Privacy Policy
Version 2.0 — Effective May 16, 2026
wingscript ("we", "us", "our") provides a real-time conversation intelligence tool delivered as a macOS application and Chrome browser extension. This policy describes what data we collect, how we use it, and your rights.
1. Data Controller
wingscript is the data controller of the Personal Data you provide through the wingscript extension and web application. For questions about how your data is handled, contact us at support@wingscript.com.
2. What We Collect
| Data Type | What | Where Processed |
|---|---|---|
| Audio | Meeting audio is captured and transcribed on your device. Raw audio is never transmitted to our servers. | Your device only |
| Transcripts | Text transcripts generated on-device are sent to our backend for real-time analysis and session history. | Azure (US regions) |
| Google Account | Email, name, and profile picture obtained via Google OAuth. Used for authentication. | Azure (US regions) |
| Calendar | Read-only access to upcoming Google Calendar events for meeting context. Cached temporarily. | Azure (US regions) |
| CRM Data | If you connect Salesforce or HubSpot, we pull account name and deal stage. No bulk sync. | Azure (US regions), via Nango |
| Cue Interactions | Which cue cards are shown and a similarity signal indicating whether the suggestion was adopted. | Azure (US regions) |
| Learning Data | Coaching lessons extracted from sessions, framework scores, and skill progress snapshots. | Azure (US regions) |
| LinkedIn Profiles | When you enable the LinkedIn connector, name, headline, company, and LinkedIn URL are captured from LinkedIn profile pages you visit. This data enriches meeting attendee context. This feature requires you to grant an optional permission. | Azure (US regions) |
| Chat History | Conversations with the wingscript chat assistant are stored to maintain context across sessions. | Azure (US regions) |
| Knowledge Base | Documents and content you upload or sync via connectors (Google Drive, Notion) for meeting preparation and cue enrichment. | Azure (US regions) |
| Contact Enrichment | Name, title, and company retrieved from Apollo.io to provide context about meeting attendees. No bulk data is imported. | Azure (US regions), via Apollo.io |
| Push Subscriptions | Web Push endpoint stored to deliver calendar update notifications. No content data is included in push payloads. | Azure (US regions) |
3. Chrome Extension Permissions
| Permission | Why |
|---|---|
| identity | Google OAuth sign-in |
| sidePanel | Display cue cards alongside your meeting |
| storage | Save local settings, auth tokens, and connector state |
| tabs | Detect active meeting tabs (Google Meet, Zoom) and detect LinkedIn profile pages when the LinkedIn connector is enabled |
| notifications | Calendar reminders for upcoming meetings |
| scripting | Dynamically inject a content script on LinkedIn profile pages when the LinkedIn connector is enabled by the user |
| linkedin.com (optional) | Requested only when you enable the LinkedIn connector. Allows capturing profile data from LinkedIn pages you visit to enrich meeting attendee context. |
4. How We Use Your Data
- Generate real-time cue cards during your conversations
- Build a learning profile to improve coaching over time
- Provide session summaries and post-call analysis
- Authenticate you and manage your account
We do not sell your data. We do not use your data to train AI models.
5. Third-Party Services
- Azure OpenAI — processes transcripts for reasoning and cue generation. Data is processed in the US and is not used by Microsoft to train models.
- Nango — OAuth proxy for CRM connectors (Salesforce, HubSpot). Nango does not store your CRM data.
- Google APIs — authentication, read-only
calendar access, and exporting your call data to a Google Sheet in
your Drive (via the
drive.filescope, limited to files wingscript creates) over OAuth 2.0. - Apollo.io — contact enrichment for meeting attendee context. Only name, title, and company are retrieved.
- Google Drive — document sync via Nango for knowledge base content used in meeting preparation.
- Notion — document sync via Nango for knowledge base content used in meeting preparation.
6. Data Storage & Retention
- Data is stored in Azure PostgreSQL in US regions.
- Session transcripts and cue history are retained for your account history. You can delete them at any time.
- Calendar data is cached temporarily and refreshed periodically.
- Audio is never stored — it is transcribed on-device and discarded immediately.
7. Your Rights
All Users
- Access: Request a copy of your data.
- Deletion: Request deletion of your account and all associated data.
- Portability: Export your session history.
California Residents (CCPA)
You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.
EU/EEA Residents (GDPR)
You have the right to access, rectify, erase, restrict processing, and port your data. Our legal basis for processing is legitimate interest (providing the service you signed up for) and consent (where required).
8. Security
- All data in transit is encrypted via TLS.
- Audio never leaves your device — privacy by design.
- Secrets are managed via Azure Key Vault with managed identity access.
- Authentication uses self-signed HS256 JWTs with short expiration.
9. Changes to This Policy
We will update this page when our practices change. The effective date at the top reflects the most recent revision. Material changes will be communicated via email to registered users.
10. Google API Limited Use Disclosure
wingscript's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
As a Chrome extension, wingscript's handling of this data also adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.
Specifically, data obtained from Google APIs (your Google profile information, calendar events, and the Google Sheets files wingscript creates in your Drive when you export call data) is:
- Used only to provide and improve wingscript's core functionality (authentication, meeting context, and real-time coaching cues).
- Not sold to third parties.
- Not used for advertising or ad targeting.
- Not used for creditworthiness determinations or lending purposes.
- Not shared with third parties except as necessary to provide the service (e.g., Azure OpenAI for transcript analysis).
Human access to Google API data is limited to debugging issues at your request, investigating security incidents, or complying with legal obligations.
11. Children's Privacy
wingscript is intended for use by business professionals. We do not knowingly collect Personal Data from children under the age of 18. If you are under 18, do not use wingscript or provide any information through the extension or web application. If we learn that we have collected Personal Data from a child under 18, we will delete that information promptly. If you believe we may have collected data from a child under 18, please contact us at support@wingscript.com.
12. Contact
For privacy questions or data requests, contact us at support@wingscript.com.