Privacy Policy

1. Scope

This Policy applies to personal information processed by Control in connection with the Service, support, billing, and our communications. It does not govern a third-party website, platform, model provider, payment provider, or other service that operates under its own privacy policy. It also does not apply to information processed solely on your device that is never transmitted to Control or a provider acting for us.

2. Information we collect

3. Device permissions and local processing

The desktop application may request microphone, screen-capture, accessibility, input monitoring, or similar operating-system permissions. These permissions support features such as transcription, screenshots, global hotkeys, push-to-talk, overlay behavior, and remote controls. The exact permissions and labels depend on your operating system.

Global keyboard and mouse monitoring used for configured Control hotkeys is processed locally. Control does not use that permission to log or transmit your general typing, browsing history, or mouse movements. Some other content processed on your device, including audio segments, screenshots, extracted text, prompts, and transcript context, may be sent to cloud services when needed to provide a feature you activate. You can manage permissions through your device settings, although disabling them may prevent features from working.

4. How we use personal information

• provide, personalize, maintain, and synchronize the Service;
• authenticate users and manage accounts, plans, access, and entitlements;
• transcribe audio; process prompts, screenshots, and files; and generate AI responses and other requested output;
• enable remote controls, helper rooms, invitations, and other collaboration features;
• process purchases, subscriptions, cancellations, refunds, and related records;
• respond to support requests and communicate about the Service;
• monitor performance, diagnose failures, maintain compatibility, and improve reliability and user experience;
• prevent fraud, promotion abuse, unauthorized access, security incidents, and violations of our Terms of Service;
• comply with legal obligations and protect the rights, safety, and property of others; and
• create aggregated or de-identified information that cannot reasonably identify you and use it for lawful business purposes.

5. AI and transcription processing

To provide AI, optical-character-recognition, and transcription features, we may send the content and context needed for your request to model-routing, AI inference, and speech processing providers. Depending on the feature, this may include audio, transcript text, screenshots, extracted text, prompts, prior conversation context, files, and technical metadata. The provider used may vary based on availability, configuration, performance, and the model or feature selected.

We use provider accounts and configurations intended for application programming interfaces and business services. We do not authorize our service providers to use your personal information for their own advertising. Provider handling and retention can vary, so avoid submitting sensitive information that is not needed for your request.

6. How we disclose personal information

We may disclose personal information to the following categories of recipients:

• Cloud and data infrastructure providers that support hosting, authentication, databases, storage, networking, and application delivery.
• AI, model-routing, OCR, and speech providers that process content to provide requested generation and transcription features.
• Payment and billing providers that process checkout, subscriptions, invoices, tax-related data, fraud screening, and payment support.
• Communications and support providers that help deliver transactional email and respond to requests.
• People you invite or authorize. Helper-room participants and other collaborators may see the content and account information made available through that feature.
• Professional advisers such as lawyers, accountants, auditors, insurers, and security consultants where reasonably necessary.
• Authorities and other parties for legal or safety reasons when we believe disclosure is reasonably necessary to comply with law, protect rights or safety, investigate fraud or abuse, or enforce our agreements.
• Transaction parties in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of some or all of our business or assets, subject to appropriate safeguards.

We do not sell personal information for money. We do not currently share personal information for cross-context behavioral advertising. If those practices change, we will update this Policy and provide any notices and choices required by law.

7. Cookies and similar technologies

We use cookies, browser storage, and similar technologies that are necessary for account sessions, security, theme selection, interface state, and remembering privacy choices. Your browser or device may let you delete or block these technologies, but necessary features may stop working. With your permission, we also load our self-hosted Umami analytics service on allowlisted public website pages. Umami does not set analytics cookies. It creates anonymous sessions from technical request data; the source IP address may be used to derive approximate location and an anonymous session hash but is not stored by Umami. We additionally use local storage to remember your analytics choice and whether the browser has visited before.

We configure this integration for manual event capture and exclude URL query strings and fragments. We do not enable session replay, heatmaps, form capture, page-content capture, advertising, or account identification. Analytics is disabled until you allow it, can be withdrawn through the footer's Privacy choices control, and respects enabled browser "Do Not Track" signals.

