Effective date: October 19, 2026 · Version 1.0
This Privacy Policy explains how Wang Yongfei, an individual / sole trader operating under the laws of the People's Republic of China, collects, uses, shares, and protects personal information when you use AI SubtitleLab at https://www.aisubtitlelab.com (the "Service").
1. Data Controller
The data controller for the Service is:
- Legal name: Wang Yongfei
- Business status: Individual / sole trader
- Country: People's Republic of China
- Privacy email: [email protected]
- Data Protection Officer: Not applicable
- Mailing address: Not applicable — individual / sole trader; please contact us by email.
If you have questions about this Policy or want to exercise a privacy right, contact [email protected].
2. Personal Information We Collect
2.1 Account Information
When you create an account, we collect your name or display name, email address, password (stored as a secure hash), interface language, account status, role, and login timestamps. If you sign in or update your profile, we may also collect your last login IP address and account preferences.
2.2 Content You Submit
We collect the audio track you upload for transcription, the resulting transcript, timestamps and word data, subtitle text, translations, caption styles, overlays, stickers, titles, and other edits you save. If you upload a custom font, we store the font file and related metadata so that we can render your captions. Video files are generally processed in your browser; the editor extracts an audio track and uploads that audio for transcription. Do not upload content that you do not have the right to use.
2.3 Payment and Transaction Information
When you buy a plan or minute pack, we receive and store order identifiers, plan details, amounts, currency, payment status, coupon use, subscription status, billing period, and related transaction metadata. Waffo Pancake acts as the merchant of record and payment processor. Waffo Pancake may provide us with your name, email address, country, tax information, payment-method brand, and the last four digits of a card where available. We do not receive or store your full card number, CVV, or full bank account details.
2.4 Information Collected Automatically
We automatically collect IP address, device type, operating system, browser type and version, user agent, language, time zone, session identifiers, guest-token identifiers, CSRF tokens, pages and features used, export events, credit-ledger entries, rate-limit data, error logs, and request timestamps. We use this information to operate, secure, and improve the Service.
2.5 Information from Third-Party AI Providers
When you request transcription, we send the uploaded audio and related settings to Third-Party AI Providers. When you request translation or use an AI writing feature, we send the relevant text and instructions to DeepSeek. These providers may return transcripts, translations, detected language, timing data, and other results. We do not use your content to train our own AI models without your explicit consent. Third-party providers process content under their own terms and privacy policies; we require them to process it only to provide the requested service to the extent permitted by their terms.
2.6 Communications and Support
If you contact us, we collect your email address, the content of your message, attachments, and our support history so that we can respond and keep a record of the issue.
2.7 Sensitive Information
We do not intentionally request sensitive personal information. Audio, video, images, and text may contain personal information about you or others. You are responsible for ensuring that you have a lawful basis and any necessary consents to upload that content.
3. How We Use Your Information
We use personal information for the following purposes and legal bases:
- Providing the Service: to transcribe audio, translate and edit subtitles, render captions, process custom fonts and overlays, and enable exports — performance of our contract with you.
- Account management: to create and authenticate your account, apply your plan, and remember your preferences — performance of our contract with you.
- Payments and subscriptions: to process orders, renewals, cancellations, refunds, coupons, and tax obligations — performance of our contract and compliance with legal obligations.
- Customer support: to answer questions, investigate problems, and improve your experience — performance of our contract and our legitimate interests in supporting customers.
- Security and abuse prevention: to detect fraud, enforce usage limits, prevent attacks, protect the Service, and maintain logs — our legitimate interests in keeping the Service safe.
- Service notices: to send billing, security, renewal, and policy notices — our legitimate interests and legal obligations.
- Product improvement: to analyse aggregated or de-identified usage, diagnose errors, and improve reliability — our legitimate interests.
- Marketing: to send promotional messages only where we have your consent or another lawful basis. You can opt out at any time.
- Legal compliance and disputes: to comply with law, respond to lawful requests, and establish or defend legal claims — legal obligations and our legitimate interests.
We may aggregate or de-identify information so that it can no longer reasonably identify you. Such information is not treated as personal information where the law permits.
4. Cookies and Similar Technologies
We use a small number of cookies, local-storage entries, and similar technologies:
- Strictly necessary: session cookies, CSRF protection tokens, locale selection, guest-trial tokens, and security controls. These are required for the Service to work and cannot be disabled through our interface.
- Functional: local storage that remembers editor settings, caption styles, and interface preferences. You can clear these through your browser.
- Analytics and marketing: we do not currently use third-party advertising pixels or cross-site behavioural advertising cookies. If we introduce them, we will update this Policy and, where required, request your consent before they are set.
We load web fonts from Google Fonts. When your browser requests a font, Google may receive your IP address, browser information, and the page you are visiting. We do not control Google's independent processing. You can block third-party fonts in your browser, although the interface may look different.
We do not respond to browser "Do Not Track" signals in a uniform way because there is no consistent industry standard. We do not use cross-site tracking for advertising.
5. Sharing and Disclosure
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share information only as described below:
- Waffo Pancake: merchant-of-record and payment processing, fraud prevention, tax calculation, subscription management, refunds, and transaction records.
- DeepSeek: translation and AI content generation. We send the text, instructions, and settings needed to produce the requested output.
