), biometric data is subject to enhanced protections only when processed for the purpose of uniquely identifying a natural person. Because the Software processes voice exclusively for transcription and not for identification, the voice data handled by the Software does not constitute biometric data within the meaning of Article 9.

• Transcribed text. The text produced by the speech recognition model is typed into the window you have focused. If you keep the local transcript history enabled (it is on by default and can be turned off), the transcribed text (both the raw transcript and, if you use the optional AI cleanup feature, the enhanced version) is also stored, encrypted, on your own device, as described in the "Local transcript history" entry below. Transcribed text is never transmitted to Lanreal or retained by Lanreal in any form.
• Local transcript history. The Software keeps a searchable history of your past dictations on your own device so that you can review, copy, and replay them. This history is enabled by default and can be fully disabled. It stores your transcribed text (the raw transcript and, where you used AI cleanup, the enhanced version) and, when audio saving is enabled, the recorded audio. The transcribed text and the audio are encrypted at rest using AES-256-GCM. The AES key is itself sealed using the Windows Data Protection API, bound to your Windows user account on the specific device, so the history can be opened only by the same Windows user on the same device. The raw transcript, enhanced transcript, saved audio, and waveform peaks used by the player are encrypted separately. Lightweight index metadata (such as a record identifier, timestamp, duration, model name, source type, and relative audio-file location) is stored unencrypted so the list can be sorted and displayed without decrypting its content. The history is kept inside your Windows user profile under %LOCALAPPDATA%\Whisperstream\ (a transcripts.db index and a recordings\ folder). Nothing in the history is ever transmitted off your device. You control it: a master "Save transcripts" toggle and a separate "Save audio" toggle let you keep a text-only history or turn history off entirely, and a retention window (1, 7, or 30 days, or forever, with 7 days as the default) automatically removes older entries. You may also delete an individual entry or clear the entire history at any time. See Section 8 for retention and deletion details.
• Local diagnostic logs. Outside Lockdown Mode, the Software writes content-free operational events to a local whisperstream.log file under %LOCALAPPDATA%\Whisperstream\logs\. The active file and up to three backups are each limited to approximately 2 MiB. The Software excludes transcript and Agent Speak content, license keys, full email addresses, foreground process identity, imported-audio filenames and paths, browser hosts, and raw error text that could carry user content. Each application window also keeps a bounded in-memory frontend log buffer (up to 500 entries, 2 KiB per entry, and 128 KiB total). The backend re-sanitizes synchronized frontend entries and keeps at most 128 KiB across windows in process memory. These logs are never transmitted automatically. Entering Lockdown Mode pauses and clears frontend capture and disables the diagnostic log and support export; leaving it resumes with empty frontend buffers.
• Usage statistics. The Software keeps aggregate counters of how many transcriptions you have run, how many words you have transcribed, and how much recording time you have accumulated. These counters are stored locally in your Windows user profile and are never transmitted.
• Configuration. Your settings, including your chosen hotkey, audio device, and word-override dictionary, are stored locally in a configuration file under your Windows user profile and are never transmitted.
• Lockdown access log. While Lockdown Mode is effective, the Software keeps a separate content-free access log that records the time and an allowlisted operation type for transcript-history access and Lockdown state changes, together with a sanitized short record identifier when applicable. It never records transcript or audio content, your password or recovery code, or health information. The active access.log file and up to five backups are each limited to approximately 2 MiB. This audit log is stored only under %LOCALAPPDATA%\Whisperstream\logs\, is not included in support exports, and is not created for ordinary transcript operations outside Lockdown Mode.

Lanreal does not automatically receive the local stores described in this Section 3.4. Particular content may nevertheless leave your device through a separate, user-directed flow described elsewhere in this Policy: finished text is delivered to the destination application under Section 3.10; a transcript may be sent to the cloud-cleanup provider you configure under Section 6; an Agent Speak reply is returned to Claude Code under Section 3.11; and review, feedback, or Featurebase content is sent only when you submit it under Sections 3.5 and 3.12. Those recipients control their own copies under the terms identified in the applicable section. If you choose to download a diagnostic archive, the backend builds it in memory and streams it to the destination you select; it does not write an app-managed ZIP file. That downloaded copy is under your control. If you then send it to Lanreal as part of a bug report (for example, by attaching it to an email to support@whisperstream.io), Lanreal processes the information you send to diagnose the issue and retains it for the duration of that support interaction.

A summary of the categories above, mapped to the CCPA categories of personal information, is provided in Section 13 of this Privacy Policy.

3.5 In-app reviews and feedback (voluntary submissions)

The Software includes an in-app review popup that lets you share a rating, a testimonial, or a free-text feedback message with Lanreal. The popup is surfaced after a usage-based heuristic suggests you may be ready to leave a review; you can also dismiss it and never return to it. The submission itself is voluntary: nothing leaves your device under this Section 3.5 unless you type content into the popup and click Submit.

When you submit a review, the Software transmits the following fields to Lanreal's reviews database (hosted on Supabase, see Section 5):

• the star rating you selected (1 to 5),
• the testimonial text you typed,
• the display name you typed (or that is prefilled from the customer name associated with your licence, which you may edit),
• a "feature my review on the website" consent flag indicating whether you agree to have Lanreal display your testimonial and display name publicly on the Whisperstream website for marketing purposes, and
• the email address associated with the submission: for activated Pro licences, this is the customer email received from Polar in response to your licence activation (see Section 3.1), displayed in a read-only field in the popup so you can see it before you click Submit; for unlicensed or trial users, this is a required email address that you type into the popup, and the Software blocks submission until you enter a syntactically valid email.

When you submit feedback (without a star rating), the Software transmits the feedback text you typed and the email address associated with the submission, as described above.

In addition to the fields listed above, each submission includes the Whisperstream application version and the standard HTTP headers automatically sent by the underlying HTTP library (including your IP address as seen by the Supabase server). The Software does not transmit your transcribed text, your voice, your device hostname, your operating system, your usage statistics, your configuration, or your license key as part of a review or feedback submission.

Lanreal uses submitted reviews and feedback to improve the Software and, where you have checked the "feature my review on the website" consent flag, to display testimonials publicly on the Whisperstream website. Reviews and feedback are stored by Supabase in the United States and are retained indefinitely by Lanreal until you request deletion (see Section 10).

If you never click Submit on the review popup, nothing is transmitted by this feature and Lanreal has no record of you having seen the popup.

3.6 Lockdown Mode (optional hardening)

Lockdown Mode is an optional setting you can turn on to harden the Software for privacy-sensitive and HIPAA-conscious workflows. It is off by default. Lockdown Mode is designed to support HIPAA-conscious workflows; it is not a HIPAA certification, it does not make the Software HIPAA compliant, and it does not replace your own compliance obligations. When Lockdown Mode is on:

• AI cleanup runs on your device only. The cloud providers and self-specified endpoints described in Section 6 are disabled, and AI cleanup is forced to the on-device model, so Whisperstream does not send that transcript to a configured cleanup provider.
• Your transcript history is locked behind a password. A key derived from a password you choose additionally wraps the transcript encryption key, on top of the AES-256-GCM encryption at rest and the Windows Data Protection API sealing already described in Section 3.4 (see Section 12 for the details). A one-time recovery code is created when you turn Lockdown Mode on and is the only other way to unlock your history. The history locks again automatically after an idle period you set, and repeated failed unlock attempts trigger escalating delays.
• Or you can choose to save nothing. Instead of a password-protected history, you may turn Lockdown Mode on without saving transcripts at all, in which case no transcript history is written to your device.
• Diagnostic logging is turned off; the content-free access log is separate. Diagnostic and telemetry logging is disabled, while the local, content-free access log described in Section 3.4 records allowlisted transcript-history and Lockdown operations (never their content). The audit log is not included in support exports.

Data-loss warning. Your Lockdown Mode password and your recovery code are held only on your own device. Lanreal never receives your password, your recovery code, or your transcripts. If you set a transcript password and lose both your password and your one-time recovery code, you will not be able to unlock your transcript history through the Software, and Lanreal cannot unlock or recover it for you. There is no Lanreal-side backup. The Software offers a destructive reset that removes the still-locked transcript history through ordinary database and file deletion and turns off Lockdown Mode; it cannot restore the old records or securely overwrite the storage device.

In Lockdown Mode, Whisperstream's audio, transcription, history, and AI cleanup pipeline stays on your device and Lanreal never receives that content. Lockdown Mode does not prevent the text from being delivered to the destination application you selected, and it does not disable Agent Speak or control Claude Code's provider connection. Those destinations handle data under their own terms. Section 14 of the Whisperstream End User License Agreement sets out the related disclaimers, including that Lockdown Mode is not a HIPAA certification and that, for this on-device workflow, Lanreal is not a business associate and there is no Business Associate Agreement to sign. Turning Lockdown Mode off and choosing a cloud AI provider would send transcribed text to that provider and change this; Lockdown Mode blocks the cloud providers to keep the Whisperstream pipeline on your device.

3.7 Optional voice feature model downloads

Whisperstream includes an optional voice feature that reads an artificial-intelligence coding assistant's text replies aloud on your device. The feature is off by default and does nothing until you turn it on.

If you enable it, the Software downloads the Voice Model or Voice Models needed for your selected or automatically resolved engine only from Lanreal's model distribution endpoint at https://models.whisperstream.io, which is hosted on Cloudflare's infrastructure. No spoken text, generated audio, license key, account information, or device identifier is put in the request. The request includes standard HTTP headers automatically added by the underlying download library, including a User-Agent, and your IP address is visible to the applicable host as part of the ordinary network connection. Each downloaded file or archive is verified against a cryptographic checksum built into the Software before it is installed.

