PRIVACY POLICY - REVOICE

1. Data Controller and Contact Information

ReVoice AI AB (org.nr 559505-0849) is the Data Controller for the processing operations where the Company determines the purposes and means of the processing.

• Company Name: ReVoice AI AB
• Registration number: 559505-0849
• VAT registration number: SE559505084901
• Registered address: Katthögsvägen 66-76, 244 91 Kävlinge, Sweden

The Company has not appointed a data protection officer under Article 37 of the GDPR. Questions about the processing of personal data are answered by the Company's data protection contact at the address below.

2. Regulatory Roles under GDPR

• 2.1 The Company as Data Controller The Company acts as an independent Data Controller for processing related to the Service’s infrastructure, administration, and commercial operations. This includes: - Management of user accounts, authentication, and user profiles. - Management of subscriptions, payment flows, and billing. - Operational security, logging, technical troubleshooting, and proactive prevention of misuse. - Direct communication with registered users and operation of the website (including necessary cookies and, only with the visitor's consent, web analytics).
• 2.2 The Company as Data Processor When a legal entity or organization (the "Customer") uses the Service to process meeting content (such as recording, transcription, summarization, text analysis, and document management), the Company acts as a Data Processor on the instructions of the Customer. In these cases, the Customer is the Data Controller and is responsible for ensuring that: - A valid legal basis exists under Article 6 of the GDPR for the processing of meeting data. - All meeting participants have received adequate information (Articles 13 and 14 of the GDPR). - Recording and transcription are permitted. The Company’s obligations as a Data Processor are regulated in the Data Processing Agreement ("DPA"), which forms part of the customer agreement and is published at https://re-voice.io/dpa. The same applies when a User sends a draft agreement to a counterparty for review through the Service: the counterparty's name and email address, one-time codes, files the counterparty uploads and the times of verification and approval are processed on the Customer's instructions.

3. Categories of Personal Data Processed

The Company processes the following categories of personal data:

• Administrative and Account Data: Name, e-mail address, password (stored in hashed form), profile settings, language preferences, workspace affiliation, and role.
• Technical and Security Data: IP address, device information, browser type, session data, login history, error reports, and security logs.
• Website and Usage Analytics: Only where the visitor accepts analytics in the cookie banner: pages visited, referrer, campaign parameters (UTM), time on page, device and browser type, screen size, language, the approximate location (country, region and city) derived from the IP address, and a shortened IP address (for IPv4 without its last part, for IPv6 only its first three groups) with a salted hash of the shortened address, stored instead of the full address, linked to the user account when the visitor is signed in. The visitor's email address is not stored in the visitor analytics. The Company's own analytics records are deleted after ninety (90) days. With the same consent, Cloudflare Web Analytics receives page views and the visitor's IP address.
• Company and Billing Identification: Company name, organization number, VAT number and company phone number, where provided at registration or checkout, and the time of the confirmation that the agreement is entered into in the course of business. The organization number is checked for its format and, for Swedish numbers, its check digit; it is not looked up in any company register.
• Support Data: Messages and contact details in support tickets and in conversations with Matilda Support, and, when a person calls the ReVoice support line, the caller's number, the call audio, the transcript and summary of the call, and any message or callback details the caller leaves.
• Marketing Data: Email address, name, language and source of a sign-up for marketing email, the record of the consent to it (including confirmation of the double opt-in and, for registered users, when and where they chose to receive marketing email and when they unsubscribed), the Company's own notes on its sales follow-up of leads and, for each message and recipient, whether and when the recipient opened the message or clicked a link in it, where the email provider reports it. Opens and clicks are counted per campaign. The per-recipient records are deleted twelve (12) months after the send; the totals per campaign are kept. Where a lead has clicked a link but not registered, the Service suggests for thirty (30) days that the Company's staff follow up with that person.
• Meeting Metadata: Meeting titles, timestamps, meeting links, platform information (e.g., Zoom, Microsoft Teams, Google Meet), and participant lists.
• Audio, Video, and Text Data: Audio and video recordings, screen sharing data, real-time transcriptions, final transcripts, speaker labels, and edited text versions.
• AI-generated Data: Summaries, action items, decision history, conversation analysis, data from AI chat (Live Assistant/Live Coach), structured relationship data (knowledge graphs) and, where it is switched on as described in section 6, sentiment analysis. Sentiment analysis is an automatic classification of each transcribed utterance into one of six emotion categories (joy, excitement, neutral, concern, frustration and confusion), with values for how positive and how intense the utterance is perceived to be and how confident the classification is, linked to the speaker who said it. The classification is made by a language model from the text of the transcript, not from the voice, and describes what is expressed in the text, not what the person feels.
• Recruitment Data (only where the Customer uses the recruitment features): Job descriptions, candidate CVs, AI-generated assessments of how the evidence about a candidate matches a role, and the recruiter's own decisions and notes.
• Consent Records: Records of consents given and withdrawn, including meeting participants' decisions where the meeting consent function is used and consents for voiceprints (see section 11). They contain no biometric data.
• Documentation (Company Knowledge): Uploaded files, extracted text, metadata, and associated vector representations (embeddings).
• Integration Data (Third-party): Calendar events, CRM/ERP metadata, and encrypted OAuth tokens (access/refresh tokens) upon user activation.
• Financial Data: Subscription status, customer ID at payment provider, and billing documentation. Credit card details are processed directly by a PCI-DSS-certified payment provider and are not stored by the Company.

