Whisperstream Website Privacy Policy

Version 7.3

Effective 2026-10-28

This Website Privacy Policy explains how Lanreal Technologies Inc. ("Lanreal," "we," "us," or "our") collects, uses, shares, and retains personal information when you visit the Whisperstream marketing website at whisperstream.io (the "Website"). It also describes the rights you have with respect to that personal information and how to exercise them.

This Website Privacy Policy covers only the Whisperstream marketing website at whisperstream.io. It does not cover the Whisperstream desktop application for Windows and macOS, which is governed by a separate Privacy Policy included with the application and published at https://whisperstream.io/privacy. Earlier paid 1.x releases are covered by the privacy policy published at https://whisperstream.io/privacy/private. If you are looking for information about how the desktop application handles your data, please refer to those documents instead.

Whisperstream is free, open-source software. The Website provides the official signed installer after a short request form (Section 3.6) and links to the public source code, which is available without the form. The Website does not sell anything. Whisperstream licenses were sold through the Website until purchases were paused on 2026-09-29, and every earlier purchase has since been refunded through Polar. Sections 3.3 and 3.5 still describe those purchases and the related survey because Lanreal and its providers keep records of them, as explained in Section 8. Section 3.5 also describes the download measurement the Website no longer collects and the records it still holds until their scheduled deletion.

This Website Privacy Policy also does not cover your relationship with Polar Software Inc. ("Polar"), which was the Merchant of Record for earlier Whisperstream purchases and processed their refunds. When a purchase was made through the Website, Polar collected the purchaser's name, email address, payment information, and billing address through its own checkout flow. Polar holds that information under its own privacy policy at https://polar.sh/legal/privacy. Lanreal never collected payment card information.

The data controller responsible for the personal information described in this Website Privacy Policy is:

Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Lanreal is a corporation incorporated under the Business Corporations Act (Ontario). Our registered office is in the Province of Ontario, and our operations are governed by Canadian federal and provincial law applicable therein.

Privacy Officer designation. In accordance with Canadian federal privacy law (the Personal Information Protection and Electronic Documents Act), Lanreal Technologies Inc. has designated a Privacy Officer responsible for compliance with this Website Privacy Policy. The Privacy Officer can be contacted at support@whisperstream.io. Throughout the remainder of this document, "Canadian federal privacy law" refers to the statute named above.

Under the European Union General Data Protection Regulation (GDPR), Lanreal is the "controller" of the personal information described in this Website Privacy Policy. Under the California Consumer Privacy Act (CCPA), Lanreal is a "business" that collects personal information about California residents through the Website.

All privacy-related communication, including data subject rights requests, complaints, and general questions about this Website Privacy Policy, should be directed to support@whisperstream.io. This is Lanreal's single privacy contact channel for the Website.

The Website describes the free, open-source Whisperstream desktop application and provides the official installer and source links. Until 2026-09-29 it also offered license purchases. This section describes every category of information associated with your visit to the Website, the official-installer form, email you exchange with Lanreal, and the records that remain from earlier purchases.

3.1 PostHog Cloud analytics data

The Website uses PostHog Cloud (EU instance at eu.i.posthog.com) to understand how visitors use the site. Most Website analytics are sent by the posthog-js browser SDK. While purchases were offered, one narrow checkout event could instead be sent by the Website server, as described below. The browser SDK is configured in cookieless mode (cookieless_mode: 'always') with memory-only persistence (persistence: 'memory') and operates as follows:

• The SDK does not set any cookies, and does not use localStorage, sessionStorage, or any other persistent browser storage. It reads the limited browser, page, and referrer information enumerated below while its JavaScript runs in memory.
• Each event you generate is associated with a server-side identifier derived by PostHog from a one-way hash of the project identifier, a daily-rotated random salt, your IP address, your user-agent string, and the website hostname. PostHog deletes the daily salt at the end of each calendar day, which makes the identifier non-reversible and rotates your effective identity every 24 hours.
• PostHog does not retain raw IP addresses against events captured in cookieless mode; the IP address is used only as input to the hash described above and to derive approximate geolocation (country, region, city) for aggregated analytics.
• The Website suppresses PostHog initialization and event capture when your browser sends a Do Not Track or Global Privacy Control signal.
• The Website disables autocapture, session replay, surveys, heatmaps, exception capture, console-log capture, Web Vitals reporting, and persistent person profiles.
• The Website sends the full current and initial page URLs and referrer URLs that the browser makes available, including paths, query strings, fragments, and arbitrary custom tracking parameters. It also sends referring-domain values and standard UTM campaign-attribution properties. This detail is used to distinguish inbound links and campaigns.

For page views and custom events sent by the browser SDK, PostHog Cloud collects the following data points:

• event timestamp,
• current and initial page URL, including hostname, path, query string, fragment, and dynamic route pattern,
• current and initial referrer URL, including any path, query string, or fragment supplied by the browser, plus the referring domain,
• standard UTM campaign-attribution properties (utm_source, utm_medium, utm_campaign, utm_term, utm_content) when present in the page URL,
• geolocation (country, region, city, derived from your IP address),
• device operating system and version,
• browser name, browser version, and browser language preference,
• device type (desktop, mobile, or tablet),
• viewport dimensions and screen dimensions,
• timezone, and
• the version of the PostHog client library.

Before 2026-08-03, Polar redirected a completed purchase to /success?checkout_id=<uuid>. PostHog's page-view event could therefore include that full success-page URL and its Polar-generated checkout identifier in the $current_url event property. The checkout identifier was not a license key or payment-card number, but Lanreal could use it with Polar's server API to retrieve the associated purchase confirmation. From 2026-08-03 until purchases ended, the success route used a short-lived encrypted, HttpOnly cookie and a clean /success URL, and did not place checkout identifiers, customer email addresses, product or payment details, or license keys in the success URL or its event-specific analytics properties. The /success address now redirects to the home page without its query string. The analytics filter still suppresses every page view and custom event on /success; no paid-success or license event is sent to PostHog. Outside that surface, the filter does not remove query strings, fragments, or referrer detail. Because inbound page URLs and referrers are transmitted in full, a value that a visitor or third party places in a tracking link can be sent to PostHog. Do not put personal or sensitive information in links to the Website.

This data is used by Lanreal in aggregated form to understand website traffic patterns. The cookieless server-side identifier described above does not track visitors across different applications or websites and rotates each day, so it cannot be used by Lanreal to build a long-term profile of an individual visitor.

In addition to automatic page view tracking, the Website sends the following custom events through the PostHog SDK to measure user engagement:

• download_clicked (with CTA label and page location),
• pdf_download_clicked (with page location), and
• watch_demo_clicked.

While purchases were offered, the browser SDK also sent price_badge_clicked and checkout_session_created (each with page location), and the Website server could also send buy_clicked when a checkout route received a purchase request. It used only a fixed page location, disabled GeoIP enrichment, and carried no IP address, user agent, URL, referrer, request headers, cookies, or customer or purchase identifier. If you had allowed the download measurement in Section 3.5, it used that measurement's random identifier; otherwise it used a shared technical value that does not distinguish visitors.

The event-specific properties contain no direct identifier, and the browser SDK sends no measurement identifier or consent preference with these cookieless events. PostHog also attaches the full page and referrer context described above. The Website's outbound filter rejects unapproved event types and removes standalone checkout, license, email, payment, customer, order, source, and transcript property names. That property-name filter does not remove text embedded in a page URL, referrer URL, query string, or fragment. The paid /success surface is excluded before those properties can leave the browser, and a later /success referrer is discarded. These controls prevent the cookieless website session from becoming a source-to-purchase join.

3.2 Cloudflare DNS and CDN data

The Website uses Cloudflare for DNS resolution and is hosted on Cloudflare Pages. When you visit the Website, your request is resolved and served by Cloudflare's network. As part of standard CDN, DNS, and hosting operation, Cloudflare may:

• process your IP address to route your request,
• set a security cookie (__cf_bm or similar) to distinguish legitimate visitors from automated traffic and to mitigate abuse, and
• collect standard access logs for security and performance monitoring.

Cloudflare's processing of this data is governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Lanreal does not have access to Cloudflare's raw CDN or DNS access logs (a separate Cloudflare Logpush product that Lanreal does not enable). The content-free application logs stored through Cloudflare Workers Observability are described separately in Section 3.4 below.

3.3 Earlier purchases and refunds through Polar

The Website no longer offers purchases. Its former checkout and confirmation addresses now redirect to the home page, and the Website no longer connects to Polar. This section describes how purchases worked until they were paused on 2026-09-29, and the records that remain.

