Privacy Policy

Effective Date: Jun 12, 2026

---

Scope of this Privacy Policy

This Privacy Policy explains how we handle personal data collected when you access or use our Services. “Personal Data” refers to any information that directly or indirectly identifies, relates to, describes, or can be reasonably linked to an individual, including information commonly referred to as “personally identifiable information” or “personal information” under applicable privacy laws and regulations.

This Privacy Policy does not apply to the data practices of entities that we do not own or control, or to individuals who are not employed or managed by us.

---

Personal Data We Collect

Categories of Personal Data Collected

To operate, maintain, and continuously improve our Services, we collect the following categories of personal data:

Audio Recording Consent Responsibility

Pastok records only when you manually start recording. Recordings may include nearby voices. You are solely responsible for ensuring that your use of audio recording features complies with applicable local, state, or national laws, including those requiring the consent of all parties to a recording. Pastok does not monitor, access, or control your real-time use of recording features and cannot determine whether your use complies with applicable consent requirements. By using any audio capture features of the Services, you represent and warrant that you have obtained all legally required consents from individuals whose voices may be recorded.

Pastok provides an in-app disclosure explaining processing providers and asks for permission.

Sources of Personal Data

We collect Personal Data from the following categories of sources:

1. You (the User)

We collect Personal Data you voluntarily provide or generate through your use of the Services, including:

• When you register for an account (e.g., name, email, authentication credentials).
• When you interact with our Services or submit information through forms, surveys, or questionnaires.
• When you send communications to us, such as emails or support requests.
• When you enable specific integrations (e.g., calendar, reminders, photos, contacts), subject to your consent.
• When you use the Services, and certain data is collected automatically, including:
  • Device and usage information.
  • Audio input and related metadata.
  • Location data (if you grant permission).
  • Cookies and tracking technologies (described below in “Tracking Technologies and Opt-Out”).

2. Your Devices

When you install and run our software or applications, we may automatically collect data from your device to support core functionality, such as:

• Device state and connectivity (e.g., whether you are online to receive updates).
• Operating system and environment data.

3. Third Parties

We may receive your Personal Data from trusted third-party sources, including:

• Vendors and Service Providers
  For example, analytics providers may supply aggregated interaction data; customer support tools may log chat records and tickets.
• Third-Party Accounts and Authentication Services
  If you log in or link your account using a third-party service (e.g., Google or Apple), we may receive associated identifiers, tokens, and basic profile data, subject to the scope of access you grant during the login process.

---

Purposes for Collecting and Using Personal Data

We collect, use, and disclose your Personal Data for various commercial and business purposes, including:

1. Providing, Customizing, and Improving the Services

• Creating and managing your account or user profile(s).
• Processing recordings and transcripts to generate transcripts, summaries, reminders, searchable memory, or content you request.
• Processing transactions, including payments and billing.
• Delivering the products, services, or information you request.
• Fulfilling the purpose for which the information was provided.
• Providing technical and customer support.
• Enhancing the quality and functionality of the Services through testing, internal research, analytics, and product development.
• Personalizing content, features, and communications according to your preferences and behavior.
• Detecting and preventing fraud, abuse, security threats, and debugging errors.
• Supporting any other business purposes that are compatible with the context in which the data was collected, or as required or permitted under applicable laws (including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)).

2. Marketing and Advertising

• Marketing, promoting, and selling our Services to you, subject to your consent where required.
• Sending you communications about new features, updates, promotions, and other marketing content in line with your notification preferences.

3. Communicating with You

• Responding to your inquiries or requests.
• Sending you operational or administrative messages.
• Contacting you for feedback, updates, or service-related matters.

4. Legal Compliance and Enforcement

• Complying with applicable legal obligations, including laws, regulations, court orders, or subpoenas.
• Investigating and preventing potentially fraudulent, harmful, or unlawful activity.
• Protecting the rights, property, and safety of you, us, or others.
• Enforcing our agreements and resolving disputes.
• Responding to legal claims, including allegations of third-party rights violations.

5. Optional Long-Term Retention for Quality and Performance Improvement

We may offer you the choice to opt in to allow Pastok to retain certain voice recordings for a longer period in order to improve the quality, accuracy, and overall performance of our services. This extended retention applies only when you provide explicit consent within the app and is not required to use the core service.

