This Privacy Policy explains how **DISTILL AI LIMITED**, a company incorporated in Hong Kong with registered office at Unit 1603, 16/F, 367-375 Queen's Road Central, Sheung Wan, Hong Kong ("Company", "we", "us"), collects, uses, and protects personal data when you use our transcription and summarization services, websites, applications, and bots (the "Service").

We process personal data in accordance with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and, where applicable to users in the European Economic Area or United Kingdom, the GDPR / UK GDPR.

1. Data We Collect
Account data: name or username, email address, messaging-platform identifiers (e.g., Telegram ID), language and product preferences.
Content data: audio and video files you upload, and the transcripts, summaries, and other outputs generated from them. Content may include personal data of you or third parties appearing in recordings.
Payment data: subscription plan, transaction history, partial card details (e.g., last four digits), billing country. Full payment card details are collected and processed directly by our payment processors; we do not store them.
Technical data: IP address, device and browser information, log data, approximate location derived from IP, cookie identifiers.
Communications: messages you send to our support team.

2. How We Use Data
We use personal data to:
— provide the Service, including transcribing and summarizing content you submit;
— create and manage your account and subscriptions;
— process payments and prevent fraud;
— provide customer support;
— improve and secure the Service, including debugging and abuse prevention;
— send service communications (billing notices, changes to terms) and, with your consent or where otherwise permitted, marketing communications, which you may opt out of at any time;
— comply with legal obligations.

Legal bases (GDPR users): performance of a contract (providing the Service), legitimate interests (security, service improvement, fraud prevention), consent (marketing, non-essential cookies), and legal obligation.
AI processing: Content you submit is processed by automated speech-recognition and language-model systems, including third-party AI providers acting as our processors. We do not use your content to train our own or third-party AI models without your explicit consent.

3. Sharing of Data
We do not sell personal data. We share data only with:
— Service providers (processors): cloud hosting and storage providers, AI/speech-recognition providers, payment processors, analytics and email providers — in each case only as necessary to operate the Service and under contractual confidentiality and data-protection obligations. A current list of key subprocessors is available on request at info@distillai.io.
— Legal and safety: authorities or third parties where required by law, to enforce our terms, or to protect rights, safety, and property.
— Corporate transactions: a successor entity in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. International Transfers
Our servers and service providers may be located in jurisdictions outside your country, including Hong Kong, the European Union, and the United States. Where required, we implement appropriate safeguards for cross-border transfers (such as standard contractual clauses or equivalent mechanisms) and take reasonable steps to ensure data receives an adequate level of protection.

5. Retention
— Uploaded audio/video files: deleted from our systems within 30 days of processing, unless you choose to store them in your account.
— Transcripts and outputs: retained while your account is active so you can access your history, and deleted within 90 days of account deletion.
— Account and billing records: retained for as long as your account exists and thereafter as required for legal, tax, and accounting purposes (typically up to 7 years for financial records).
— Technical logs: retained for up to 12 months.
You may request earlier deletion of your content at any time (see Section 7).

6. Security
We apply appropriate technical and organizational measures, including encryption in transit, access controls, and isolation of production systems. No system is completely secure; we cannot guarantee absolute security, but we will notify you and relevant authorities of data breaches where required by law.

7. Your Rights
Subject to applicable law, you have the right to:
— access the personal data we hold about you;
— correct inaccurate data;
— delete your data ("right to erasure");
— receive a copy of data you provided in a portable format;
— object to or restrict certain processing;
— withdraw consent at any time (without affecting prior processing);
— opt out of marketing communications;
— lodge a complaint with a supervisory authority — in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD); EEA/UK users may contact their local data protection authority.
To exercise these rights, contact us at info@distillai.io. We respond within the timeframes required by applicable law (generally within 30 days / 40 days under the PDPO).

8. Third-Party Content in Recordings
If you upload recordings containing other people's voices or personal data, you are responsible for having a lawful basis and any required consents to do so. If you believe your personal data appears in content uploaded by another user, contact us at info@distillai.io and we will handle the request in accordance with applicable law.

9. Cookies
Our website uses cookies and similar technologies: strictly necessary cookies (authentication, security), and, with your consent where required, analytics cookies. You can manage cookies through your browser settings and, where available, our consent banner. Disabling necessary cookies may affect Service functionality.

10. Children
The Service is not directed at children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to This Policy
We may update this Policy from time to time. Material changes will be announced via the Service or by email before taking effect. The "Last updated" date above reflects the latest revision.

12. Contact

Data controller: DISTILL AI LIMITED
Registered office: Unit 1603, 16/F, 367-375 Queen's Road Central, Sheung Wan, Hong Kong
Privacy contact: info@distillai.io
General support: info@distillai.io
Website: https://distillai.io