How checkout worked. When you clicked a purchase button, the Website created a checkout session through Polar's API and opened an embedded Polar checkout modal (an iframe served by Polar). Inside that checkout modal, Polar collected:

• your name,
• your email address,
• your payment card information (processed by Stripe, Inc., Polar's payment processor), and
• your billing address, phone number, business name, and tax number (if you provided them).

This information was collected directly by Polar inside its own iframe. Lanreal never saw, handled, or stored your payment card details. When the Website created the checkout session, Polar immediately returned the checkout identifier (a Polar-generated UUID) to Lanreal's server. This occurred before you completed or abandoned the checkout. If you completed the purchase and returned to the confirmation page, Lanreal then retrieved the following data from Polar through its server-side API:

• the customer email address associated with the purchase,
• the product name and purchase total, and
• the license key generated for your purchase.

This data was used to render the post-purchase confirmation page on the Website (showing your email, product name, total, and license key). The checkout identifier was held in an encrypted, authenticated, HttpOnly, Secure, SameSite=Lax cookie for twenty-nine minutes. It was not placed in the confirmation-page URL, browser-visible JavaScript, PostHog, or Lanreal application logs. The Website used the cookie to retrieve confirmation and licensing data from Polar's API. If the checkout was abandoned, the cookie expired without being used for purchase confirmation. Neither the checkout data nor the license key was stored in a Lanreal-operated Website database.

Refunds and retained records. Every earlier purchase has been refunded through Polar, which processed the refunds as Merchant of Record, with Stripe returning the payments. Polar keeps the purchase and refund records, including the purchaser's name, email address, billing details, product, amount, license key, and refund status, under its own privacy policy and record-keeping obligations. Lanreal can view these records through its Polar account and keeps the details it needs in its own refund and accounting records. Lanreal uses them only to answer questions about earlier purchases and refunds, handle disputes, claims, and privacy requests, and meet its accounting, tax, and other legal obligations. Lanreal does not use them for analytics or outreach and does not combine them with the official-installer form. Lanreal used purchasers' email addresses to tell them about the end of sales and their refunds, sending those messages through Resend (Section 6). Replies and other emails about purchases or refunds are correspondence under Section 3.7.

If you had allowed the download measurement in Section 3.5, the checkout-state cookie could also carry its random identifier and a reduced acquisition cohort, so the checkout event described there could be sent. No attribution field was sent to Polar, and the desktop app never read, stored, or transmitted attribution data.

3.4 Server-side request logs and Cloudflare Workers Observability

The Website is served by Cloudflare's Workers platform (via Cloudflare Pages and the @opennextjs/cloudflare adapter). Two distinct categories of server-side log data exist for the Website:

• Cloudflare's own platform-level logs. Cloudflare's hosting infrastructure logs standard HTTP request metadata (including your IP address, request path, user agent, and timestamp) as part of its normal platform operation. These logs are controlled by Cloudflare and are governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Lanreal does not have access to or control over these platform-level logs.

• Content-free application logs. Lanreal's server-side routes emit allowlisted operational events such as a route name, status code, latency, outcome, and error class. They do not log request URLs, request bodies, checkout identifiers, license keys, email addresses, attribution channel, source, campaign, cookies, measurement or event identifiers, HMAC values, or payment data. Cloudflare's automatic per-request invocation logging is explicitly disabled. Cloudflare retains the content-free application log events according to the Workers Logs setting on Lanreal's account. Lanreal uses them only for reliability, debugging, and security, not marketing or profiling.

Server-side request logs and the Cloudflare DNS and CDN data described in Section 3.2 are processed by the same provider under the same Cloudflare Customer Data Processing Addendum and the same privacy policy.

3.5 Earlier download measurement (no longer collected)

The Website no longer offers download measurement. It does not ask for this consent, set or read its cookies, or send its events.

From 2026-08-17 until Version 7.0 of this policy took effect on 2026-10-24, the Website asked whether you would allow download measurement when you requested the installer. If you allowed it, the Website set a preference cookie (whisperstream_attribution_choice, no more than 180 days) and an encrypted cookie (whisperstream_download_attribution, no more than 90 days) holding a random identifier beginning with wm1_. It then sent PostHog Cloud EU a download_measurement_started event with that identifier, the acquisition week, a broad channel, an optional fixed source, and an optional allowlisted campaign, and created a minimal PostHog person with no person properties. While license purchases were offered, a later purchase in the same browser could add buy_clicked, checkout_started, and verified_purchase_completed events linked to the same identifier. These events never included your name, email, IP address, device details, raw URL or referrer, or a checkout, order, or license identifier, used no GeoIP enrichment, and were not joined to the cookieless analytics in Section 3.1 or the form in Section 3.6. If you chose decline, only the preference cookie was set.

Events already sent, with their minimal person, are deleted no more than 12 months after each person's earliest event. A daily scheduled process starts deletion around day 330. Lanreal does not add to, export, or otherwise use these records. They are pseudonymous, not anonymous. Any of these cookies left in your browser expire on their original deadlines, and you can delete them in your browser settings. Because the Website no longer reads the cookies, Lanreal generally cannot find your records; see Section 9 for how GDPR Article 11 applies.

Optional post-purchase acquisition survey

Until 2026-10-24, after a completed purchase, the Website separately offered an optional survey asking how you found Whisperstream. If you submitted it, Lanreal collected one source from a fixed list and, if you selected "Somewhere else," an optional free-text description of up to 200 characters. The free-text field asked you not to include names or other personal or sensitive information. Because the survey followed a completed purchase, no new responses were possible after purchases were paused on 2026-09-29.

The Website sent the response through a Cloudflare Worker API route to the acquisition_sources table hosted by Supabase. The API validated the fixed source, trimmed the optional description, and limited it to 200 characters. The response is not linked to a name, email, checkout identifier, license key, IP address, user agent, purchase record, PostHog identifier, or the consented PostHog download measurement described above. The source or free-text response is not written to application logs or sent to PostHog.

Lanreal retains submitted responses for longitudinal customer-acquisition analysis and reviews at least once each calendar year whether individual responses remain reasonably necessary for that purpose. A response remains necessary only while it supports a channel trend, source-taxonomy decision, or acquisition-period comparison that Lanreal still uses and cannot reproduce from less detailed aggregate data. Lanreal deletes or anonymizes responses that no longer meet that criterion. Optional free text could contain personal information voluntarily entered by a respondent, so Lanreal treats the table as potentially containing personal information. You may object to this processing or request deletion under Section 9.

3.6 Official-installer request form

Before the Website provides the free official signed installer, it asks you to complete a short form. The download starts right after you submit it. Lanreal does not send the installer by email.

What we collect. The form asks for your name or company name and your email address. You can enter whichever name you want Lanreal to use, such as your own name or your organization's. The Website server stores them in the installer_form_submissions table hosted by Supabase, together with the submission time and the version of the form notice you saw.

The form does not ask for your country. Until 2026-10-26, it also asked for your country, which you chose from a list (Lanreal did not derive it from your IP address or another location signal). If you submitted the form before then, Lanreal keeps that value with your submission, uses it only for the outreach described below, and deletes it with your submission (Section 8). From 2026-10-26 until 2026-10-28, the form asked only for an email address, so submissions from that period hold no name or company name. If you later opt out, Lanreal deletes your submission and keeps only a minimal suppression record (Section 8) in a separate operator-only table, outreach_suppressions, containing your email address and the date of your opt-out. If you later give permission by email to publish a testimonial, Lanreal records the approved quote, attribution, channels, and date with your correspondence (Section 3.7).

What we do not collect with the form. The submission does not store your IP address, user agent, cookies, PostHog identifier, purchase or checkout identifier, or any Whisperstream app or installation identifier. The Website server, not your browser, sends the submission to Supabase. Cloudflare processes your IP address and request information while serving the form and the download, as described in Sections 3.2 and 3.4. The form includes a hidden field to filter automated submissions; a submission that fills it is discarded without being stored. The form sets no cookie and uses no browser storage.

Required for the official installer only. Your name or company name and your email address are required to receive the official signed installer through the Website. They are not required for the public source code at https://github.com/lanreal-io/whisperstream, which you can download, build, and redistribute under its license without completing the form. If you do not want to provide them, the only consequence is that you use the source route instead of the official installer. No law or contract requires you to provide them.

