Annex Orbis1. What this policy covers
This policy covers biometric identifiers and biometric information as those terms are used in the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, and the Washington biometric privacy law. For us that means one thing and one thing only:
- Wake-word recordings. If you turn on HAL's wake word, your device asks you to say it three times. Those three short recordings, about a second each, are a voiceprint.
- The measurement derived from them. Your device turns the recordings into a numerical description of the sound so it can recognise you saying the phrase. That measurement is biometric information.
We do not collect fingerprints, face or iris scans, hand or face geometry, or DNA. Signing in with a passkey uses your device's own fingerprint or face check; that check happens on your device, and we receive a public key, never the biometric.
2. Why we collect it, and for how long
The purpose is to recognise you saying the wake word, on the devices you sign in on. Nothing else. It is not used to identify you elsewhere in the Services, to verify who you are, to judge how you sound, or to decide anything about you.
The term is one year from the day a recording is made, and shorter if you ask. We tell you this before you record, and you agree to it in writing — by checking a box that is off by default — as part of the same step.
The measurement your device derives stays on that device. If you do not ask us to save the recordings, nothing leaves the device at all and this policy has nothing to cover.
3. Consent, before anything is recorded
- We ask before the microphone opens, not afterwards.
- Saving recordings to your account is a separate choice from turning the wake word on, and it is off unless you turn it on. The wake word works without it, on that one device.
- We record which version of this notice you agreed to and when.
- You can withdraw consent at any time in HAL's settings. Withdrawing deletes every wake-word recording we hold for you.
There is always a way to use HAL without this. Typing to HAL and tapping to talk reach everything the wake word reaches. We will not make a biometric the only way to do something.
4. Retention schedule and destruction
This is the written retention schedule and destruction guideline that Illinois law requires us to publish. It also appears in our Data Retention schedule.
| What | Destroyed |
|---|---|
| Wake-word recordings saved to your account | One year after the recording is made — or immediately when you withdraw consent or delete them, whichever comes first |
| The measurement your device derives from them | When you turn the wake word off, delete the recording it came from, or sign out of that device |
| Recordings from an attempt that did not work | Same as above. They are never used to recognise you; they are kept only so a failure can be looked at rather than guessed at, and they expire on the same schedule |
Destruction means the recording is deleted from our storage and the derived measurement is removed from the device. Deletion is queued durably, so a storage outage delays it but does not cancel it.
We do not wait for three years of inactivity, which is the outer limit the Illinois statute allows. One year from recording is shorter, and it is what we hold ourselves to.
5. We do not sell it or profit from it
We do not sell, lease, trade, or otherwise profit from biometric data. We do not disclose it to anyone else except where you direct us to, or where a warrant or subpoena requires it.
We do not use wake-word recordings to train models without asking you separately. Agreeing to save a recording so your own devices recognise you is not agreement to train anything, and we will not read it that way. If we ever want to, we will ask for that in its own words.
6. How it is protected
Recordings are stored in private object storage with no public access, reached only through our own service and never by a link handed to a browser. The credential that reaches them is scoped to that one storage bucket and nothing else, and it expires.
We protect biometric data using at least the standard of care we use for other confidential information, and in the same manner.
7. Your choices
- See what you have recorded, and where, in HAL's settings.
- Delete any recording, from any device you are signed in on.
- Withdraw consent, which deletes all of them.
- Turn the wake word off entirely and use HAL by typing or tapping.
If you have a question about this policy, or want us to confirm something has been deleted, write to privacy@annexorbis.com.