Voice recordings retained under this optional consent are used solely for quality and performance improvement. You may withdraw consent at any time through the in-app Settings page. Upon withdrawal, we will delete any recordings held only for this purpose within a reasonable processing window.

---

How We Disclose Your Personal Data

We may disclose your Personal Data to the following categories of recipients, as necessary to operate our business and provide the Services:

1. Service Providers

We engage trusted third-party vendors to support our operations. We require these providers to protect Personal Data using appropriate safeguards and to process it only for the services they provide to Pastok or as otherwise permitted by applicable law. These include:

• Cloud infrastructure providers, including Amazon Web Services (AWS), which we use to host and operate parts of our Services.
• Transcription providers, including Microsoft Azure AI Speech / Speech-to-Text, which may process audio from recordings you start to generate transcripts.
• Pastok-operated transcription infrastructure, including our self-hosted SenseVoice service running on AWS infrastructure, which may process recordings to generate transcripts.
• AI providers, including Anthropic, OpenAI and Gemini, which may process transcripts and user prompts to generate summaries, reminders, searchable memory, chat-based recall, and other content you request.
• Analytics, diagnostics, security, and support providers, including Firebase and Google Analytics, which help us monitor performance, improve reliability, protect accounts, and maintain the Services.
• Payment processors, including Apple for App Store In-App Purchases. Payments are processed directly by Apple. We do not store your payment card details. We may share limited transaction or service usage information with Apple to validate purchases, process refunds, prevent fraud, or comply with App Store requirements. Apple’s processing is governed by Apple’s Terms and Conditions and Privacy Policy.

2. Analytics and Measurement Partners

These partners help us understand how users interact with our Services:

• Platforms that analyze traffic sources, usage behavior, or conversion data.
• Tools for monitoring product performance and engagement.

3. Third Parties You Authorize or Integrate With

We may disclose your information to third parties when you:

• Authenticate or link your account via third-party platforms (e.g., Google, Apple).
• Explicitly authorize sharing (e.g., calendar, contacts, reminders).
• Interact with other users within our Services.

4. Legal Requirements

We may share your Personal Data where necessary to:

• Comply with legal obligations.
• Enforce legal rights or defend against legal claims.
• Assist law enforcement or public authorities, where permitted by law.

5. Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your Personal Data may be transferred to a successor or acquiring entity. In such cases, we will take reasonable steps to ensure the security of your data and provide you with notice before your data is subject to materially different privacy practices.

---

Data That Is Not Personal Data

We may create aggregated, de-identified, or anonymized data derived from the Personal Data we collect. This process involves removing or modifying information such that it cannot reasonably be used—whether alone or in combination with other data—to identify an individual.

We may use such data for any lawful business purpose, including but not limited to:

• Analyzing usage trends and user behavior,
• Improving the functionality and performance of our Services,
• Developing new features or offerings,
• Generating business intelligence or marketing insights.

We may also share this non-personal data with third parties, provided that:

• It does not include information that can reasonably be linked back to you, and
• We implement appropriate technical and organizational safeguards to prevent re-identification.

For clarity, this type of data is not considered “Personal Data” under applicable privacy laws such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

---

Tracking Technologies and Your Choices

We may use certain tracking technologies within our mobile applications and related Services to enhance functionality, measure engagement, and improve performance.

These technologies may include:

• Mobile SDKs and App-based Analytics Tools
  We may incorporate third-party SDKs (software development kits), such as those provided by analytics or error tracking vendors, which function similarly to cookies by collecting usage data and device information (e.g., crash logs, session data, interaction events) directly from the mobile application environment.

• Authentication and OAuth Flows
  When you sign in using third-party providers (such as Google or Apple), limited web-based components may use tracking technologies to facilitate login, consistent with those providers’ own privacy and cookie policies.

• Device or App Identifiers
  We may use a device or installation identifier for analytics, crash reporting, and core app functionality. Pastok does not use Apple's Advertising Identifier (IDFA), does not link your data with third-party data for advertising or measurement, and does not share your data with data brokers.

We use these tools for purposes such as:

• Ensuring the secure and stable operation of our Services,
• Remembering your preferences and settings,
• Understanding how users engage with the app and improving usability,
• Measuring the effectiveness of in-app messages or feature experiments.

Your Choices

Depending on your device and operating system, you may be able to:

• Adjust your device or app settings to limit or block certain tracking tools (e.g., disabling background data, or opting out of analytics collection where we offer that control).
• Opt out of certain third-party tracking via system-level privacy controls provided by iOS or Android.
• Withdraw consent or change settings within the app if we implement a consent management interface (e.g., for EU users under GDPR or ePrivacy Directive).