4. Purposes and Legal Basis for Processing

5. Transparent Information for Meeting Participants

When the ReVoice meeting assistant joins a virtual meeting, it appears in the participant list as "Matilda by ReVoice"; the name cannot be changed. When the assistant joins, it posts a message in the meeting chat. The message is written in Swedish, or in English where the meeting's or the account's language is English or another named language than Swedish. It states on whose behalf Matilda joins, with the user's and the company's names where they are known, and names no user or company where that information is missing or where the same assistant may record the meeting for users in several companies. It also says how to stop the recording. When somebody joins after the assistant, the message is posted to the meeting chat again, at most once per new participant. Example with made-up names:

• Swedish: "Hej, jag är Matilda från ReVoice. Jag deltar för Anna Andersson (Exempel AB) som AI-mötesassistent för att spela in/transkribera mötet och skapa AI-stödda anteckningar. Vill du inte att mötet spelas in? Skriv stopp i chatten, så lämnar jag mötet och inspelningen kasseras. Information om personuppgiftsbehandling finns på https://re-voice.io/privacy"
• English: "Hi, I’m Matilda from ReVoice. I’m joining on behalf of Anna Andersson (Exempel AB) as an AI meeting assistant to record/transcribe this meeting and create AI-assisted notes. Don’t want this meeting recorded? Type stop in the chat and I will leave the meeting and the recording will be discarded. Privacy information is available at https://re-voice.io/privacy"

Anyone taking part in the meeting can stop the recording by typing stop (or stopp) as a message of its own in the meeting chat; upper or lower case does not matter, but the word must be the whole message. Matilda replies in the chat and leaves the meeting, and the recording is discarded: the meeting is not processed further, no summary or analysis is made, the conversation is removed from the Service, and it is permanently erased, with its transcript, files and the meeting bot provider's copy of the recording, as described in section 9. The same applies when the meeting host removes Matilda from the meeting. The meeting owner gets a notice in the Service that the recording was discarded and why, but not who objected. A "no" or "nej" does not stop the recording. Where the meeting consent feature is used, the message is followed by a request for consent to AI transcription: participants reply ACCEPT to allow what they say to be transcribed, or DECLINE to opt out. For a participant who declines, a marker is stored instead of what they say, and the meeting recording with everyone's audio is deleted.

The message is an information measure and does not replace the Customer's obligation to inform the participants and to have a legal basis for the recording. The assistant stays in the meeting only while one of the users it records for takes part; where the same assistant records the meeting for several users, it stays as long as at least one of them is present. A user counts as present when the meeting platform gives the user's email address for a participant. Where the platform gives no email address for the participant, it is enough that the name exactly matches the user's full name, or that the user has chosen the participant under This is me in the live view. The name is not a verified identity: another participant who shows exactly the same full name, without the platform giving an email address, therefore also counts as the user. A participant the platform gives with an email address other than the user's never counts as the user, whatever the name. If no such user has joined within five minutes of the recording starting, or they leave the meeting and nobody rejoins within two minutes, the assistant leaves the meeting. While the assistant waits, the meeting is recorded and transcribed in real time, but until the user has joined nothing from the meeting is passed to Matilda, the live coaching, the sales signals, the search indexing or the automatic titling, and what was recorded is not shown in the Service either, whether in the live view, on the meeting page, in exports, in shared links or through the API. If the user a recording belongs to never took part at all, the recording is marked as deleted when the meeting ends: it is removed from the Service, no post-processing or summary is made, and it is permanently erased, with its real-time transcript and files, thirty (30) days later as described in section 9.