The Voice Models run entirely on your device. The Software does not transmit the text sent to the Voice Models or the audio they generate off your device for speech synthesis. Lanreal does not receive that text or audio and sends no separate feature-use telemetry. The model host can retain the ordinary access-log record described in Section 8, which can show that a model-specific file was requested. Turning the feature off stops the Software from using the Voice Models. You can remove a downloaded model from your device by deleting its applicable model directory under %LOCALAPPDATA%\Whisperstream\models\. If you selected a custom model storage location, delete the corresponding models or local-llm directory from that custom location instead.

The available Voice Models have different third-party license terms. Kokoro 82M is distributed under Apache License 2.0 and is not subject to the behavioural use restrictions described below. If you download, enable, or use Supertonic 3, your use of that model is subject to its OpenRAIL-M behavioural use restrictions. Those restrictions are set out in Section 27 of the Whisperstream End User License Agreement and reproduced in full in the THIRD_PARTY_LICENSES.txt file bundled with the Software.

3.8 Optional on-device AI cleanup model download

If you select on-device AI cleanup and its Gemma model is not already installed, the Software downloads that model from Lanreal's Cloudflare R2 endpoint at https://models.whisperstream.io. The request contains your IP address and standard HTTP headers, and the requested URL identifies the selected model to Cloudflare. The Software does not include transcript text, a license key, account information, or a device identifier in the model request. The model is verified locally before installation and then processes transcribed text entirely on your device.

3.9 Trial, activation, and acceptance state stored on your device

The Software stores the state needed to operate the seven-day trial, license activation, and legal acceptance. In a packaged Windows build, the trial and activation record is stored in the current user's Windows registry under HKCU\Software\Whisperstream; development builds use a local file instead. The record includes the trial start time, the latest time observed for clock-rollback protection, activation status, license key, activation identifier, last validation time, and the customer name and email returned by Polar. A keyed HMAC detects modification but does not encrypt this record. A failed integrity check treats the trial as expired. The record remains until you remove the registry value or the application data as described in Section 8.

The Software separately stores local records of the EULA version and content hash you accepted, the acceptance time, the Software version, the type of acceptance event, and any cloud-processing consent. EULA acceptance evidence is kept in an append-only local ledger: accepting a later agreement updates the current acceptance fields while preserving earlier exact acceptance records in the same file. These records are used to identify the current legal notice and consent state. They are not sent to Lanreal.

3.10 Imported audio, app/site routing, and text delivery

When you import audio, the Software reads and decodes each file in place, transcribes it on your device, and stores the resulting entry under the same history settings as a microphone dictation. The selected path is used only while the import is active; its base filename may be shown in the active progress interface but is not written to diagnostics. The Software does not modify, delete, or make a plaintext path-based copy of your source file. If cloud AI cleanup is enabled, the resulting transcript may be sent to the provider you selected under Section 6. The imported audio itself is not uploaded.

Foreground and browser information is read only when a configured app or site rule, manual route, Pin Mode, or destination-delivery operation can use it. App routing uses local process identity. A configured browser site rule may cause the Software to read only the normalized active host from a supported browser's address bar; it does not collect the full URL through this route. Pin Mode keeps the selected window handle and process identifier in bounded process memory for activation. No foreground or host probe is performed when routing cannot affect the current operation. These transient values are not written to diagnostics or sent to Lanreal. The app paths and host rules you choose to save remain in your local settings.

When you choose a site-routing rule, the Software may read matching favicon data from the local Chrome, Edge, or Firefox favicon database to display the rule. It first uses a read-only database connection. If the browser has locked that database, it may create an attributable copy in the operating-system temporary directory. The Software closes the copy and makes up to three ordinary deletion attempts after use. At startup and before creating another owned copy, it also tries to remove only attributable Whisperstream copies older than 24 hours. A copy can remain longer after a crash or repeated deletion failure; the Software does not broadly delete older unattributable browser-database copies. It does not send the database, host, or favicon to Lanreal or a network favicon service.

Whisperstream delivers finished text to the focused or pinned destination application using a clipboard paste or simulated keystrokes. The destination application then receives and controls that text under its own privacy and retention practices. Lockdown Mode does not prevent this user-directed delivery.

3.11 Agent Speak and Claude Code interactions

Agent Speak is an optional, default-off local companion for Claude Code. When enabled, Whisperstream's Claude Code plugin forwards response text, structured questions and options, permission context, short replies, session-scoped identifiers, and a sanitized session name to the Software's loopback-only backend so the local HUD can display, speak, or answer them. When response display is disabled, the raw response is not sent to the HUD, although local speech or reply routing may still use it.

The Software keeps active Agent Speak content in bounded process memory and does not write hook payloads, content-derived fingerprints, paths, session identifiers, or interaction content to diagnostic logs or support exports. Questions expire after approximately 15 seconds if they are not answered. Delivered decisions are discarded, and retained reply drafts expire after approximately 120 seconds and are subject to count and size limits. Completion acknowledgement, feature disablement, Lockdown Mode, or shutdown clears the applicable active state and bounded caches.

To resolve an active display name, Whisperstream may reduce a working directory immediately to its base name or read a limited tail of a regular Claude Code transcript file confined to Claude Code's local projects directory. A project base name can itself be sensitive; it remains bounded active display state and is not logged or exported. Agent discovery writes only a local port number while the feature is enabled and removes that file on disablement, Lockdown Mode, or clean shutdown.

A reply you dictate through Agent Speak passes through Whisperstream's ordinary local dictation pipeline. If "Save transcripts" is on, that reply is stored as an agent_reply history entry with the same encrypted content and retention controls as other saved dictations. Other Claude Code interaction content is not written to transcript history. Whisperstream does not automatically send these local records or interaction content to Lanreal.

Agent Speak does not control how Claude Code sends prompts or receives responses from Anthropic or another provider you configured in Claude Code. That provider interaction occurs outside Whisperstream and is governed by your Claude Code and provider terms. Lockdown Mode blocks Whisperstream's optional cloud AI cleanup, but it does not disable Agent Speak or change Claude Code's own network behavior.

3.12 Feature requests on Featurebase

If you choose "Request a feature on Featurebase," the Software opens Lanreal's external feedback board in your browser. Whisperstream does not automatically send transcript content or other application data to the board. Information you choose to submit there may include a feature request, messages, attachments, contact or account identifiers, votes, and standard service-usage data. Lanreal uses submissions to evaluate, respond to, and plan product improvements. Do not include dictation content, sensitive personal information, or GDPR Article 9 special-category data. If Lanreal becomes aware that a submission contains such information, Lanreal will delete or restrict it as reasonably practicable, subject to any legal retention obligation. Featurebase's role is described in Section 5.

This section explains, for each category of information described in Section 3, the purpose for which Lanreal processes that information and the corresponding lawful basis under GDPR Article 6.

• License activation and validation data. The purpose of forwarding your license key and the Whisperstream organization identifier to Polar is to activate your Whisperstream license, to validate that the license is still current, and to deactivate a device when you choose to release it. The lawful basis under GDPR Article 6 is Article 6(1)(b), the performance of a contract to which you are a party (the Whisperstream Pro license itself).
• Device hostname forwarded to Polar as an activation label. The purpose of forwarding the operating system hostname, along with the operating system family string, is to let you distinguish which of your devices a given license slot is assigned to in the Polar license dashboard. The lawful basis under GDPR Article 6 is Article 6(1)(b), performance of the license contract, because multi-device slot management is part of the license as described in the Whisperstream End User License Agreement. Your IP address, which is visible to Polar as a standard byproduct of the HTTPS connection, is processed under GDPR Article 6(1)(b) as part of the same license validation transaction.
• Update-check data. The purpose of the update check is to let the Software determine whether a newer version is available, and to verify the integrity and authenticity of any update before it is installed. As described in Section 3.2, the update server sees your IP address as part of the underlying network connection. The lawful basis for this incidental processing of your IP address is GDPR Article 6(1)(f), Lanreal's legitimate interest in delivering signed, authenticated software updates to protect the security and integrity of the Software.
• Required speech-recognition model download data. The purpose of the model download is to provide the Software with the Parakeet speech-recognition model required by setup or your selected language. As described in Section 3.3, the download transmits standard HTTP headers including your IP address to Cloudflare. The lawful basis for this incidental processing of your IP address is GDPR Article 6(1)(f), Lanreal's legitimate interest in providing the Software with the speech recognition model it requires to function.
• User-selected speech and local AI model download data. The purpose is to install the optional Qwen speech-recognition or Gemma on-device cleanup model you selected. The lawful basis is GDPR Article 6(1)(f), Lanreal's legitimate interest in delivering the on-device feature you asked the Software to enable.
• Optional voice feature model download data. The purpose of these downloads is to provide the optional voice feature with the Voice Model or Voice Models it needs, and they happen only if you turn that feature on. As described in Section 3.7, the download transmits standard HTTP headers including your IP address to Cloudflare. The lawful basis for this incidental processing of your IP address is GDPR Article 6(1)(f), Lanreal's legitimate interest in delivering a feature you asked the Software to enable.
• Local product data and state. The local information described in Sections 3.4 and 3.9 to 3.11 is processed by the Software to provide the features you request, protect the trial and license from abuse, route dictation, and preserve legal acceptance records. Lanreal does not receive this information through the Software. To the extent an Article 6 basis is required for Lanreal's determination of these local purposes, the basis is Article 6(1)(b) for feature and license performance and Article 6(1)(f) for trial integrity, fraud prevention, and legal record-keeping. If you choose to send logs to Lanreal as part of a bug report, the lawful basis for Lanreal's subsequent processing is Article 6(1)(f), our legitimate interest in diagnosing and fixing the issue you have reported, balanced against your interests and your expectations as the person who initiated the bug report.
• Transcribed text transmitted under the optional cloud post-processing feature. If you enable the optional feature described in Section 6 and select a cloud provider, the purpose of transmitting your transcribed text to that provider is to perform the post-processing that you have requested (for example, grammar or style correction). The lawful basis under GDPR Article 6 is Article 6(1)(a), your explicit consent, which you give by enabling the feature in the Software's settings, selecting a provider, and supplying a credential for that provider. This consent basis covers all data transmitted to the provider as part of the post-processing request, including the transcribed text, your API credential, any instruction prompt you have configured, and the IP address visible to the provider as a standard byproduct of the HTTPS connection. You may withdraw your consent at any time by disabling the feature as described in Section 6.5, which stops all further transmission of transcribed text to the provider. Note that Lanreal is not the recipient of the transcribed text in this processing; the recipient is the provider you selected, and your contractual relationship is directly with that provider.
• Review and feedback submissions (Section 3.5). If you choose to submit a review or feedback through the in-app review popup, the purpose of processing the rating, testimonial, display name, feedback text, and associated email is to operate Lanreal's reviews database (including responding to your feedback and improving the Software). The lawful basis under GDPR Article 6 is Article 6(1)(a), your explicit consent, which you give by clicking Submit in the review popup after seeing the fields that will be transmitted. You may withdraw your consent and request deletion of your submitted content at any time by contacting Lanreal as described in Section 10. Where you check the "feature my review on the website" consent flag, your consent to public display of your testimonial and display name for marketing purposes is a separate Article 6(1)(a) basis that you may also withdraw by the same mechanism.
• Feature requests (Section 3.12). Lanreal processes information you submit on the Featurebase board to evaluate and respond to feedback and plan product improvements. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in operating and improving the Software. You may use Whisperstream without visiting or submitting to the board. Lanreal does not intentionally process Article 9 special-category data for this purpose; incidental special-category content is handled as described in Section 3.12 rather than treated as ordinary feature-request data.

