← wingscript

Version 2.3 — Effective September 1, 2026

wingscript ("we", "us", "our") provides a real-time conversation intelligence tool delivered as a Chrome browser extension, web application, macOS companion app, and iOS app. This policy covers those products and the wingscript.com website. It describes what data we collect, how we use it, and your rights.

1. Data Controller

Weavery, LLC, a California limited liability company doing business as wingscript ("wingscript"), is the data controller of the Personal Data you provide through wingscript's applications and website. For questions about how your data is handled, contact us at support@wingscript.com.

2. What We Collect

Data Type	What	Where Processed
Audio	During a session, audio from your microphone and — with your permission — from your meeting or call is streamed over an encrypted connection and transcribed in real time, either on our servers or by our speech-to-text provider, Deepgram. The iOS app streams audio directly to Deepgram. Audio is processed transiently for transcription and deleted immediately; it is never stored. Only the resulting text transcript is retained.	Azure (US regions); Deepgram
Transcripts	Text transcripts of your sessions, used for real-time analysis and session history.	Azure (US regions)
Google Account	Email, name, and profile picture obtained via Google OAuth. Used for authentication.	Azure (US regions)
Calendar	Read-only access to upcoming Google Calendar events for meeting context. Cached temporarily.	Azure (US regions)
CRM Data	If you connect Salesforce or HubSpot, we pull account name and deal stage. No bulk sync.	Azure (US regions), via Nango
Phone Calls	If you place a call through wingscript's dialing feature, the number you dial, call status, and call audio pass through Twilio, our telephony carrier, to connect the call and enable real-time transcription.	Azure (US regions); Twilio
Dialpad Call Events	If your organization connects Dialpad, we receive call-state events (that a call has started or ended, and which rep it belongs to) so wingscript can prepare your session automatically. No call audio or content comes from Dialpad.	Azure (US regions)
Cue Interactions	Which cue cards are shown and a similarity signal indicating whether the suggestion was adopted.	Azure (US regions)
Learning Data	Coaching lessons extracted from sessions, framework scores, and skill progress snapshots.	Azure (US regions)
LinkedIn Profiles	When you enable the LinkedIn connector, name, headline, company, and LinkedIn URL are captured from LinkedIn profile pages you visit. This data enriches meeting attendee context. This feature requires you to grant an optional permission.	Azure (US regions)
Chat History	Conversations with the wingscript chat assistant are stored to maintain context across sessions.	Azure (US regions)
Knowledge Base	Documents and content you upload or sync via connectors (Google Drive, Notion) for meeting preparation and cue enrichment.	Azure (US regions)
Contact Enrichment	Name, title, and company retrieved from Apollo.io to provide context about meeting attendees. No bulk data is imported.	Azure (US regions), via Apollo.io
Billing	If you purchase a paid plan, payment is processed by Stripe. Your card details are collected directly by Stripe and never touch our servers. We store your plan, subscription status, and seat counts.	Stripe; Azure (US regions)
Usage Analytics	Content-free product events (for example, "session started" or "feature used") tied to your account identity (name, email, organization, plan tier), forwarded to Mixpanel so we can understand how wingscript is used. Conversation content — transcripts, cue text, chat messages, document text — is never included in analytics events; this is enforced in our ingestion code.	Azure (US regions); Mixpanel
Onboarding Survey	Optional one-tap answers you may give during setup — your role, sales-team size, where your calls happen, and how you intend to use wingscript. Used to tailor coaching defaults and to suggest the right plan for you; stored with your account, and included in the account-identity properties forwarded to Mixpanel. Every question is skippable, and answers can be changed or deleted at any time (see Your Rights).	Azure (US regions); Mixpanel
Push Subscriptions	Web Push endpoint stored to deliver calendar update notifications. No content data is included in push payloads.	Azure (US regions)
Website Forms	If you request a demo on wingscript.com, the name, work email, and team size you enter are sent to our servers and delivered to our inbox as an email via Resend, our email delivery provider. Demo requests are not stored in our database — the delivered email is the only copy.	Azure (US regions); Resend
Server Logs	Standard request logs (IP address, request metadata, timestamps) generated when you use our applications or website, kept for security and operations.	Azure (US regions)

