EYRO Privacy Notice

Version 1.1

Effective date: 6 October 2026
Publication URL: https://www.eyro.co.uk/legal/privacy

Scope and key information

EYRO's included Efficient speech option uses the Moonshine Medium Streaming English INT8 model to process audio locally on your computer's CPU while you speak. Dictionary functions, Notebook, local writing review and local AI Context organisation also run on your computer. These features do not send your audio or writing to CAWOSH, Moonshine AI or Microsoft for processing.

Paid licensing, purchases, licence-email delivery, support and website operation involve limited personal information. Optional web-search, custom-website, ChatGPT and Claude destinations are different from local processing: when you choose them, your text is passed to the selected service or application, which may process it online. An exported context file can also be shared by you.

We do not sell your personal information or use your dictated content to build an advertising profile. This notice is information about processing, not a request for blanket consent.

Who is responsible

CAWOSH LTD is responsible as controller for the personal information it processes to operate EYRO and the associated licence service, website and support. Other providers may be responsible separately for their own services.

Contact us using that email or postal address for privacy questions. CAWOSH LTD appears on the Information Commissioner's Office register of fee payers under reference ZB983718. Registration is a fee-register entry, not certification or approval of EYRO or CAWOSH's privacy practices. The live ICO register provides the current registration details.

Information processed on your computer

The included Moonshine Medium Streaming English INT8 model runs locally through Moonshine Voice and ONNX Runtime. EYRO processes microphone audio incrementally while you speak and keeps a complete local recording until the dictation attempt completes so that it can recover if streaming fails. It then intends to discard that recording. Provisional streaming text stays inside EYRO and is not inserted into another application before final completion. If Moonshine cannot complete after its recovery attempt, EYRO can use the bundled local Whisper recovery model. A later dictation can try Moonshine again.

Ordinary local features also process final transcripts, saved history, notes, dictionary entries, selected writing, preferences, hardware calibration results and local usage measurements. CAWOSH, Moonshine AI and Microsoft do not receive that material merely because these local components are used.

Depending on the processing or recovery path, temporary recording files may be used and are intended to be removed after transcription. An interruption or system crash can leave local files requiring cleanup. Saved transcripts and notes can remain after you finish a dictation or close EYRO. Other people or software with access to your Windows profile, clipboard, files, backups or synchronised folders may be able to access them.

The optional Build my context feature keeps a separate encrypted local AI Context vault. Enabling it may include existing dictated notes as described in the app, as well as future eligible dictations. This is not a claim that all history, notes, logs or exported files are encrypted. Clearing the context vault does not necessarily remove separate transcript history, Notebook entries, previously exported files or copies held by other applications. Manage these separately.

Raw and organised context exports create a local Markdown file. An organised export can still include original dictated material alongside categories. The file is readable text, not an encrypted vault. Review it before sharing, particularly if it contains personal, client, employer or confidential information. Exporting alone does not upload it to an AI platform; uploading it or saving it in a cloud-synchronised folder is your choice.

EYRO's ordinary local features do not automatically upload content or local diagnostic reports to CAWOSH. If you deliberately send a screenshot, transcript or diagnostic file to support, we receive what you send. Review attachments and remove unnecessary personal or confidential material first. No microphone recording is needed for licence verification.

Information processed by the licence service

For activation, renewal, purchase fulfilment, verified device replacement and cancellation, the service processes:

• Product keys submitted for activation, and cryptographic product-key hashes used in validation records.
• Licence ID, edition, seat limit, status and pseudonymous device code.
• Issue, activation, verification, expiry and status-change timestamps.
• Paddle transaction, customer and product references when linked to a purchase.
• Cancellation, refund, payment-dispute, suspension or revocation status and relevant reasons.
• Delivery status, delivery attempts, secure-claim token hashes, claim expiry and view counts.
• Webhook handling, administrative audit and security records.
• IP addresses as requests arrive, and keyed values derived from IP addresses for rate limiting; hosting providers also process ordinary network and diagnostic metadata.

A pseudonymous device code or keyed IP value is not necessarily anonymous. These identifiers can distinguish a device or link activity, so we treat them as personal information.

The service currently issues paid-use certificates valid for up to seven days from issue. The application is configured for routine refresh attempts approximately every 24 hours while running and connected; activation, restart and other status checks can also contact the service. There is no automatic transition to a non-expiring certificate after the first 14 days. Licence requests do not contain your audio, transcripts, notes, dictionary, selected writing or local performance measurements.

If required licensing information is not supplied, we may be unable to activate or verify paid access. If a certificate expires without successful renewal, EYRO can return to the available free allowance. Contact us if you believe a licence decision is wrong.

Purchases and licence delivery

Paddle acts as merchant of record for purchases made through its checkout and is a separate controller for its payment, tax, fraud-screening and related processing. It handles details such as name, email, billing address, payment and transaction information under Paddle's Privacy Notice. CAWOSH does not receive full payment-card details.

