Privacy Notice v1.14-2026-10-11

Version 1.14 — last updated 11 October 2026. Hablexo is operated by Hablexo Ltd, a company registered in England & Wales (company no. 17354416), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Hablexo Ltd is the data controller for the account, eligibility, billing, and operational data described below. Contact: hello@hablexo.com.

This notice explains what Hablexo does with information about you, whether you are at an event, hold an account or write to us. We have kept it short and in plain words; if anything is unclear, ask us at hello@hablexo.com.

We never sell your data or use it for advertising.

If you attend an event

You followed a link or scanned a QR code. You have no account with us and we do not ask who you are.

• Your IP address is handled by our server while your device is connected, because captions cannot be delivered without it. We do not use it to identify or profile you.
• The language you choose is sent to our server so that it knows which captions to send. It is not tied to any identity.
• Your preferences (language, appearance, audio settings and any chat name) are stored on your own device.
• Chat posts and the chat name you chose are stored on the event organiser’s device, not on Hablexo’s servers, for a limited period: 7 days unless the organiser sets another. The page tells you this before you can post. If the organiser has switched on automatic screening, your post and chat name are also sent to one of the translation providers listed below, which decides whether the post may be shown.
• In a conversation, for example across a counter or round a meeting table, the organiser’s device captures everyone who speaks, so that each person can read the others in their own language. If the organiser is recording, the attendee page tells you so.
• Live audio. If the organiser relays the event’s audio, anyone with the link can listen while it is on. It passes through our servers and is not recorded by us.

Who is responsible. The organisation or professional running the event decides why and how it runs, and is normally the controller of its content. Hablexo acts on their instructions as a processor. To exercise your rights over an event’s content or its chat history, contact the organiser first. Hablexo accounts are for business and organisational use. Attendees do not become Hablexo customers by following an event link.

If you send us feedback about an event

If you use Feedback, you write directly to Hablexo, which is the controller for your message. The organiser does not receive it. We receive:

• your message, and an email address if you choose to give one so that we can reply. It is never given to the organiser;
• some technical details, if you leave the diagnostics box ticked: the caption language you chose and the event’s source language, the state of the connection, your window size and your browser type. The form shows you exactly what will be sent before you send it;
• which organisation’s event you were at, if your link carried an event key. We use the key only for that: it is not kept and never appears in the email, and you can send feedback without one;
• a few identifiers for the report and your browser session, your network address and the times of recent reports, which we hold briefly in memory to stop automated abuse and duplicate reports. They are cleared as later requests are handled or when the server restarts.

The form does not automatically attach captions, translations, chat messages, chat names or screenshots; your message contains what you choose to type. Our lawful basis is legitimate interests (Article 6(1)(f)): fixing and improving a service people are using. We do not use feedback to profile or target you. An AI assistant may help us read, translate and reply to reports; see Service providers below. Retention: we keep reports and support correspondence while they are useful and delete them when they are not, or when you ask.

If you are a translator at an event

An organiser can invite a human translator to translate for listeners. You have no account with us. Your voice is relayed through our servers, in memory only, to the listeners who chose your language. Where your language is supported, your speech is also transcribed by the speech-to-text providers listed below to produce captions, and your browser may connect to one of them directly. A reconnect credential is kept in your browser until you close the tab. We count the minutes relayed, as numbers only, because the organiser is billed for them.

If you hold or are named on an account

An account belongs to an organisation, and the people who use it are named on it as Admins or Members. One sign-in can hold memberships in several organisations. For this information Hablexo is the controller.

• Sign-in details: your email address, and either a password, stored only as a salted hash, or the identifier Google or Apple gives us when you sign in with them. For Apple we also keep a token that lets us end the link when you delete your account.
• Your display name, if you give it or Google or Apple passes it on. It is optional, and your organisation’s Admins see it beside your email address.
• Customer identity and eligibility: the organisation’s legal name, type, country and registration number, and the business-purpose and authority declarations made at sign-up, with the name of the person who made them, the version of the declaration and when it was accepted.
• Membership: which organisations you belong to, your role, who invited you and when you joined or left.
• Invitations: when an Admin invites a colleague, we hold the address they gave us from the moment the invitation is sent, so that we can deliver it. If you were invited, your address came from that Admin.
• Testers: when we invite someone to help us test Hablexo, we hold their email address. For the Android app we give it to Google so that Google Play can admit them to our private test group, and we remove it when their testing ends.
• Devices: the name each installation reports, so that you and your Admins can tell them apart and sign one out.
• Usage and billing: counts of minutes and messages, never content; the credit balance; and transaction records. Each usage record carries the membership that produced it, so your organisation’s Admins can be shown which member used the credit.
• Starter credit: one-way hashes of the email address, device identifier and network address used at sign-up, so that a free starter credit cannot be claimed twice.
• How you found us: a referral code, if your link carried one, the sector you tell us you work in, and the language you want our emails in.
• Support: what you choose to send us, with the account it came from, the app version and your operating system.
• Operational logs: connection and error events, kept for up to 28 days. They contain no caption content.

We need your sign-in details and the organisation’s identity and declarations to open and run an account, and cannot provide one without them. The person making the declarations gives their full name. Your account display name and any feedback reply address are optional.

Signing in with Google or Apple. Google or Apple shares your verified email address, which for Apple may be a private relay address, and your name where you allow it. We receive no access to your other Google or Apple data. Hablexo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Payments. Card payments are processed by Stripe. Card details go directly to Stripe and never reach our servers. We keep Stripe’s references for your account and for any saved card, with the card’s brand and last four digits.