6. Profiling and Automated Decision-Making

The Service uses AI for transcription and summarization and, where it is switched on, for sentiment analysis. Sentiment analysis classifies what is expressed in each utterance in a transcript into a category linked to the speaker (see section 3). It is off by default and runs only for meetings in a workspace (Space) where it has been explicitly switched on; a paid plan does not switch it on. It never runs in recruitment: not for interviews, not for meetings with recruitment coaching or a recruitment profile, not for meetings linked to a candidate and not where an earlier debrief of the meeting concerned recruitment. The result is shown only to the meeting owner, not to others with access to the meeting. The classification is an automatic interpretation of the text and can be wrong. Neutral is a common outcome, and the classification does not establish anyone's emotions, tone of voice, personality or psychological safety. New analyses produce no charisma or alertness scores, and older such scores are not shown where sentiment analysis is not allowed for the meeting. These processes do not constitute automated decision-making that produces legal effects or similarly significantly affects the data subject within the meaning of Article 22 of the GDPR. AI-generated content should be considered decision support and should be verified manually by the User. Where the Customer uses the recruitment features, the Service produces AI-generated assessments of how the evidence in a candidate's documents and interview matches a role. They are decision support for the recruiter: hiring decisions are recorded only by a person, and the Service does not take them.

7. Recipients of Personal Data and Sub-processors

The Company discloses personal data only to the recipients needed for each purpose, under written agreements. Sub-processors that process the Customer's data are listed, with their purpose, where data is stored and processed and the transfer mechanism that applies, at https://re-voice.io/sub-processors; changes are notified in accordance with the applicable DPA. The recipients are:

• Operations, storage and error tracking: Render (hosting, database and background processing), Cloudflare (network, file storage in R2 and, after consent, web analytics) and Sentry (server-side error tracking). An error event contains the error message, the stack trace and technical details of the request, but not the request body. Known sensitive fields, such as transcripts, prompts, email addresses and names, are redacted before the event is sent, query strings in addresses are not sent and error messages are shortened; there is no single maximum length for every field in the event. An error message may nevertheless, in exceptional cases, contain an excerpt of what was being processed when the error occurred.
• AI, speech recognition and meeting recording: Microsoft Azure (Azure OpenAI and Azure AI Speech), OpenAI, Deepgram and Recall.ai, as listed on the sub-processors page.
• Email: Microsoft 365 (Exchange Online) sends transactional email, such as invitations, password resets and meeting summaries. Resend sends the Company's marketing email for the Company's own purposes and reports back deliveries, bounces, complaints and, where the feature is active at Resend, opens and clicks (see sections 3 and 4).
• Bot checks: Cloudflare Turnstile checks at sign-up and checkout that a request comes from a human and receives the visitor's IP address and technical information about the browser.
• Payments: Stripe processes payments and subscriptions and is an independent controller for its own purposes, such as fraud prevention and legal requirements.
• Support phone line: Zadarma provides the telephone number and call routing for the ReVoice support line and receives the caller's number, the call audio in transit and call metadata. The call is held by Matilda on Microsoft Azure OpenAI, and the call record is stored at Render.
• E-signing (optional): Scrive AB, where the Customer has activated e-signing (see section 10.3).
• Recipients used only when the feature is switched on: (a) operational alerts to the Company's own Slack channel through a webhook, with a technical description of the error that may contain identifiers of the records concerned; (b) web search in Matilda through Microsoft's Grounding with Bing service, which receives only the search phrase the User asks Matilda to search for, never meeting content or Company Knowledge, and processes it outside the EU; for the search phrase Microsoft is an independent controller under the Grounding with Bing terms, outside Microsoft's data processing agreement; (c) a fallback route to OpenAI in the United States that is used only if the Company has explicitly enabled it and the European AI services do not respond. See section 8.
• Integrations and AI clients the User connects: When the User connects an integration (for example Google, Microsoft, Slack, Zoom, Fortnox, HubSpot, Salesforce, Notion or Zapier), data is disclosed to that service at the request of the User or the Customer. An external AI client that the Customer connects through MCP receives what the Customer gives it access to and is governed by that client's terms.
• Authorities: where the Company is required by law to disclose data.

8. Third-Country Transfers (Outside EU/EEA)

The Company uses EU regions for storage and processing as specified below. Some services process data outside the EU/EEA. Applicable transfers rely on the European Commission's Standard Contractual Clauses (SCCs, Article 46 GDPR) in the provider's data processing agreement, supplemented by encryption and access restrictions, and, where the provider states certification, on the EU-US Data Privacy Framework (Article 45 GDPR). Processing locations and safeguards per provider:

