Privacy Policy
Effective from
1. Scope and data controller
- This policy applies to the Transcora Chrome extension and the Transcora website, together referred to as the service.
- Controller and processor of personal data: Tăng Ái Quốc, an individual providing the service in Vietnam. Contact: tang.ai.quoc123@gmail.com.
- This policy is a notice on the processing of personal data under Vietnamese law on personal data protection. Users read the policy before signing in; signing in constitutes consent to the processing activities set out in section 5.
2. Data collected by Transcora
| Group | Data | Source |
|---|---|---|
| Account | Google account identifier, verified email, name, avatar URL; display name as edited by the user | Google at sign-in; the user |
| Meeting transcript | Caption text, speaker names as displayed by Google Meet, timestamp of each utterance, meeting room code, meeting start and end times, meeting title (when available) | The extension reads the Google Meet caption panel |
| Chat messages in the meeting | Sender name, content and send time of messages shown in the Google Meet chat panel while the extension is recording; stored with the transcript and deleted when the transcript is deleted | The extension reads the Google Meet chat panel |
| AI summary | Meeting summary content and creation time; stored with the transcript and deleted when the transcript is deleted | AI feature, generated when the user selects Summarize |
| Device | Browser name and operating system (for example "Chrome on Windows"), sign-in time, last-used time | Extension at sign-in |
| Usage | Number of meetings created and AI summaries used in each quota period | System |
| Plans and orders | Current plan and expiry date; for each order: order code, plan, period, amount, status, creation time and payment time | The system, when the user buys a plan |
| Payment transactions | Amount, transfer description (as entered at the payer's bank, may include the payer's name), transaction ID, bank reference code, transaction time | Sent by SePay when the receiving account has a transaction |
Transcora does not collect:
- Audio, video or screen content of the meeting.
- The content of Gmail, Google Drive, Google Calendar or other Google data beyond email, name and avatar.
- Data on websites other than meet.google.com.
- Card details, bank passwords or authentication codes, and the payer's account balance. Apart from the fields SePay sends with a transaction listed in the table above, the system does not receive the payer's bank account information.
- IP address: the Transcora system does not read or store IP addresses. Cloudflare processes IP addresses at the network layer under Cloudflare's own policy.
3. How the extension works during a meeting
- When the user enters a Google Meet room and the "Auto-record meetings" switch is on (on by default), the extension turns on Meet captions if they are off and hides the caption panel from the user's screen.
- When recording starts, the extension posts the sentence "This meeting is being transcribed by Transcora." to the meeting chat so that participants are informed.
- The extension icon shows a REC badge while the tab is recording.
- Caption utterances and chat messages are buffered on the user's device and sent to the server in batches of about 30 seconds; the data is deleted from the device once the server confirms receipt.
- The system creates an AI summary only when the user clicks Summarize.
4. Extension permissions
| Permissions | Purpose |
|---|---|
storage | Save the auto-record switch, device token and per-tab recording state on the device |
alarms | Schedule sending of caption and chat batches and resend on network errors |
identity | Open Google sign-in window |
meet.google.com | Read the caption panel, read messages in the chat panel and post a notice message to the chat panel |
| Transcora server address | Send caption sentences and chat messages to the server |
5. Purposes and legal bases for processing
| Purpose | Data | Legal basis |
|---|---|---|
| Sign in, manage your account and devices | Account, devices | User consent when signing in |
| Display, search, filter, download and delete transcripts for the user themselves | Meeting transcripts, chat messages | User consent when turning on recording |
| Generate AI summary | Meeting transcripts, chat messages, AI summaries | User consent each time Summarize is selected |
| Calculate quotas, sell plans, confirm payments, handle mismatched transfers | Usage, plans, orders and payment transactions | Perform the plan purchase agreement under the Terms of Service |
| Keep records for invoices, revenue reporting and tax filing | Plans, orders and payment transactions | Obligations under accounting and tax regulations |
- Only the owner can view each transcript and summary. Admins view orders and payment transactions to confirm payments and handle mismatched transfers.
- Transcora does not sell data and does not use data for advertising.
6. AI features
- AI features run on the infrastructure of the hosting provider listed in section 7; data is not used to train models. When the user selects Summarize, the transcript and chat messages of that meeting are sent to the AI feature to generate the summary.
- Content sent to AI features is not used to train AI models, including by Transcora.
- Summaries are generated automatically and may be incomplete or inaccurate; they are not used to evaluate or make decisions about users or meeting participants.
- A user who does not want to use AI features should not select Summarize; the transcript remains fully usable for other functions. A generated summary is deleted together with its transcript.
