Privacy Policy

Xlate is a service for live transcription of meetings, with real-time translation into English, operated by Xlate Live (“Xlate”, “we”, “us”). This policy explains what personal data we collect, why, who we share it with and how you can control it. We aim to handle personal data in line with Singapore's Personal Data Protection Act 2012 and, where they apply, other data protection laws.

For your account and billing data, we decide how the data is used. For the content of your meetings, you decide what to record and we process it on your behalf to provide the Service.

• Account data: your email address and either a password (stored only in hashed form by our authentication provider) or the identifier and email address of the Google account you sign in with, plus the organization workspace created for you.
• Meeting content: the live audio you stream to Xlate, and what is produced from it: transcripts in the original language and English, speaker labels and any names you give them, summaries, action items, session titles, glossary terms, and the questions you ask our AI features.
• Visit statistics: when you visit our public pages (the home page, languages, sign-up and legal pages) we count the visit: which page, the site you came from, your country, and your browser and device type. This is collected by Vercel Web Analytics without cookies and cannot follow you to other sites. Pages inside your signed-in account are not counted, and nothing is collected from a browser that sends a Do Not Track or Global Privacy Control signal.
• Usage and billing data: the minutes and sessions you use, your plan and subscription status, and Stripe customer and subscription identifiers. Payments are handled by Stripe. We do not receive or store your card number.
• Records of activity: entries such as when you confirmed recording consent and when a session started and stopped.
• Session emails (off unless you turn them on): if you switch this on in Settings, we email the address on your account when one of your sessions ends, with its title, how long it ran and a link to it. These emails never contain transcript, translation or summary text. You can switch them off in Settings or with the link in any of the emails.
• Technical data: IP address, browser and device details, and logs generated by our hosting and infrastructure providers when you use the Service.
• Where you are and how you found us: once you are signed in we record, one time, the country you connected from (a two-letter country code worked out by our hosting provider; we do not store your address for this), and, if you created your account by email after following a link, the name of the website or campaign that sent you. We use this to understand where people use the Service and how they find it. It is kept with your account and deleted with it.

If you record other people, their voices and words become part of your transcript. Please make sure you have told them and obtained any consent required (see our Terms).

• to provide the Service: transcribe and translate your audio, produce summaries, search and answers, and let you export your transcripts;
• to create and secure your account, and to keep each organization's data separate from others';
• to take payment, manage your plan and enforce plan limits;
• to keep the Service secure, prevent abuse and fix problems;
• to answer your questions and send service messages such as sign-up confirmation and password reset; and
• to meet legal, tax and accounting obligations.

We do not sell your personal data, we do not show advertising, and we do not use your meeting content to train machine-learning models.

We use these service providers to run Xlate. Each receives only what it needs for its role:

• Speech-to-text provider (currently Soniox): receives your live audio to transcribe it.
• AI language provider (currently OpenAI): receives transcript text to translate it, write summaries and answer your questions.
• Supabase: authentication and our database, which stores your account and meeting content (hosted in Australia).
• Vercel and Railway: host our website and application servers. Vercel also provides the cookie-free visit statistics described above.
• Stripe: payments. For paid plans Stripe acts as merchant of record through its Managed Payments service, and receives the billing details you enter at checkout.
• Google: only if you choose “Sign in with Google”.
• Email delivery provider: sends account emails such as sign-up confirmation and password reset, and, only if you turn them on in Settings, the short “your session has ended” emails described above.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a business transfer such as a merger or sale, with notice to you where required.

Our providers operate in several countries, so your data may be processed outside the country where you live, including in Singapore, Australia and the United States. We choose providers that offer reasonable safeguards, and we remain responsible for personal data we transfer.

• Raw audio: Xlate does not store your audio. It is streamed to our speech-to-text provider to produce the transcript and is not saved by us. The provider handles audio under its own terms.
• Transcripts, summaries and other meeting content: kept in your workspace until you delete them. You can delete any session yourself from History, and you can choose an automatic delete window in Settings (for example, delete sessions 30 days after they end). A deleted session is erased from our database straight away: its transcript, summary, speaker names, captions and activity records.
• Usage record: when a session is deleted we keep a bare record of it, with its date and how many minutes it used, and no transcript, title or other content, so that your plan's limits stay accurate. It is removed when you delete your account.
• Your account: you can delete it yourself in Settings. That permanently deletes your workspace and everything in it. An active subscription has to be cancelled first.
• Billing and sign-in records: payment records are kept by Stripe for as long as legal, tax and accounting rules require. Your sign-in record (your email address) is held by our authentication provider, and we remove it when you ask.

Deleted data may remain in backups for a limited period until they are overwritten.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, withdraw consent, object to certain processing, or receive a copy in a portable format. You can already export your transcripts, and delete sessions or your whole account, from within Xlate. For anything else, email neural1narrative@gmail.com and we will respond within 30 days. If you are unhappy with our response you can complain to your local data protection authority (in Singapore, the Personal Data Protection Commission).

If your voice or words were captured in someone else's Xlate meeting and you want them removed, contact us or the person who recorded the meeting.

We protect data with measures such as encryption in transit, access controls, and separation of each organization's data. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects your personal data we will notify you and the authorities where the law requires.

Xlate stores only what it needs in your browser: your sign-in session and your light or dark theme preference. We do not use advertising or analytics cookies, and our visit statistics use no cookies at all. Stripe's checkout and billing pages, which you may be sent to, have their own privacy policies.

Xlate is not intended for anyone under 18, and we do not knowingly collect their personal data.

We may update this policy. If a change is material we will tell you by email or in the Service before it takes effect. The date at the top shows when it was last updated.

Xlate Live · neural1narrative@gmail.com