Privacy Policy

This policy applies to Newey AI (newey.ai, the “Service”), our real-time interpretation caption service. We collect only the minimum personal data necessary to provide the Service, and we do not use it for any purpose other than those disclosed in this policy.

The Service is currently offered as a free beta and does not collect payment information. We do not use advertising tools, and our visit and usage analytics tools (Google Analytics, PostHog) operate only where you have consented — see Cookies and Analytics.

If you turn on the Audience sharingfeature yourself (off by default), that session’s caption text is (1) displayed in real time to audience members (third parties) who hold the share link, and (2) temporarily routed through our servers to deliver it. Our servers only relay it from memory without storing the caption text, and it is immediately discarded when you turn sharing off or the session ends. You can turn sharing on and off at any time during a session.

Your display settings are kept only in your browser’s storage (localStorage) and never leave your device. Your glossary is stored in your browser as well, and a copy is also mirrored to your account so the browser extension and your other devices can read it — this account copy is stored like other account data (not end-to-end encrypted), is replaced whenever you save, and is deleted together with your account. Only you can access it, unless you publish a glossary (below). Session caption records, where you choose to save them, are retained in your account and can be accessed from multiple devices (Sections 3 and 5), with an encrypted copy also kept in the browser for immediate display.

Shared glossaries (from August 21, 2026 — off unless you publish one). The Service lets you publish one of your glossaries so that other people can install a copy of it. If you choose to publish one — and only then — we store a snapshot of that glossary on our servers, together with the listing details you provide, and make it available to anyone browsing the shared-glossary marketplace within the Service (an unlimited and unidentified group of third parties). We publish it under your account display name — the name on your account, which may be your real name if that is what your account uses (for example, the name provided by Google or Microsoft when you signed in). We show you the exact name before you publish, and you can change your display name in the Service settings; your email address is never shown. We also show listing statistics such as the number of installations. Editing your own glossary afterwards does not change the snapshot, and unpublishing it — or deleting your account — deletes the snapshot from our servers and stops further installations. It does not delete copies that other people have already installed: those copies become part of their data and cannot be recalled, by you or by us (Section 5). Nothing in your glossary is published unless you publish it.

In addition, portions of the transcript text may be sent to the API of a large language model (LLM) provider in the United States in two cases: (1) only where you have turned on the Smart Context (AI suggestions) feature yourself — this feature is off by default — and (2) where a session record is saved to your account, a short excerpt of the transcript is sent once to generate an automatic session title. In both cases the text is transmitted transiently for that processing only and is not stored by our servers. Only where we have configured a fallback, an alternative LLM provider (also in the United States) may perform the same processing.

What we collect and process on our servers:

We do not collect original audio, payment information, or government-issued identifiers. Transcription and translation text is not stored on our servers during real-time processing; it is processed only for session records you choose to save (the table above) and for the opt-in AI suggestion and Audience sharing features described in Section 2.

• Identifying you and maintaining your login state (account information, session cookies)
• Managing free usage limits and preventing abuse (session metadata, usage records)
• Operating the Service, responding to incidents, and improving quality (statistical use of session metadata)
• Personalizing your experience and understanding, in aggregate, which languages and regions our users come from (language and region preference)
• Improving the Service through visit and usage analytics (behavioral information — only where you consent)
• Fulfilling legal obligations and responding to disputes