• Render Services, Inc. (USA): servers, database and background processing in Frankfurt. SCCs and the EU-US Data Privacy Framework.
• Cloudflare, Inc. (USA): file storage in R2 under EU jurisdiction. Web traffic to re-voice.io, web analytics and Turnstile are received at the Cloudflare node nearest the visitor, which may be outside the EU. SCCs and the EU-US Data Privacy Framework.
• Microsoft (Microsoft Ireland Operations Ltd): Azure OpenAI in Microsoft's EU Data Zone, Azure AI Speech in an EU region and Exchange Online with storage in Sweden. SCCs in Microsoft's data processing agreement.
• OpenAI (OpenAI Ireland Ltd and OpenAI OpCo, LLC, USA): OpenAI's European endpoint, only where Azure OpenAI is not used. SCCs.
• Deepgram, Inc. (USA): Deepgram's EU endpoint for imports and direct recordings. During meetings with the meeting bot, Deepgram transcribes through Recall.ai using its EU endpoint (api.eu.deepgram.com). SCCs.
• Recall.ai (Hyperdoc Inc., USA): meeting capture and recording media use Recall's EU region (Frankfurt). Transcription through Recall uses Deepgram's EU endpoint (api.eu.deepgram.com). Recall keeps its copy of the recording until the Company requests deletion, which happens when the conversation record is permanently erased. SCCs.
• Stripe (Stripe Payments Europe Ltd; the data is passed on to Stripe, LLC, USA): payment data is processed in the United States. SCCs and the EU-US Data Privacy Framework.
• Resend (Plus Five Five, Inc., USA): the messages are sent from Resend's region in Ireland, but Resend stores the data, including message content, delivery logs and account records, in the United States. SCCs and, as Resend states, the EU-US Data Privacy Framework.
• Functional Software, Inc. (Sentry, USA): error tracking sent to Sentry's EU ingest (Germany) under the Company's current configuration; if it changes, this item and the sub-processor list are updated. SCCs.
• Zadarma (support phone line): where Zadarma processes the data and which transfer mechanism applies has not yet been established. The Company will update this item once it has been clarified.
• Microsoft Grounding with Bing (only when web search is switched on): the search phrase is processed outside the EU, including in the United States. The service is not covered by Microsoft's data processing agreement; Microsoft processes the search phrase as an independent controller under the Grounding with Bing terms and the Microsoft Privacy Statement. Which transfer safeguard Microsoft applies to that processing has not been verified by the Company.
• OpenAI in the United States (only when the fallback route is enabled): the request is processed in the United States. SCCs.
• Integrations and external AI clients that the User or the Customer connects: the location and safeguards depend on the provider and the Customer's account there.

A copy of the safeguards that apply to a transfer can be requested via privacy@re-voice.io.

9. Storage and Retention (Retention Period)

Personal data is stored only for the period required to fulfill the purposes for which it was collected, or as long as required by law or applicable customer agreements.

