Privacy policy

Last updated: October 18, 2026

This Privacy Policy explains what personal information Lingrow processes, why, with whom it shares it, how long it retains it and what rights you have.

No model training: Session Content is not used to train or fine-tune AI models. Deleted at session end: transcripts and translations are deleted when the conversation ends. No recording archive: audio is processed in real time and is not retained as a recording. No sale of information: Session Content is not used for advertising or behavioural advertising.

1. Who We Are and What This Policy Covers

The Service is operated by Simultaneous in the Air Ltd., company no. 512885161, 18 Katzenelson Street, Kiryat Ono (“Lingrow”, the “Company” or “we”).

This Policy applies to:

• Customers — organizations that contract with Lingrow, and their account administrators and sub-users (“Authorized Users”).
• Participants — people who join a session at a Customer’s invitation through a QR code, link or room code, without registering.
• App users — people who use the Lingrow app for iOS or Android. The app operates with an access code issued by the Customer.
• Visitors to lingrow.org and the lingrow.live platform, and people who contact us through a form, by email or through the “Arik” support agent.

The Service is intended for business and organizational use. It includes simultaneous translation, transcription, captions, speech synthesis, AI summaries and comprehension quizzes.

2. Who Is Responsible for the Information

• Session Content and Participant details (audio, transcripts, translations, summaries, quizzes and answers, organizational glossary): the Customer that ordered the session is the controller; Lingrow processes the information on the Customer’s behalf and according to its instructions.
• Authorized User account details, billing, support inquiries, technical information and website data: Lingrow is the controller.

Session Participants: the Customer that invited you determines the purpose of the session and what is done with its Outputs, and is therefore the first point of contact for questions about your information. If you contact us, we will forward the request to the Customer.

Customers that provide personal information about employees, trainees, patients or students sign a Data Processing Agreement (DPA), which includes the information security measures and the list of sub-processors. In the event of a conflict, the DPA prevails over this Policy.

3. What Information We Process

We process the information needed to provide, operate and secure the Service:

• Account details: organization name, display name, access code and email address; for the organization’s contact person: name, email, telephone number and role. Source: Customers and Authorized Users.
• Participant details: a display name entered by the Participant or assigned by the organization, and selected language. A full name, telephone number, email address or ID number is not required. Source: Participants.
• Audio: speech in the session, transmitted in real time for speech recognition, translation and synthesis. Source: anyone who speaks in a session.
• Session Content: transcripts, translations, captions, AI summaries, comprehension quizzes, answers and scores, and organizational glossary terms. Source: generated from the session.
• Recipients: email addresses to which summaries and reports are sent, and the message content. Source: Authorized Users.
• Usage and billing data: session times, usage meter, usage by sub-user, room settings and billing details. Source: generated from use.
• Device data: installation identifier, push-notification token and routing data for app features. Source: app users.
• Support inquiries: contact details and inquiry content, including conversations with the “Arik” support agent. Source: people who contact us.
• Technical information: IP address and an approximate location derived from it (country or region), device and browser type, and operational and security logs. We do not collect precise location and do not use advertising identifiers. Source: all users.
• Website data: contact-form details (name, company, email, area of interest) and cookies. Source: website visitors.

We do not request sensitive information. Participants may nevertheless say sensitive things during a session, such as medical information in a care setting. See Section 11.

You are not legally required to provide us with information. However, without certain information, such as account details or the audio to be translated, we cannot provide the Service.

4. Why We Use Information

• Providing the Service — translation, transcription, captions, speech synthesis, summaries, quizzes and sending summaries at an Authorized User’s request. Information: Session Content, session data and Participant language. Basis: performance of the agreement with the Customer and its instructions.
• Managing the account, permissions, usage meter and hour bank. Information: account and usage data. Basis: performance of the agreement.
• Billing and collection. Information: billing details. Basis: performance of the agreement and legal obligations (tax and accounting).
• Support and service notices. Information: support inquiries and account details. Basis: performance of the agreement and legitimate interest.
• Security, abuse prevention and enforcement of the Terms. Information: technical information and logs. Basis: legitimate interest and legal obligations.
• Improving the Service. Information: aggregate data that does not identify a Customer or person. Basis: legitimate interest (not Session Content — see Section 5).
• Business updates and marketing communications to business contacts. Information: business contact details. Basis: consent, which may be withdrawn at any time.
• Legal compliance and dispute management. Information: as needed. Basis: legal obligations and protection of rights.

What we do not do: we do not sell personal information, use Session Content for advertising, or use it for behavioural advertising.