7. Data recipients and processors
Transcora sends data only to the following parties, within the scope needed for each task:
| Party | Tasks | Data |
|---|---|---|
| Verify sign-in | Sign-in credentials are provided by the user directly to Google | |
| Cloudflare | Server, database, storage and AI features | All data in section 2 |
| SePay and the receiving bank | Receive transfers and report transactions to the system | Payment transactions |
| VietQR image generation service | Generate the VietQR image shown on the payment page | Receiving account number, amount and order code; excludes email and user name |
Transfer information is provided by the payer to their own bank and is processed under that bank's policy. Transcora provides data to competent state authorities when required by law.
8. Storage location and cross-border data transfer
- Data is stored on the infrastructure of Cloudflare, Inc. (United States): servers run on the Cloudflare network, the database is located in the Asia-Pacific region; AI features run on Cloudflare infrastructure. The servers that process data may be located outside Vietnam.
- Storing and processing data on this infrastructure constitutes a cross-border transfer of personal data under Vietnamese law. Users are informed of this before signing in.
- The connection between the extension, the website and the server uses HTTPS.
9. Retention period
| Data | Validity |
|---|---|
| Meeting transcripts, caption utterances and chat messages | Until the user deletes it, regardless of the current plan |
| AI summary | Until the user deletes the transcript |
| Account and usage | Until the user requests account deletion (section 10) |
| Website sign-in session | Deleted automatically after 30 days of non-use; deleted immediately on sign-out |
| Devices and device tokens | Until the user revokes it, signs out in the extension, or the account exceeds 10 devices (the least recently used device is removed) |
| Code that transfers sign-in from the extension to the website | 60 seconds, single use |
| Orders and payment transactions | 10 years from the year the transaction occurred, in accordance with accounting and tax record retention regulations; when an account is deleted, orders and transactions are kept separately from the account until the end of the retention period |
| Operations logs on Cloudflare | Cloudflare Workers Logs deletes logs automatically after at most 7 days. Logs do not contain caption content, speaker names or email addresses |
10. User rights
| Permissions | How |
|---|---|
| Right to be informed about data processing | Read this policy; ask further questions through the contact email |
| View data | View transcripts, summaries, plans, orders and devices on the website; request a copy of account data by email |
| Edit data | Edit the display name on the website; other data is corrected on request by email. Email, name and profile picture are taken from the Google account |
| Export data | Download each transcript as Markdown on the website |
| Delete data | Delete each meeting on the website. Deletion is permanent and includes all caption lines, chat messages and AI summaries of the meeting; deletion does not restore quota already used in the quota period |
| Withdraw consent, restrict or object to processing | Turn off the "Auto-record meetings" switch, do not select Summarize, revoke the device, sign out, uninstall the extension or request account deletion. Withdrawing consent does not affect processing already carried out |
| Delete account | Send an email to tang.ai.quoc123@gmail.com from the email address of the account. The request is processed within 20 days of receiving the email, and the result is sent back by email. Orders and payment transactions are retained under section 9 |
| Complaints, denunciations and lawsuits | Send complaints to the contact email; users have the right to complain to the competent state authority in accordance with the law |
Requests sent by email are verified against the account's email address before being carried out.
11. Meeting participants
- A transcript contains the speech and messages of other participants in the meeting. The user who turns on recording is responsible for notifying the other participants and obtaining their consent in accordance with applicable law (Terms of Service, section 9).
- A participant who does not use Transcora and wants to make a request about their data in a transcript should contact the person who recorded the meeting, or email tang.ai.quoc123@gmail.com with the time and the meeting room code.
12. Security
- The session cookie is set with the HttpOnly, Secure and SameSite=Lax flags.
- The server stores only the SHA-256 hash of the session, device token and sign-in transfer code, not the original values.
- Google sign-in uses PKCE and verifies the ID token signature against Google's public keys.
- When a personal data breach is detected, the controller notifies affected users by email and reports to the competent authority as required.
13. Changes to this policy
When this policy changes, the content of this page and the effective date at the top of the page are updated. Changes to the types of data collected, the purposes of processing or the recipients of data are announced on the website before they apply.
14. Contact
Send questions and data requests to tang.ai.quoc123@gmail.com.
15. Chrome Web Store and limited use
Use of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
- User data that the extension receives (captions, chat messages, account information) is used only to provide the meeting recording function and to create transcript summaries.
- Transcora does not sell user data and does not transfer it to third parties, except the parties listed in section 7 for operating the service, and where necessary to comply with the law or handle a security incident.
- User data is not used for advertising, or to determine creditworthiness or for lending.
- Humans do not read user data, unless the user consents for specific data, it is necessary for security purposes such as investigating abuse, or it is required by law.
- When the user clicks Summarize, the transcript and chat messages of that meeting are processed by the AI feature running on Cloudflare infrastructure (sections 6 and 8); the data is not passed to any other model provider and is not used to train models.
- Data between the extension, the website and the server is transmitted only over HTTPS connections.