• Account Data: Stored during the contract period (active account) and deleted or anonymized upon termination of the agreement, subject to statutory limitation periods.
• Meeting Data (Recordings, transcripts, AI data): Automatic deletion applies where neither the User who owns a conversation record nor the company that owns its workspace is on a paid plan: such records are automatically marked for deletion thirty (30) days after creation and are permanently erased from the Company's databases and object storage thirty (30) days later; erasure is processed in batches and may take correspondingly longer where large volumes are involved. A paid plan, including a running trial, held by the owning User, by the company owning the workspace or by any company in whose workspace the User is a member, exempts the record. Where a company's trial ends without a paid subscription, its content remains readable and exportable for thirty (30) days from the end of the trial; all of it is then marked for deletion and permanently erased thirty (30) days later. On paid plans, conversation records are retained until deleted by the User, until the User's account is deleted, or until a retention period configured by the workspace administrator expires. A workspace administrator can configure separate retention periods for conversations, recordings, transcripts and uploaded documents; content older than a configured period is deleted by the daily retention run, and a conversation retention period replaces the automatic deletion described above for that workspace. When a workspace is deleted, its conversation records, recordings, transcripts, documents and voiceprints are removed from the Company's database at once, and the Company at the same time requests deletion of the related files in file storage and of the meeting bot provider's copy of the recording; if such a request fails, it is retried. Copies may remain in backups as described under Backups below. Data deleted by the User is removed from the Service immediately and permanently erased thirty (30) days later, subject to the same batch processing. Calendar entries created from a connected calendar are described in section 10.1.
• Google Integration Data and OAuth Tokens: OAuth access and refresh tokens for Google Calendar and Google Drive are stored encrypted for as long as the integration remains connected. They are deleted from the Company's database when the User disconnects the integration or deletes the account. A single Google grant covers both Google Calendar and Google Drive. Revocation of that grant with Google is requested when the last remaining Google integration is disconnected; disconnecting one Google integration while the other remains connected deletes the tokens of the disconnected integration without requesting revocation, so that the remaining connection is not broken. Deleting the account both removes the stored tokens from the Company's database and requests revocation of the Google grant. Revocation is requested on a best-effort basis in every case, and a failed request does not prevent deletion of the tokens held by the Company; see section 10.1 for the full description. The User can also revoke the grant themselves at any time at https://myaccount.google.com/permissions. Calendar entries created from synchronized events (event title, description, scheduled times, meeting link, Google's event identifier and iCalUID) are not deleted by disconnecting the integration; they are deleted automatically once no conversation record refers to them any longer, or on request. For each summary the Service writes to Google Drive, the Company retains a delivery record containing the Drive file identifier, the meeting title and the first two hundred (200) characters of the summary. That record is deleted when the conversation record it belongs to is permanently erased, when the User disconnects the Google Drive integration, or when the User deletes the account. Deletion before the end of these periods may be requested at any time via privacy@re-voice.io.
• Technical and Audit Logs: Webhook logs, cron logs and system metrics are deleted after ninety (90) days. Audit log entries are deleted after ninety (90) days, except entries recording security and compliance events, such as administrative actions, data protection requests, single sign-on events, membership changes and deletions, which are kept as evidence for twelve (12) months and then deleted. The same twelve months apply to the workspace audit and access logs, to the log of when the Company's staff opened a customer's account for support (counted from the end of that access) and to the log of AI budget resets. Two kinds of records that prevent an action in an external system from being carried out twice, the delivery record of a meeting note in a CRM and the record of an executed Fortnox draft, are kept for as long as the meeting or the draft exists and are deleted after twelve months only once it is gone; they hold identifiers and reason codes only, no content. Records of registration attempts are deleted after one hundred and eighty (180) days. Completed data deletion requests are deleted thirty (30) days after completion. Separately from these, the Service writes technical application logs. Those logs do not contain calendar event titles, meeting links, event descriptions, locations or attendees; what a calendar synchronization records there is stated in section 10.1. The logs are held by the Company's hosting provider, are used only to operate and debug the Service, are not part of the User's account data, and are not used for any other purpose. The security audit records of the AI functions (who asked a question, in which workspace, which decision was made and a hash of the question, but not the text of the question) are deleted after twelve (12) months, and earlier when the account or the workspace is deleted. Read notifications are deleted after thirty (30) days, records of transactional email sent after ninety (90) days, and conversations with Matilda Support that were not escalated to a support ticket ninety (90) days after the last activity. Call records of the ReVoice support line are deleted after thirty (30) days.
• Support Tickets: Support tickets, including what is sent through the Help Center form and tickets created from Matilda Support, are kept while the ticket is open and deleted twelve (12) months after it was resolved or closed, together with the Matilda Support conversation the ticket was created from. An open ticket is not deleted because of its age. All tickets are also deleted when the person who sent them deletes their account, and deletion can be requested via privacy@re-voice.io.
• Marketing Data: Kept until the person unsubscribes or asks for deletion. A sign-up for marketing email that was never confirmed through the link in the confirmation email is deleted thirty (30) days after its last change, unless the Company has already started a sales follow-up of the person. After an unsubscribe, the email address is kept only to ensure that no further marketing email is sent. Records of who received a message, and whether and when the recipient opened it or clicked a link in it, are deleted twelve (12) months after the send, and earlier when the person's account or the sign-up is deleted, or when the person asks for their data to be deleted. A person without an account asks for deletion or a copy at privacy@re-voice.io. The Company then deletes or provides the sign-up with exactly the person's email address, the record of the consent, the Company's sales follow-up of the person and the records of the messages sent to it. If a campaign is waiting to be sent or being sent when the twelve months have passed, they are deleted once that send is complete. After that only the totals per campaign remain. When a sign-up or an account is deleted after the person unsubscribed, bounced, reported the messages as spam or asked for deletion, the Company keeps a hash of the email address, not the address, to respect the objection to marketing: the address is not added again and receives no marketing email. The hash is removed if the person signs up again themselves and confirms through the link in the confirmation email.
• Accounting Records: Stored for seven (7) years in accordance with the Swedish Accounting Act (1999:1078).
• Backups: The database is backed up in encrypted form, and each backup is kept for thirty-five (35) days. The latest valid backup and the latest backup that passed a restore drill are, however, not deleted until a newer such backup exists, so that the database can always be restored. Data deleted in the Service remains in backups taken before the deletion until those backups have been deleted. The hosting provider also takes its own backups of the database under its terms. Files in file storage are copied to a second storage location within the EU, where a file deleted in the Service is removed after the configured period, by default and at most thirty-five (35) days. Backups are used only for recovery after faults or incidents.
• Voiceprints: Stored for as long as the person's consent is valid, for at most twelve (12) months, and deleted automatically when the consent expires or is withdrawn (see section 11).

