Privacy Policy

Controller

Mykhailo Kulinich, individual entrepreneur (FOP), Ukraine, Akademika Pavlova St., building 309, apt. 45, 61168 Kharkiv, Kharkiv region, Ukraine. Data protection contact: [email protected].

The short version

We process your speech to turn it into subtitles, and nothing else. Audio is never written to disk. Transcripts exist only if you turn them on, and they are deleted automatically.

Which third parties see your data depends on your processing tier, and this page says so explicitly rather than making a blanket promise. See the AI Transparency Notice for what the models do and how they fail.

In the free mode, and for a while as a backup when one of our providers fails, speech recognition is done by your Chrome browser, which sends the tab's audio to Google. See "Where processing happens" below.

What we process

We process the following categories of data:

• Account data: email address, name (optional), password hash, locale, sign-in timestamps.
• Audio stream: processed in memory in real time, never stored.
• Transcripts and translations: only when you enable saving for a session.
• Meeting fingerprint (company accounts only): a one-way hash of the call's address, kept with a saved transcript so that recordings of one call made by several colleagues appear as a single entry. The address itself is never stored.
• Usage metadata: session start/end, duration, target language, detected source language, number of utterances, confidence scores.
• Billing data: plan, minute-balance transactions, Paddle customer identifier. Card details are handled by Paddle, our merchant of record, and never reach our servers.
• Consent records: type of consent, policy version, timestamp, IP address, user agent.
• Device sessions: user agent and IP of active sign-ins, so you can revoke them.
• Country of your request, derived from your IP address by our proxy when you register or pay. It is used only to check sanctions restrictions and is discarded immediately — we do not store it against your account and we do not track your location.

Website analytics

On sublive.app we use Google Analytics 4, provided by Google Ireland Limited, to understand how visitors find and use the website. It runs only if you allow analytics cookies in the cookie banner; until then its script is not loaded at all. Google receives the pages you open, the referring site, device and browser details, your IP address (used for approximate location and not stored by Google Analytics 4) and a few events: sign-up, a click on "Add to Chrome", the start of a checkout and a completed purchase. The purchase is reported by our server after Paddle confirms the payment, and only if you had allowed analytics when you opened the checkout. Google's advertising features are switched off, and Google never receives audio, transcripts or the content of your conversations. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time under "Cookie settings" in the footer. Google may transfer the data to Google LLC in the United States under the EU–US Data Privacy Framework.

We also use Cloudflare Web Analytics, provided by Cloudflare, Inc., for aggregate traffic statistics. It sets no cookies, stores nothing on your device and does not build profiles of individual visitors. It runs for every visitor, on the basis of our legitimate interest in knowing whether the website works and is used (Art. 6(1)(f) GDPR).

The cookies themselves are described in the Cookie Policy (sublive.app/legal/cookies), and the third parties involved are listed on the Subprocessors page (sublive.app/legal/subprocessors).

Legal bases (GDPR Art. 6)

• Performance of a contract: providing translation, billing you.
• Legitimate interests: security, fraud prevention, service reliability.
• Consent: optional transcript storage, marketing email, non-essential cookies.
• Legal obligation: retaining invoices for tax purposes, and checking that we are allowed to serve you at all under applicable sanctions law.

Where processing happens — and it depends on your tier

SHARED TIER (the default): your audio is sent to third-party AI providers for speech recognition and translation. Those providers process it on their infrastructure under contract with us. They are listed on the Subprocessors page.

"Your audio" normally means the sound the chosen tab is playing. If you save a transcript, it also means your microphone, so that your own replies are in the transcript, and that audio goes to the same speech recognition provider — for transcription only, never for translation. The extension tells you this the first time you switch saving on, and your browser asks for microphone access before it takes effect. Both are processed in memory and neither is stored. Muting the microphone in the subtitle window or switching saving off stops it immediately. If you switch on "Stop dubbing while I speak", the extension also measures how loud your microphone is in order to pause the AI voice; that happens only on your device, and nothing from it is recorded or sent to us.

