Subprocessors

These are the categories of third party that receive your data when you use HushedEchoes — what each gets, why, and where it is processed. Sections 4 and 5 of our Privacy Policy point here.

You can ask us for the specific companies. We describe recipients by category here. If you want the names of the individual providers that hold your data, email hello@hushedechoes.com and we will tell you.

We update this page when the categories change. For material changes we give at least 14 days’ notice — in the app, and by email to signed-in users — before the new processing begins.

Which provider within a category handles a given request depends on the feature, the language you are using, and available capacity. Not every provider receives every request.

Before content is sent for automated processing, your name, email address and internal user ID are stripped from the request. What you say or write may still contain identifying details — if you speak your own name aloud, those words travel with the recording.

End-to-end encrypted chats and direct messages are never sent to any of these providers. We cannot read them, so we cannot send them.

Except as stated below, these providers act on our instructions under contracts that limit their use of your information to the services they provide to us. They are not permitted to use your content to develop or train their own models.

One exception, which we name because you need to know it.

Transcripts of what you record, and the text of what you type into a day-log, are sent to Google’s Gemini API to be sorted into tasks, moods and reminders. Google’s terms for the tier we use permit Google to use the content submitted and the responses generated to provide, improve and develop Google products and services, and permit human reviewers to read, annotate and process that content. Google states that it disconnects such content from your account and from our API key before human review. Google’s terms for this tier also advise against submitting sensitive or personal information to it.

Treat anything you record or write in a day-log as something a person at Google may read, and as something that may inform Google’s own model development.

Declining the AI notice in the app turns off voice recording; typed day-log entries are still processed this way. Section 4.4 of the Privacy Policy sets out exactly what declining does.

One provider is unconfirmed.

For Hindi and Hinglish speech we use a provider whose data-use position we have not been able to verify from its published terms, and we are seeking written confirmation. Until we have it, assume that provider’s own terms govern what it does with what it receives.

Separately, we may use your content to improve our own prediction models — but only if you switch that setting on. It is off by default and refusing it disables nothing. See section 4.3 of the Privacy Policy.

Our primary database is in India. Several of the categories above are in the United States or run global networks.

If you are in the EEA or the UK, that means your personal data is processed outside the EEA and the UK. Neither India nor the United States has a European Commission adequacy decision of general application, so these are restricted transfers needing a safeguard under Chapter V of the GDPR. For each recipient we rely on Standard Contractual Clauses (with the UK International Data Transfer Addendum where the transfer is from the UK), the EU–US Data Privacy Framework where the recipient is certified, or another mechanism permitted under Chapter V.

Our website analytics provider is hosted in the European Union, so that processing is not a restricted transfer.

To ask which safeguard applies to a particular recipient, or to request a copy of it, write to hello@hushedechoes.com.