Obligation to provide personal data. The provision of your license key and device hostname to Polar for license activation is a contractual requirement necessary for the performance of the Whisperstream Pro license. If you do not provide this information (by activating the Software), the Software will not function beyond any applicable trial tier. You are not under any statutory obligation to provide personal data described in this Privacy Policy; the obligation is contractual. No other personal information described in this Privacy Policy is required to be provided by you as a condition of using the Software. If you choose not to enable the optional cloud post-processing feature described in Section 6, or if you withdraw your consent by disabling it, the Software continues to function normally for all core features (on-device transcription, text injection, local configuration). The only consequence is that the cloud-based post-processing functionality is unavailable. Submitting reviews or feedback through the in-app review popup (Section 3.5) is entirely voluntary and is not a condition of using the Software.

Except for the optional cloud post-processing feature described in Section 6 and the voluntary review, feedback, and testimonial-display choices described in Sections 3.5 and 4, Lanreal does not rely on your consent (GDPR Article 6(1)(a)) as the lawful basis for processing described in this Privacy Policy. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22.

Whisperstream relies on the following third-party service providers and other recipients across its default and user-initiated application flows. Some act as processors on Lanreal's behalf; others determine their own purposes for limited connection data as identified below. The list is exhaustive for those application flows. If you enable the optional cloud post-processing feature described in Section 6, you establish a direct contractual relationship with the cloud provider you select, and that provider is not a Lanreal service provider or recipient within the meaning of this Section 5. Changes to this list are communicated via version bumps to this Privacy Policy (see Section 14), and are also published in advance via the public provider page and RSS feed described in Section 14. In accordance with Principle 4.1.3 of the Personal Information Protection and Electronic Documents Act, Lanreal uses contractual and other means to ensure that each listed recipient acting as a processor on Lanreal's behalf provides a comparable level of protection for personal information transferred for processing. Lanreal remains accountable for the protection of personal information transferred to third-party processors. Lanreal does not use or disclose personal information for purposes other than those described in this Privacy Policy, unless required by law.

1. Polar Software Inc. (Delaware, USA) -- license activation and Merchant of Record. Receives your license key, the Whisperstream organization identifier, your device hostname, and your operating system family. Polar's processing of this information is governed by Polar's privacy policy at https://polar.sh/legal/privacy. For the license activation and validation data described in Section 3.1, Polar acts as a data processor on Lanreal's behalf within the meaning of GDPR Article 28. For the separate checkout and payment data that Polar collects directly from you (email address, payment information), Polar acts as an independent data controller. Polar's Data Processing Addendum (at https://polar.sh/legal/data-processing-addendum), which forms part of the Polar Master Services Terms, designates Polar as the processor and incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area and the United Kingdom to the United States. Note: when you complete your purchase, Polar separately collects your email address and payment information directly from you through its checkout flow. That information is governed by your relationship with Polar and is not transmitted by Whisperstream.

2. Cloudflare, Inc. (Delaware, USA) -- model distribution and software updates. Lanreal serves model files from a Cloudflare R2 endpoint at models.whisperstream.io. Whisperstream uses this endpoint for the required Parakeet speech-recognition model; user-selected Qwen and Gemma models; and optional Supertonic or Kokoro voice models. The Software can also request the model manifest to determine optional model availability. Cloudflare receives only the standard HTTP headers automatically sent by the underlying download library, including your IP address. Cloudflare's processing is governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Cloudflare's GDPR transfer mechanism is the European Commission's Standard Contractual Clauses combined with EU-U.S. Data Privacy Framework certification.

   Note: the Software's update-check endpoint at releases.whisperstream.io is hosted on Cloudflare's infrastructure. Update checks are covered by the Cloudflare disclosure above.

3. Supabase, Inc. (Delaware, USA) -- reviews and feedback database. If you choose to submit a review or feedback through the in-app review popup described in Section 3.5, Supabase hosts the relational database tables (reviews and feedback) that store your submission. Supabase receives the submitted fields (rating, testimonial, display name, feedback text, the "feature on website" consent flag, the email address associated with the submission, and the Whisperstream application version) together with the standard HTTP headers automatically sent by the underlying HTTP library (including your IP address). Supabase's processing is governed by Supabase's privacy policy at https://supabase.com/privacy. Lanreal has executed Supabase's Data Processing Addendum (published at https://supabase.com/legal/dpa); the Standard Contractual Clauses (Controller-to-Processor, Module 2) incorporated into that Addendum are the transfer mechanism for personal information sent from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States.

4. CORDNET OÜ (d/b/a Featurebase) (Estonia) -- external feature-request board. If you choose the control described in Section 3.12 and submit information on the board, Featurebase processes feedback, messages, attachments, end-user identifiers, and workspace usage on Lanreal's behalf. Lanreal is the controller for this Customer Personal Data and Featurebase is the processor. Featurebase separately acts as an independent controller for its own account, billing, security, fraud-prevention, and service data. Its Data Processing Agreement is incorporated into its customer terms and is available through Featurebase's help centre at https://help.featurebase.app. Its privacy policy is at https://help.featurebase.app/en/articles/4744036-privacy-policy. Featurebase states that Customer Personal Data is primarily hosted in the European Economic Area and uses Standard Contractual Clauses, a UK Addendum, and a Swiss Addendum where an onward transfer requires them.

Other than the four recipients listed above, Lanreal does not share personal information with any other recipients. In particular, Lanreal does not disclose personal information to advertisers, data brokers, or social media platforms, and Lanreal does not use third-party analytics, crash reporting, or error-reporting services (see Section 9 for the full enumeration of what the Software does not do).

The Software includes an optional AI cleanup feature that can route transcribed text through a Large Language Model for post-processing (for example, filler-word removal, spoken-correction handling, punctuation and number normalization, style adjustment, or custom formatting). This feature is disabled by default in every new installation. When it is disabled, the Software does not transmit transcribed text to any party, consistent with the default-state promise made in Section 9.

When you enable AI cleanup, it can run on a Large Language Model hosted on your own device, in which case your transcribed text is processed locally and does not leave your device. Alternatively, under Bring Your Own Key, you may configure the feature to route your transcribed text to a third-party cloud provider that you select, using a credential that you supply. This Section 6 describes that optional cloud path: the providers you may select, what is transmitted, and your relationship with the provider. The on-device option involves no transmission of transcribed text and is covered by the default-state promises in Sections 3.4 and 9.

6.1 Supported providers

If you enable the optional post-processing feature, you may configure the Software to route transcribed text to any one of the following providers. Lanreal does not host, operate, resell, or receive revenue from any of these providers. Your contractual relationship is directly with the provider whose credentials you supply.

1. OpenAI, L.L.C. (Delaware, USA) -- a cloud-based Large Language Model provider. Users outside North America may contract with a different OpenAI regional entity (for example, OpenAI Ireland Limited for users in the European Economic Area). See OpenAI's privacy policy at https://openai.com/policies/privacy-policy/ and OpenAI's terms of use at https://openai.com/policies/terms-of-use/ for information on how OpenAI handles content submitted to its API.