Paddle supplies CAWOSH with purchase and customer information needed to fulfil orders, manage licences, respond to support requests, administer refunds and maintain appropriate records. The licence service can retrieve the purchaser's email address from Paddle and derive the readable activation key for delivery through Resend, the transactional email provider. That provider receives the email address and message containing the key. Validation records using hashes do not mean the readable key is never processed during delivery.

The licence-delivery service records delivery state and purchase references rather than a separate purchaser email address. This does not mean email information is absent from Paddle, the email provider, correspondence or other necessary transaction records.

Keep your key private. For routine support, give a transaction or licence ID rather than sending your full key. Transactional licence and refund messages are not newsletter subscriptions.

Support and correspondence

If you contact us, we process your contact details, message and attachments, together with relevant licence or purchase records. We may ask for proportionate information to verify a request. We use this to answer enquiries, resolve faults, administer rights and handle complaints or disputes.

Do not send health information, identification documents, information about other people or confidential work unless it is necessary and we have arranged an appropriate way to receive it. If a request genuinely requires sensitive personal information, we will assess the applicable legal conditions and safeguards before seeking it; the ordinary support purposes below are not blanket permission to collect it.

Microsoft 365 provides the info@cawosh.com support mailbox. Microsoft processes sender and recipient details, message content, attachments and ordinary account, security and delivery metadata under its service and privacy terms. Resend is used separately for transactional paid-licence email delivery. The free-download form does not send an email. See Microsoft's Privacy Statement.

Website operation

The public EYRO website at https://www.eyro.co.uk is hosted using Vercel. Vercel processes IP addresses, request headers, requested pages, timestamps, security signals and operational logs needed to deliver and protect the site. Cloudflare provides the separate EYRO licence service and may also provide DNS or network-security services where configured.

The download-access form collects your email address, submission time, page source, accepted terms version, optional marketing choice, and the marketing wording and version shown to you. Vercel sends this record to CAWOSH's separate Cloudflare release-access service and D1 database. Only after the record is saved does the website return the public installer link, when available. No free-download email is sent. The address is not an EYRO login and ownership is not verified by this form. If you do not provide an address and accept the access terms, the form cannot complete your request; you can contact info@cawosh.com about access or privacy concerns.

We use the access record for our legitimate interests in administering release access, keeping a record of the request and resolving related support enquiries. We assess those interests against your rights; collecting an address does not authorise advertising. Anti-abuse checks use the submitted fields and a hash of the address for rate limiting. The hosting providers also receive normal network information. The form receives no dictated audio, transcripts or notes.

Optional email marketing

A separate checkbox, unticked by default, asks: "Yes, CAWOSH LTD may email me occasional EYRO and other CAWOSH product news, offers, and invitations to give feedback. I can unsubscribe at any time."

Consent is the basis for this optional marketing. Acceptance of download terms, installation or purchase does not give that consent. Surveys that promote products are covered by the marketing choice. Refusing or withdrawing consent does not affect download or free use. We do not sell this list, use it for third-party advertisers or upload it to advertising platforms under this permission. CAWOSH product emails may describe other products offered by CAWOSH LTD, as stated in the checkbox.

You may withdraw consent through the unsubscribe route in a marketing message or at info@cawosh.com. We keep the minimum suppression record needed to prevent further marketing. We do not restart marketing merely because an old opt-in record is imported again. Withdrawal does not affect processing that was lawful before it. No marketing campaign or automatic marketing email is triggered by the download form.

Website technologies

The website code can generate local browser events describing actions such as button clicks or a successful form submission. No third-party analytics collector or advertising pixel is configured in the reviewed release website, and those events do not include the submitted email address or dictated content. If analytics or advertising technology is introduced later, this notice and any required consent controls will be updated before it is enabled.

CAWOSH does not configure non-essential cookies on the ordinary information pages. Essential hosting, security or checkout technologies may operate when required to deliver a requested page, protect a form or open Paddle checkout. Paddle and any destination you choose have their own notices and cookie controls. Where consent is legally required, the relevant technology will not be enabled until consent is obtained.

Downloads and external destinations

Moonshine Medium and its local runtime are included in the EYRO 3.10.1 installer; using them for dictation does not contact Moonshine AI or Microsoft's ONNX Runtime service. Optional speech models, acceleration packs, runtime repairs or updates can contact the relevant distribution provider directly. The public installer is distributed as a GitHub Release. GitHub receives your IP address and ordinary download-request information; EYRO does not put the submitted email address in the installer URL. GitHub has its own privacy notice at https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. Other download providers can include Microsoft, GitHub, Hugging Face, npm, Intel or NVIDIA infrastructure, depending on the component and download location. They receive normal request information, including your IP address, but the request does not include your dictated content. Their own privacy information applies to their service.

When you choose a voice shortcut destination or a search action:

• A search provider or custom website receives the query supplied to it through your browser. The query may appear in a URL, browser history or provider logs.
• ChatGPT or Claude receives the prompt through the selected app or browser route. The provider may process and store it under its own terms, account settings and privacy notice. EYRO cannot guarantee those providers' retention or training settings.
• Text inserted into another application's textbox is handled by that application. A local transcription can therefore become part of a cloud message or document when you use that application.

