Privacy Policy

HoldSay is built so that your voice stays on your computer. The speech model runs there, and your audio, recordings, transcripts and summaries are stored only on your own disk. We do not upload them, hold copies of them, or have a technical way to retrieve them. This policy explains the smaller amount of information involved in licensing, updates, purchases, support and our website.

Your voice and library

Dictation and transcription happen on your own machine. After the one-time speech-model download when you first launch HoldSay, the app can work without an internet connection.

Your HoldSay library is a normal folder: ~/HoldSay Library by default. You can open it in Finder or Explorer, move it, back it up, or delete it. It is not a database and does not use a proprietary format.

If a transcription fails, HoldSay keeps the relevant audio file on your computer in ~/Library/Logs/HoldSay/failed/. This can help diagnose the problem locally. That file is never uploaded, and you can delete the folder whenever you wish.

Cowork is optional and off until you switch it on. When enabled, it allows AI tools running on your own computer to read your transcripts through a local connection. Those tools are responsible for what they do with the text, under their own policies.

Licence checks

When HoldSay checks or activates a licence, it sends the licence key, an identifier that lets us recognise the same computer, and the platform and app version. On Macs, the app also sends a scrambled value solely to distinguish one person’s computers from another’s. It cannot be traced back to an account, an email address, or anything else about the person. Our server also records the IP address of the request.

The same kind of identifier is recorded when a free trial starts, so the trial stays tied to one computer and does not restart after reinstalling.

We use this information to activate your licence, keep it within the number of computers you bought, and detect licence sharing. The legal basis is performance of our contract with you, together with our legitimate interest in preventing unlicensed use.

Licence checks never include audio, recordings, transcripts, summaries, note titles or file names.

App events and updates

HoldSay’s app events never include your dictation, recordings, transcripts, summaries, note titles or file names. This material stays on your computer and is not sent to our servers as part of app events.

We receive basic technical information about the app and the computer it runs on, together with a technical installation identifier and information that lets us link an event to a licence. App events record that something happened, and where relevant how long it took, without recording its content. They also include signals that help us identify whether the app or licence system has been tampered with. Like any internet request, events include an IP address, which we use only to estimate the request’s approximate country.

We use this information to find errors, understand whether features work as intended, and detect tampering with the licence system. Our lawful basis is our legitimate interests in improving HoldSay and protecting it from misuse.

Update checks, model downloads and price lookups do not send identifying fields.

Purchases and support

Checkout is hosted by Lemon Squeezy, the merchant of record. When you buy HoldSay, we receive and store your email address, order reference and amount paid. Lemon Squeezy handles card details; we never see them.

If you write to support, we receive your email address, your name if you provide it, your message, and your app version, platform, device model and system version. Our web form also records the browser user-agent, an approximate country and the page from which it was sent. Support messages arrive as email and are not kept in a separate database.

If you join the waiting list, we receive your email address, browser user-agent and approximate country. We do this with your consent, and you can ask us to remove you at any time.

If you take part in the referral programme and request payment, we pass your name, payout account and address to our payment provider, and check that the commission claim is genuine before payment.

Our website

The HoldSay website does not use cookies. It has no third-party analytics, advertising or tracking scripts. Fonts are served from our own servers, and we do not embed media players.

The website uses two functional browser local-storage items. hs_lang remembers your chosen site language until you clear it. hs_ref stores a referral code for 30 days.

We count download clicks without cookies and without storing IP addresses. For this purpose, the IP address and user-agent are combined with a salt that changes daily and then hashed. We keep only the resulting hash for 400 days, so the same person is not counted twice. Because we hold the salt, this is pseudonymised rather than anonymous information.

When you open holdsay.com, images and videos are served by a third-party content delivery provider. The same applies when you download the app. This provider receives your IP address, browser user-agent and referring page for every visitor.

Companies that help us

We use Lemon Squeezy for checkout, payment and tax; Vercel for the website and licence server in the United States; Neon for the licences and activations database; Upstash for rate limiting and the waiting list; a third-party content delivery and storage provider operating outside the UK for images, downloads and the analytics server; Resend for sending email; Wise for referral payouts; and third-party hosting services for the speech model downloaded on first launch. These providers process information only as needed to provide their services, and we do not sell personal data or share it with advertisers.

Some of these providers process data outside the UK. Where personal data leaves the UK, we rely on the provider’s data protection terms incorporating the UK International Data Transfer Addendum or Standard Contractual Clauses, or on an adequacy decision where one applies.

How long we keep information

We keep each type of information for as long as its purpose still applies. Licence and purchase records are kept while a licence is valid and afterwards where needed for accounting. Activation records and IP addresses are kept while useful for keeping licences within their seat count. We keep support email while the question is open, and waiting-list entries until you ask for removal.

While a licence is active, we cannot delete the records that make it work: the licence, its activations and the computer identifiers tied to them. Without those records, we could not tell a paid copy from an unlicensed one. The law allows this where information is needed to perform the contract or defend against misuse. Everything else is deleted on request.

Your choices and rights

We hold little personal data. This may include your email address if you bought a licence or contacted us, records needed to keep your licence working, and payout details if you joined the referral programme. Your dictation, recordings, transcripts and summaries stay on your computer. We do not have a copy to send you.

HOLDSAY LTD is the controller of the personal data described here. You can ask for a copy of your data, ask us to correct or delete it, restrict its use, object to processing, or request portability. Email support@holdsay.com. We will respond within one month.

You can complain to the UK Information Commissioner’s Office at ico.org.uk, or to a national supervisory authority in the EU.

Security and legal disclosures

We keep the information we hold small. Since your voice data never leaves your computer, it cannot be leaked by us. For the information that does reach us, we use reputable providers, encrypted connections and access limited to people who need it.

No system is completely secure. If an incident occurs, we will report it where the law requires.

We may disclose information when required by law, such as in response to a court order, regulator or legitimate law-enforcement request, or where needed to establish, exercise or defend a legal claim. If HoldSay is sold or reorganised, relevant information may pass to the new owner, who will be bound by a policy that is no less protective.

Children and changes

HoldSay is not directed at children under 16, and we do not knowingly collect their data.

If this policy changes, we will update the date shown at the top. Significant changes will also be announced on the website.

HOLDSAY LTD, registered in England and Wales, company number 17285609. Registered office: Office 15355, Initial Business Centre, Unit 7 Wilson Business Park, Manchester, M40 8WN, United Kingdom. Questions about this policy, or any request about your data, go to support@holdsay.com.