Why we collect it. Lanreal uses form details only to email you to ask about your experience with Whisperstream and, if you install it for an organization, roughly how many machines it runs on and what you use it for. Your name or company name tells Lanreal how to address you and whether you are writing for yourself or for an organization, so it can ask relevant questions. In a later message, usually after you have replied, Lanreal may ask whether you would share a testimonial. Lanreal never sends that request to anyone who has opted out. Lanreal publishes a testimonial, your name, or your company only with your separate, explicit permission for the final quote, attribution, and channels.

Lanreal does not use form details for a newsletter, advertising, promotional offers, or sale, and does not join them to PostHog analytics, the earlier download measurement in Section 3.5, purchase records, or app installations.

Outreach email and opt-out. Each outreach email identifies Lanreal and its mailing address, states your right to object, and tells you how to stop further emails: reply with "unsubscribe," or use the link to mailto:support@whisperstream.io?subject=unsubscribe. You can also write to support@whisperstream.io at any time. Lanreal treats every opt-out as permanent for all outreach and acts on it within ten business days at most.

3.7 Correspondence, outreach replies, and privacy requests

If you contact Lanreal, or reply to an outreach email, we receive the contact details, message, and any attachments you choose to send. We use this information to address your message, continue the conversation you choose to have, handle privacy requests, and resolve related claims. Do not send API keys, passwords, or unnecessary sensitive content.

We use Gmail, through a personal Google account under Google's consumer terms, and Resend to send and receive email, including support email, outreach email and replies.

We also use individual consumer subscriptions to OpenAI (ChatGPT and Codex) and Anthropic (Claude), not business or API plans, to help review some messages and draft replies. This can make the message and attachments we submit available to those providers. They are not Lanreal's processors for this use, and no data processing agreement covers it. Each provider handles that content under its own consumer terms and privacy policy, may retain it, and, depending on those terms and our account settings, may use it to improve its models.

You can ask us not to use these AI tools for your message, in that message or at any time; we then handle it without them. If you are in the European Economic Area, the United Kingdom, or Switzerland, we submit your message to these AI tools only with your explicit consent (Section 7). Contact support@whisperstream.io about our handling of correspondence.

3.8 Information the Website does not collect

The Website does not collect the following:

• No user accounts. The Website has no registration, login, or user-account database. Earlier download-measurement records are held only in PostHog until their scheduled deletion. Supabase stores the separate optional acquisition survey described above and the official-installer form records described in Section 3.6.
• No PostHog attribution free text. The earlier download measurement used fixed coarse values and an optional allowlisted shared campaign only. The separate optional survey may accept the limited free text described above, but that response is not sent to PostHog.
• No cookies of its own. Cookieless PostHog browser analytics uses no persistent storage, and the Website no longer sets the checkout-state or download-measurement cookies described in Sections 3.3 and 3.5.
• No attribution identity join. Lanreal has not joined the earlier random measurement identifier to cookieless browser analytics, Polar metadata, a customer, email, license, support record, or app installation.
• No other contact forms. Apart from the official-installer form in Section 3.6, the Website has no contact or newsletter form. Support requests are handled through email at support@whisperstream.io (Section 3.7).
• No localStorage or sessionStorage. The Website does not use those browser storage mechanisms for attribution or analytics.
• No advertising identifiers or tracking pixels. The Website does not integrate Google Analytics, Meta Pixel, Google Tag Manager, or a comparable advertising service.

This section explains, for each category of information described in Section 3, the purpose for which Lanreal processes that information and the corresponding lawful basis under GDPR Article 6. Sections 3 through 9 provide the clear, accessible processing information required by GDPR Articles 12 and 13.

• PostHog Cloud analytics data (Section 3.1). The purpose is to understand how visitors use the Website so that Lanreal can improve its content, layout, and user experience. The lawful basis under GDPR Article 6 is Article 6(1)(f), Lanreal's legitimate interest in understanding aggregate website usage patterns, balanced against your interests and fundamental rights. The PostHog SDK is configured in cookieless mode (no cookies, no localStorage, no sessionStorage), does not track visitors across sites, derives a daily-rotating server-side identifier from a one-way hash with a daily-deleted salt, stores data on PostHog's EU instance in Frankfurt, Germany, and produces aggregated statistics. The Website suppresses this processing for Do Not Track and Global Privacy Control signals. Full URL and referrer collection increases the possibility that a tracking link contains information unrelated to audience measurement. Lanreal relies on Article 6(1)(f) for GDPR purposes while its data- minimization assessment, first-party privacy-choice control, and jurisdiction-specific review remain open. This does not establish a jurisdiction-wide exemption from consent requirements under national laws implementing the ePrivacy Directive.

• Cloudflare DNS and CDN data (Section 3.2). The purpose is to deliver the Website to your browser reliably and to protect the Website against malicious traffic. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in operating and securing the Website. Cloudflare's security cookies, if set, serve the strictly necessary function of distinguishing legitimate visitors from bots and are not used for advertising or analytics.

• Earlier purchases and refunds (Section 3.3). While purchases were offered, Lanreal created checkout sessions and displayed order confirmation details to complete the purchase you initiated, under Article 6(1)(b), performance of a contract, because the checkout flow was how you entered into the Whisperstream license agreement. Polar's own collection of payment information inside its checkout iframe, and its processing of refunds, is governed by Polar's privacy policy; Polar acted as Merchant of Record. Lanreal now uses the retained purchase and refund records, and used purchasers' email addresses for the refund notices, only for the purposes in Section 3.3. The lawful basis is Article 6(1)(f), Lanreal's legitimate interests in completing and explaining the refunds, meeting its accounting, tax, and other legal obligations under applicable law, answering questions about earlier purchases and refunds, and establishing, exercising, or defending legal claims. Where European Union or Member State law requires Lanreal to keep a record, the basis is Article 6(1)(c), legal obligation.

• Cloudflare's own platform-level logs (Section 3.4). Standard HTTP request logs generated by Cloudflare's hosting platform serve Cloudflare's purpose of platform operation, security monitoring, and abuse prevention. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in maintaining the availability and security of the Website. These logs are controlled by Cloudflare; Lanreal does not access them.

• Content-free application logs (Section 3.4). The allowlisted operational events serve Lanreal's purposes of reliability, debugging, and security of Lanreal's server-side route handlers. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in operating a reliable and secure marketing website. This processing is distinct from the Cloudflare-controlled platform-level logs described in the preceding bullet because Lanreal is the controller for these events and uses the data for Lanreal's own purposes. Lanreal does not use application log data for marketing analytics, visitor profiling, retargeting, or any purpose beyond the three named here. Lanreal maintains a documented legitimate-interests assessment for this processing under Article 6(1)(f).

• Earlier download measurement (Section 3.5). Those records were collected with your consent under GDPR Article 6(1)(a) and Article 7, with prior consent under ePrivacy Directive Article 5(3) and UK PECR Regulation 6 for the cookies. Lanreal now only keeps them until their scheduled deletion and does not use them further. A decline preference was stored under Article 6(1)(f) and the strictly necessary preference-storage exception, only to honor the refusal.

• Optional acquisition survey responses (Section 3.5, Optional post-purchase acquisition survey). The purpose is longitudinal analysis of the voluntarily submitted sources through which customers found Whisperstream. The lawful basis is GDPR Article 6(1)(f), Lanreal's legitimate interest in understanding and improving customer acquisition. Self-reported answers provide information that inferred landing data cannot, and the optional free-text field identifies sources outside the fixed list. A fixed list alone would lose that information. The survey was optional, its records contain no account, purchase, contact, device, network, or PostHog identifier, and its answers are not joined to PostHog data. Lanreal treats optional free-text descriptions as potentially personal information, uses responses only for the acquisition-analysis purpose, reviews their continuing necessity at least annually, and honors applicable objection and deletion rights. These controls implement purpose limitation, data minimisation, storage limitation, and accountability under GDPR Articles 5(1)(b), 5(1)(c), 5(1)(e), and 5(2).

• Official-installer form and outreach (Section 3.6). The purpose is to ask people who download the official installer about their experience and, for organizations, their deployment, so that Lanreal can understand how Whisperstream is used and improve it. The lawful basis is GDPR Article 6(1)(f), Lanreal's legitimate interest in understanding the use and deployment of its free software to improve the product. Asking in a later email whether you would share a testimonial is a follow-up to that outreach and rests on the same basis. Lanreal does not present the form as consent and does not rely on consent for it. Publishing a testimonial is different: it requires your separate consent under Article 6(1)(a) for the final quote, attribution, and channels. The form collects only your name or company name and your email address, states its purpose at the point of collection, keeps the public source available without it, excludes promotional use, and lets you object at any time. Countries given in earlier submissions are used only for the same outreach. Lanreal keeps a documented legitimate-interests assessment for this processing. Under GDPR Article 13(2)(e), providing your name or company name and your email address is required to receive the official installer through the Website, but not to obtain the public source code (Section 3.6).

