Privacy Policy

1. Listeners

Listeners open a room link or scan a QR code. They do not create an account and we do not ask who they are.

• The listener page sets no cookies and loads no analytics, advertising or tracking scripts.
• Your choices (language, text size, theme, sound on/off, Chinese script) are saved only in your own browser’s local storage, so they are remembered next time. They are never sent to us as a profile.
• To deliver audio and captions your device connects to our servers. Like any website, your IP address is processed by our hosting provider and our servers to route the connection and to rate-limit abuse; we do not store it with your listening activity.
• We count listeners only as numbers — the peak number of listeners and total listening time per session — which the organisation sees in its history.

2. Hosts, admins and owners

• Account: your email address, used to sign you in with a one-time code (handled by Supabase), and your role in each organisation.
• Organisation: name, type (church or business), logo, default languages, glossary, room code, plan and usage balances, and integration settings (webhook URLs; API keys are stored only as hashes).
• Service metadata: when each session started and ended, its languages, billable seconds, listener counts and how it ended. We use this to run, bill and support the service.
• Billing: Stripe processes payments. We store your Stripe customer and payment-method identifiers and purchase records — never your full card number.

3. Live audio, captions and transcripts

While a session is live, the speaker’s audio is streamed from the host app to our servers and on to OpenAI (or, as a fallback, Microsoft’s Azure OpenAI Service) to produce interpreted speech and captions in real time. The interpreted audio and captions are relayed straight to listeners.

Acts2 does not record or store session audio, and we do not keep caption text after it has been delivered — with one exception: if your organisation subscribes a webhook to the transcript.ready event, we assemble the session transcript only to deliver it to your endpoint. It is deleted as soon as it is delivered, or after 7 days if delivery keeps failing.

Our interpretation provider processes audio under its API terms, which state that API data is not used to train its models. [Provider data-processing terms and retention to be confirmed — pending legal review.]

4. Who processes data for us

• Cloudflare — hosting, networking and security for the website, listener page and API.
• Supabase — sign-in and our database.
• OpenAI / Microsoft Azure OpenAI Service — real-time interpretation.
• Stripe — payments and invoices.

These providers may process data outside Hong Kong. We share only what each needs to do its job and do not sell personal data. Webhooks and API access you configure send data to systems you control.

5. Cookies and local storage

Acts2 does not use advertising or analytics cookies. When you sign in to your account, your browser stores your session in local storage so you stay signed in; signing out removes it. The listener page stores only the preferences described above.

6. How long we keep data

• Session audio: never stored.
• Transcripts for transcript.ready webhooks: until delivered, at most 7 days.
• Account, organisation and service metadata: while the account is active, then deleted or anonymised within a reasonable period unless we must keep it (for example billing records for tax law).

7. Your rights

Under the Hong Kong Personal Data (Privacy) Ordinance and other laws that may apply to you, you can ask to access or correct your personal data, or ask us to delete your account. Email privacy@prebabel.ai and we will reply within the time the law requires.

8. Security

Connections are encrypted (HTTPS/WSS). Access to our database is restricted per organisation, secrets are never shipped to browsers, and API keys and webhook secrets are shown only once. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

9. Changes and contact

We will update this policy when the product changes and show the date at the top. Questions or requests: privacy@prebabel.ai. [Data controller details and postal address placeholder — pending legal review.]