2. Anthropic, PBC (Delaware, USA) -- a cloud-based Large Language Model provider. Users outside North America may contract with a different Anthropic regional entity (for example, Anthropic Ireland Limited for users in the European Economic Area). See Anthropic's privacy policy at https://www.anthropic.com/legal/privacy and Anthropic's Commercial Terms of Service at https://www.anthropic.com/legal/commercial-terms for information on how Anthropic handles content submitted to its API.

3. Google LLC (Delaware, USA), via the Google Gemini API -- a cloud-based Large Language Model provider. The specific Google legal entity that contracts with you for Gemini API access depends on your location and your Google Cloud billing arrangement, and is determined by Google at https://cloud.google.com/terms/google-entity. For most individual users the contracting entity will be Google LLC (Delaware, USA). Canadian users contracting for paid Gemini API access may contract with Google Canada Corporation. See https://ai.google.dev/gemini-api/terms for the Gemini-API-specific additional terms and https://policies.google.com/privacy for Google's general privacy policy.

4. A self-specified endpoint (Ollama-compatible or other OpenAI-compatible endpoint) -- a Large Language Model server that you point the Software at by supplying its URL, together with a credential where the endpoint requires one. This covers both an Ollama server speaking the Ollama HTTP API and any other endpoint speaking the OpenAI-compatible chat API. If the endpoint is a process running on your own device (for example, an Ollama process at http://localhost:11434), transcribed text does not leave your device at all. If you configure the Software to connect to a non-local endpoint (for example, a self-hosted server on another machine, or an endpoint on a private network), transcribed text is transmitted to the URL you specify. The operator of that endpoint, which may be you or another party, is responsible for its own data handling, and Lanreal has no visibility into or control over that endpoint.

6.2 What is transmitted

When the optional post-processing feature is enabled, for each eligible transcript the Software transmits to the provider you selected:

• The transcribed text produced by the speech recognition model, as an input to the post-processing request. Transcripts of three words or fewer are excluded from this transmission and remain local to your device.
• The API key or credential that you supplied for the selected provider, as an Authorization or equivalent request header, so that the provider can authenticate you and apply the usage limits of your account.
• Any instruction prompt that you have configured in the Software (for example, a system prompt describing the post-processing style you want), as part of the request payload.
• Standard HTTP headers automatically attached by the Software's HTTP library, including your IP address as it is seen by the provider.

The Software does not transmit, as part of any optional post-processing request, any of the following: your audio recording, your license key, the Whisperstream organization identifier, your device hostname, your operating system family, your local diagnostic logs, your in-memory frontend log ring buffer, your usage statistics, your configuration file, or any other category of information listed in Section 3.4 as staying on your device. These remain on your device regardless of whether the optional post-processing feature is enabled.

In addition to the per-transcript transmissions described above, while the feature is enabled and a credential is present the Software periodically sends a short connectivity probe to the provider you selected to verify that the credential is valid and the provider is reachable, so that the Software can display an accurate connection status in its settings interface. The probe transmits the same API credential, the same standard HTTP headers including your IP address, and a short fixed test prompt authored by Lanreal; it does not transmit any of your transcribed text, any prompt you have configured, or any other user content. The probe is covered by the same consent you give when you first enable the feature under Section 6.5, and the Software will not send a probe to any provider for which that consent has not been recorded.

6.3 Provider response handling

After the provider processes your request, it returns the post-processed text to the Software as the response body. That response is then handled locally by the Software under the same rules as any other transcribed text: it is typed into the focused window and, if you keep the local transcript history enabled, stored encrypted on your own device as described in Section 3.4. Lanreal does not receive or retain a copy, and the Software does not transmit the provider's response to any other recipient.

6.4 Your credentials

The API key or credential you supply for any of the providers listed in Section 6.1 is stored locally on your device within your Windows user profile, under %LOCALAPPDATA%\Whisperstream\. The key is encrypted at rest using the Windows Data Protection API (specifically, the CryptProtectData function), which derives the encryption key from your Windows user account credentials. As a consequence, the encrypted credential can only be decrypted by the same Windows user on the same device on which it was stored. A different Windows user logged into the same device, and any user on a different device, cannot decrypt the stored credential.

The stored credential is transmitted only to the provider you selected, only over HTTPS with certificate verification enabled, and only as a request header on the post-processing requests described in Section 6.2. The Software does not transmit the credential to Lanreal, to any service provider or recipient listed in Section 5, or to any recipient other than the provider you selected. Lanreal does not receive, store, or have any ability to recover your credential.

6.5 How to enable, disable, and delete

• Enabling. The optional post-processing feature is disabled by default in every new installation. To enable it, you must explicitly select a provider and supply a valid credential for that provider through the Software's settings interface. Before the feature begins transmitting transcribed text, the Software will display a blocking consent dialog that identifies the provider you selected, describes what data will leave your device, links to this Privacy Policy and to the provider's own privacy policy, and requires an affirmative click to continue. The Software will not begin transmitting transcribed text to any provider until you have completed all of those steps and confirmed the blocking consent dialog.
• Disabling. To disable the feature, toggle it off in the same settings interface. After you disable it, the Software will not transmit any further transcribed text to any provider, and will resume the default behaviour described in Sections 3.4 and 9 of this Privacy Policy.
• Deleting your credential. To delete a stored credential, use the "remove key" control in the same settings interface. This removes the encrypted credential from your Windows user profile in its entirety.
• Lockdown Mode override. While Lockdown Mode (Section 3.6) is on, all of the cloud providers and self-specified endpoints listed in Section 6.1 are disabled and AI cleanup is forced to the on-device model, so no transcribed text leaves your device regardless of any provider you may have configured.

6.6 Relationship to Section 5 (service providers and other recipients)

The four providers listed in Section 6.1 are not Lanreal sub-processors, resellers, or agents within the meaning of Section 5. This classification rests on four facts about how the optional cloud post-processing feature operates:

1. You determine the purposes and means of processing. You select the provider, you supply the credential, you configure the instruction prompt, and you trigger each transmission by enabling the feature and completing the consent gate described in Section 6.5. Lanreal's code is the transport; it does not select the destination, does not determine the purpose of the post-processing, and does not act on behalf of Lanreal in performing the transmission.

2. Lanreal does not hold the transcribed text. The transcript is generated on your device by the local speech-recognition model, transmitted directly from your device to the provider you selected, and is not routed through, copied to, or received by any Lanreal server. Lanreal has no possession, custody, or control of the transcript at any point.

3. Lanreal has no contract with the provider. Your credential is issued to you by the provider under the provider's own terms of service and privacy policy. Your contractual relationship is directly with the provider. Lanreal is not a party to that agreement, has no contract with the provider concerning the processing of your data, and does not assume any obligation owed to you by the provider.

4. Lanreal receives no consideration from the provider. Lanreal receives no revenue, referral fees, usage-based payments, or other valuable consideration from any of the four providers listed in Section 6.1, and Lanreal pays none of them.

Because of these facts, for the optional cloud post-processing feature: (a) the provider is not processing personal data on Lanreal's behalf within the meaning of Article 4(8) of the GDPR and is therefore not a Lanreal processor under Article 28; (b) Lanreal does not transfer personal information to the provider "for processing" within the meaning of Clause 4.1.3 of Schedule 1 to Canadian federal privacy law, and accountability for the provider's handling of the transcript does not attach to Lanreal; (c) the transmission is not a "sale" under Cal. Civ. Code Section 1798.140(ad)(1) (Lanreal receives no consideration), not a "share" under Section 1798.140(ah) (the transmission is not for cross-context behavioural advertising), and not a disclosure to a service provider under Section 1798.140(ag) (no contract, no on-behalf-of relationship). To the extent the transmission could be characterised as a disclosure at all, it is a user-directed disclosure within the carve-outs at Cal. Civ. Code Sections 1798.140(ad)(2)(A) and 1798.140(ah)(2)(A).

By enabling the feature and supplying a credential, you represent that you have read and agreed to the selected provider's terms of service and privacy policy, and that you have the legal right to submit the content you are submitting for post-processing.

Because Lanreal is incorporated in Canada and the service providers and other recipients listed in Section 5 operate outside Canada, personal information forwarded through the Software may be transferred across international borders. This section summarizes the transfer mechanism or other transfer posture for each processor and other recipient under Chapter V of the GDPR.

• Polar Software Inc. (United States). Polar is incorporated in Delaware, USA. Polar's Data Processing Addendum (at https://polar.sh/legal/data-processing-addendum), which forms part of the Polar Master Services Terms and applies automatically, incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area and the United Kingdom to Polar in the United States. Lanreal relies on these Standard Contractual Clauses for the license-activation and validation data described in Section 3.1.
• Cloudflare, Inc. (United States). Cloudflare is incorporated in Delaware, USA. Cloudflare's published privacy policy and Trust Hub cite both the European Commission's Standard Contractual Clauses and EU-U.S. Data Privacy Framework certification as the mechanisms for transfers of personal information from the European Economic Area, the United Kingdom, and Switzerland to Cloudflare in the United States. Lanreal relies on Cloudflare's combined Standard Contractual Clauses and Data Privacy Framework certification for the model downloads described in Sections 3.3, 3.7, and 3.8 and the update checks described in Section 3.2.
• Supabase, Inc. (United States). Supabase is incorporated in Delaware, USA, and hosts the reviews and feedback database described in Section 3.5. Lanreal has executed Supabase's Data Processing Addendum (published at https://supabase.com/legal/dpa), which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States.
• CORDNET OÜ (Featurebase) (Estonia). Featurebase primarily hosts Customer Personal Data in the European Economic Area. Its Data Processing Agreement incorporates the European Commission's Standard Contractual Clauses, the UK Addendum, and the Swiss Addendum for any transfer to a location that lacks an applicable adequacy decision.