  Under Canadian federal privacy law, Lanreal identifies these purposes at the form, before you submit it, and uses the details only for them. If you give a work email address to tell Lanreal about your organization's deployment, Lanreal uses it to communicate with you in that business or professional capacity.

• Suppression records (Section 3.6). Keeping your email address and opt-out date after you opt out lets Lanreal honor your objection permanently and show that it did so. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in respecting and demonstrating that objection, which also supports Lanreal's duty under Article 21(3) to stop the outreach.

• Correspondence (Section 3.7). Lanreal processes the messages you send, including replies to outreach, to address them and continue the conversation, under Article 6(1)(f), its legitimate interest in responding to people who contact it. Using the consumer AI tools described in Section 3.7 to help review a message or draft a reply relies on the same interest, subject to your right to ask Lanreal not to use them. Section 7 describes the explicit consent Lanreal obtains before submitting a message from a sender in the European Economic Area, the United Kingdom, or Switzerland. Lanreal processes privacy requests to meet its obligations under GDPR Articles 12 to 22.

Except for the earlier download measurement and testimonial publication identified above, and the transfer consent described in Section 7, Lanreal does not rely on your consent (GDPR Article 6(1)(a)) as the lawful basis for the other processing described in this Website Privacy Policy. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22.

The Website no longer sets cookies of its own and does not use localStorage or sessionStorage for tracking purposes. While purchases and download measurement were offered, it set whisperstream_checkout_state (encrypted, HttpOnly, 29 minutes, for checkout confirmation and licensing; Section 3.3) and the whisperstream_attribution_choice and whisperstream_download_attribution cookies described in Section 3.5. The Website no longer sets or reads them, and any left in your browser expire on their original deadlines.

The PostHog Cloud analytics SDK described in Section 3.1 is active but does not use cookies, localStorage, sessionStorage, IndexedDB, or other persistent browser storage. Do Not Track and Global Privacy Control signals suppress it. The official-installer form in Section 3.6 sets no cookie and uses no browser storage.

The following third parties may set cookies or use similar technologies when you visit the Website:

• Cloudflare may set a security cookie (such as __cf_bm) to identify and mitigate malicious bot traffic. This is a strictly necessary cookie that serves a security function. It is not used for advertising, analytics, or cross-site tracking.

• Polar could set cookies inside its embedded checkout iframe when you started a purchase while purchases were offered. These cookies operate within Polar's own domain and are governed by Polar's privacy policy. The Website no longer loads Polar's checkout.

The Website shows no cookie banner because it sets no cookies of its own. A Cloudflare security cookie, if present, is treated as strictly necessary under ePrivacy Directive Article 5(3). Lanreal continues to review the jurisdiction-specific treatment of cookieless PostHog analytics and the minimisation of URL and referrer data. This policy does not claim a consent exemption for cookieless analytics in every jurisdiction. The cookieless browser analytics described in Section 3.1 follows supported browser privacy signals.

The Website and Lanreal's related email rely on the third-party services and other recipients below. Items 1, 4, and 5 serve the Website. Items 2 and 3 handled earlier purchases and refunds and still hold those records (Section 3.3); they no longer receive information from the Website. Items 6 and 7 handle email and correspondence assistance (Section 3.7). This list is exhaustive for the Website, those earlier purchases, and that correspondence as they exist at the time of this policy's effective date.

1. PostHog Inc. (San Francisco, California, USA), website analytics provider. PostHog provides the PostHog Cloud analytics service described in Section 3.1 and holds the earlier download-measurement records in Section 3.5 until their scheduled deletion. Those records and the cookieless browser analytics use unlinked identifiers. Analytics data remains in Lanreal's PostHog account under the retention terms described in Section 8. PostHog's processing is governed by PostHog's privacy policy at https://posthog.com/privacy and PostHog's Data Processing Addendum at https://posthog.com/dpa. PostHog's GDPR transfer mechanism includes both the European Commission's Standard Contractual Clauses and PostHog's certification under the EU-U.S. Data Privacy Framework.

2. Polar Software Inc. (Dover, Delaware, USA), historical Merchant of Record and checkout provider. Until purchases were paused on 2026-09-29, Polar provided the embedded checkout modal described in Section 3.3, processed purchases, and received the data enumerated in Section 3.3 directly from purchasers within its checkout iframe. Polar processed the refunds of all earlier purchases and keeps the purchase and refund records, which Lanreal can view through its Polar account (Section 3.3). Polar's processing is governed by Polar's privacy policy at https://polar.sh/legal/privacy. Polar's GDPR transfer mechanism is the European Commission's Standard Contractual Clauses, as stated in Polar's privacy policy. While purchases were offered, Lanreal read each checkout after the purchaser's return to verify status, exact product, and positive total. Lanreal did not send attribution fields to Polar.

3. Stripe, Inc. (South San Francisco, California, USA), historical payment processor for Polar. Stripe processed payment card information for earlier purchases, and the related refunds, on behalf of Polar, and may keep records of those payments under its own obligations. Lanreal does not have a direct contractual relationship with Stripe for the Website's former checkout flow. Stripe's involvement is governed by Polar's relationship with Stripe and by Stripe's privacy policy at https://stripe.com/privacy.

4. Cloudflare, Inc. (San Francisco, California, USA), DNS, CDN, website hosting (via Cloudflare Pages and Cloudflare Workers), and Workers Observability. Cloudflare provides DNS resolution, content delivery, the hosting platform that serves the Website, and the Workers Observability product that stores Lanreal's content-free application log events (Section 3.4). Cloudflare ran the same-origin attribution and checkout routes while they were offered. It runs the daily PostHog deletion job for the earlier download-measurement records and holds that job's server-only PostHog key. Cloudflare also runs the official-installer form route that sends submissions to Supabase (Section 3.6) and serves the official installer download from releases.whisperstream.io. Cloudflare receives the data described in Section 3.2, the platform-level hosting logs described in Section 3.4, and the content-free application events stored through Workers Observability. Automatic per-request invocation logging is disabled. Cloudflare publishes a Customer Data Processing Addendum (version 6.4, effective 2026-04-03), whose Annex I.B expressly contemplates "Personal Data processed in Customer Logs, such as IP addresses." Lanreal is correcting the Cloudflare account's customer-of-record details so that the account-level contract names Lanreal; that operational item is not represented here as already complete. No additional sub-processor is engaged for the storage of Workers Observability data; it is stored on Cloudflare's own infrastructure. Cloudflare's processing is governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Cloudflare's GDPR transfer mechanism includes both the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

5. Supabase, Inc. (Delaware, USA), database hosting for the optional acquisition survey and the official-installer form. Supabase was not used for the download measurement. It hosts the separate acquisition_sources table for the earlier post-purchase survey under the purpose and annual review criteria in Sections 4 and 8. It also hosts the installer_form_submissions table and the operator-only outreach_suppressions table described in Section 3.6, under the purpose and retention criteria in Sections 4 and 8. Supabase receives these submissions from the Website server, not from your browser, and acts as Lanreal's processor for them. The project region and transfer mechanism are described in Section 7. Supabase's processing is governed by its privacy policy at https://supabase.com/privacy. Lanreal has executed Supabase's Data Processing Addendum at https://supabase.com/legal/dpa, which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum.

6. Google (Gmail) and Resend, email. Lanreal uses Gmail, through a personal Google account under Google's consumer terms, and Resend to send and receive email, including outreach email, the refund notices described in Section 3.3, replies, support, and privacy requests (Sections 3.6 and 3.7). Those services can receive the email addresses, names, messages, and attachments supplied for that purpose. Their policies are at https://policies.google.com/privacy and https://resend.com/legal/privacy-policy. Lanreal remains responsible for its handling of correspondence and for processors it engages.

7. OpenAI and Anthropic, correspondence assistance. OpenAI (ChatGPT and Codex) and Anthropic (Claude) can receive messages and attachments that Lanreal submits through its individual consumer subscriptions to help review messages and draft replies, as described in Section 3.7. They are not engaged as Lanreal's processors for this use and process that content as independent recipients under their consumer terms and privacy policies, at https://openai.com/policies/privacy-policy/ and https://www.anthropic.com/legal/privacy, including any model-improvement use those terms and Lanreal's account settings permit. Lanreal remains responsible for its decision to submit the content.