For more information about controlling mobile app tracking, you can refer to:

• Google Play Help – Manage Ad Preferences
• Apple Support – Control Privacy Settings

Data Security

We take the security of your Personal Data seriously. We implement appropriate technical, organizational, and administrative safeguards designed to protect your data from unauthorized access, use, disclosure, alteration, or destruction. These safeguards are based on the nature of the data we collect and the risks associated with processing that data.

Examples of such measures may include:

• Encryption in transit and at rest,
• Access controls and authentication mechanisms,
• Security monitoring and vulnerability management,
• Employee access limitations based on role and necessity.

While we strive to use commercially reasonable means to protect your Personal Data, no method of transmission over the internet or method of electronic storage is 100% secure. You are responsible for maintaining the security of your account credentials and device.

Encryption and Its Limits

Your recordings, transcripts, and the content generated from them are encrypted in transit and at rest. They are not end-to-end encrypted, and we want to be direct about what that means.

End-to-end encryption means that only your own device holds the keys, and the service can never read your content. Pastok's core features — transcription, summaries, and search across past conversations — require our processing systems to read the audio and the text derived from it. A service cannot both read your content in order to process it and be unable to read it. Products that do offer end-to-end encryption therefore either do not apply AI to your content, or run that AI entirely on your own device.

Because we hold the encryption keys, we are technically able to access your content. We limit that access to authorized personnel and to specific circumstances: investigating a support request you have made, diagnosing a system fault or security incident, or complying with a valid legal process.

---

Data Retention

We retain your Personal Data only for as long as necessary to:

• Provide our Services to you,
• Fulfill the specific purposes for which the data was collected,
• Comply with our legal obligations, resolve disputes, and enforce our agreements.

Retention periods vary depending on the type of data and its intended use. For example:

• Account Information: Retained while your account is active and for a limited period thereafter to allow for reactivation or legal compliance.
• Voice Data: Retained for up to seven (7) days after upload for processing and service functionality. After this period, the recordings are automatically and permanently deleted. Audio data stored in the cloud is encrypted at rest and in transit, access-controlled, and deleted when you request it. Where you have opted in to extended retention under Section 5, recordings held under that consent are kept until you withdraw it or request deletion.
• Device and usage data: Retained to monitor system performance and ensure fraud protection.
• Payment data: Retained for as long as necessary to process transactions and meet legal or tax requirements.
• De-identified or aggregated data: May be retained indefinitely and used to improve our Services, including improving app reliability, analytics, and product performance, provided it cannot reasonably identify you. Pastok does not use recordings or transcripts to train AI models.

---

Personal Data of Children

Our Services are not intended for children under the age of 16. We do not knowingly collect or solicit Personal Data from anyone under 16 years old. If we learn that we have collected Personal Data from a child under 16 without verified parental consent, we will delete that data as soon as possible.

If you believe that a child under 16 may have provided us with Personal Data, please contact us at: [email protected].

Other State and International Privacy Rights

California Resident Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rights may include:

• The right to know what categories of Personal Data we have collected, used, disclosed, or sold.
• The right to request deletion of your Personal Data.
• The right to correct inaccurate Personal Data.
• The right to opt-out of the “sale” or “sharing” of Personal Data (as those terms are defined under California law).
• The right to non-discrimination for exercising your privacy rights.

We do not sell Personal Data for monetary value, but we may share data with certain service providers for business purposes. You may submit a privacy rights request by contacting us at [email protected].

Under California Civil Code § 1798.83, you may also request information about our disclosure of Personal Data to third parties for their direct marketing purposes. To make such a request, contact us at [email protected] with the subject “California Shine the Light Request.”

---

Nevada Resident Rights

If you are a resident of Nevada, you may request that we do not “sell” certain Personal Data to third parties (as defined under Nevada law). While we do not currently engage in “sales” of Personal Data as defined under Nevada law, you may submit a “do not sell” request by emailing us at [email protected] with the subject line “Nevada Do Not Sell Request.”

---

EU, UK, and Swiss Data Subject Rights

If you are a resident of the European Union (EU), United Kingdom (UK), Switzerland, Lichtenstein, Norway, or Iceland, you may have additional rights under the General Data Protection Regulation (GDPR) or the UK GDPR regarding your Personal Data, as described below.

