Privacy Policy

Provider / controller: ALGOPOETICA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, Aleja Jana Pawła II 43A / 37B, 01-001 Warsaw, Poland · KRS: 0001036276 · NIP (Tax ID): 5273061434 · Contact: privacy@algopoetica.ai

1. Introduction and Scope

This Privacy Policy explains how we collect, use, and protect personal data in connection with the provision of the Algopulse — Intelligent Meeting Assistant service. This document applies to users of our application, visitors to our website, and participants in online meetings recorded using our tool.

2. Who We Are and Our Role

In providing our service, we act in two distinct roles defined by data protection laws:

• Data Controller: We are the data controller for your Account data, billing data, and technical data collected for analytical purposes. We determine the purposes and means of processing these data.
• Data Processor: For meeting content, including audio and video recordings, transcriptions, and AI-generated summaries, we act as a data processor. We process these data strictly on the instruction and behalf of our client (the meeting organizer), who acts as the data controller in this specific context. For users acting as consumers (B2C), we act as the data controller for all data required to execute the Terms of Service.

3. What Data We Process

Depending on how you use the service, we process the following categories of data:

• Registration Data: Name, e-mail address, company name, hashed password.
• Billing Data: Address, tax ID, payment history.
• Meeting Content: Audio/video recordings, transcripts, AI summaries.
• Meeting Metadata: Meeting title, date, time, duration.
• Participant Data: Names, e-mail addresses from the meeting participant list.
• Connected Calendar Data: The list of your calendars (name, color) and, for calendars you sync, event title, start and end time, status, organizer, attendees (name, e-mail, response) and meeting link, plus the e-mail address of the connected account. Read, read-only, from the Google or Microsoft Outlook calendar you connect yourself (for Google, see “Google user data” in Section 6).
• Technical and Session Data: IP address, browser type, app logs.
• Correspondence: Support inquiries and tickets.
• Marketing Data: Consents for commercial communications and tracking signals.
• Share Recipient Data: E-mail address and the link to the shared Recording and to the person who shared it, provided by the User who shared the Recording and by the recipient when creating an Account.
• Waitlist Data: E-mail address, optionally company name and team size, provided in the Early Access Group form or with one click after following a share or invitation link; for such requests, also the source of the request and the e-mail address of the person who shared the Recording or invited you.

Warning: Please note that during recorded meetings, any information may be disclosed, including special categories of personal data under Art. 9 GDPR (e.g., health information, religious beliefs, trade union membership). We do not prohibit such data from being processed through the Service, but you — as the Customer initiating the Meeting and acting as controller for participant data — are responsible for maintaining your own Art. 9(2) GDPR legal basis for processing it. We apply a uniformly heightened level of safeguards to all Customer Data regardless of whether such data is present.

4. Purposes and Legal Basis

We process data for specific purposes:

• Performance of Contract (registration and Account support): Based on Art. 6(1)(b) GDPR.
• Billing and Tax Obligations: Based on Art. 6(1)(b) and (c) GDPR.
• Creation of Transcripts and Summaries (B2B): Based on the client’s legal basis as the data controller. We process data strictly on their behalf.
• Support Inquiries: Based on Art. 6(1)(b) and (f) GDPR (Legitimate Interest).
• Security and Fraud Prevention: Based on Art. 6(1)(f) GDPR (Legitimate Interest to secure our infrastructure).
• Analytics and Statistics (Google Analytics and first-touch UTM tracking): Based on Art. 6(1)(a) GDPR (Consent).
• Waitlist and Invites, including requests from shares: Based on Art. 6(1)(f) GDPR (Legitimate Interest to handle your access request).
• Sharing Recordings with identified people (delivering the message and handling the recipient’s access): Based on Art. 6(1)(f) GDPR, and on Art. 6(1)(b) once the recipient creates an Account. For the content of the Recording we act as a data processor.
• Service and billing messages (end of trial, payment, end of plan, warnings about data deletion): Based on Art. 6(1)(b) GDPR; they are not marketing messages.
• Keeping data in read-only mode after a plan ends: Based on Art. 6(1)(b) and (f) GDPR (giving you time to access, export or resume; see Section 5).
• Product Analytics and Error Logs: Based on Art. 6(1)(f) GDPR (Legitimate Interest to improve app features and ensure stability).

5. How Long We Retain Data

• Audio/Video Recordings: Not deleted automatically unless you enable automatic deletion after 30 days when starting the recording. Regardless of this setting, you may delete a Recording manually at any time from within the Application.
• Transcripts and Summaries: By default, 365 days (configurable by the client), with notice before or at the time of deletion, followed by permanent deletion.
• Data in a workspace without a plan (read-only mode): Retained for 12 months from the date the plan ended. We send a warning e-mail 30 and 7 days before deletion. Until then you can download, delete or resume. Then Recordings, Transcripts, Summaries, projects and tasks are permanently deleted; the Account, organizations and memberships remain.
• Shares of Recordings: Until the share is revoked, the Recording is deleted, or the sharing person’s Account is deleted; the recipient then loses access.
• Account Data: Retained for the duration of the Account. Upon deletion of the Account, data is securely wiped within 30 days.
• Billing Data: Retained for 5 years following the end of the tax year, as strictly required by Polish tax laws.
• Waitlist Data: Retained for 12 months or until deleted upon request, followed by permanent deletion.
• Product and Error Logs: Retained for 24 months, followed by permanent deletion.
• Access Audit Logs: Retained for 5 years for evidentiary and security purposes (e.g., SOC 2).