Lanreal does not share personal information with any other recipients. Lanreal does not disclose personal information to advertisers, data brokers, or social media platforms.

Lanreal is incorporated in Ontario, Canada. The services and recipients listed in Section 6 are based in the United States and can process personal information in the United States and other countries. Personal information collected through the Website or exchanged by email may therefore be transferred from your location to Canada, the United States, and other countries.

Lanreal is a for-profit Ontario corporation that handles personal information in the course of commercial activity, so it is subject to Canadian federal privacy law. For transfers from the European Economic Area to Lanreal in Canada, Lanreal relies on European Commission Decision 2002/2/EC, the adequacy decision for Canadian organisations subject to that law. For transfers from the United Kingdom, Lanreal relies on the United Kingdom's corresponding adequacy recognition of Canada, and for transfers from Switzerland, on Switzerland's recognition of Canada as providing adequate protection.

This section summarizes the transfer mechanism for each service under Chapter V of the GDPR:

• PostHog Inc. (United States; EU data instance in Frankfurt, Germany). PostHog retains Lanreal's analytics events on its EU instance, which is physically located in Frankfurt, Germany. The Frankfurt storage location reduces transfer risk for data at rest but does not eliminate the Chapter V transfer, because PostHog Inc. (United States) remains the contracting processor with potential support and operational access rights under United States law. PostHog's GDPR transfer mechanisms include both the European Commission's Standard Contractual Clauses and PostHog's certification under the EU-U.S. Data Privacy Framework, which are intended to address that residual access risk, as described in PostHog's privacy policy and Data Processing Addendum. The earlier download-measurement records are in the same PostHog EU project until their scheduled deletion.

• Polar Software Inc. (United States). Polar, which holds the earlier purchase and refund records, cites the European Commission's Standard Contractual Clauses as the transfer mechanism for personal information from the European Economic Area, as stated in Polar's privacy policy.

• Stripe, Inc. (United States). Stripe was Polar's payment processor for earlier purchases and refunds. Stripe's transfers are governed by Stripe's privacy policy and by Polar's contractual relationship with Stripe. Lanreal does not implement a separate transfer mechanism for Stripe because Lanreal's relationship with Stripe is indirect (through Polar as Merchant of Record).

• Cloudflare, Inc. (United States). Cloudflare's GDPR transfer mechanisms include both the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework, as described in Cloudflare's privacy policy and Trust Hub.

• Supabase, Inc. (United States). Supabase is incorporated in Delaware, USA, and stores the optional acquisition-survey responses described in Sections 3.5, 4, and 8 and the official-installer form and suppression records described in Sections 3.6 and 8. It does not receive PostHog events or identifiers. These records are stored in Lanreal's Supabase project in the us-west-2 region (Oregon, United States) and can be accessed by Supabase from the United States and other countries for support and operations, as described in Supabase's privacy information. Lanreal has executed Supabase's Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States.

• Email. Google and Resend can process email, including outreach email, replies, and supplied attachments, in the United States and other countries under the applicable account terms, settings, and privacy policies linked in Section 6. Their service disclosures describe processing locations and available safeguards. Lanreal remains responsible for applicable transfer duties for its handling of that information.

• Consumer AI drafting tools. OpenAI and Anthropic can process messages Lanreal submits through its consumer subscriptions (Section 3.7) in the United States and other countries. No Standard Contractual Clauses or other safeguard arranged by Lanreal covers this use, and the providers may use the content under their own consumer terms. For senders in the European Economic Area, the United Kingdom, or Switzerland, Lanreal therefore submits a message to these tools only with the sender's explicit consent, given after being informed of these risks (GDPR Article 49(1)(a) and the corresponding UK and Swiss rules). Without that consent, the message is handled without them.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and wish to receive further information about these transfer mechanisms, please contact Lanreal at support@whisperstream.io.

Lanreal's retention posture for Website data is limited. The Website does not operate a user account system. Supabase holds the separate optional acquisition-survey responses and the official-installer form and suppression records described in Section 3.6. Lanreal reviews the form records at least once each calendar quarter and deletes those that no longer meet the criteria below.

• PostHog Cloud analytics data. Data sent by the Website remains on PostHog's EU instance for the configured retention period or until Lanreal deletes it, subject to PostHog's retention schedule. The daily-rotated server-side identifier described in Section 3.1 cannot be tied to a returning visitor because the salt used to derive it is deleted at the end of each calendar day. Aggregated analytics data (page view counts, referrer distributions, device breakdowns) is retained by PostHog for as long as Lanreal's PostHog account remains active. PostHog does not retain raw IP addresses against events captured in cookieless mode.

• Earlier download-measurement records. The random wm1_ identifier, minimal person, and linked events are retained for no more than 12 months from each person's earliest event. A daily scheduled process begins deletion around day 330, submits person-and-events deletion, and checks PostHog's asynchronous deletion status. No new records are created.

• Cloudflare DNS and CDN logs. Cloudflare retains access logs in accordance with its own retention schedule, as described in Cloudflare's privacy policy. Lanreal does not have access to these logs.

• Earlier purchase and refund records. Polar retains purchase and refund information (name, email, billing address, product, amount, license key, refund status, and payment details via Stripe) in accordance with Polar's own retention schedule and applicable financial record-keeping obligations. Lanreal keeps access to these records, and keeps purchase and refund details in its own refund and accounting records, only as long as needed for the purposes in Section 3.3, including applicable tax and accounting retention periods and limitation periods for claims. Lanreal never stored checkout data in a Lanreal-operated Website database. While purchases were offered, the checkout identifier was kept in the encrypted, authenticated, HttpOnly cookie described in Section 3.3 for 29 minutes, and the displayed email, product, total, and license key existed only in transient server and browser memory for the confirmation session.

• Cloudflare's own platform-level logs. Cloudflare retains platform-level request logs in accordance with its own retention schedule, as described in Cloudflare's privacy policy. Lanreal does not control or have access to these platform-level logs.

• Content-free application logs. Cloudflare Workers Observability stores the allowlisted application events described in Section 3.4. Automatic invocation logging is disabled. The application events remain on Cloudflare's platform for the configured Workers Logs retention period and are not exported off that platform.

• Earlier Website cookies. The Website no longer sets or reads them. Any left in your browser expire on their original deadlines: no more than 180 days for the preference cookie and 90 days for the measurement cookie.

• Optional acquisition-survey responses. The selected source and any optional free-text description remain in the separate acquisition_sources table for longitudinal customer-acquisition analysis. At least once each calendar year, Lanreal reviews whether each response still supports a channel trend, source-taxonomy decision, or acquisition-period comparison that Lanreal uses and cannot reproduce from less detailed aggregate data. Lanreal deletes or anonymizes responses that no longer meet that criterion. Because a response is not linked to your account or purchase, if you object or request deletion you may need to provide the selected source, the free-text description as closely as you can recall, and an approximate submission date so Lanreal can attempt to locate it.

• Official-installer form submissions. Lanreal keeps a submission only as long as it needs it to follow up with you about your use of Whisperstream. If you do not reply, Lanreal deletes your submission once that follow-up has ended. If you reply, Lanreal keeps your submission while it handles the conversation and then deletes it; your messages follow the correspondence criteria below. Lanreal reviews stored submissions regularly and deletes those it no longer needs. Copies in outreach exports are deleted with the submission. A country given in a submission before 2026-10-26 is kept and deleted with that submission under the same criteria.

• Testimonial permissions. If you allow Lanreal to publish a testimonial, Lanreal keeps the approved quote and permission record while it uses the testimonial, and afterwards only as long as needed to show that it had permission. If you withdraw permission, Lanreal stops new uses and removes the testimonial from the channels it controls.

• Suppression records. If you opt out or object, Lanreal keeps only your email address and the opt-out date in the separate outreach_suppressions table, indefinitely, so it never contacts you again. Lanreal uses this record for no other purpose.

• Database backups. Lanreal's Supabase plan does not include project backups, so deleted form records are not kept in backups that Lanreal can restore. If Lanreal later enables backups, deleted records can remain in them until they expire, at most 7 days on Supabase's Pro plan, and Lanreal will not restore deleted records for outreach.

• Correspondence and support emails. If you contact Lanreal at support@whisperstream.io or reply to an outreach email, Lanreal retains your messages for as long as necessary to address them and document any remaining rights or claim obligation, taking account of applicable limitation periods and legal retention requirements, and then deletes or anonymizes them. Resolving a request does not itself mean all related records or provider backups are immediately deleted. Email services can retain supplied information under their applicable account terms, settings, and privacy policies linked in Section 6. OpenAI and Anthropic retain content submitted through Lanreal's consumer subscriptions under their own terms and Lanreal's account settings. Lanreal can delete those conversations from its accounts, after which the providers' retention rules apply; content already used to improve a model may not be removable from it.