Transfers to Canada. The European Commission has recognized Canada as providing an adequate level of data protection (Commission Decision 2002/2/EC). Transfers of personal information from the European Economic Area to Lanreal in Canada are therefore covered by this adequacy decision.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and wish to receive further information about these transfer mechanisms, including copies of the relevant Standard Contractual Clauses where available, please contact Lanreal at support@whisperstream.io.

Foreign law enforcement access. Because personal information may be transferred to service providers or other recipients in the United States for processing (as described in Section 5), that information may be accessible to the courts, law enforcement agencies, and national security authorities of the United States under the laws of that jurisdiction.

Optional cloud post-processing (Section 6). If you enable the optional cloud post-processing feature described in Section 6 and select a cloud provider other than a local Ollama-compatible endpoint, transcribed text is transmitted to the provider's infrastructure, which is typically located in the United States. Three of the four providers listed in Section 6.1 (OpenAI, Anthropic, Google) are U.S.-incorporated entities whose processing infrastructure generally sits in the United States, and your contract for Gemini API access through Google may involve a Canadian or European Google entity depending on your location. Lanreal does not control the routing, the storage locations, or the onward transfer decisions those providers make once the data leaves your device, and Lanreal does not implement Standard Contractual Clauses or any other Chapter V transfer mechanism on your behalf for that transmission, because Lanreal is not the contracting party. Your contractual protection for any such cross-border transfer is governed by the privacy policy and terms of service of the provider you selected, and Lanreal encourages you to review both documents before enabling the feature.

Lanreal's retention strategy is hybrid. For information that the Software controls directly, we state concrete retention behaviour because the data flow is narrow enough to do so honestly. For information that a third-party service provider or recipient controls, we describe the retention category and point you to that party's own policy, because Lanreal cannot enforce a specific retention period on a third party's infrastructure.

Retention for information the Software controls directly:

• Audio recordings: not retained by Lanreal, and never transmitted off your device. Microphone audio is held in random-access memory while each capture is transcribed. If you keep audio saving enabled in the local transcript history (on by default, and separately disableable), a copy of the recording is also stored, encrypted, on your own device, and is removed on the same schedule as the rest of your history (see "Local transcript history" below).
• Transcribed text: not retained by Lanreal. The output of the speech recognition model is typed into the focused window. If you keep the local transcript history enabled (on by default), the transcribed text is also stored, encrypted, on your own device and removed on the schedule you set (see "Local transcript history" below). If you have enabled the optional cloud post-processing feature described in Section 6 and the transcript is longer than three words, the text is transmitted to the provider you selected for the duration of the post-processing request; Lanreal does not retain a copy, and the provider's retention of your submitted content is governed by the provider's own terms of service and privacy policy (see the links in Section 6.1).
• Local transcript history (your transcribed text, encrypted waveform peaks, and, optionally, your audio): retained on your own device only, encrypted at rest (AES-256-GCM with the data key sealed by the Windows Data Protection API), and never transmitted to Lanreal. You control how long it is kept: a retention window of 1, 7, or 30 days, or forever, with 7 days as the default, removes older entries, and you may delete any individual entry or clear the entire history at any time. Retention and orphan-audio cleanup run at startup, after live and imported saves, after a retention change, and after a successful Lockdown unlock. Cleanup that requires the history key is deferred while the history is locked and retried after unlock. Deletion uses ordinary SQLite deletion and file unlinking, not secure disk overwrite. A failed file deletion may be retried by a later cleanup; database free pages or journals, filesystem remnants, backups, shadow copies, and exported copies remain outside the Software's deletion control. If the history cannot be decrypted on your current Windows account (for example, after a profile reset or a move to a different device), it is not readable and no new entries are written to it.
• Local diagnostic logs: the active file and up to three 2 MiB backups are retained locally by size-based rotation outside Lockdown Mode. They are never transmitted automatically. Pre-existing files remain on disk but are closed and excluded from export while Lockdown Mode is effective. You may delete the local log directory at any time.
• Lockdown access log (Section 3.4): while Lockdown Mode is effective, the active content-free file and up to five 2 MiB backups are retained locally by size-based rotation. The Software does not assign it a time-based purge period. It is never transmitted or included in the support archive. You may delete it with the local log directory.
• Frontend diagnostic buffers: each application window keeps at most 500 entries, 2 KiB per entry, and 128 KiB total in memory; the backend keeps at most 128 KiB of re-sanitized frontend entries across windows. Ring eviction, process or window exit, or entering Lockdown Mode releases that state.
• Local usage statistics and configuration: retained locally on your device until you uninstall the Software or delete the %LOCALAPPDATA%\Whisperstream\ directory.
• Trial, activation, and legal-acceptance state (Section 3.9): retained in the current user's Windows registry and application data until you remove those records. Uninstalling does not necessarily remove them. Trial state persists across reinstallations to prevent repeated trials. The HMAC detects modification; it is not encryption. Exact EULA acceptance events remain in the append-only local ledger so accepting updated terms does not erase prior evidence.
• Agent Speak interaction content (Section 3.11): active responses, questions, permissions, session display state, and reply drafts remain in bounded process memory. They are discarded on the applicable delivery, acknowledgement, approximately 15-second question expiry, approximately 120-second retained-draft expiry, feature disablement, Lockdown Mode, or shutdown. Interaction content and content-derived fingerprints are not written to diagnostics or support exports. A reply you dictate through Agent Speak follows your ordinary encrypted transcript-history retention setting when that setting is enabled.
• Credentials you supply for the optional cloud post-processing feature (Section 6): retained locally on your device, DPAPI-encrypted, inside your Windows user profile, until you remove the credential through the Software's settings interface (see Section 6.5) or until you uninstall the Software and delete the %LOCALAPPDATA%\Whisperstream\ directory. Lanreal does not retain, store, or have any visibility into this credential.
• Diagnostic archives and logs: the support ZIP is assembled in backend memory and streamed to your selected download destination, with no app-managed ZIP retention. Your downloaded copy remains under your control. Logs you voluntarily send to Lanreal with a bug report are retained only for the duration of the support interaction and deleted or anonymized once the issue is resolved. The DPAPI-encrypted credential you supply for the optional cloud post-processing feature (Section 6.4) is not part of the bug-report log export, so it is not inadvertently transmitted when you submit a bug report.
• Reviews and feedback you voluntarily submit (Section 3.5): stored by Supabase on Lanreal's behalf (see Sections 3.5, 5, and 7). Lanreal retains submitted reviews and feedback indefinitely for the business purposes described in Section 4 (improving the Software and, where you consented, publicly displaying testimonials on the Whisperstream website) until you request deletion by contacting Lanreal at support@whisperstream.io as described in Section 10. On receipt of a valid deletion request, Lanreal will delete the corresponding row from the reviews or feedback database within the response timeline described in Section 10.

Retention for information third-party providers and recipients control:

• Polar activation-slot data (your license key, the Whisperstream organization identifier, your hostname, and your OS family): retained by Polar for the duration of your active license, plus Polar's own retention period as governed by Polar's privacy policy at https://polar.sh/legal/privacy. Lanreal cannot enforce a specific retention number on Polar's side. When you deactivate a device, the slot is released, and any residual retention is governed by Polar's policy.
• Cloudflare R2 access logs: standard content delivery edge access logs, as governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.
• Featurebase feature-request data: retained according to the board configuration and Featurebase's retention schedule until Lanreal or the submitting user deletes it, subject to legal-record and backup periods described in Featurebase's Privacy Policy and DPA. You may request deletion from Lanreal at support@whisperstream.io.

Retention by optional cloud post-processing providers (Section 6). If you have enabled the optional cloud post-processing feature and selected a cloud provider, your transcribed text and any instruction prompt you have configured are submitted to that provider as part of each eligible request. How long the provider retains that submitted content, whether it is used to train the provider's models, and whether it is logged for abuse detection are governed entirely by the provider's own terms of service and privacy policy, which vary by provider and by account tier (for example, some providers offer a "zero-data-retention" enterprise tier that differs from their default consumer retention). Lanreal has no visibility into and no control over retention decisions at the provider, and Lanreal does not make representations about them. Please review the provider's published policies (see the links in Section 6.1) before enabling the feature.

This section enumerates categories of information that the Software never collects, never transmits, and never retains. It is intended as an explicit companion to Section 3, so that you can see not just what the Software does, but also what it does not do.

