Privacy Statement

Last updated: April 16, 2026

Buir Lake Laboratories Limited ("we", "us", or "our") operates Vox, an AI-powered voice input tool. This Privacy Statement explains what information we collect when you use Vox, how we use it, and your rights regarding that information.

If you have questions or concerns, you may contact us at support@buirlake.com.

1. Information We Collect

Account Information

When you create an account, we collect your email address and a hashed password. We do not collect your name unless you provide it. This information is required to authenticate you and associate your usage quota with your account.

Voice Audio

When you use Vox to transcribe speech, your device transmits audio data over an encrypted WebSocket connection to our servers. Audio is processed in real time to produce a transcription. We do not retain the raw audio on our servers after processing is complete. No audio recordings are stored or transferred to third parties for storage purposes.

Transcription and Session Data

The transcribed and polished text produced by each session is stored locally on your device in a history database (~/.vox/history.db). We do not upload session transcripts to our servers. Server-side, we record only the duration of each session (in seconds) for quota accounting and aggregate service analytics. We do not have access to the content of what you said or the text output.

Usage Metrics

We collect technical metadata about each session, including session duration, the approximate time the session started, the type of request (transcription, polishing mode), and whether the session completed successfully or encountered an error. This data is used to operate and improve the service, enforce quota limits, and diagnose reliability issues. It does not include the content of your speech or text.

Payment Information

Subscription payments are handled by Airwallex. When you subscribe to a paid plan, you enter your payment details directly into Airwallex's secure payment interface. We do not receive or store your full card number, card verification code, or bank account details. We receive from Airwallex a payment status (success or failure), a subscription identifier, and the amount charged. We use this information to activate or maintain your plan.

Beta Access Requests

If you submit the beta-access form on the Download page, we record the name, email address, primary working language, intended use case, and optional notes you provide, along with the IP address and browser user-agent of your submission. We use this information solely to evaluate the request, send you the beta build, and follow up about your experience. We do not add beta requesters to any marketing list, do not share the data with third parties, and will delete the record on request (mail@buirlake.com) or automatically once the beta period ends.

Cookies and Local Storage

We use two types of browser-side storage on the Vox web portal:

• Session cookie: A short-lived, HTTP-only cookie that identifies your authenticated session. It is deleted when your session expires or you log out. This cookie is strictly necessary for the service to function.
• Locale preference: A small value stored in your browser to remember your preferred display language. This is a functional preference and does not track you across sites.

We do not use advertising cookies or third-party tracking scripts.

2. How We Use Your Information

To Provide the Service

We process audio in real time to produce transcriptions. We use session duration data to enforce your monthly quota. We use your account information to authenticate you and display your account status.

To Improve Quality

Aggregate, anonymised usage metrics (for example, error rates, average session length, distribution of polishing modes used) help us identify reliability issues and prioritise improvements. We do not use the content of your speech or transcripts for model training or product improvement without your explicit consent.

Billing

We use payment status information received from Airwallex to activate paid plans, handle renewal events, and manage account downgrade if payment fails.

3. How We Share Your Information

We do not sell your personal information. We share data only in the following limited circumstances:

• Airwallex (payment processing): When you subscribe or update a payment method, relevant billing information is exchanged with Airwallex to complete the transaction. Airwallex processes this data in accordance with their own privacy policy and applicable PCI standards.
• Legal requirements: We may disclose information if required to do so by law, court order, or a valid legal process issued by a competent authority in Hong Kong SAR or another applicable jurisdiction.

No other third-party data sharing takes place in our current operations.

4. Infrastructure and Data Location

Vox server infrastructure operates on nodes located in Hong Kong SAR and Singapore. Audio data transmitted for transcription passes through and is briefly held in memory on whichever node serves your request. It is not written to disk or replicated to other nodes. Account data and usage metrics are stored in databases hosted on these nodes.

5. Data Retention

We retain account information and aggregated usage metrics for as long as your account is active. If you delete your account, we will delete your account record and associated usage data within 30 days, except where we are required to retain records for legal or accounting obligations (for example, transaction records for tax purposes, which are retained for the period required by applicable law in Hong Kong SAR).

6. Your Rights

You have the right to:

• Access: Request a summary of the personal data we hold about you.
• Correction: Ask us to correct inaccurate data, such as an email address.
• Deletion: Request deletion of your account and associated personal data. You may also delete your account directly from the Account Center.
• Data portability: Request an export of your account information and usage history in a machine-readable format.
• Withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at support@buirlake.com. We will respond within 30 days.

7. Security

All data in transit between your device and our servers is encrypted using TLS. Passwords are stored as bcrypt hashes. We do not store raw credentials. For more detail on our infrastructure security practices, see our Security page.

8. Children

Vox is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will delete it.

9. Changes to This Statement

We may update this Privacy Statement from time to time. If we make material changes, we will notify registered users by email at least 30 days before the changes take effect. Continued use of the service after the effective date constitutes acceptance of the updated statement.

10. Contact

Buir Lake Laboratories Limited
Email: support@buirlake.com