10. Specific Terms for Third-Party Platforms

• 10.1 Google API Services ReVoice's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. That policy is available at https://developers.google.com/terms/api-services-user-data-policy.
• Scopes requested: when the User connects a Google account, the Company requests only openid, email and profile (to sign the User in with Google), read-only access to Google Calendar events (https://www.googleapis.com/auth/calendar.events.readonly), and per-file access to Google Drive (https://www.googleapis.com/auth/drive.file).
• Data received from Google Calendar: the Company reads events from the User's primary calendar only. Calendar synchronization and the upcoming-meeting views read a window from twenty-four (24) hours in the past to thirty (30) days ahead, up to fifty (50) events per page and no more than five hundred (500) events per read. Where the User asks the ReVoice assistant to book a meeting, a separate read covers a window of approximately sixteen (16) days around the time the User asked about, which may therefore extend beyond the thirty (30) day window, up to one hundred (100) events per page and no more than one thousand (1000) events per read; in that flow every event is reduced immediately to an anonymous busy period consisting of a start and an end time, the event's cancelled status being the only other field read (a cancelled event does not block a time), and no field of the event is displayed or stored. Each event may contain title, description, start and end time, location, conference link (Google Meet), event status, iCalUID, and the attendee list with names, email addresses and RSVP status. The Company never creates, modifies or deletes Google Calendar events.
• Data received from Google Drive: the Company reads no file content of any kind. The only read the Service performs is a metadata search that returns the identifier and name of the folder the Service itself created, so that new documents can be filed into it. The Service uses the drive.file scope solely to create and manage files that it has itself created.
• Use: calendar data is used to display the User's upcoming meetings, to let the User select a meeting, to connect the ReVoice meeting assistant to the correct Zoom, Google Meet or Microsoft Teams link, to attribute speech in a transcript to the correct participant, to answer the User's own questions about their meetings and schedule, to suggest an agenda for an upcoming meeting from the agenda text contained in the meeting invitation, to pass names from the event title and description to speech recognition as hints so that they are transcribed correctly, to derive the public website of a counterpart company from an external attendee's email domain and present a summary of that website to the meeting owner as preparation, and to determine when the User is already busy so that the ReVoice assistant can propose a free time when the User asks it to book a meeting. Google Drive access is used solely to create a folder called ReVoice Meeting Summaries and to write one Google document per meeting summary to the destination the User has selected; no recordings and no raw transcripts are written to Drive.
• Transfers: calendar data, including the event title, the agenda text contained in the meeting invitation, and attendee names and email addresses, is transmitted to a large language model inference provider (OpenAI, or Microsoft Azure OpenAI where configured), and is used there for inference only. Where an external attendee's email domain identifies a counterpart company, the Company additionally requests the home page of that company's public website; that request discloses no Google user data to the website beyond the fact that its own domain was visited, and the retrieved page text is transmitted to the same inference provider in order to be summarized. Separately, where the ReVoice meeting assistant joins a meeting, the meeting link taken from the calendar event is transmitted to the Company's meeting-bot provider so that the assistant can join that meeting. Sent with the link are the assistant's display name, the meeting owner's own display name and speech-recognition hints: any custom vocabulary the User has configured and up to twelve (12) short terms, such as names of people, companies and products, taken from the event title and description. The same hints are passed to the speech-to-text provider that transcribes the meeting. Email addresses and links are never included in the hints; the event title and description are not otherwise transmitted to these providers, and neither are the event location and attendee list. No other AI sub-processor receives Google Calendar data, and no text-to-speech provider receives it. Inference is configured against these providers' European endpoints; any transfer outside the EU/EEA is governed by section 8 above. Calendar data is also held by the Company's cloud hosting, database and backup providers as part of operating the Service. Writing a summary to Google Drive is itself a transfer of meeting data into the User's own Google account, and occurs only where the User has configured that destination and the workspace's external sharing policy permits it.
• Limitations on use: the Company does not sell information received from Google APIs, does not use it for advertising or to build advertising profiles, and does not permit any human to read it except with the User's explicit consent, to the extent necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized. Information received from Google APIs is under no circumstances used to train, retrain, fine-tune or otherwise optimize general AI or machine learning models, whether by the Company or by any sub-processor.
• Protection: all transfers occur over encrypted connections (TLS). Google OAuth access and refresh tokens, and the titles of meetings and calendar events stored by the Service, are encrypted at rest in the Company's database. Other calendar-derived fields, including the snapshot of attendee names, email addresses and RSVP statuses, are stored without field-level encryption in an access-controlled database. Access to a meeting record is limited to the User who owns it, to the members of the workspace it belongs to, and to anyone the User has shared the record with; where a record belongs to no workspace, members of a channel the User has shared it into can also read it. Modification is further restricted by role. Additional technical and organizational measures are described in section 14 below.
• What is stored: for calendar events that contain a recognized Zoom, Google Meet or Microsoft Teams link, the Company stores the event title, start and end time, the meeting link, Google's event identifier and iCalUID, and a snapshot of up to fifty (50) attendees (name, email address and RSVP status). The event description is stored with the calendar entry as plain text, without formatting and limited to four thousand (4000) characters, so that an agenda can be suggested when the User opens meeting preparation and so that names in it can be used as speech-recognition hints as described above; it is not encrypted at field level. Event locations are not stored; they are processed in memory only, in order to detect a meeting link. For operational and troubleshooting purposes the Company's technical application logs record how many calendar events a synchronization returned, broken down by provider and by detected meeting platform, together with the provider's opaque event identifier for a limited number of events whose meeting link could not be recognized. Event titles, meeting links, descriptions, locations and attendees are not written to those logs. The logs are held by the Company's hosting provider, are used only to operate and debug the Service, are not part of the User's account data, and are not used for any other purpose.