• When you delete your account or your agreement with us ends, we destroy the personal data we have collected without delay — except for the security records described below and anything we must keep by law. You can delete your account directly in the Service settings (“My data”) or request deletion at contact@newey.ai.
• Information we are required to retain under applicable law is kept for the period prescribed by that law — see Country-Specific Privacy Terms for examples.
• Security records, and the encrypted off-site copy of them. We keep an internal record of security-relevant actions on the Service — such as signing in, deleting an account, exporting your data, and administrative access — noting what was done, when, the account email address, and the IP address. It contains no captions, transcripts, glossaries, or anything else you created. We keep these records for 2 years, including after an account is deleted: their purpose is to show what happened, which they cannot do if what they record can be made to disappear. If you ask us to erase your data, we remove your email address and IP address from these records, leaving only an internal account reference, the kind of action, and when it happened — and once your account is deleted, that reference no longer resolves to anyone.
• From August 3, 2026 we also store an encrypted copy of those security records off-site (Sections 6 and 7), so that our record of a security incident does not sit only in the system such an incident would affect. From August 26, 2026 that copy is write-once: once written it cannot be changed or deleted by anyone, including us and including in response to an erasure request, until it expires and is destroyed automatically 3 years after it was written. That is longer than the 2 years above, because the copy exists to prove the records were not tampered with, and it has to outlast the originals to do that. We rely on Article 17(3)(e) of the GDPR — retention necessary for the establishment, exercise, or defence of legal claims — together with our obligation to keep our own security records; a record that can be edited on request is not a record. The copy is encrypted before it leaves our servers with a key we keep offline and never give to the provider, and we use it only to investigate a security incident, to answer an audit, or to deal with a legal claim. Until August 26, 2026 no such write-once protection is in place.
• Data stored only in your browser (display settings and the local cache of session records) is not held by us and can be deleted by you directly in your browser. The glossary’s account copy (Section 3) is replaced whenever you save and is destroyed together with your account.
• Session records you choose to save are retained in your account, and you can delete them individually or all at once, or export them, within the Service. When you delete your account, saved session records are destroyed together without delay.
• Shared glossaries: a limit on erasure you should know about before you publish. A glossary snapshot you publish is retained until you unpublish it or delete your account; either destroys the snapshot on our servers without delay and stops further installations. Copies that other users have already installed are not deleted. An installed copy becomes part of that user’s own glossary — their data, on their devices and in their account — and neither you nor we can recall it. This is an inherent consequence of letting other people keep what they installed, and it is a practical limit on your right to erasure. We tell you this before you publish so that you can decide accordingly: publish nothing you may later need to withdraw from the people who already have it. Content reports (Section 3) are retained as a record of moderation even after the reported content is removed.

We use service providers (processors) to operate the Service. They process personal data only for the tasks we assign to them, and are not permitted to use it for any other purpose.

Apart from the processing described above, we do not provide personal data to third parties and we do not sell personal data. Lawful requests from authorities based on applicable law are an exception.

To provide the Service, personal data is transferred internationally as set out below. If you do not want your personal data transferred abroad, you may stop using the Service and request account deletion; in that case, however, the Service cannot be provided.

These transfers are necessary to perform our contract with you — to provide the Service you have asked for — and that necessity, together with the disclosure in this section, is the basis on which they are made.

Where a provider processes personal data on our behalf, we rely on a data processing agreement with that provider which incorporates the European Commission’s Standard Contractual Clauses, together with the United Kingdom addendum where the provider offers one, so that the protection that travels with your data does not depend on the law of the country it arrives in. The Clauses themselves are published by the European Commission; if you want to know which of them we rely on for a particular transfer, ask us at the address in Section 14. Not every recipient in the table below sits under such an agreement, and we would rather name the exceptions than let the sentence above be read as covering all of them: the public notification service that delivers our operational alerts is used without an individual agreement, which is why what we send it is limited to the items its row describes; and where you sign in with an account you already hold with another company, your sign-in reaches that company under the terms you have with it.

We distinguish between strictly necessary cookies required to provide the Service (such as login) and optional analytics cookies used only with your consent. We do not use cookies for advertising or personalized tracking.

• Necessary and functional cookies are used without separate consent to the extent needed to provide the Service; if you block them in your browser settings, some features such as login will be unavailable.
• Analytics cookies are set only if you accept them in the consent banner shown on your first visit. If you decline or make no choice, analytics cookies are not set. Even in that case, under Google Consent Mode a cookieless, non-identifying aggregate signal may be sent; this signal is not used to identify individual users.
• Your consent choice is stored only in your browser (localStorage), and you can change (withdraw) it at any time below.