• No audio recordings leave your device. Microphone audio is processed by the speech recognition model on your CPU and is never uploaded to any server for any reason. If you keep audio saving enabled in the local transcript history (Section 3.4), a copy of the recording is stored encrypted on your own device only; it still never leaves your device.
• By default, no transcribed text leaves your device. In the default configuration of the Software, the output of the speech recognition model is typed into the focused window, and the Software does not upload transcriptions to any server. The transcribed text may be stored in the local, encrypted transcript history on your own device (Section 3.4), which never leaves your device. If you explicitly enable the optional cloud post-processing feature described in Section 6 and supply a credential for a cloud provider, transcribed text longer than three words is transmitted only to the specific third-party provider you selected, only over HTTPS, and only for the duration of each post-processing request. No transcribed text is transmitted to Lanreal or to the service providers listed in Section 5 as part of Whisperstream's transcription or cloud-cleanup pipeline. Text you deliberately submit to a destination application, Claude Code, a feedback form, or Featurebase is controlled by that destination.
• No microphone input, typing, keystrokes, or clipboard contents are transmitted. The Software does not intercept or transmit your keyboard or clipboard activity.
• No telemetry, no analytics, error reporting, crash reporting, no usage tracking, and no feature-flag service. The Software does not integrate Sentry, PostHog, Mixpanel, Google Analytics, Plausible, or any comparable service. No automatic event streams, per-action tracking, or behavioural profiling are sent to any server. Operational data leaves your device only through the flows explicitly described in Section 3: license validation, update checks, and required model downloads. The user-initiated outbound flows are voluntarily submitting a review or feedback through the in-app review popup (Section 3.5), opening and submitting to Featurebase (Section 3.12), selecting an optional speech, local AI, or Voice Model (Sections 3.3, 3.7, and 3.8), and, if you explicitly enable it, optional cloud post-processing (Section 6). Communication with the local backend uses only the loopback interface and does not leave your device. There is no "opt out" for telemetry because there is no telemetry to opt out of; the user-initiated flows are controlled by you each time you use them. The content-free local access log described in Section 3.4 is likewise stored only on your device and is never transmitted.
• No advertising identifiers. The Software does not collect, generate, or transmit any advertising identifier (such as IDFA, AAID, or similar).
• No local network scanning. The Software does not scan your local network, enumerate devices on it, or probe for other services.
• No persistent loopback-accessible endpoints beyond the local backend process. The local backend process binds exclusively to the loopback interface (127.0.0.1) so that no other device on your network can reach it, and it exposes no outbound telemetry.
• No sale of personal information. Lanreal does not sell or rent personal information. See Section 13 for the CCPA-specific disclosure on sale and sharing.
• No profiling or automated decision-making. The Software does not profile you, score you, rank you, or make any automated decision that produces legal or similarly significant effects within the meaning of GDPR Article 22.
• No cookies or tracking technologies. The Software does not use cookies, web beacons, pixel tags, local storage tokens, browser fingerprinting, or any other tracking technology to identify you, track your behaviour, or build a profile about you. The local communication between the Software's frontend and backend processes (over the loopback interface) does not use persistent cookies or session identifiers.

Depending on where you live, you may have one or more of the rights listed in this section. Lanreal extends all of these rights to every Whisperstream user, regardless of jurisdiction, so that you do not have to prove residency in order to exercise a right.

Rights summary. The most commonly exercised rights, with the statutory basis for each, are:

• Right to know what personal information Lanreal holds about you and how we use it (GDPR Article 15 / CCPA Section 1798.110 / Canadian federal privacy law Principle 4.9).
• Right to delete or erase personal information Lanreal holds about you (GDPR Article 17 / CCPA Section 1798.105). This includes deletion of any review or feedback you have submitted under Section 3.5.
• Right to correct inaccurate personal information (GDPR Article 16 / CCPA Section 1798.106 / Canadian federal privacy law Principle 4.9.5).
• Right to data portability in a structured, commonly-used, machine-readable format (GDPR Article 20).
• Right to withdraw consent for the optional cloud post-processing feature (Section 6) and for the in-app review and feedback submissions (Section 3.5), which are the two pieces of processing described in this Privacy Policy that rely on your consent as the GDPR Article 6 lawful basis (GDPR Article 7(3)).
• Right to complain to a privacy regulator (GDPR Article 77, CCPA, Canadian federal privacy law; see Section 15 for the supervisory authorities).

To exercise any of these rights, email Lanreal's Privacy Officer at support@whisperstream.io. There is no charge, no account required, and no in-app rights-request form. Lanreal will respond within 30 days under Canadian federal privacy law and the GDPR and within 45 calendar days under the CCPA, with the extensions described in the timelines at the end of this Section 10.

Rights under the European Union General Data Protection Regulation (GDPR Articles 15 to 22):

• Right of access (Article 15): you may ask Lanreal to confirm whether we process personal information about you and, if so, to provide a copy of that information.
• Right to rectification (Article 16): you may ask Lanreal to correct any inaccurate personal information we hold about you.
• Right to erasure (Article 17): you may ask Lanreal to delete personal information we hold about you, subject to the statutory exceptions in Article 17(3).
• Right to restriction of processing (Article 18): you may ask Lanreal to restrict the processing of your personal information in the circumstances set out in Article 18(1).
• Right to data portability (Article 20): you may ask Lanreal to provide your personal information in a structured, commonly used, machine-readable format where the processing is based on consent under Article 6(1)(a) or contract under Article 6(1)(b) and is carried out by automated means.
• Right to object (Article 21): you may object at any time, on grounds relating to your particular situation, to processing of your personal information that is based on Article 6(1)(f) (our legitimate interests). If you believe that any processing by Lanreal that is based on Article 6(1)(f) affects you, you may object on grounds relating to your particular situation, and Lanreal will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights in relation to automated decision-making (Article 22): not applicable. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of Article 22.
• Right to withdraw consent (Article 7(3)): applies to the optional cloud post-processing feature described in Section 6 and to the in-app review and feedback submissions described in Section 3.5. These are the two pieces of processing described in this Privacy Policy that rely on your consent as the GDPR Article 6 lawful basis. For the cloud post-processing feature, you may withdraw your consent at any time by disabling the feature through the Software's settings interface as described in Section 6.5, which stops all further transmission of transcribed text to the provider. For reviews and feedback, you may withdraw your consent and request deletion of your previously submitted content by emailing Lanreal at support@whisperstream.io; where you check the "feature my review on the website" consent flag, that separate consent may be withdrawn the same way. Withdrawal of consent does not affect the lawfulness of processing already performed under your consent before withdrawal. The other processing described in this Privacy Policy does not rely on consent, so the Article 7(3) right to withdraw does not apply to any processing outside Sections 3.5 and 6.

Rights under the California Consumer Privacy Act (CCPA):

• Right to know what categories of personal information we have collected about you, the sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties with whom we shared it.
• Right to delete personal information we collected from you, subject to the statutory exceptions in Cal. Civ. Code Section 1798.105(d).
• Right to correct inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information: Lanreal does not request or use sensitive personal information for a purpose that triggers this right. A voluntary Featurebase submission could nevertheless contain sensitive personal information despite the instruction in Section 3.12; Lanreal handles such incidental content as described there.
• Right to opt out of the sale or sharing of personal information: not applicable. Lanreal does not sell or share personal information for cross-context behavioural advertising, as described in Section 13 below. The disclosure that this right is not applicable is nonetheless provided.
• Right to non-discrimination for exercising any CCPA right. Lanreal will not deny you the Software, charge you a different price, or provide a different level of quality because you exercised a right under the CCPA.

Rights under Canadian federal privacy law:

• Right of access to personal information Lanreal holds about you.
• Right to correction of inaccurate personal information.
• Right to challenge compliance with this Privacy Policy and with Canadian federal privacy law generally. Challenges are directed to the Privacy Officer in the first instance (see Section 15).

How to exercise your rights. To exercise any of the rights above, email Lanreal's Privacy Officer at support@whisperstream.io with a description of your request and enough information for us to verify your identity and locate your personal information (typically the license key you use with the Software, if any). Lanreal does not operate an in-app rights-request button in this version of the Software; the email channel above is the designated rights mechanism.

Verification. Because Lanreal does not maintain a user account database, identity verification for most requests will consist of confirming that the email you use to contact us matches a license activation we can locate, or (if you have not purchased a Pro license) confirming enough details about your use of the Software that we can associate your request with specific personal information we hold.

Unresolved challenges. If you challenge the accuracy of personal information Lanreal holds and the challenge cannot be resolved to your satisfaction, Lanreal will record the substance of the unresolved challenge alongside the information in question.

Response timeline. Lanreal will acknowledge your request within a reasonable period and will respond substantively within 30 days of receipt. Lanreal will respond to access and correction requests at no cost to you. Under GDPR Article 12(3), Lanreal may extend this period by up to an additional 60 days where necessary, taking into account the complexity and the number of requests; if we need to do so, we will inform you of the extension and the reasons for it within the original 30-day window.

CCPA response timeline. For requests submitted by California residents under the CCPA, Lanreal will respond within 45 calendar days. Lanreal may extend this period by an additional 45 calendar days (for a total of 90 calendar days) where reasonably necessary, and will inform you of any extension within the original 45-day window.

If Lanreal does not take action. If Lanreal decides not to take action on your request, we will inform you within 30 days of receipt of the reasons for not taking action and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.

Authorized agents. California residents may use an authorized agent to submit a rights request on their behalf. If you do so, we may require the agent to provide written authorization from you and to verify their own identity.

The Software is not directed to children. Lanreal does not knowingly collect personal information from children under the age of 13 in the United States (consistent with the Children's Online Privacy Protection Act, or COPPA), or from children under the age of 16 in the European Economic Area (consistent with GDPR Article 8). If you are a parent or guardian and you believe your child has provided personal information to Lanreal through the Software, please contact us at support@whisperstream.io and we will take reasonable steps to delete that information. The Software does not implement age verification because it does not require account creation, does not collect age or date-of-birth information, and is not directed to children.