8. Legal bases for processing

If the laws of the European Economic Area, United Kingdom, or another jurisdiction require a legal basis, we rely on one or more of the following:

• Contract: processing needed to create your account, provide requested features, and administer purchases and subscriptions.
• Legitimate interests: securing, maintaining, troubleshooting, improving, and communicating about the Service; preventing abuse; and protecting legal rights, where those interests are not overridden by your rights.
• Consent: where you provide consent for a specific activity. You may withdraw consent at any time, without affecting prior processing.
• Legal obligation: processing needed to comply with tax, accounting, legal, regulatory, and law-enforcement requirements.

9. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy. Retention depends on the type of information, the feature involved, account status, sensitivity, legal requirements, and the need to prevent abuse or resolve disputes. In general:

• account and profile information is retained while your account remains active;
• saved sessions, messages, transcripts, screenshots, and files are retained until you or Control delete them, subject to feature behavior and the exceptions below;
• billing, transaction, and entitlement records may be retained for tax, accounting, fraud, chargeback, and legal purposes after an account closes; and
• security, diagnostic, and usage records are retained for periods reasonably necessary to protect and operate the Service.
• self-hosted public website analytics is retained until we delete or aggregate it under our analytics retention practices.

Deletion from active systems may take time to propagate to backups. We may retain information longer when required by law, needed to establish or defend legal claims, or necessary to detect and prevent fraud or abuse. We may retain aggregated or de-identified information where it no longer reasonably identifies you.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls and protections for information in transit and at rest where appropriate. No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials, devices, invitation links, and exported content secure. Contact us promptly if you believe your account or information has been compromised.

11. International data transfers

Control and its service providers may process personal information in the United States and other countries that may have different data-protection laws from your country. Where required, we use recognized safeguards for restricted transfers, such as contractual protections, and take other steps required by applicable law.

12. Your privacy choices and rights

Depending on where you live and subject to legal exceptions, you may have the right to:

• access or obtain a copy of personal information we hold about you;
• correct inaccurate personal information;
• delete personal information;
• receive certain information in a portable format;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• opt out of certain sale, sharing, targeted advertising, or profiling practices;
• appeal our decision on a request where applicable; and
• not receive discriminatory treatment for exercising a privacy right.

You may update some information through your account. To exercise another right, email [email protected] with the subject "Privacy Request" and describe your request and jurisdiction. We may ask you to verify your identity or account. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity confirmation. We will respond within the period required by applicable law.

13. U.S. state privacy disclosures

This section supplements the rest of this Policy for residents of U.S. states with applicable comprehensive privacy laws. In the preceding 12 months, we collected the categories described in Section 2, including identifiers; customer records; commercial information; internet or electronic network activity; audio, visual, and similar information; professional or employment-related information that users choose to submit; and inferences generated to provide requested features. We collect this information from the sources in Section 2, use it for the purposes in Section 4, and disclose it for business purposes to the recipients in Section 6.

Some submitted content may contain information treated as sensitive under state law, such as account credentials, private communications, precise content about a person, or racial, health, or other sensitive details a user chooses to include. We use such information only to provide requested features, secure the Service, comply with law, and for other purposes allowed without a right to limit under applicable law. We do not use sensitive personal information to infer characteristics for advertising.

As stated above, we do not sell personal information for money or currently share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16. Residents may exercise applicable rights using the process in Section 12.

14. Information about other people

The Service may allow you to capture or submit the voice, image, communications, documents, or other personal information of interviewers, meeting participants, collaborators, or other people. You are responsible for providing any legally required notice and obtaining all required consents before using the Service. You must not use Control to secretly record or process a person where doing so is unlawful or prohibited. If you believe your information was submitted to Control without authorization, contact us with enough detail to identify the relevant account or content.

15. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action. Users below the age of legal majority must use the Service only with the involvement and consent of a parent or legal guardian.

16. Changes to this Policy

We may update this Policy to reflect changes to the Service, law, or our practices. We will post the revised Policy and update the date above. If a change materially affects how we use personal information, we will provide additional notice or request consent when required by law. We encourage you to review this page periodically.

17. Complaints

Please contact us first if you have a privacy concern so we can try to resolve it. Depending on where you live, you may also have the right to complain to your local data-protection, privacy, or consumer-protection authority.