3. Other People on Your Calls

wingscript transcribes conversations, so the words of the people you talk to are part of your transcripts. Those people are not wingscript users and do not see this policy, so this allocation of responsibility matters:

• You are responsible for consent. Laws on recording and transcribing conversations vary; some jurisdictions — including California — require the consent of all parties. By using wingscript you confirm that you have obtained any consent required by the laws that apply to your conversations.
• We process other participants' data on your behalf — solely to provide the service to you (real-time cues, transcripts, summaries, coaching). We do not use it for any independent purpose, and we never contact the other participants.
• Deletion cascades. When you delete a session or your account, the other participants' transcript data in it is deleted too.
• If you were a participant in a conversation transcribed by a wingscript user and want that data removed, contact support@wingscript.com and we will help.

4. Chrome Extension Permissions

Permission	Why
identity	Google OAuth sign-in
sidePanel	Display cue cards alongside your meeting
storage	Save local settings, auth tokens, and connector state
tabs	Detect active meeting tabs (Google Meet, Zoom) and detect LinkedIn profile pages when the LinkedIn connector is enabled
notifications	Calendar reminders for upcoming meetings
scripting	Dynamically inject a content script on LinkedIn profile pages when the LinkedIn connector is enabled by the user
linkedin.com (optional)	Requested only when you enable the LinkedIn connector. Allows capturing profile data from LinkedIn pages you visit to enrich meeting attendee context.

5. How We Use Your Data

• Generate real-time cue cards during your conversations
• Build a learning profile to improve coaching over time
• Provide session summaries and post-call analysis
• Authenticate you and manage your account
• Process payments and manage subscriptions
• Understand product usage and improve the service (content-free analytics only)
• Secure the service and prevent abuse

We do not sell your data. We do not use your data for advertising. We do not train AI models on your data.

6. Third-Party Services

• Deepgram — real-time speech-to-text. Session audio is streamed to Deepgram for transcription and is not retained by us afterward.
• Azure OpenAI — processes transcripts for reasoning and cue generation. Data is processed in the US and is not used by Microsoft to train models.
• Twilio — telephony carrier for calls placed through wingscript's dialing feature.
• Stripe — payment processing. Stripe collects your payment details directly; we never see full card numbers.
• Mixpanel — product usage analytics. Receives content-free usage events and account profile information, never conversation content.
• Nango — OAuth proxy for connectors (Salesforce, HubSpot, Google Drive, Notion, Dialpad). Nango does not store your connected-service data.
• Google APIs — authentication, read-only calendar access, and exporting your call data to a Google Sheet in your Drive (via the drive.file scope, limited to files wingscript creates) over OAuth 2.0.
• Apollo.io — contact enrichment for meeting attendee context. Only name, title, and company are retrieved.
• Google Drive — document sync via Nango for knowledge base content used in meeting preparation.
• Notion — document sync via Nango for knowledge base content used in meeting preparation.
• Resend — email delivery. Sends demo-request notifications from our website to our inbox.

These providers are permitted to use your data only to provide their services to us.

7. Other Disclosures

• Legal requirements. We may disclose Personal Data if required to do so by law — for example in response to a subpoena, court order, or other lawful request — or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers. If wingscript is involved in a merger, acquisition, or sale of assets, Personal Data may be transferred as part of that transaction. This policy will continue to apply, and we will notify you of any change in ownership or in how your Personal Data is handled.

We have never sold personal information, and we do not share personal information for cross-context behavioral advertising.

