Privacy Policy

1. Introduction

Neural Wave Labs LLC ("we," "us," or "our") operates VeloxWaves, a desktop voice-to-text application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and related services (collectively, the "Service").

We are committed to protecting your privacy. VeloxWaves was built with a privacy-first architecture, and we collect only the minimum information necessary to provide and improve our Service.

By using VeloxWaves, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect the following categories of information:

• Account Information: Email address and basic profile information provided through Google or GitHub OAuth when you create an account.
• Usage Data: Transcription counts (how many transcriptions you perform) to manage plan limits. We do not store the content of your transcriptions.
• Subscription Information: Your subscription plan, billing period, and Stripe customer ID for managing your subscription.
• Device Information: Operating system, hardware details, and application version, collected only when you voluntarily submit a support ticket through the in-app issue reporting feature.
• Device Identifier: A hardware-derived identifier (cryptographically hashed, not reversible to specific hardware details) collected during cloud session establishment for abuse prevention and account security. This identifier is not shared with third parties and is used solely for protecting the integrity of our Service.

Information We Do Not Collect:

• Voice audio recordings (never stored on our servers)
• Transcription text content (injected directly into your active application)
• Credit card numbers or financial details (handled entirely by Stripe)
• Passwords (we use OAuth exclusively)

3. Voice Data

How your voice data is handled depends on which transcription mode you use:

Local Mode: All voice processing happens entirely on your device using the Moonshine AI model. Your voice audio never leaves your machine. No audio data is transmitted to any server. This is the most private option available.

Cloud Mode: When you choose cloud transcription, your voice audio is sent to the Groq API (groq.com) for processing using the Whisper speech-to-text model. The audio is processed in real-time and is not stored by Groq after processing is complete. The resulting transcription text is returned to your device and injected directly into your active application. We do not store, log, or retain your voice audio or transcription content on our servers.

Hybrid Mode: Uses cloud transcription as the primary method with automatic fallback to local processing if the cloud service is unavailable. The same privacy considerations for each mode apply.

4. Payment Information

All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. When you make a purchase or subscribe to a paid plan, your payment information is collected and processed directly by Stripe.

We store only your Stripe customer ID for subscription management purposes. We never see, handle, process, or store your credit card numbers, bank account details, or other financial information.

For more information about how Stripe handles your data, please review Stripe's Privacy Policy.

5. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, operate, and maintain the Service
• Manage your account and subscription
• Enforce usage limits based on your subscription plan
• Process transactions and send related billing information
• Respond to support requests and provide customer service
• Improve and optimize the Service through aggregated, anonymized usage analytics
• Send service-related communications (e.g., subscription confirmations, security alerts, policy updates)
• Detect and prevent fraud, abuse, or violations of our Terms of Service

6. Third-Party Services

We use the following third-party services to operate VeloxWaves. Each service processes data under their own privacy policies:

• Supabase — Authentication and database hosting. Stores your account information and usage data.
• Stripe — Payment processing for subscriptions and one-time purchases. Handles all financial transactions.
• Groq — Cloud speech-to-text processing (only used when you select Cloud or Hybrid transcription mode). Audio is processed in real-time and not stored.

We encourage you to review the privacy policies of these services to understand how they handle your data.

7. Data Retention

• Account Data: Retained for as long as your account is active. When you delete your account, your data is permanently removed within 30 days.
• Usage Logs: Retained for analytics and billing verification purposes.
• Voice Audio (Local Mode): Never stored. Processed entirely on your device and discarded immediately.
• Voice Audio (Cloud Mode): Discarded by Groq immediately after processing. Not stored on our servers at any point.
• Transcription Content: Never stored on our servers. Injected directly into your active application on your device.

You may request deletion of your data at any time by contacting us at contact@neuralwavelabs.com.

8. Data Security

We implement industry-standard security measures to protect your information, including:

• All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security)
• Authentication is handled via OAuth (Google and GitHub), meaning we never store your passwords
• Database access is protected by Row-Level Security (RLS) policies ensuring users can only access their own data
• API keys and secrets are stored securely and never exposed to client applications

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to improve our security practices.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data and account.
• Data Export: Request a portable copy of your data in a commonly used format.
• Opt-Out: Opt out of marketing communications at any time.

To exercise any of these rights, please contact us at contact@neuralwavelabs.com. We will respond to your request within 30 days.

10. Children's Privacy

VeloxWaves is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete such information promptly. If you believe we may have collected information from a child under 13, please contact us at contact@neuralwavelabs.com.

11. International Users

VeloxWaves is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located and our database is operated.

By using the Service, you consent to the transfer of your information to the United States and acknowledge that your data may be subject to the laws of the United States, which may differ from the laws of your country of residence.

12. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: You have the right to opt out of the sale of your personal information. However, we do not sell your personal information to third parties.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at contact@neuralwavelabs.com.

13. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis for Processing: We process your personal data based on the following legal grounds:

• Contractual Necessity: Processing necessary to provide you with the Service you requested (account management, subscription fulfillment).
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security.
• Consent: Where you have given explicit consent, such as opting in to marketing communications.

Your GDPR Rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time (where processing is based on consent)
• Right to lodge a complaint with a supervisory authority

For GDPR-related inquiries, contact our Data Protection Officer at contact@neuralwavelabs.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (using the address associated with your account) or by displaying a prominent notice within the application prior to the changes becoming effective.

The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: contact@neuralwavelabs.com
• Company: Neural Wave Labs LLC
• Website: neuralwavelabs.com