Lanreal will not export the earlier download-measurement records or send them to any destination.

Depending on where you live, you may have one or more of the rights listed in this section. Lanreal extends all of these rights to every Website visitor, regardless of jurisdiction, so that you do not have to prove residency to exercise a right.

Rights under the European Union General Data Protection Regulation (GDPR Articles 15 to 22):

• Right of access (Article 15): you may ask Lanreal to confirm whether we process personal information about you and, if so, to provide a copy of that information.
• Right to rectification (Article 16): you may ask Lanreal to correct any inaccurate personal information we hold about you.
• Right to erasure (Article 17): you may ask Lanreal to delete personal information we hold about you, subject to the statutory exceptions in Article 17(3).
• Right to restriction of processing (Article 18): you may ask Lanreal to restrict the processing of your personal information in the circumstances set out in Article 18(1).
• Right to data portability (Article 20): you may ask Lanreal to provide your personal information in a structured, commonly used, machine-readable format where the processing is based on consent or contract and is carried out by automated means.
• Right to withdraw consent (Article 7(3)): the Website no longer asks for consent to download measurement. You can withdraw an earlier consent or ask for earlier deletion by contacting Lanreal; otherwise those records are deleted on the schedule in Section 8. Withdrawal does not affect the lawfulness of earlier processing.
• Right to object (Article 21): you may object at any time, on grounds relating to your particular situation, to processing of your personal information that is based on Article 6(1)(f) (our legitimate interests). This right applies to PostHog Cloud analytics data retained under Section 8, the Cloudflare processing described in Section 3.2, the Cloudflare-controlled platform-level logs described in Section 3.4, and the content-free application logs described in Section 3.4, the optional acquisition-survey responses described in Section 3.5, and Lanreal's use of earlier purchase and refund records under Article 6(1)(f) (Section 3.3). Where Lanreal must keep a record under applicable law, or needs it to establish, exercise, or defend legal claims, Lanreal will treat that as compelling legitimate grounds and keep the record only for that purpose. You can erase any earlier preference cookie through your browser's site-data controls or contact Lanreal for rights assistance. If you exercise this right, Lanreal will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to object to outreach (Article 21): you may object at any time to the official-installer form outreach described in Section 3.6, including any testimonial request. Lanreal does not weigh its own interests against this objection. Where any outreach counts as direct marketing, Article 21(2) and 21(3) make the objection absolute, and Lanreal treats every objection or opt-out as permanent for all outreach. To object, reply "unsubscribe" to any outreach email, use the unsubscribe link in it, or write to support@whisperstream.io. Lanreal stops contacting you within ten business days at most, deletes your submission, and keeps only the suppression record described in Section 8.
• Right to withdraw testimonial permission (Article 7(3)): you may withdraw permission to publish a testimonial at any time by writing to support@whisperstream.io. Lanreal then stops new uses and removes the testimonial from the channels it controls. Withdrawal does not affect earlier lawful publication or copies made by others.
• Rights in relation to automated decision-making (Article 22): not applicable. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of Article 22.

Rights under the California Consumer Privacy Act (CCPA):

• Right to know what categories of personal information we have collected about you, the sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties with whom we shared it.
• Right to delete personal information we collected from you, subject to the statutory exceptions in Cal. Civ. Code Section 1798.105(d).
• Right to correct inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information: Lanreal does not request sensitive personal information through the Website. Lanreal does not use or disclose sensitive personal information inadvertently entered in the optional survey for a purpose that triggers the CCPA right to limit.
• Right to opt out of the sale or sharing of personal information: not applicable. Lanreal does not sell or share personal information for cross-context behavioural advertising, as described in Section 11 below.
• Right to non-discrimination for exercising any CCPA right. Lanreal will not deny you access to the Website, charge you a different price, or provide a different level of service because you exercised a right under the CCPA.

Rights under Canadian federal privacy law:

• Right of access to personal information Lanreal holds about you.
• Right to correction of inaccurate personal information.
• Right to challenge compliance with this Website Privacy Policy and with Canadian federal privacy law generally. Challenges are directed to the Privacy Officer in the first instance (see Section 14).

How to exercise your rights. To exercise any of the rights above, email Lanreal's Privacy Officer at support@whisperstream.io with a description of your request and enough information for us to locate your personal information. Lanreal generally cannot connect an earlier download-measurement record to you because those records do not contain your identity, checkout, order, license, or contact details, and the Website no longer reads the cookie that held the random identifier. GDPR Article 11 does not require Lanreal to collect more identifying information solely to identify you. If you provide information that lets Lanreal locate a record without exposing another person's information, Lanreal will assess and honor applicable rights rather than treating Article 11 as an automatic refusal. For an optional free-text acquisition response, locating the record may require the selected source, the free-text description as closely as you can recall, and an approximate submission date. Because the Website does not have user accounts, acquisition survey responses are not linked to a purchase. Separate cookieless PostHog Cloud analytics data is aggregated under a daily-rotating, irreversible server-side identifier. Lanreal may not be able to link Website data to you. In that case, Lanreal will explain that it cannot identify the relevant record.

Official-installer form records. Lanreal locates your form submission, suppression record, and related correspondence by the email address you used. You may ask for access to, correction of, or deletion of those records, and Lanreal will also provide a copy of your form submission in a structured, machine-readable format on request. Deleting your submission ends outreach to you. Lanreal keeps the suppression record described in Section 8 unless you ask it to delete that too, in which case it explains that it may then be unable to prevent future contact if you submit the form again.

Verification. Because the Website does not maintain user accounts, identity verification for rights requests related to the Website will depend on the nature of the request. For requests about an earlier purchase or refund, Lanreal may verify your identity by confirming the email address associated with your Polar checkout. For official-installer form records and correspondence, Lanreal verifies a request by your control of the email address concerned, for example by receiving the request from that address or asking you to confirm it from that address.

Response timeline. Lanreal will acknowledge your request within a reasonable period and will respond substantively within 30 days of receipt. Under GDPR Article 12(3), Lanreal may extend this period by up to an additional 60 days where necessary, taking into account the complexity and the number of requests; if we need to do so, we will inform you of the extension and the reasons for it within the original 30-day window.

Authorized agents. California residents may use an authorized agent to submit a rights request on their behalf. If you do so, we may require the agent to provide written authorization from you and to verify their own identity.

The Website is not directed to children. Lanreal does not knowingly collect personal information from children under the age of 13 in the United States (consistent with the Children's Online Privacy Protection Act, or COPPA), or from children under the age of 16 in the European Economic Area (consistent with GDPR Article 8). If you are a parent or guardian and you believe your child has provided personal information to Lanreal through the Website, please contact us at support@whisperstream.io and we will take reasonable steps to delete that information.

This section supplements the rest of this Website Privacy Policy for California residents whose personal information is collected by Lanreal through the Website, and is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA").

Categories of personal information collected. In the preceding twelve months, Lanreal has collected the following categories of personal information from or about California residents through the Website, as those categories are defined by Cal. Civ. Code Section 1798.140(v):

