Through your API key.
The polish step runs through your account at OpenAI, Anthropic, or Groq. Your transcript (and audio, if you also chose cloud speech-to-text) goes from your machine to the provider you chose, then back.
Auris never sees it.
The provider's privacy policy applies to that hop. Speech-to-text can independently be set to local, in which case audio never leaves your machine even on this path.