• Retention and deletion: a synchronized calendar event creates two records, a calendar entry (event title, description, Google's event identifier, iCalUID, scheduled times and the meeting link) and a conversation record (title and the attendee snapshot, together with any later recording, transcript and summary). Conversation records follow the retention rules in section 9: automatic deletion where neither the owning User nor the company owning the workspace is on a paid plan (marked for deletion thirty (30) days after creation and permanently erased thirty (30) days later, processed in batches that may take correspondingly longer where large volumes are involved), the thirty (30) day window after a trial that ends without a paid subscription, and any retention period configured by the workspace administrator, which replaces the automatic deletion for that workspace. On paid plans, conversation records are retained until the User deletes them, until the User's account is deleted, or until a retention period configured by the workspace administrator expires. Deleting a workspace permanently deletes the conversation records held in it, together with their recordings and other media. When the User deletes a conversation, or requests deletion at privacy@re-voice.io, the record is removed from the Service immediately and permanently erased from the Company's databases and object storage thirty (30) days later; where an erasure operation against external storage fails it is retried automatically up to ten (10) times, after which it is flagged for manual completion. A calendar entry is deleted automatically once no conversation record refers to it any longer, that is, once the last conversation record created from the event has been permanently erased, and otherwise on request to privacy@re-voice.io; where the same event also belongs to another User's conversation record, the calendar entry remains until that record has been erased as well. Deleting the account immediately and permanently erases the User's conversation records, transcripts, participant records and the calendar attendee snapshot, together with the calendar entries that no other User's conversation record refers to. Self-service account deletion cannot be completed while the User owns a company or a workspace that has other members, or owns a company with a workspace that someone else owns; ownership must be transferred first.
• Disconnection and revocation: Google Calendar and Google Drive are separate integrations and are disconnected separately, but a single Google grant covers both surfaces, so revoking it affects both. When the User disconnects one of them, the tokens stored for that integration are deleted from the Company's database, and the Company requests revocation of the Google grant only where no other Google connection still relies on it. Disconnecting Google Drive while Google Calendar remains connected, and disconnecting Google Calendar while Google Drive remains connected, therefore both delete the tokens of the disconnected integration without requesting revocation, so that the remaining connection is not broken; disconnecting the last remaining Google integration requests revocation. Revocation is requested on a best-effort basis, and a failed request does not prevent deletion of the tokens held by the Company. Deleting the account both removes the stored tokens from the Company's database and requests revocation of the Google grant, likewise on a best-effort basis. In every case the User can also revoke the grant themselves at any time at https://myaccount.google.com/permissions. Disconnecting an integration stops further retrieval of data but does not delete records already created from calendar events; those follow the retention and deletion rules stated above.
• 10.2 Microsoft Services When the User connects Microsoft services, the Service uses Microsoft Graph with delegated permissions that the User grants on Microsoft's consent screen. Microsoft Outlook (calendar): the Service requests Calendars.Read, User.Read and offline_access. Calendar events are read, never changed, to list the User's upcoming meetings, to connect the meeting assistant to the correct meeting link and, where the User asks the assistant to book a meeting, to determine when the User is busy. Outlook calendar data is otherwise handled in the same way as the Google Calendar data described in section 10.1. Outlook email (optional): only where email-based meeting preparation is enabled for the Service and the User separately opts in on the Outlook integration card, the Service also requests Mail.Read. It then searches the User's recent messages exchanged with the participants of a meeting the User prepares for, processes them in memory, and transmits a bounded extract to the inference provider described in section 10.1 to draft preparation that only the User sees. The messages themselves are not stored by the Service. The User withdraws this by reconnecting Outlook without the email option or by disconnecting Outlook. Microsoft Teams (work or school accounts only): the Service requests ChannelMessage.Send, Channel.ReadBasic.All, Team.ReadBasic.All and offline_access. The Service lists the names and identifiers of the teams and channels the User belongs to so that the User can choose a destination channel, and stores the chosen team and channel together with the identifier of the User's Microsoft tenant. It posts to that channel only when the User shares a meeting or has switched on automatic sharing, and the posted message contains the meeting title, the AI-generated summary, action items, key highlights and a link to the meeting in ReVoice. The Service does not read messages in Teams. For each post the Company keeps a delivery record containing the Microsoft message identifier, the meeting title and the first two hundred (200) characters of the summary. That record is deleted when the conversation record it belongs to is permanently erased or when the User deletes the account; disconnecting Teams does not delete it. Tokens: access and refresh tokens are stored encrypted. When the User disconnects Outlook, the stored tokens are deleted from the Company's database; when the User disconnects Teams, the stored access and refresh tokens are cleared and the integration is marked as disconnected. Microsoft offers no per-application revocation request for these delegated tokens, so the Company does not send one, and the User can additionally remove the app's consent at https://account.live.com/consent/Manage for a personal Microsoft account or at https://myapps.microsoft.com for a work or school account (the organization's administrator can also remove it). Disconnecting stops further retrieval and posting but does not delete records already created from calendar events or messages already posted to Teams.
• 10.3 Scrive e-signing (optional) Only when the Company has ordered and activated Scrive through ReVoice, an authorised user may review and send a document and recipient details for signing. For this Customer-instructed processing the Customer is controller, ReVoice AI AB is processor and Scrive AB is sub-processor. Scrive receives the approved document, sender and recipient details and signing evidence such as timestamps, status and IP addresses to deliver, sign, seal and make the document available. Core e-signing processing uses the EU locations in the sub-processor list. BankID, other eIDs and SMS codes are not included in this workflow. The Company customer addendum and ReVoice DPA govern instructions, retention, return and deletion. Disconnecting the integration does not cancel invitations or erase provider-held documents, backups or independent recipient copies. Contact ReVoice for support, export or erasure.