• A. Identifiers (such as real name, unique personal identifier, online identifier, IP address, email address, or similar identifiers): IP address is processed transiently by Cloudflare for DNS, CDN, and hosting routing and by PostHog as a hash input from which the daily-rotating server-side identifier and approximate geolocation shown in analytics are derived. PostHog does not retain raw IP addresses against events captured in cookieless mode and does not make them accessible to Lanreal. Cloudflare's CDN and DNS access logs are not accessible to Lanreal either. Cloudflare Workers Observability stores only the content-free application events described in Section 3.4; those events exclude IP addresses, request URLs, user agents, and request bodies. The earlier download measurement did not request direct identifiers or free text. The separate optional survey could contain an identifier if you enter one despite the instruction not to. Purchase-related identifiers (name and email) were collected by Polar until purchases were paused on 2026-09-29 and are governed by Polar's privacy policy; Polar and Lanreal keep them in the purchase and refund records described in Section 3.3. While purchases were offered, the Website temporarily received the customer email and license key during confirmation, and a Polar checkout identifier when it created the checkout, before completion, as described in Section 3.3. The checkout identifier was confined to the short-lived encrypted cookie and server-side request; the license key was confined to the confirmation response and browser memory. If the purchaser had allowed download measurement, the encrypted 90-day attribution cookie contains a random wm1_ identifier and technical event UUID. A domain-separated HMAC of the checkout ID supplies only the technical purchase-event UUID; the checkout ID is not sent to PostHog. The random identifier and linked events remain pseudonymous identifiers until their scheduled deletion. The official-installer form (Section 3.6) collects your name or company name and your email address (submissions from 2026-10-26 until 2026-10-28 hold only an email address). Email correspondence (Section 3.7) includes the sender's name, email address, and any other identifiers included in a message.
• B. Personal information categories listed in Cal. Civ. Code Section 1798.80(e): The optional free-text acquisition field could contain a name or another category you choose to enter despite the instruction not to include personal information. Name, address, and payment information required for purchase were collected by Polar as Merchant of Record and remain in the purchase and refund records described in Section 3.3. Official-installer form submissions can include a name, and correspondence can contain names and other information in this category that a sender chooses to include.
• C. Characteristics of protected classifications: Not requested. The optional free-text acquisition field could contain this information if you choose to enter it despite the instruction not to include personal information.
• D. Commercial information: While purchases were offered, the Website temporarily retrieved the purchased product and total from Polar during confirmation to display them to you. Lanreal never stored a purchase record in a Website database. Polar maintains the transaction and refund records, which Lanreal can view, and Lanreal keeps purchase and refund details in its own refund and accounting records (Section 3.3).
• E. Biometric information: None.
• F. Internet or other electronic network activity information: aggregated page view data, full current and initial page and referrer URLs (including paths, query strings, fragments, and arbitrary tracking parameters), referring domain, UTM campaign-attribution properties, browser type and language, operating-system type, device type, viewport and screen dimensions, and timezone, as collected by PostHog Cloud (Section 3.1). Before 2026-08-03, a page-view URL also could contain the Polar checkout identifier on the success route, as specifically described in Section 3.1. PostHog data is aggregated under a daily-rotating cookieless identifier and was not intended to identify individual visitors. In addition, Lanreal stores content-free route name, status code, latency, outcome, and error-class events for its server-side route handlers through Cloudflare Workers Observability (Section 3.4). These events exclude request URLs, bodies, IP addresses, and user-agent strings. Until download measurement ended, this category included the minimal 180-day choice cookie and decision time and, if you allowed download measurement, the 90-day encrypted attribution cookie, random measurement identifier, the PostHog measurement events, technical event UUIDs, coarse landing channel, optional fixed source, optional allowlisted campaign, and decayed week or month cohort described in Section 3.5.
• G. Geolocation data: approximate geolocation (country, region, city) derived from IP address by PostHog Cloud and provided only in aggregated form.
• H. Audio, electronic, visual, thermal, olfactory, or similar information: The Website does not collect audio, visual, thermal, olfactory, or similar information. An optional survey description is stored under the purpose and annual review criteria in Section 8.
• I. Professional or employment-related information: The official-installer form can collect a company name and a work email address, and replies to outreach can describe your organization's deployment, such as roughly how many machines run Whisperstream and what it is used for. The optional free-text acquisition field could contain this information if you choose to enter it despite the instruction not to include personal information.
• J. Education information: Not requested. The optional free-text acquisition field could contain this information if you choose to enter it.
• K. Inferences: Until download measurement ended, the Website classified landing information into a coarse acquisition channel and optional fixed source. It did not use that classification to build a person-level profile, predict characteristics, or make a decision about you, and no longer collects it.
• L. Sensitive personal information: Not requested. The optional free-text acquisition field could contain sensitive personal information if you choose to enter it despite the instruction not to include personal or sensitive information.

Sources of personal information. PostHog Cloud analytics data is derived from browser interactions with the Website and from page and referrer URLs supplied by visitors, link creators, browsers, and referring sites. Cloudflare data is derived from your DNS and HTTP requests as they pass through Cloudflare's network and the Cloudflare Pages hosting platform. Earlier download-measurement data was derived from the landing URL and referrer your browser supplied, the consent choice you made when requesting the installer, and, while purchases were offered, the paid-checkout result received from Polar. Optional acquisition-survey data came directly from a respondent after purchase. Official-installer form data, including the country declared in submissions before 2026-10-26, and correspondence come directly from you. While purchases were offered, the checkout identifier was received from Polar when Lanreal's server created the checkout session, and customer email, product, total, and license key were received from Polar after a completed purchase. The historical checkout identifier in the success URL likewise originated from Polar. Purchase and refund records come from Polar.

Business or commercial purposes for collecting personal information. Analytics data is collected for the business purpose of understanding aggregate website traffic patterns and improving the Website. Cloudflare data is collected for the business purpose of delivering the Website securely and mitigating abuse. Acquisition data was collected, and retained responses are kept, to understand which sources introduce customers to Whisperstream and to evaluate Lanreal's marketing. Official-installer form data is collected to ask about your experience and deployment of Whisperstream and, later, whether you would share a testimonial, and suppression records are kept to honor opt-outs. Correspondence is processed to respond to you and handle requests. While purchases were offered, Polar checkout-session data was collected to open and maintain the short-lived confirmation flow, and purchase-confirmation data was collected to confirm the completed order, display the product, price, and customer email, and retrieve the license key. Purchase and refund records are kept to answer questions about earlier purchases and refunds, handle disputes, claims, and privacy requests, and meet accounting, tax, and other legal obligations. Before 2026-08-03, the checkout identifier in the success-page URL also could be processed by PostHog as part of historical page-view analytics.

Categories of third parties with whom we share personal information. PostHog Inc. (cookieless analytics and the earlier download-measurement records), Cloudflare Inc. (DNS, CDN, Pages hosting, and content-free application logs), Polar Software Inc. and its payment processor Stripe, Inc. (checkout, payment, and refund processing for earlier purchases, and the retained records), Supabase, Inc. (optional acquisition-survey storage and official-installer form and suppression records), Google (Gmail) and Resend (email), and OpenAI and Anthropic (correspondence assistance), as described in Section 6. OpenAI and Anthropic receive message and attachment content that Lanreal submits through consumer subscriptions as third parties under their own terms, not as Lanreal's service providers or contractors. Lanreal pays for these subscriptions and receives no payment or other valuable consideration for the content. You can ask Lanreal not to use these tools for your message. Until they were removed, Cloudflare processed the first-party attribution and checkout cookies through the Website routes, and PostHog received the random measurement identifier and minimal measurement events, but not the cookieless browser identifier or a purchase/customer identifier. Polar received no attribution field. Any optional survey free-text description remains only in the separate Supabase table and is not shared with PostHog.

Categories of personal information disclosed for a business purpose. In the preceding twelve months, Lanreal has disclosed or made available the following categories for the stated business purposes: Identifiers and internet or electronic network activity information to Cloudflare for DNS, CDN, hosting, security, and content-free application logging; Identifiers, internet or electronic network activity information, and approximate geolocation to PostHog for Website analytics (before 2026-08-03 this could include a checkout identifier in the success-page URL); Identifiers, personal information under Section 1798.80(e), and commercial information to Polar and Stripe for checkout, payment, purchase confirmation, licensing, and refunds (purchases until 2026-09-29 and their later refunds); and, for the earlier download measurement, pseudonymous cookie and checkout-state data to Cloudflare and the random measurement identifier, technical event UUIDs, allowed cohort fields, and measurement events to PostHog, together with any free-text description a visitor voluntarily submits through the optional survey, which remains in the separate Supabase table under the purpose and annual review criteria in Section 8. For email correspondence, Lanreal has disclosed identifiers and message content to Google (Gmail) and Resend, and identifiers and message content it submitted for correspondence assistance to OpenAI and Anthropic, as described in Sections 3.7 and 6. Lanreal has not disclosed any other category collected through the Website for a business purpose in the preceding twelve months. Since the official-installer form launched with Version 7.0 of this policy, Lanreal also discloses identifiers, personal information under Section 1798.80(e), and professional information from the official-installer form to Cloudflare (form route) and Supabase (storage), and outreach email content to Google (Gmail) and Resend, as described in Sections 3.6 and 6. These disclosures are not a sale or sharing of personal information.

Sale or sharing of personal information ("Do Not Sell or Share My Personal Information"). Lanreal does not sell your personal information to third parties in exchange for money or other valuable consideration, and Lanreal does not share your personal information for cross-context behavioural advertising. Lanreal has not sold or shared personal information about California residents in the preceding twelve months, and does not intend to do so. Because there is no sale or sharing, there is no "Do Not Sell or Share My Personal Information" link; this Website Privacy Policy, which discloses that the right is not applicable to Lanreal's practices, serves as the required disclosure under Cal. Civ. Code Section 1798.135.