• You may request access to, correction of, deletion of, or restriction of the processing of your personal data at any time. Contact contact@newey.ai, and we will act without delay (and no later than within the statutory deadline) and inform you of the outcome.
• You can also exercise the most common rights yourself, at any time, in the Service settings (“My data”): delete your account and the data associated with it (subject to the one limit described below), or export your data as a downloadable file.
• One limit on erasure you should know about. The internal security records described in Data Retention are kept even after an account is deleted, and from August 26, 2026 the encrypted off-site copy of them cannot be altered or deleted at all until it expires. When you ask us to erase your data we remove your email address and IP address from those records in our live systems, and we tell you plainly that the off-site copy remains until it is destroyed automatically at the end of its period, and when that will be. We will not tell you a copy has been deleted when it has not.
• You may exercise your rights through a legal representative or an authorized agent; we may request documentation confirming the lawful representation.
• Additional rights that apply in your country or region — and how to lodge a complaint with your local authority — are described in Country-Specific Privacy Terms.

The Service is not directed at children under the age of 14 — or under any higher minimum age that applies in your jurisdiction — and we do not knowingly collect children’s personal data. If we confirm that a child’s information has been collected, we will destroy it without delay.

• Encryption in transit: all of the Service’s communications (including audio transmission) are encrypted with TLS.
• Data minimization by design: real-time audio and the live transcription stream are designed not to be stored on our servers, reducing the risk of exposure; only the session records you choose to save are retained in your account.
• Local encryption: the local cache of the glossary and session caption records stored on your device is encrypted with AES-256-GCM. The encryption key is kept in the browser’s secure storage in a non-exportable (non-extractable) form and is not transmitted externally. Saved session records are stored on managed database infrastructure, scoped so that no other user can access them; with opt-in end-to-end encryption enabled, the server stores ciphertext only.
• Access control: secret values, such as database connection credentials, are managed only in the server environment and are not exposed to the client.
• Session security: HttpOnly and Secure attributes are applied to authentication cookies, and the origin of API requests is verified.

• EEA and United Kingdom (GDPR / UK GDPR). In addition to the rights in Section 9, you have the right of access (Art. 15), the right to erasure (Art. 17), the right to data portability (Art. 20), and the right to object to processing (Art. 21), and you may lodge a complaint with the supervisory authority in your place of residence. Our legal bases are performance of a contract (Art. 6(1)(b)), your consent for optional analytics (Art. 6(1)(a)), and legitimate interests (Art. 6(1)(f), preventing abuse).
• Japan (APPI). You may request disclosure, correction, or suspension of use of your retained personal data under the Act on the Protection of Personal Information — exercise these rights as described in Section 9. Personal data is handled by processors in the countries listed in Section 7; information about the personal-data protection systems of those countries is available on request (Section 14), and by agreeing to this policy and using the Service you consent to these transfers. Our business name, address, and representative are provided without delay on request. You may also contact the Personal Information Protection Commission (ppc.go.jp) with complaints.
• Republic of Korea. You have the rights of access, correction and deletion, and suspension of processing under the Personal Information Protection Act; the statutory retention periods referred to in Section 5 include communication log records (3 months, Protection of Communications Secrets Act) and, if the Service becomes paid, records of contracts and withdrawal of subscription (5 years, Act on Consumer Protection in Electronic Commerce). You may seek redress through the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972). The entrusted processors and their assigned tasks are disclosed in Section 6.
• United States (California — CCPA / CPRA). We do not sell personal information or share it for cross-context behavioral advertising. You may request disclosure of the categories collected, as well as deletion and correction, and you will not be discriminated against for exercising your rights.
• Other jurisdictions. If the privacy law of your country of residence grants you additional rights, those rights are not limited by this policy — contact us to exercise them.

If we add to, delete from, or amend this policy, we will give notice through in-service announcements starting at least 7 days before the effective date. For material changes affecting your rights — such as new categories of data collected or new third-party disclosure — we will give notice 30 days before the effective date and, where required, obtain your consent again.

The dated list of all past revisions is available in the revision history.

For matters relating to the terms of use of the Service, please see the Terms of Service.

For inquiries, complaints, or remedies concerning the processing of personal data — including requests for the information described in Section 12 — contact our Privacy Officer, Joosuk Son, Representative Director, at contact@newey.ai. We will respond and act without delay.