5. Artificial Intelligence

We do not train models on Session Content. Lingrow does not use audio, transcripts, translations or summaries to train or fine-tune AI models. Organizational glossary terms are handled separately, as described below. AI providers process information to provide the Service and, under their API terms, do not use it to train their models.

No voiceprints: we do not create voiceprints or identify people by their voice. The transcription provider may distinguish among speakers within a session to transcribe correctly; this is not identification of a person.

No recording archive: audio is processed in real time and is not retained as a recording in Lingrow’s system. Sub-processors may retain information for a limited time under their terms, for example up to 30 days for abuse monitoring.

Organizational glossary: glossary terms are used to adapt transcription and translation to the Customer’s terminology. Lingrow also uses them to improve translation quality across the Service, not only in that Customer’s account, without identifying the Customer.

Automated Outputs: transcripts, translations, summaries and quizzes are generated automatically and may contain errors. The Service does not make decisions about people. Use of identified quiz results, for example for training purposes, is the Customer’s responsibility.

Not a monitoring tool: the Service is intended for communication, not employee surveillance. Authorized administrators can view usage data by sub-user to manage permissions and quotas. When comprehension quizzes are enabled, they can also view answers and scores by Participant. The Customer is responsible for notifying Participants and using this information lawfully, including under employment and privacy laws.

Conversations with “Arik”: content you type to Arik is sent to an AI provider to generate a response. Do not provide Arik with passwords, access codes or sensitive information.

6. With Whom We Share Information

Within the Customer’s organization: account administrators and, in some room types, Participants may view and export Session Content according to their permissions. A report sent by email reaches addresses set by the Authorized User and may include a summary, full transcript and quiz results by Participant.

We share information only with sub-processors required to provide the Service, and only to the extent necessary:

• Cloud infrastructure and storage — platform and database hosting in the Netherlands.
• Language and AI processing — speech recognition, translation, speech synthesis, summaries, comprehension quizzes and the “Arik” support agent. Processing takes place in the Netherlands, the United States and providers’ global infrastructure.
• Email and notifications — sending summaries, reports, service notices and app notifications. The notification service receives routing data only, without audio or transcripts.
• Website services — fonts, the contact form (submissions are retained by the provider for up to 30 days) and loading website components.

The list of sub-processors is available to Customers under the DPA. We will give Customers that signed a DPA at least 30 days’ advance notice before adding or replacing a provider that processes Session Content.

We will disclose information to authorities only when required by law and, where permitted, will notify the Customer in advance.

In a merger, acquisition, financing or transfer of the business to another company, including a new company formed to operate Lingrow, we may disclose information to involved parties, including during due diligence and subject to confidentiality obligations. If the business is transferred, the information will be transferred to the recipient, which will be subject to this Policy.

7. Transfers of Information Outside Israel

Information is processed outside Israel: the cloud infrastructure is in the Netherlands, and some AI processing takes place in the United States and providers’ global infrastructure.

Transfers are made in accordance with the Israeli Privacy Protection Regulations (Transfer of Data to Databases Outside the State’s Borders), 5761–2001, and subject to providers’ contractual commitments. For Customers subject to the GDPR or another foreign law, we will enter into an appropriate transfer mechanism where needed, such as Standard Contractual Clauses (SCCs).

8. How Long We Retain Information

Transcripts and translations are deleted at the end of each session; other information is retained as follows:

• Audio: not retained as a recording in Lingrow’s system; processed in real time only.
• Transcripts, translations and conversation history: retained only during the session for display to Participants, reconnection continuity and export. Deleted when the conversation manager clicks “End Conversation”, automatically after eight consecutive hours without speech, or 15 minutes after the room becomes empty.
• Comprehension quiz results (answers and scores): retained separately from the transcript while the account is active; not deleted at the end of the session.
• Room settings: while the account is active, for reuse.
• Organizational glossary terms: in the Customer account while active; for Service improvement, also retained after the engagement ends, without identifying the Customer.
• Usage data: while the account is active.
• Account details: for the engagement period and three months thereafter.
• Billing records: seven years, as required by tax law.
• Conversations with “Arik”: not retained in Lingrow’s database. The question and limited context are sent to the AI provider to generate a response (Section 5).
• Email support inquiries: for the period needed to handle the inquiry and continue providing the Service.
• Operational and security logs: for the period needed to operate and secure the Service and comply with legal obligations.