6. Who We Share Data With

We use trusted third-party sub-processors that support our infrastructure and service delivery. They process data solely upon our instruction:

• AWS EMEA SARL: Application infrastructure, S3 storage, meeting content database (Amazon DocumentDB), transcription, AI models run in Amazon Bedrock, and transactional e-mail (Amazon SES) — AWS regions located in the EU. The developers of the AI models available in Amazon Bedrock do not receive your data.
• Hostinger International Ltd.: Website hosting — server logs of website visitors (EU, Cyprus).
• Stripe: Payment processor acting as an independent data controller.
• Google LLC (Google Analytics on the website, only with your consent): Website traffic analytics only, with advertising features (Google Signals) disabled; access governed by a data processing agreement.

At your instruction, we send data to services you connect to your Account yourself to save results (Google Drive, Notion). Their providers process the data as independent controllers under your agreement with them; you decide what is shared and can remove the connection at any time in the Application settings. We never change connected calendars (Google Calendar, Microsoft Outlook calendar); we only read events from them, as described below.

Google user data

When you connect Google Calendar, Algopulse asks Google only for read-only access (the calendar.events.readonly and calendar.calendarlist.readonly scopes, plus your e-mail address). Algopulse never creates, modifies or deletes anything in your Google account.

• What we access. The list of your calendars (name, color) and, in the calendars you choose to sync, your events: title, start and end time, status, organizer, attendees (name, e-mail, response status), meeting link, location and description. We read the location and description only to find a Google Meet or Microsoft Teams link; we do not store them. We also receive the e-mail address of the connected Google account.
• How we use it. Only for features you see in the Application: showing your upcoming meetings, detecting meeting links, recording the meetings you choose (manually, or automatically if you turn auto-record on; it is off by default), and labeling Recordings with the meeting’s title, time and attendees. Data from your calendar is never used to label other Users’ recordings.
• Who we share it with. Google user data is processed by our infrastructure provider Amazon Web Services EMEA SARL (AWS regions in the EU), including Amazon Bedrock for AI features (e.g. generating a meeting title). Amazon Bedrock does not use this data to train models and does not share it with model developers. A meeting’s title and attendees become visible to the people you share the Recording with, and to the members of your organization’s project you assign the meeting to. We do not sell Google user data, use it for advertising (including personalized or retargeted ads) or for creditworthiness or lending purposes, or transfer it to data brokers.
• How we protect it. Encryption in transit (TLS 1.2+) and at rest; Google OAuth tokens are envelope-encrypted with AWS KMS keys; administrative access requires two-factor authentication.
• Retention and deletion. Stored calendar events are deleted after they end or when they disappear from your Google Calendar. The title, time and attendees attached to a Recording are kept as long as the Recording (Section 5), and you can delete it at any time. When you disconnect the calendar in Settings → Calendars, we revoke our access with Google and delete all stored calendar data and tokens. When you delete your Account, all data is permanently deleted within 30 days. You can also revoke access at any time at https://myaccount.google.com/permissions.
• Limited Use. Algopulse’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data, raw or derived, is not used to develop, improve or train AI or machine-learning models. Our staff do not read this data unless you give us permission (e.g. in a support request), it is necessary for security purposes, or it is required by law.

At your instruction we also make the content of a selected Recording (summary, transcript, playback) available to the people you share it with (share recipients). A recipient sees the content only after signing in to an Account with a confirmed e-mail address. We do not track message opens or playback and do not tell the sharing person about them.

We will not disclose your data to governmental bodies unless legally compelled to do so by binding laws. We may also share data with our legal advisors, external accounting firm, and potential legal successors. We explicitly declare that we do not sell your personal data.

7. Data Transfers Outside the EEA

Your personal data is fundamentally processed within the European Union (AWS cloud — regions located in the European Union). However, in cases of technical support (e.g., from US-based vendors like Stripe or Google LLC as our website analytics provider) or operational necessity, data may be accessed outside the European Economic Area (EEA), including in the United States. Such transfers are governed by legally recognized safeguards:

• Standard Contractual Clauses (SCCs) (Decision 2021/914).
• Adequacy decisions such as the Data Privacy Framework (DPF) for certified US entities. You have the right to request information regarding these safeguards by contacting us at privacy@algopoetica.ai.

8. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Access (Art. 15): Request a copy of your personal data.
• Rectification (Art. 16): Correct inaccurate or incomplete data.
• Erasure / “Right to be forgotten” (Art. 17): Request the deletion of your data (subject to legal obligations like tax laws).
• Restriction of processing (Art. 18): Pause the processing of your data.
• Data Portability (Art. 20): Obtain your data in a structured, machine-readable format.
• Object to processing (Art. 21): Object to direct marketing or processing based on legitimate interests.
• Withdraw consent: Withdraw any provided consent at any time without affecting the lawfulness of previous processing. To exercise your rights, email us at: privacy@algopoetica.ai. We will respond within 30 days. You also have the right to lodge a complaint with the supervisory authority (PUODO in Poland).