Use of sensitive personal information. Lanreal does not request sensitive personal information through the current Website flow. The earlier download measurement had no free-text field. If you enter sensitive information in the optional free-text survey, Lanreal does not use or disclose it for a purpose that triggers the CCPA right to limit, and you may request deletion of that free text as described in Section 9.

How to submit CCPA requests. California residents may submit a right-to-know, right-to-delete, right-to-correct, or non-discrimination request by emailing support@whisperstream.io.

Lanreal implements security safeguards proportional to the sensitivity of the personal information the Website processes. The Website does not operate a user account database or store payment information. Earlier download-measurement records are held only in PostHog until their scheduled deletion, not in a Lanreal-operated database. The separate optional survey table is not linked to a purchase or visitor identifier. The official-installer form tables are not linked to analytics, purchases, or app installations. The source design applies GDPR Articles 25 and 32 as follows:

• The Website is served over HTTPS. All connections between your browser and the Website are encrypted in transit.
• Cloudflare provides DDoS protection and bot mitigation at the DNS and CDN layer.
• While purchases were offered, the Polar checkout iframe was served from Polar's own domain over HTTPS, and payment card data was handled by Stripe within the checkout iframe and never passed through the Website's frontend or backend.
• While purchases were offered, the Website's server-side API routes (checkout session creation and license key retrieval) communicated with Polar's API over HTTPS using a server-side access token that was not exposed to the browser. Those routes now only redirect to the home page, and the Website no longer connects to Polar.
• PostHog Cloud analytics data is transmitted to PostHog's EU ingestion endpoint over HTTPS.
• The earlier checkout-state and download-measurement cookies used authenticated encryption, HttpOnly, Secure, and SameSite=Lax.
• The deletion job's PostHog key is a server-only, project-restricted secret that is not exposed to browser code.
• The earlier acquisition-survey API validated the fixed source, trimmed the optional description, and limited it to 200 characters. Supabase row-level security permits anonymous inserts but prevents anonymous reads, updates, and deletions. Survey answers are excluded from application logs and PostHog.
• The official-installer form is submitted to a server-side Website route that accepts only the expected fields, validates the name or company name and the email address, and limits their length before inserting one row into Supabase containing only the name or company name, the email address, the notice version, and the submission time. Database constraints repeat those limits. Supabase row-level security permits anonymous inserts into installer_form_submissions but prevents anonymous reads, updates, and deletions. The outreach_suppressions table grants no access to anonymous or signed-in client roles.
• A hidden form field filters automated submissions, and Cloudflare's bot and abuse protections apply to the form route as to the rest of the Website.
• Form field values are excluded from application logs, which record only content-free outcome events, and are never sent to PostHog.
• Access to stored form submissions and suppression records is limited to Lanreal personnel who handle outreach and privacy requests, using operator credentials that are never placed in the Website or its browser code.
• A daily scheduled process deletes the earlier download-measurement records, starting around day 330 from each person's earliest event, and checks PostHog's asynchronous deletion status. Failed or incomplete cleanup fails the scheduled invocation.

No security program can guarantee absolute protection against all threats. If you become aware of a security issue affecting the Website, please contact Lanreal at support@whisperstream.io.

Lanreal may revise this Website Privacy Policy from time to time. When we revise it, we will change the version number at the top of this document. Minor clarifications that do not materially change how we collect, use, or share personal information will increment the minor version (for example, from 1.0 to 1.1). Material changes will increment the major version (for example, from 1.0 to 2.0). Version 7.3 supersedes Version 7.2. It is a minor version. The official-installer form again asks for your name or company name, as it did before 2026-10-26, together with your email address, for the same outreach purpose and under the same lawful basis, recipients, and retention criteria. It does not ask for your country. Countries in earlier submissions are kept, used only for the same outreach, and deleted with the submission (Sections 3.6, 4, 8, 11, and 12). It adds no recipient, cookie, or purpose.

Version 7.2, effective 2026-10-26, superseded Version 7.1. It was a minor version that narrowed collection: the official-installer form asked only for your email address and no longer asked for a name or company name or a country. Version 7.2 also included every change made in Version 7.1, described below.

Version 7.1, published on 2026-10-26 with an effective date of 2026-10-28, was superseded by Version 7.2 before that date. It superseded Version 7.0 and was a minor version that started no new processing and added no recipient. It described license purchases, checkout, payment, confirmation, and the related analytics events and cookies as past, since the Website stopped offering purchases on 2026-09-29 and every earlier purchase has been refunded through Polar (Sections 1, 3, 3.1, 3.3, 3.5, 5, and 12). It explained the purchase and refund records that Polar and Lanreal keep, why, on what basis, and for how long, and your right to object (Sections 3.3, 4, 6, 7, 8, 9, and 11). It also described the purchase and refund records Lanreal already kept for the refunds and the refund notices it sent, which Version 7.0 did not describe. It stated plainly the adequacy basis Lanreal relies on for transfers to it in Canada (Section 7). Finally, it stated that the Whisperstream desktop application is available for Windows and macOS (Section 1).

Version 7.0, effective 2026-10-24, superseded Version 6.1 and was a material change. It added the official-installer request form, its purpose, lawful basis, retention, and rights (Sections 3.6, 4, 8, and 9); extended Supabase's role to the form and suppression tables and Cloudflare's role to the form route and installer download; added Google (Gmail) and Resend for email; and disclosed Lanreal's use of consumer OpenAI and Anthropic subscriptions to help with correspondence (Sections 3.7, 6, 7, and 11). The correspondence disclosure described email handling that was already in place and corrected its earlier omission from this policy. Version 7.0 also noted that Whisperstream is free, that the Website no longer offers purchases, and that it no longer collects download measurement; earlier records keep their existing deletion schedule (Sections 3.5 and 8). The form began collecting information only after Version 7.0 took effect.

How you learn about changes. The current version of this Website Privacy Policy is always available at the URL where it is published on the Website. When a material change is made, Lanreal will update the effective date at the top of the document and publish the revised version at the same URL. Lanreal also publishes provider changes on its public provider page at https://whisperstream.io/subprocessors. Lanreal does not email policy changes. The Website does not maintain user accounts, and email addresses from the official-installer form are used only for the outreach described in Section 3.6, not as a newsletter or mailing list. This may change in a future version.

Third-party service changes. If Lanreal adds, removes, or replaces a third-party service or recipient listed in Section 6, or materially changes its role or purpose, that change will be reflected in a new version of this Website Privacy Policy.

If you believe that Lanreal has processed your personal information in a way that is inconsistent with this Website Privacy Policy or with applicable privacy law, please contact Lanreal first at support@whisperstream.io so that we have the opportunity to address your concern. Lanreal's Privacy Officer will review your complaint and respond within the timeline described in Section 9.

If you are not satisfied with Lanreal's response, you may also have the right to lodge a complaint with a supervisory authority:

• European Economic Area, the United Kingdom, and Switzerland: you have the right under GDPR Article 77 to lodge a complaint with the data protection supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.
• California: you may contact the California Privacy Protection Agency or the California Attorney General's Office for information about your rights under the CCPA.
• Canada (federal): you may file a complaint with the Office of the Privacy Commissioner of Canada (the "OPC") at https://www.priv.gc.ca/en/report-a-concern/, toll-free 1-800-282-1376. The OPC has the authority to investigate your complaint under section 11 of the Personal Information Protection and Electronic Documents Act, issue a Report of Findings, and make formal recommendations. If the matter remains unresolved after the OPC's investigation, section 14 of the Act grants you the right to apply to the Federal Court of Canada for a hearing.
• Canada (provincial): if you are a resident of Quebec, British Columbia, or Alberta, your provincial regulator may have parallel jurisdiction. You may contact Quebec's Commission d'accès à l'information at https://www.cai.gouv.qc.ca, the Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca, or the Office of the Information and Privacy Commissioner of Alberta at https://www.oipc.ab.ca.

Nothing in this section limits any other right or remedy available to you under applicable law.

Questions, requests, and complaints about this Website Privacy Policy and about Lanreal's handling of personal information collected through the Website should be directed to Lanreal's Privacy Officer:

Privacy Officer Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Email: support@whisperstream.io

Lanreal Technologies Inc. is the data controller for the personal information described in this Website Privacy Policy. The Privacy Officer is the designated contact for Canadian federal privacy law, for GDPR Articles 13 and 14, and for CCPA consumer requests.

Copyright (c) Lanreal Technologies Inc. All rights reserved.