With dubbing set to the AI voice, the translated text is also sent to a speech synthesis provider, which returns audio for us to play. Nobody's real voice is involved: the synthetic voice is generated from text and is not modelled on the speaker. The audio is played and discarded, exactly like the audio coming in. With dubbing set to the browser voice, the text is spoken by your browser and reaches neither us nor our providers. Depending on the voice you or your system choose, the browser either speaks on your device or, for voices it marks as online (in Chrome, the voices named "Google"), has the voice generated on its maker's servers.

FREE MODE AND BROWSER BACKUP: when your balance is empty, when you switch on Free mode, or for a while when one of our providers fails, the extension uses features built into Chrome instead. Speech recognition then uses Chrome's speech service: Chrome sends the tab's audio to Google, which recognises it on its servers under Google's own terms and privacy policy rather than under a contract with us. For some languages Chrome can recognise speech on your device, and then the audio does not leave it. Translation uses Chrome's built-in translator, which runs on your device. The voice is your browser's voice, as described above. Only the sound of the tab is used, never your microphone. In the free mode we receive no audio and no text at all: we record only that a free session took place, how long it lasted and its languages. If only our speech recognition provider fails, the text Chrome has recognised is sent to us for translation and, if you chose it, the AI voice, exactly as described for the shared tier. Company accounts use these browser features only if the company administrator has allowed it.

LOCAL TIER (enterprise): processing runs on infrastructure we control, and audio is not sent to any third-party AI provider.

We state this distinction plainly because it matters: the phrase "your data never leaves our infrastructure" is true only for the local tier, and we will not claim it for shared-tier customers.

Retention

• Audio: not retained. In memory only, for the duration of processing.
• Transcripts: private accounts keep them 24 hours — long enough to download the file from Recordings in the extension — and a scheduled job deletes them after that. Company accounts keep them up to 30 days in the company admin panel, and the company may shorten that.
• AI summaries of saved conversations: stored inside the conversation they summarise, and deleted with it — they never outlive the transcript they were written from.
• Conversation recap emails (off by default, switched on by you in the dashboard): when they are on, the summary and the details of each finished conversation are sent to your address through our email provider, listed on the Subprocessors page. A sent email is in your mailbox, not in our system: we cannot delete it later, and the link inside stops working once the conversation is deleted or expires.
• Session metadata: 24 months, for billing disputes and capacity planning.
• Invoices and minute-balance ledger: as required by tax law (typically 7-10 years), in a form no longer linked to your identity after account deletion.
• Consent records: for the duration of the account plus the applicable limitation period.

Your rights

Under GDPR you can access, rectify, erase, restrict, port and object to processing of your data. Two of these are self-service in the dashboard:

• Export (Art. 15 and 20): download everything we hold about you as JSON and as a readable text file.
• Deletion (Art. 17): delete your account. Personal fields are anonymised immediately and access is revoked; a scheduled purge removes the rest.
• For anything else, or to complain, contact [email protected]. You also have the right to lodge a complaint with your local supervisory authority.

California residents (CCPA/CPRA)

We do not sell personal information, and we do not share it for cross-context behavioural advertising. You may still exercise your Do Not Sell or Share right using the link in the footer.

You have the right to know, delete, correct, and to non-discrimination for exercising these rights.

International transfers

Our infrastructure is hosted in the EU. Where a subprocessor processes data outside the EEA, transfers rely on Standard Contractual Clauses. The Subprocessors page names each one and its location.

When Chrome's speech service is used in the free mode or as a backup, Google processes the audio under its own terms and may do so outside the EEA; that transfer is made by your browser, not by us.

Biometric data

We do not create voiceprints or voice embeddings, we do not attempt to work out who a speaker is, and we never match a voice against any other conversation or against anything outside the one it was spoken in.

Our speech provider does separate voices within a single conversation, so that turns can be labelled “Speaker 1” and “Speaker 2” in the subtitles and in a saved transcript. That separation exists for the length of that one conversation, attaches to no identity, and is discarded with the audio. It is not a biometric identifier and is not used as one.