At the end of the engagement, and upon the Customer’s written request, we will delete the Customer information remaining in our systems within 30 days. Backup copies will be deleted in the ordinary backup cycle and no later than 90 days, except for information that the law requires us to retain.

Instead of deleting information, we may anonymize it so that it no longer identifies a person or Customer and use it in that form to operate and improve the Service.

What ending a session does not delete

• Files that were downloaded or shared and summaries sent by email, including copies in the mailbox from which Lingrow sends them and in recipients’ mailboxes.
• Information retained by sub-processors under their terms (Section 5).
• Database backups, until deleted in the ordinary backup cycle.

Deletion is performed through an automated cleanup process. Anyone who needs Session Content must export it before ending the conversation.

9. Information Security

We protect information through technical and organizational measures, including:

• Public traffic encryption over HTTPS and WSS using TLS 1.2 or higher, and an encrypted internal network between the server and database.
• Logical separation between Customers by organization identifier.
• Role-based permissions, personal access codes, room locking and removal of sub-user access.
• System keys and secrets stored in environment variables outside the code.
• Filtering audio, transcripts, passwords and access tokens before recording information in system logs.
• Production-system access limited to authorized team members solely to provide and maintain the Service.

No system is completely immune. If a security incident occurs that affected or may have affected information, we will notify affected Customers without undue delay and no later than 72 hours after becoming aware of it, and report to the Israeli Privacy Protection Authority where required by law.

10. The App and Device Permissions

The app requests only permissions required for features you use:

• Microphone: to speak in a session.
• Camera: only to scan a QR code.
• Notifications: messages about sessions and app features.
• Background audio: to continue listening to the translation while the screen is locked during an active session.

The app does not request access to precise location or contacts. Permissions can be revoked in device settings, but some features will not work without them.

Files you export or receive by email are stored on your device or in your mailbox, and are your responsibility.

11. Minors and Sensitive Information

Minors: the Service is intended for organizations and not for minors to open accounts. Minors may participate in a session only when invited by a Customer, such as an educational institution. The Customer is responsible for giving notice and obtaining parental consent where required by law.

Sensitive information: the Service is not a medical-record management system. We ask Customers to minimize sensitive information spoken during sessions. In the United States, Protected Health Information under HIPAA must not be processed through the Service without a Business Associate Agreement (BAA) signed with Lingrow.

12. Your Rights

Under the Israeli Privacy Protection Law, 5741–1981, you may review information about you and request correction of inaccurate information or deletion. Depending on your location and applicable law, you may have additional rights, such as restriction of processing, objection, data portability and withdrawal of consent.

To exercise a right, contact us using the details in Section 13. We will respond within the time limits required by law.

Before handling a request, we may ask for details to verify your identity. We may deny all or part of a request where the law requires us to retain the information, where it is needed to secure the Service or protect rights, or where the request is vexatious or unreasonably repetitive. If we deny a request, we will explain why.

A request concerning Session Content will be forwarded to the Customer that invited the session, which is the controller, and we will assist it in handling the request. Most Session Content is deleted at the end of the session, so information may no longer remain for review.

You may also submit a complaint to the Israeli Privacy Protection Authority.

13. Cookies, Changes and Contact

Cookies: the platform uses only essential cookies and local storage to keep you signed in and remember “Remember me”, interface language and room settings. Without them, the Service will not operate properly. On the website, cookie use is described in the Cookie Policy. We do not use advertising cookies.

Website analytics supplement — November 8, 2026: with your analytics consent, we use Google Analytics 4, provided by Google, to measure visits, coarse traffic sources, devices/browsers, section views, demo clicks, video interactions and successful inquiries. No names, company names, email addresses or form contents are sent. Google processes technical information such as IP addresses; this collection is not anonymous. Processing may occur outside Israel and the EEA, including the United States; appropriate contractual transfer safeguards are required. _ga and _ga_* cookies last up to 365 days without renewal in this configuration. Withdraw anytime through Cookie Settings: withdrawal stops future collection and deletes these cookies, but does not delete previously collected data. For rights requests, contact privacy@lingrowapp.com. Advertising features are disabled. GPC and Do Not Track disable analytics on this website.

Google Privacy Policy

Changes to this Policy: we will update the Policy when the Service or law changes. We will give Customers at least 14 days’ advance notice of a material change. The last-updated date appears at the top.

Privacy Officer — privacy, exercise of rights and security reports: privacy@lingrowapp.com

Support: support@lingrowapp.com

Mail: Simultaneous in the Air Ltd., 18 Katzenelson Street, Kiryat Ono, Israel.