Subprocessors

These are the categories of third party that receive your data when you use HushedEchoes — what each gets, why, and where it is processed. Sections 4 and 5 of our Privacy Policy point here.

We name content processors that matter most. Sarvam and Groq are named below because they receive echo or Assistant content. The AI assistants you can connect, and Amazon for the Alexa skill, are named because you choose them and they receive what you say or ask them to fetch. Google Firebase is named because it runs inside the app. For the company used in another category, email hello@hushedechoes.com and we will tell you.

We update this page when the categories change. For material changes we tell you before the new processing begins — in the app, and by email to signed-in users. A recipient that receives your data only because you connected it, such as an AI assistant, applies from the moment you connect it.

Not every provider receives every request. Sarvam receives every day-log recording first and is the only transcript classifier; Groq receives audio or Assistant context only when its fallback path is needed.

Amazon receives data only if you link the Hushed Echoes skill for Alexa: Amazon records and transcribes what you say under its own privacy notice and sends us the recognised text, never the audio (section 4.7 of the Privacy Policy). An AI assistant receives data only after you connect it, and only what you ask it to fetch or create; it then holds that data under its provider’s own privacy policy, and we cannot retract it (section 4.6 of the Privacy Policy).

Before content is sent for automated processing, your name, email address and internal user ID are stripped from the request. What you say or write may still contain identifying details — if you speak your own name aloud, those words travel with the recording.

Echo recordings and transcripts remain readable by our service so transcription and classification can work. Authorized staff may access them only for a specific support, operations, security, abuse-investigation or legal need.

End-to-end encrypted chats and direct messages are never sent to any of these providers. Our service cannot read them even if we want to: the server holds ciphertext and the keys never leave your device.

Provider model training is disabled on the Sarvam and Groq accounts used for HushedEchoes. Training being disabled does not by itself mean that a provider stores nothing.

Our Groq project is configured for zero retention of customer content, although non-content operational metadata may remain. Sarvam’s published standard policy permits request-content retention for up to 30 days after last access and usage-log retention for up to one year unless a separate agreement or deletion request shortens those periods. We therefore do not describe Sarvam as zero-retention.

Separately, we may use your content to improve our own prediction models — but only if you switch that setting on. It is off by default and refusing it disables nothing. See section 4.3 of the Privacy Policy.

Our primary database is in India. Several of the categories above are in the United States or run global networks.

If you are in the EEA or the UK, that means your personal data is processed outside the EEA and the UK. Neither India nor the United States has a European Commission adequacy decision of general application, so these are restricted transfers needing a safeguard under Chapter V of the GDPR. For each recipient we rely on Standard Contractual Clauses (with the UK International Data Transfer Addendum where the transfer is from the UK), the EU–US Data Privacy Framework where the recipient is certified, or another mechanism permitted under Chapter V.

Our website analytics provider is hosted in the European Union, so that processing is not a restricted transfer.

To ask which safeguard applies to a particular recipient, or to request a copy of it, write to hello@hushedechoes.com.