- Cloudflare: content delivery, network security, and abuse protection. Cloudflare may process IP addresses, request metadata, and security signals.
- Google Fonts: font delivery. Google may receive your IP address and browser information.
- Hosting, database, storage, email, backup, and monitoring providers: infrastructure needed to operate the Service, subject to confidentiality and data-protection obligations.
- Professional advisers: lawyers, accountants, auditors, and insurers where necessary and subject to confidentiality.
- Legal requirements: courts, regulators, law enforcement, or other authorities where required by law or necessary to protect rights, safety, or the Service.
- Business transactions: a successor or acquirer in a merger, acquisition, financing, or sale of assets, subject to continued protection of personal information.
- With your consent: for any other purpose after we provide notice and obtain your consent where required.
6. Data Security
We use technical and organisational measures designed to protect personal information, including:
- TLS/HTTPS encryption for data in transit.
- Secure password hashing and encrypted session cookies.
- Access controls and least-privilege administration.
- Storage of secrets in server-side environment configuration.
- Rate limits, CSRF protection, security headers, and abuse monitoring.
- Regular software updates and backups.
No method of transmission or storage is completely secure. If we become aware of a security incident that affects your rights, we will notify you and the relevant authorities within the time required by applicable law, and we aim to act within 72 hours of discovery where the law requires.
7. Data Retention
We retain personal information only for as long as needed for the purposes described in this Policy:
- Account information: while your account is active; after deletion, we delete or anonymise active-system records within 30 days, and backup copies within 90 days, unless a longer period is required by law.
- Audio uploads: deleted after transcription is completed or fails. Residual copies may remain in backups for up to 30 days.
- Transcripts, subtitles, translations, edits, overlays, and custom fonts: retained while your account is active and until you delete them or close your account. After account closure, active-system records are deleted within 30 days and backups within 90 days.
- Guest-trial records: retained for up to 12 months from the last activity for abuse prevention and quota enforcement, then deleted or anonymised.
- Support communications: retained for up to 24 months after the matter is closed, unless needed for a legal claim.
- Order and billing records: retained while your account is active and for up to 30 days after deletion, or longer where required for tax, accounting, fraud prevention, chargeback, or legal purposes. Waffo Pancake also retains transaction records under its own policy.
- Server and error logs: ordinarily retained for up to 14 days. Security events may be retained for up to 12 months.
- Cookies and local storage: session data expires when your session ends or after the configured session lifetime; preference data remains until you clear it or it expires.
When a retention period ends, we delete, anonymise, or aggregate the information. We may retain information if we are required by law or if it is necessary to establish, exercise, or defend legal claims.
8. Your Data Rights
Subject to applicable law, you have the following rights:
- Right to be informed: to know what personal information we collect and how we use it.
- Right of access: to request a copy of your personal information.
- Right to rectification: to correct inaccurate or incomplete information.
- Right to erasure: to request deletion of your information in certain circumstances.
- Right to restriction: to ask us to limit processing in certain circumstances.
- Right to data portability: to receive your information in a structured, commonly used, machine-readable format.
- Right to object: to object to processing based on legitimate interests, including profiling or direct marketing.
- Right to withdraw consent: to withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.
To exercise a right, email [email protected]. We may need to verify your identity before acting. We aim to respond within 30 calendar days and may extend the period where the law allows. You may also lodge a complaint with your local data-protection authority.
8.1 California Privacy Rights
If you are a California resident, you may request to know, access, correct, or delete personal information, and to opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioural advertising. You may designate an authorised agent to submit a request on your behalf, subject to verification. We will not discriminate against you for exercising a privacy right. To submit a request, email [email protected].
9. Marketing and Opt-Out
We do not currently send marketing email to customers without a lawful basis. If we introduce marketing, you may opt out by clicking "Unsubscribe" in the message or by contacting us. Opting out does not affect essential service notices, including billing, security, renewal, and policy notices.
10. International Data Transfers
We and our providers may process information in the People's Republic of China, the United States, the European Union, and other countries where our providers operate. Data-protection laws in those countries may differ from those in your country. Where required, we use appropriate safeguards, such as data-processing agreements and standard contractual clauses, or rely on another lawful transfer mechanism. You may contact us for more information about the safeguards we use.
11. Children's Privacy
The Service is intended for users aged 18 and above. We do not knowingly collect personal information from anyone under 18. If you believe that a child has provided personal information, contact us immediately and we will take reasonable steps to delete it.
12. Third-Party Links and Services
The Service may link to or integrate with third-party websites, payment pages, and AI providers. This Policy applies only to information we directly collect. We are not responsible for the privacy practices of third parties. Review their policies before providing information to them.
13. Policy Changes
We may update this Policy from time to time. For material changes, we will provide at least 15 days' advance notice by email or through the Service, unless a shorter period is required by law, and we will update the "Last updated" date. Continued use after the effective date constitutes acceptance of the revised Policy.
14. Contact Us
- Privacy email: [email protected]
- Support email: [email protected]
- Legal name: Wang Yongfei
- Business status: Individual / sole trader
- Country: People's Republic of China
- Mailing address: Not applicable — individual / sole trader; please contact us by email.
- Response time: We aim to respond within 2 business days for support requests and within 30 calendar days for privacy-rights requests.
Wang Yongfei · https://www.aisubtitlelab.com
Last updated: October 19, 2026