CAWOSH does not receive your prompt merely because you select one of these destinations. EYRO's ordinary local history may still retain a copy on your computer. Review the destination and its privacy settings before sending sensitive information. See OpenAI's Privacy Policy and Anthropic's Privacy Policy for those services; your search or custom-website provider has its own notice.

Purposes and lawful bases

The following explains CAWOSH's UK GDPR bases. A purpose having more than one activity does not mean we can choose a different basis after consent is withdrawn to continue the same consent-based activity.

We must assess that reliance on legitimate interests is necessary and proportionate and does not override your rights. You can object to that processing. Choosing an external AI destination is a user instruction to that feature, not general consent to unrelated processing by CAWOSH or the provider.

Automated checks and human review

Automated checks can allow or refuse paid access, enforce device binding or assess an in-app cancellation request against configured eligibility rules. They are not used to profile your dictated content for advertising. Local grammar suggestions and context categories do not decide your licence status.

If a key is incorrectly blocked, a device replacement fails or cancellation appears wrong, email info@cawosh.com for human review. We will consider the relevant records and correct errors where appropriate. Any statutory rights concerning automated decisions remain available where the law applies.

Recipients

A properly managed business transfer may involve necessary information with confidentiality and data-protection safeguards. It is not permission to sell a marketing list or local user content. Provider information is available from Cloudflare, Paddle, Resend, Vercel and Microsoft.

International transfers

Licensing, purchases, email and website providers can operate internationally. We do not promise that all service information is stored only in the UK or that local transcription makes all associated processing offline.

Where CAWOSH makes a restricted transfer, the applicable arrangement must provide a lawful transfer basis, such as UK adequacy regulations or an appropriate safeguard. For transfers relying on contractual safeguards under UK GDPR, this can include the UK International Data Transfer Agreement or the UK Addendum used with the EU Standard Contractual Clauses, with the required assessment and supplementary measures. EU clauses alone are not described here as a universal UK transfer solution.

CAWOSH reviews the provider terms and transfer arrangements applicable to its accounts. You may request information about the safeguards and an appropriate copy by contacting info@cawosh.com, with confidential or security-sensitive details protected where necessary.

Retention

We keep personal information only for the period needed for the stated purpose, legal obligations, security, and any active complaint or claim. Local EYRO content follows the storage and backup choices on your computer and is not governed by CAWOSH's server-retention schedule.

Retention reviews and rights requests are administered by CAWOSH; the download form itself does not perform these reviews. When a retention period ends and no documented exception applies, we delete or irreversibly minimise the information unless a lawful exception applies. Backup copies expire through the relevant backup cycle. A legal hold is limited to information genuinely required for the matter concerned.

Deleting a local file does not necessarily erase a cloud-synchronised copy, backup or file already shared with another provider.

Security

EYRO uses measures including encrypted network connections, cryptographic key validation, signed licence certificates and protected administrative operations. The separate context vault uses local encryption. Security also depends on device protection, account access, secret management, backups and operational maintenance. No system is completely secure, and this notice is not a security certification.

Your rights

Where applicable, you can request access, correction, erasure, restriction or portability of your personal information. You have the right to object to processing based on legitimate interests, and to object to direct marketing at any time. You can withdraw consent where it is the basis for processing without affecting processing lawfully carried out before withdrawal. Where direct marketing occurs, you can object to that use at any time.

Some rights depend on the circumstances; for example, required accounting records or information genuinely needed for a claim may have to be retained. A right to complain or to object to direct marketing is not removed by those exceptions.

Email info@cawosh.com to make a request. We will normally respond within one month, subject to the applicable statutory rules, and explain any lawful extension. We may request proportionate verification information. You do not need to give us your dictated content to exercise rights concerning licensing records.

CAWOSH cannot retrieve or remotely delete local content it has not received. You can manage that content through EYRO and Windows, separately from any exports or third-party copies. If deletion of required licence records would prevent continued paid verification, we will explain the consequence rather than treating it as automatic refusal of your request.

Complaints

You may contact info@cawosh.com so we can try to resolve a concern. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to waive or delay an available legal right by contacting us first. Depending on your location, another competent supervisory authority may also be available.

Children

EYRO is not marketed as a children's product. Direct licence purchasers must be adults with legal capacity under the EULA. That restriction does not prove no child could use a device or send a support message. Contact us if a child has supplied personal information so that we can assess and address the situation appropriately.

Changes and contact

We will update this notice when the product, providers or processing change and state the effective date. Where a change materially affects personal information, we will provide an appropriate additional notice. A privacy-notice update does not replace any consent or other legal requirement that applies to a new use.

CAWOSH LTD, company 15522294, 86–90 Paul Street, London, England, EC2A 4NE. Email: info@cawosh.com.