Lanreal implements security safeguards proportional to the sensitivity of the personal information the Software processes. Because the data flow described in Section 3 is narrow by design (license key, Whisperstream organization identifier, hostname, and operating system family, forwarded to Polar over HTTPS), the attack surface is correspondingly narrow. In particular:

• Lanreal does not maintain a user account database for the Software in the conventional sense: the Software does not require user registration, does not issue Lanreal-hosted credentials, and does not track individual user accounts. The only Lanreal-hosted database containing personal information is the reviews and feedback database described in Section 3.5, which is populated only by content that you have voluntarily submitted through the in-app review popup.
• All network communications described in Section 3 travel over HTTPS with the certificate-verification behaviour of the underlying HTTP library. The Software does not disable certificate verification.
• Update manifests are cryptographically signed using minisign and verified locally on your device before installation.
• The local backend process binds exclusively to 127.0.0.1 on a fixed port, so that no other device on your network can reach it.
• Local configuration, logs, and usage statistics are stored under your Windows user profile with the access controls your operating system provides.
• The local transcript history described in Section 3.4 separately encrypts the raw transcript, enhanced transcript, waveform peaks, and, if enabled, audio using AES-256-GCM. The AES data key is itself sealed using the Windows Data Protection API, bound to your Windows user account on the specific device, so the history can be decrypted only by the same Windows user on the same device. Lightweight index metadata needed for lookup and playback remains unencrypted. Existing plaintext waveform peaks from an older database schema are transactionally migrated to separately authenticated ciphertext when the data key is available; if the history is locked, migration is deferred and retried after unlock. The replacement of a legacy database value uses ordinary SQLite updating and is not represented as secure erasure of storage remnants.
• When Lockdown Mode (Section 3.6) is on, the Software adds a password layer to the transcript history. A key derived from a password you choose (using the scrypt key-derivation function) and a separate key derived from a one-time recovery code each wrap the transcript encryption key using AES-256-GCM, on top of the at-rest encryption and Windows Data Protection API sealing described above. The transcript history locks automatically after an idle period you set, and repeated failed unlock attempts trigger escalating delays. Lanreal never receives your password or your recovery code.
• For the optional cloud post-processing feature described in Section 6, credentials (API keys) that you supply are encrypted at rest using the Windows Data Protection API (specifically, the CryptProtectData function), which binds the encrypted value to your Windows user account on the specific device where the credential is stored. A different Windows user on the same device cannot decrypt the stored credential, and neither can any user on a different device. The encrypted credential is stored under %LOCALAPPDATA%\Whisperstream\ with the access controls your operating system provides, and is not part of the bug-report log export described in Section 8, so it is not inadvertently transmitted when you submit a bug report to Lanreal.
• When the optional cloud post-processing feature is enabled, each request to the provider you selected travels over HTTPS with certificate verification enabled. Your credential is transmitted only as a request header on those requests, and only to the provider you selected. The Software does not transmit the credential to Lanreal, to any service provider or recipient listed in Section 5, or to any other recipient.

No security program can guarantee absolute protection against all threats. If you become aware of a security issue affecting the Software, please contact Lanreal at support@whisperstream.io.

In the event of a breach of security safeguards involving personal information under Lanreal's control that creates a real risk of significant harm to you, Lanreal will:

(a) report the breach to the Office of the Privacy Commissioner of Canada in accordance with section 10.1 of the Personal Information Protection and Electronic Documents Act and the associated Breach of Security Safeguards Regulations (SOR/2018-64);

(b) notify you of the breach as soon as feasible after determining that the breach has occurred, by email if we have your email address on file through a license activation, or by prominent notice on the Whisperstream website at https://whisperstream.io if we do not have a direct means of contacting you;

(c) where required by the General Data Protection Regulation (Articles 33 and 34), notify the relevant European supervisory authority within 72 hours of becoming aware of the breach, and notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms; and

(d) where required by the California Consumer Privacy Act or other applicable law, provide notice in accordance with the requirements of that law.

Lanreal maintains a record of all breaches of security safeguards involving personal information under its control, as required by section 10.1(3) of the Personal Information Protection and Electronic Documents Act and the Breach of Security Safeguards Regulations (SOR/2018-64). This record is retained for at least 24 months and is available to the Office of the Privacy Commissioner of Canada upon request.

If Lanreal Technologies Inc. is involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal information we hold may be transferred as part of that transaction. If such a transfer occurs, the acquiring entity's use of your personal information will remain subject to the commitments made in this Privacy Policy. We will notify you of any such transfer and of any changes to the applicable privacy terms by updating this Privacy Policy (see Section 14) and, where feasible, by notice on the Whisperstream website. Where required by applicable law, we will obtain your consent before transferring your personal information to the acquiring entity.

Lanreal may disclose personal information to law enforcement, regulatory authorities, courts, or other governmental bodies where we are legally required to do so (for example, in response to a valid subpoena, warrant, or court order), or where we reasonably believe disclosure is necessary to comply with applicable law or to protect the safety of any person. Lanreal will attempt to notify you of any such disclosure before it occurs, unless notification is prohibited by law or court order. Lanreal does not voluntarily provide personal information to any government surveillance programme.

Sections 8 (How Long We Keep It), 10 (Your Rights), 11 (Children's Privacy), 12 (Security Safeguards), 12a (Data Breach Notification), 12b (Business Transfers), 12c (Law Enforcement and Government Requests), 13 (CCPA Notice for California Residents), 14 (Changes to This Policy), 15 (How to File a Complaint), and 16 (Contact Us) of this Privacy Policy, and any obligations arising from a data breach that occurred before termination, survive the termination of your license or the uninstallation of the Software for as long as Lanreal retains any personal information about you.

This section supplements the rest of this Privacy Policy for California residents whose personal information is collected by Lanreal through the Software, and is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA").

Categories of personal information collected. In the preceding twelve months, Lanreal has collected the following categories of personal information from or about California residents through the Software, as those categories are defined by Cal. Civ. Code Section 1798.140(v):

• A. Identifiers (such as real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, or similar identifiers): device hostname, forwarded to Polar as an activation label as described in Section 3.1; license key, forwarded to Polar as a unique activation credential; IP address, visible to Polar as an automatic byproduct of the HTTPS connection during license validation, to Cloudflare during speech and Voice Model downloads, to Cloudflare during update checks, and to Supabase as an automatic byproduct of the HTTPS connection during review or feedback submission; and, if you choose to submit a review or feedback through the in-app review popup (Section 3.5), the email address associated with the submission (either the customer email received from Polar or, for unlicensed or trial users, an email you type in the popup) and the display name you supply. Polar additionally returns to your device a copy of your customer email and customer name as part of the license-activation response, which are stored locally on your device and, if you choose to submit a review, may be transmitted to Supabase as described in Section 3.5. If you submit a feature request under Section 3.12, Featurebase may also receive the name, email, username, IP address, or other account identifier you provide or that its board ordinarily processes.
• B. Personal information categories listed in Cal. Civ. Code Section 1798.80(e) (such as name, signature, social security number, physical characteristics, address, telephone number, passport number, or similar): display name if supplied in the review popup (Section 3.5), and a name or similar information if you voluntarily provide it to Featurebase (Section 3.12). Other information in this statutory category is not requested, but could appear in a voluntary freeform Featurebase submission despite the instruction in Section 3.12.
• C. Characteristics of protected classifications under California or federal law (such as race, religion, sexual orientation, gender identity, marital status, medical condition, or similar): Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12.
• D. Commercial information (such as records of personal property, products or services purchased, obtained, or considered, or other purchasing histories): Purchase processing is handled separately by Polar at checkout and is not transmitted by the Software. Reviews and feedback submitted through the in-app review popup are opinion content, not purchase histories. A voluntary Featurebase submission could nevertheless contain commercial information if you choose to include it.
• E. Biometric information: None. Voice audio is processed by the on-device speech recognition model solely for the purpose of text transcription, not for the purpose of identifying you. The audio is processed in volatile memory for each push-to-talk capture and, if you enable audio saving in the local transcript history (Section 3.4), is also stored only on your own device, encrypted at rest. It is never transmitted to Lanreal, and is never used to create a voiceprint, template, or other biometric identifier.
• F. Internet or other electronic network activity information (such as browsing history, search history, or interactions with a website, application, or advertisement): None beyond the network flows described in Section 3 (license activation, update check, required or user-selected model downloads, and in-app review or feedback submissions described in Section 3.5, and an optional Featurebase submission under Section 3.12). If you enable the optional cloud post-processing feature described in Section 6, additional network activity (the transmission of transcribed text to the provider you selected) also falls within this category; see Section 6 for details.
• G. Geolocation data: None.
• H. Audio, electronic, visual, thermal, olfactory, or similar information: Feature-request messages and attachments are electronic information disclosed to Featurebase when you choose to submit them. Do not attach audio, dictation content, or sensitive files. Voice data handled by Whisperstream remains on your device as described in category E above.
• I. Professional or employment-related information: Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12.
• J. Education information: Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12.
• K. Inferences drawn from any of the above to create a profile reflecting preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, or aptitudes: None.
• L. Sensitive personal information as defined by Cal. Civ. Code Section 1798.140(ae): Not requested. A voluntary Featurebase submission could contain this information despite the instruction in Section 3.12; incidental content is handled as described there.

Local transcript history is not collected by Lanreal. The searchable transcript history described in Section 3.4 (your saved transcribed text and, if you enable it, your audio), and the content-free local access log described in Section 3.4, are created and kept entirely on your own device, encrypted at rest where noted, and are never transmitted to Lanreal. Because Lanreal never receives them, they are not "collected," "sold," or "shared" by Lanreal within the meaning of the CCPA, and they do not add a new category of personal information to the list above. You retain full control of this on-device history and can delete its database records and associated files at any time (see Sections 3.4 and 8).