In this section:

• “Personal Data” means any information relating to an identified or identifiable individual.
• “Processing” includes actions such as collecting, using, storing, or disclosing data.

Pastok acts as the data controller of your Personal Data in connection with the Services.

If there is any conflict between this section and other parts of this Privacy Policy, the provisions more protective of your Personal Data will prevail.

If you have any questions or wish to exercise your rights, please contact us at [email protected].

---

Personal Data We Collect

See the section “Categories of Personal Data We Collect” above for the types of Personal Data we collect from you.

---

How We Use Your Data and Legal Bases for Processing

See “Our Commercial or Business Purposes for Collecting Personal Data” above for details on our processing purposes.

We process Personal Data only when a lawful basis applies:

1. Contractual Necessity

We process the following categories of Personal Data to fulfill our contract with you (e.g. to provide the Services). Without this data, you may not be able to access certain features.

• Profile or Contact Data
• Payment Data
• Professional or Employment-Related Data
• Photos, Videos, and Recordings
• Other Identifying Information you voluntarily provide

Please note that raw voice recordings are retained for no more than 7 days and are automatically deleted thereafter. Processing beyond this period applies to the content derived from them, such as transcripts and summaries. That content remains associated with your account until you delete it, and is not anonymous.

2. Legitimate Interests

We process the following categories to serve our and third parties’ legitimate interests, including to improve services, ensure security, and market the Services:

• Profile or Contact Data
• Payment Data
• Device/IP Data
• Web Analytics
• Professional or Employment-Related Data
• Photos, Videos, and Recordings
• Other voluntarily provided information

We may also de-identify or anonymize data for these purposes.

3. Consent

We rely on consent where required before sending recordings or transcripts to third-party or cloud-based AI processing services. In certain cases, we rely on your explicit consent—such as when you grant permission to access photos, calendar, reminders, or record audio. You may withdraw your consent at any time (see below).

4. Legal Obligations and Vital/Public Interests

We may also process your data to comply with legal obligations, protect vital interests, or carry out tasks in the public interest.

---

How We Share Your Data

See the section “How We Share Your Personal Data” for information on third-party disclosures.

---

Your GDPR Rights

You have the following rights under applicable data protection laws:

Access

You may request confirmation of whether we process your Personal Data and obtain a copy of it.

Rectification

If you believe any data we hold is inaccurate or incomplete, you may request corrections.
Note: Transcript records cannot be altered after generation, but you may modify the summaries associated with them.

Erasure

You may request deletion of your Personal Data. Certain data can be deleted directly within your account settings.

Withdraw Consent

If processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal. However, withdrawing consent may limit your ability to use some features.

Data Portability

You may request a copy of your Personal Data in a machine-readable format or ask us to transfer it to another controller, where technically feasible.

Objection

You may object to further processing of your Personal Data, particularly for direct marketing.

Restriction

You may request that we restrict processing of your data in certain cases (e.g. if accuracy is contested or processing is unlawful).

Right to File a Complaint

You have the right to lodge a complaint with the data protection authority in your country of residence.
A list of EU supervisory authorities is available here.

---

Transfers of Personal Data

Our Services are hosted and operated in the United States (“U.S.”). Regardless of your location, any Personal Data you provide to us, or that we obtain from third parties, may be transferred to, stored, and processed in the U.S. or other countries where our service providers are located.

For example, Pastok may use:

• Microsoft Azure AI Speech / Speech-to-Text in the United States, including the Azure eastus region, to process audio streams or audio chunks for transcription.
• Amazon Web Services (AWS) infrastructure in the United States, including the AWS us-west-2 region, to host parts of our Services, store and process data, and operate Pastok-managed infrastructure.

By using the Services, you acknowledge and agree that:

• Your Personal Data will be transferred to the United States;
• You authorize us to transfer, store, and process your information in the U.S. and other countries as necessary;
• We will take appropriate safeguards in accordance with applicable laws—such as entering into data processing agreements incorporating Standard Contractual Clauses—to ensure your data receives adequate protection.

---

Contact Information

If you have any questions or comments about this Privacy Policy, how we collect and use your Personal Data, or your rights regarding your data, please do not hesitate to contact us at:

pastok.com [email protected] 10 ANSON ROAD #11-20 INTERNATIONAL PLAZA SINGAPORE

---

Thank you for trusting Pastok to protect your privacy.