Email we send you

We send account and service email, such as verifying your address, resetting a password or warning that credit is low, because it is part of running your account, and you receive it regardless of any marketing choice. Product news is separate and opt-in, and we do not currently send any. Withdraw consent at any time using the email link or hello@hablexo.com; this does not affect earlier lawful processing. If you opt out, or ask us never to contact you, we keep that request as a one-way hash of your email address so that it survives even if you delete your account.

Why we use your data

Where you are personally our customer, we rely on our contract with you to run the account, meter usage and bill. Where you act for an organisation, we rely on our legitimate interests in verifying its representatives and administering its account. We rely on legitimate interests to keep the service secure, to handle support and feedback, and to retain a closed account’s sector and source so that we can understand take-up. We rely on consent for product news only, and on legal obligation for the financial records we must keep. For event content we act as a processor, and the controller is responsible for its lawful basis. We make no solely automated decisions about you that have legal or similarly significant effects.

Service providers and other recipients

These providers act on our instructions unless we say otherwise:

• Speech-to-text: Soniox, ElevenLabs, Deepgram, Google Cloud and AWS process live audio to produce transcripts.
• Translation: Makora, DeepInfra and Google Cloud process caption and chat text to produce translations and, where switched on, to screen chat posts.
• Payments: Stripe, which also keeps its own record of your payments as a controller in its own right.
• Email: Resend, for account email and delivery of feedback, and Migadu, for the mailboxes that receive correspondence.
• Issue tracking: Atlassian, for a de-identified summary of a bug or feature request.
• AI assistance: Anthropic (Claude), which helps us read, sort and translate the mail we receive and draft our replies.
• Hosting: Oracle Cloud, in the United Kingdom.
• Content delivery and backups: Cloudflare serves our website and the attendee page’s static files, and holds encrypted copies of the account database in the European Union. Backblaze holds a second encrypted copy in the Netherlands. Neither receives event content.

The providers that may process event content, and their locations, are published with the Data Processing Addendum. Where personal data is transferred internationally, we rely on a mechanism the applicable law recognises, such as an adequacy decision or approved contractual clauses. You can ask us for details of the safeguards, and for a copy, at hello@hablexo.com.

How long we keep it

• Event content: in memory only, for a short time, and then discarded.
• Account details: while the account is open.
• The financial record: for six years from the end of the accounting period in which the account is closed, the period kept for tax and accounting records. It retains payment references but no name or email address.
• Usage detail: 24 months.
• Backups: a deletion applies to the live system at once. Backups still hold the earlier state until they expire: up to 30 days for daily copies and about 13 months for monthly ones. Backups are encrypted before leaving Hablexo; the provider holds no key and cannot read them. They are excluded from day-to-day processing.
• On the organiser’s device: chat history for 7 days by default.
• Recordings and transcripts: only if the organiser switches on transcript logging or audio recording, both off by default, and then for 28 days by default, a period the organiser sets. A transcript can include chat posts and names. These files stay on the organiser’s device, under their control. The device’s own backup, if the organiser has one switched on, may carry a copy into their iCloud or Google account.

Your rights

You may ask for access to your data, for it to be corrected or deleted, or for a portable copy, and you may ask us to restrict processing. You may object at any time to processing based on our legitimate interests, and to product news. Write to hello@hablexo.com to exercise your rights or to complain to us. If you are in the UK you may complain to the Information Commissioner’s Office (ico.org.uk), and if you are in the EU or EEA, to your local supervisory authority.

Deleting your account

You can do this yourself from the web console, or from the phone app, which opens the same page, without writing to us. It happens at once and cannot be undone. Leaving an organisation removes your membership of it and leaves it running for everyone else; the record of past usage stays with the organisation as part of its billing records. Closing an organisation, which only an Admin can do, erases its name, its declarations and its event keys, removes saved cards and signs every device out.

Your own name, email address and sign-in details are erased when you no longer belong to any organisation. What stays is the financial record described above, the starter-credit hashes kept with it, the sector and source the organisation gave us, and any do-not-contact record. Stripe keeps its own record of your payments under its own rules. Before you confirm, the page tells you what will happen to any credit: purchased credit is refunded to the card you paid with where our payment provider can still reverse the payment, and otherwise we repay it by other means and write to you to arrange it. Free credit is not refunded.

Cookies and storage on your device

We use no advertising or tracking cookies. Our pages store only what follows, in your browser:

• Console: a sign-in token until you close the tab, a random device identifier, and your language and appearance choices.
• Sign-up: a referral code, if your link carried one, for the length of your visit, so that we know how you found us.
• Sign-in and sign-up pages: where signing in with Google or Apple is offered, nothing from Google or Apple is loaded until you choose to sign in with one of them. That company then receives your network address and may set cookies of its own.
• Videos: where a page offers a video from YouTube, it is loaded only when you choose to play it. Google then receives your network address and may set cookies of its own.
• Attendee and translator pages: your preferences, whether you have seen a notice, and what the page needs in order to connect.
• The operator app’s control panel: a session cookie that keeps you signed in to it.
• Our website: your language choice.

Changes

We may update this notice as the service changes. Material changes appear here with a new version date.

Hablexo Ltd · Registered in England & Wales · Company No. 17354416 · Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF · hello@hablexo.com

Hablexo home · Terms of Service · Data Processing Addendum · EULA · Sign up