8. Data Storage & Retention

• Data is stored in Azure PostgreSQL in US regions and encrypted at rest.
• Session transcripts and cue history are retained for your account history. You can delete them at any time.
• Calendar data is cached temporarily and refreshed periodically.
• Audio is never stored — it exists only in transient buffers during transcription and is deleted immediately afterward.
• When you delete your account, your Personal Data is removed from our production systems. Content-free usage records are unlinked from your identity rather than deleted. Residual copies in encrypted backups expire on a fixed rotation schedule.

9. Your Rights

All Users

• Access: Request a copy of your data.
• Correction: Request that inaccurate data be corrected.
• Deletion: Request deletion of your account and all associated data.
• Portability: Export your session history.

To exercise any of these rights, email support@wingscript.com. We will verify your request using the email associated with your account and respond within 45 days. You may use an authorized agent to submit a request on your behalf.

California Residents (CCPA/CPRA)

• Right to know what personal information we collect, where it comes from, and how it is used and disclosed — described in this policy, and available on request.
• Right to correct inaccurate personal information.
• Right to delete personal information, subject to legal exceptions.
• Right to opt out of sale or sharing: we do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to limit use of sensitive personal information: we use sensitive information (such as the contents of your conversations) only to provide the service you requested, which is a permitted purpose that does not require a limit option.
• Non-discrimination: we will never deny you service, charge you a different price, or provide a different level of quality because you exercised your privacy rights.

EU/EEA Residents (GDPR)

You have the right to access, rectify, erase, restrict processing, object to processing, and port your data. Our legal bases for processing are: performance of our contract with you (providing the service you signed up for), our legitimate interests (securing and improving the service), and your consent (optional features such as connectors, which you can withdraw at any time by disconnecting them).

10. Do Not Track and Global Privacy Control

Some browsers can send "Do Not Track" or Global Privacy Control signals. Because we do not sell or share personal information and do not serve targeted advertising, there is no sale or tracking to opt out of, and we do not change our data collection in response to these signals.

11. Cookies & Local Storage

• Our applications use browser storage for essential purposes only: keeping you signed in and saving your settings.
• We do not use advertising or cross-site tracking cookies.
• Our website loads fonts from Google Fonts; like any web request, this discloses your IP address to Google.

12. Security

• All data in transit is encrypted via TLS; data at rest is encrypted.
• Audio is never stored — it is transcribed in real time and discarded.
• Secrets are managed via Azure Key Vault with managed identity access.
• Sessions use short-lived, signed authentication tokens.
• If a security breach affects your Personal Data, we will notify you as required by applicable law, including California Civil Code §1798.82.

13. International Users

wingscript is operated from the United States, and data is stored and processed in US regions. If you use wingscript from outside the US, you understand that your data will be transferred to and processed in the United States.

14. Changes to This Policy

We will update this page when our practices change. The effective date at the top reflects the most recent revision. Material changes will be communicated via email to registered users.

15. Google API Limited Use Disclosure

wingscript's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

As a Chrome extension, wingscript's handling of this data also adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Specifically, data obtained from Google APIs (your Google profile information, calendar events, and the Google Sheets files wingscript creates in your Drive when you export call data) is:

• Used only to provide and improve wingscript's core functionality (authentication, meeting context, and real-time coaching cues).
• Not sold to third parties.
• Not used for advertising or ad targeting.
• Not used for creditworthiness determinations or lending purposes.
• Not shared with third parties except as necessary to provide the service (e.g., Azure OpenAI for transcript analysis).

Human access to Google API data is limited to debugging issues at your request, investigating security incidents, or complying with legal obligations.

16. Children's Privacy

wingscript is intended for use by business professionals. We do not knowingly collect Personal Data from children under the age of 18. If you are under 18, do not use wingscript or provide any information through the extension or web application. If we learn that we have collected Personal Data from a child under 18, we will delete that information promptly. If you believe we may have collected data from a child under 18, please contact us at support@wingscript.com.

17. Contact

For privacy questions or data requests — including California and GDPR requests — contact us at support@wingscript.com.