9. Non-Client Meeting Participants and Share Recipients

If you attended a meeting as a guest (without an Algopulse Account) where our bot (Algopulse | [inviting User’s email address]) recorded the conversation, your personal data (voice, image, statements) may be included in the recording and transcript. In this scenario, we act solely as a data processor. The meeting organizer (our client) is the data controller. To exercise your privacy rights regarding meeting content (e.g., erasure of statements), you must contact the meeting organizer directly. If we receive such a request, we will promptly forward it to the respective client-controller and provide them with the technical assistance necessary to fulfill your request.

Share recipients. If a User shared a Recording with you, your e-mail address comes from that person, not from you. You receive a message sent on the User’s behalf containing the summary and an invitation to open the Application. We process your e-mail address to deliver that message and to give you access to the shared content after you sign in to an Account with a confirmed address (Art. 6(1)(f) GDPR; once you create an Account, Art. 6(1)(b)). The person who shared the Recording sees the list of recipient addresses, but we do not track or tell them whether you opened the message, signed in or played the Recording. We keep the link until the share is revoked, the Recording is deleted, or the sharing person’s Account is deleted. If registration is limited to named addresses, you can request access with one click; we then record your address, the source of the request and the address of the person who shared the Recording or invited you, for 12 months or until you ask us to delete it. For the content of the Recording itself, you exercise your rights through the controller — the User who shared it — as described above. For your e-mail address and your request, you can contact us at privacy@algopoetica.ai, including to ask for deletion or to object, and you may complain to the supervisory authority.

10. Artificial Intelligence in Our Service

Our service relies on AI-driven automation (Amazon Transcribe and language models provided through Amazon Bedrock and run in AWS regions located in the European Union in an AWS cloud environment). We explicitly affirm the following:

• No training on your data: We guarantee that meeting recordings, transcripts, and generated summaries are never used to train, tune, or improve internal or external AI models.
• We do not engage in automated decision-making that produces legal effects concerning you (no profiling under Art. 22 GDPR).
• In accordance with the EU AI Act, our system does not perform emotion, tone, or sentiment recognition in the workplace or educational settings.
• Due to the nature of AI, generated summaries may occasionally contain inaccuracies (hallucinations) and should not be used as legally binding transcripts.

11. Data Security

We implement rigorous technical and organizational measures to protect your data. This includes encryption at rest and in transit (TLS 1.2+), mandatory Two-Factor Authentication (2FA) for administrative access, robust AWS security controls, and regular data backups. Our staff and sub-processors are bound by strict confidentiality clauses. In the event of a high-risk data breach, we have procedures in place to notify affected users and supervisory authorities within 72 hours.

12. Cookies

Our website uses essential cookies necessary for functionality, as well as analytics cookies (Google Analytics, with advertising features disabled) which are deployed strictly subject to your consent. You may freely manage your preferences through our Consent Management Platform (vanilla-cookieconsent 3.x — an open-source library, self-hosted; your choice is stored in the cc_cookie cookie for 6 months). For full details and the list of third-party vendors, please review our separate Cookie Policy.

13. US Residents’ Rights (CCPA/CPRA, VCDPA, etc.)

To ensure compliance with US state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the CPRA, we provide the following disclosures. Over the past 12 months, we collected identifiers (e.g., email), commercial information, internet activity, approximate geolocation, and audio data for service provision and product development purposes. The only analytics tool we use is Google Analytics, configured with advertising features disabled (Google Signals and remarketing lists are off). We do not use advertising pixels or remarketing tools. As a result, we do not engage in the “Sale” or “Sharing” of Personal Information under the CCPA/CPRA (no cross-context behavioral advertising takes place). We do not use Sensitive Personal Information to infer characteristics about consumers. Eligible US residents have the Right to Know, Access, Correct, and Delete their Personal Information. We will not discriminate against you for exercising your privacy rights. Should your request be denied, you retain the Right to Appeal by contacting us at the same address. Requests may be submitted personally or via an Authorized Agent to: privacy@algopoetica.ai.

14. Children

Our SaaS is a professional B2B platform not intended for children. We strictly prohibit the collection and processing of personal data from individuals under 16 in the EU or under 18 in the US (in compliance with COPPA). If we learn that a minor has created an account without verifiable parental consent, the account and associated data will be promptly and permanently deleted.

15. Policy Changes

We reserve the right to modify this Privacy Policy to reflect legal or functional changes to Algopulse. For material changes affecting privacy rights, we will notify registered users via email or application dashboard at least 14 days before the changes take effect. The updated document will reflect a new “Effective Date.”

16. Contact and Complaints

If you have questions or wish to exercise your rights, please contact our privacy team at: privacy@algopoetica.ai. We aim to respond substantively within 30 days. You also have the right to file a formal complaint with your relevant supervisory authority or State Attorney General.