Security & data protection

An organizer sends the stage audio through our web app. It is transcribed in real time, translated by an LLM, synthesized back into speech, and delivered to attendees on their own phones — they scan a QR code and pick a language. Attendees create no account and give no personal details.

The database of record is Supabase, hosted in the EU (Ireland). The real-time worker runs on Fly.io with its primary region in the EU (Amsterdam) and additional regions activated per event for latency. Transcripts, event settings, and account data are stored in the EU.

• Source and translated transcripts of the event audio.
• Organizer account data (email, events, settings).
• Knowledge packs — glossaries and speaker names from documents the organizer uploads.
• Operational telemetry (broadcast minutes, listener counts, latency, per-event cost) — aggregates, not content.
• Payment records via Stripe — we store the purchase record only, never card data.

Attendees are not asked for personal information; listening is anonymous.

Spoken content — captions, transcripts, and latency traces — is automatically deleted after 90 days. Organizers can also delete an event's transcripts and captions on demand at any time from the event summary page; the booking and receipt are retained for accounting. Operational aggregates and billing records are kept for as long as the account is active.

Optionally, an event can deliver translation in a cloned voice of the speaker. This is opt-in per speaker and captured live for that event; clone voices are ephemeral and are not retained after the event.

We use the following processors to deliver the service:

We sign DPAs with enterprise customers and can provide our subprocessor list and data-flow summary on request. For a DPA, zero-retention arrangement, or a security questionnaire, contact RonP@hakolsound.co.il.

This page describes current practices and is not a contract. See also our pricing.