Sources of personal information. The device hostname is supplied by your own computer at the time of license activation. The license key is issued to you by Polar Software Inc. upon purchase. The IP address is an automatic byproduct of the HTTPS connection to Polar's API during license validation and to Cloudflare during required or user-selected model downloads, to Cloudflare during update checks, and to Supabase when you submit a review or feedback. Your customer email and customer name are received from Polar Software Inc. as part of the response to a license activation or validation, and are then stored locally on your device; if you choose to submit a review or feedback through the in-app review popup (Section 3.5), the email associated with your submission is either that Polar-sourced customer email (for Pro licence holders) or an email you type directly into the popup (for unlicensed or trial users). Your review display name, testimonial, rating, feature-on-website consent flag, and feedback text are collected directly from you when you type them into the in-app review popup and click Submit. Featurebase feature-request data is collected directly from the text, attachments, account details, messages, and votes you choose to provide on the external board; Featurebase also receives ordinary connection and service-usage data from your visit to that board.

Business or commercial purposes for collecting personal information. The device hostname is collected for the business purpose of labelling your license-activation slots so that you can distinguish one device from another in the Polar license dashboard. The license key is collected for the business purpose of activating, validating, and deactivating your Whisperstream Pro license. The IP address is not separately collected by Lanreal for a business purpose; it is an automatic byproduct of the HTTPS connection visible to the applicable recipient. The review and feedback fields described in Section 3.5 (email address, display name, testimonial, rating, feature-on-website consent flag, feedback text) are collected for the business purposes of improving the Software, responding to user feedback, and (where you have checked the "feature my review on the website" consent flag) publicly displaying testimonials for marketing purposes. Featurebase submissions are collected to evaluate and respond to feature requests, administer the feedback board, and plan product improvements.

Retention periods. The retention periods for each category of personal information listed above are described in Section 8 of this Privacy Policy. In summary: Category A data (device hostname, license key, IP address) forwarded to Polar is retained by Polar for the duration of your active license plus Polar's own retention period. Reviews and feedback you voluntarily submit under Section 3.5 are retained by Lanreal on Supabase indefinitely until you request deletion. All other categories listed as 'None' above are either not collected or are retained only on your local device under your control. Featurebase feature-request data is retained under the board configuration and Featurebase retention schedule described in Section 8, until Lanreal or you delete it where the board permits.

Categories of third parties with whom we share personal information. Polar Software Inc., Cloudflare Inc., Supabase Inc., and CORDNET OÜ (Featurebase), for the purposes described in Section 5. The license key, device hostname, and operating system family are shared only with Polar. The review and feedback fields (email, display name, testimonial, rating, feedback text, feature-on-website consent flag) are shared only with Supabase when you voluntarily submit a review or feedback. The IP address is visible to Polar during license validation, to Cloudflare during required or user-selected model downloads and update checks, and to Supabase during review submissions, as a standard byproduct of HTTPS connections. Information you choose to submit on the Featurebase board, together with ordinary board connection and service-usage data, is disclosed to Featurebase for feedback-board operation and product planning.

Categories of personal information disclosed for a business purpose. In the preceding twelve months, Lanreal has disclosed the following categories of personal information to the following categories of third parties for business purposes: Identifiers (device hostname, license key, IP address) to Polar Software Inc. for license activation and validation; Identifiers (IP address) to Cloudflare Inc. for required or user-selected model downloads and update checks; and, for users who voluntarily submit a review or feedback, Identifiers (email, IP address), Personal information in Section 1798.80(e) (display name), and electronic network activity information (review or feedback submission itself) to Supabase Inc. for the reviews and feedback database; and Identifiers, electronic information, and ordinary network-activity information to Featurebase for the external feature-request board. If a user voluntarily includes them in a Featurebase message or attachment despite the instruction in Section 3.12, the Featurebase disclosure may also include personal information under Section 1798.80(e), characteristics of protected classifications, commercial information, professional or employment-related information, education information, or sensitive personal information. Lanreal does not disclose any other category of personal information to third parties for a business purpose.

Sale or sharing of personal information ("Do Not Sell or Share My Personal Information"). Lanreal does not sell your personal information to third parties in exchange for money or other valuable consideration, and Lanreal does not share your personal information for cross-context behavioural advertising. The transfer of your review content and email to Supabase, and of license data to Polar, are disclosures to service providers for the business purposes described above, not a "sale" or "sharing" within the meaning of Cal. Civ. Code Sections 1798.140(ad) or 1798.140(ah). Lanreal has not sold or shared personal information about California residents in the preceding twelve months and does not intend to do so. Because there is no sale or sharing, there is no "Do Not Sell or Share My Personal Information" link; this Privacy Policy, which discloses that the right is not applicable to Lanreal's practices, serves as the required disclosure under Cal. Civ. Code Section 1798.135.

Use of sensitive personal information. Lanreal does not request or use sensitive personal information for a purpose that triggers the CCPA right to limit. A voluntary Featurebase submission could contain sensitive personal information despite the instruction in Section 3.12; incidental content is handled as described there.

How to submit CCPA requests. California residents may submit a right-to-know, right-to-delete, right-to-correct, or non-discrimination request by emailing support@whisperstream.io. As a business that operates exclusively online and has a direct relationship with its customers through the Software, Lanreal uses email as its designated CCPA request method under Cal. Civ. Code Section 1798.130(a)(1)(A).

Lanreal may revise this Privacy Policy from time to time. When we revise it, we will change the version number at the top of this document. The version number of this Privacy Policy generally tracks the version of the Software it is bundled with and is an identifier only. Whether a change is material is determined by whether it changes how Lanreal collects, uses, shares, or retains personal information, not by how the version number changes.

How you learn about changes. The current version of this Privacy Policy is the version bundled with the installer for the Software version you have installed. New installs always receive whichever version ships in the installer at the time of download. Existing users receive the updated Privacy Policy with the updated installer. If an updated End User License Agreement changes rights or obligations, the installed release blocks content processing until the user reviews the complete updated agreement and affirmatively accepts it; closing, deferring, installing, or continued use does not record acceptance. The most recent published Privacy Policy is also available at https://whisperstream.io/privacy.

Service-provider and recipient changes. If Lanreal adds, removes, or replaces a party listed in Section 5, or materially changes that party's role or purpose, the change will be reflected in a new version of this Privacy Policy. Lanreal also publishes a public provider list at https://whisperstream.io/subprocessors and a companion RSS feed at https://whisperstream.io/subprocessors/feed.xml, both of which mirror Section 5 and the human-readable changelog Lanreal maintains for provider additions, removals, replacements, and material updates. Except for changes required for security, legal, or fraud-prevention reasons, Lanreal commits to publishing each prospective provider change to that page and feed at least thirty (30) days before it takes effect, so that you have a meaningful opportunity to exercise the right to object to processing under Article 21 of the General Data Protection Regulation, or the equivalent right of withdrawal of consent and accountability-based recourse under Canadian federal privacy law and the Personal Information Protection and Electronic Documents Act, before the change becomes operative. The page and feed are the canonical advance-notice channel; Section 5 of this Privacy Policy remains the authoritative source of truth for the current list.

If you believe that Lanreal has processed your personal information in a way that is inconsistent with this Privacy Policy or with applicable privacy law, please contact Lanreal first at support@whisperstream.io so that we have the opportunity to address your concern. Lanreal's Privacy Officer will investigate your complaint and respond within the timeline described in Section 10. Lanreal commits to investigating all privacy complaints received and, if a complaint is found justified, taking appropriate measures including amending policies and practices where necessary.

If you are not satisfied with Lanreal's response, you may also have the right to lodge a complaint with a supervisory authority:

• European Economic Area, the United Kingdom, and Switzerland: you have the right under GDPR Article 77 to lodge a complaint with the data protection supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.
• California: you may contact the California Privacy Protection Agency or the California Attorney General's Office for information about your rights under the CCPA.
• Canada (federal): you may file a complaint with the Office of the Privacy Commissioner of Canada (the 'OPC') at https://www.priv.gc.ca/en/report-a-concern/, toll-free 1-800-282-1376. The OPC has the authority to investigate your complaint under section 11 of the Personal Information Protection and Electronic Documents Act, issue a Report of Findings, and make formal recommendations. If the matter remains unresolved after the OPC's investigation, section 14 of the Act grants you the right to apply to the Federal Court of Canada for a hearing.
• Canada (provincial): if you are a resident of Quebec, British Columbia, or Alberta, your provincial regulator may have parallel jurisdiction. You may contact Quebec's Commission d'accès à l'information at https://www.cai.gouv.qc.ca, the Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca, or the Office of the Information and Privacy Commissioner of Alberta at https://www.oipc.ab.ca.

Nothing in this section limits any other right or remedy available to you under applicable law.

Questions, requests, and complaints about this Privacy Policy and about Lanreal's handling of personal information should be directed to Lanreal's Privacy Officer:

Privacy Officer Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Email: support@whisperstream.io

Lanreal Technologies Inc. is the data controller for the personal information described in this Privacy Policy. The Privacy Officer is the designated contact for Canadian federal privacy law, for GDPR Articles 13 and 14, and for CCPA consumer requests.

Accessibility. This Privacy Policy is available in Markdown format bundled with the Software, in plain text format inside the installer, and in HTML format at https://whisperstream.io/privacy. If you need this Privacy Policy in an alternative format to accommodate a disability, please contact us at support@whisperstream.io.

Copyright (c) Lanreal Technologies Inc. All rights reserved.