11. Special Categories of Personal Data (Sensitive Data)

Voice recognition and voiceprints. ReVoice can create a voiceprint of a person's voice to recognize that person in meetings. The following applies:

• What a voiceprint is: A mathematical representation of a person's voice characteristics, never the audio recording itself. It is biometric data processed to uniquely identify a person, a special category of personal data under Article 9 GDPR.
• How it is created: Only with the person's explicit consent (Article 9(2)(a)), given by reading the consent text and actively ticking a box before anything is recorded. A voiceprint can be created in three ways: a User records their own voice during onboarding or under Settings, a User invites a person who records their own voice and gives their consent, or a User registers a person's voice from an earlier meeting, which is only possible if that person has already given their consent to that User. If a workspace administrator has enabled automatic voice enrollment, voiceprints can also be created for meeting participants with a valid consent, but only from a separately recorded audio track that the meeting platform has tied to that participant, never from the meeting's mixed recording, an imported recording or a browser recording.
• What it is used for: Recognizing the person and labelling their speech with the right name. In meetings with the ReVoice meeting bot, participants' names come from the meeting platform. Automatic recognition and automatic enrollment run only on a separately recorded audio track that the meeting platform has tied to a particular participant, and the speaker is then compared only with that person's own profile, never with other people's voiceprints. No voiceprint is created and no automatic recognition is made from the meeting's mixed recording, imported recordings or browser recordings. The Service does not produce such separate audio tracks today, so automatic enrollment and recognition give no results for today's recordings. A User's own voiceprint is used in that User's own meetings within the same company.
• Scope and validity of consent: A consent applies to the User and the workspace in which it was given, for at most twelve (12) months. A voiceprint without a valid consent is never used.
• Storage and deletion: Voiceprints are stored in the EU, are not shared with third parties and are not used to train AI models. When the consent has expired or been withdrawn, the voiceprint is deleted automatically. The record that consent was given and withdrawn is kept as evidence that the processing was lawful, but contains no biometric data.
• Withdrawal: A User can withdraw their consent and delete their voice profile at any time under Settings > Privacy & Data > Voice profile. An invited person can withdraw their consent by contacting the person who invited them, who deletes the profile, or by contacting privacy@re-voice.io. A workspace administrator can switch off automatic voice enrollment, which deletes the automatically created voiceprints. Speakers already named in earlier meetings are not changed by a withdrawal.
• Controller responsibility: Where ReVoice acts as data processor for meeting content, the Customer, as data controller, is responsible for there being a valid Article 9(2) basis for voiceprints of meeting participants. The Service provides the consent capture: the consent text, the explicit consent and a record of consents given and withdrawn.

Apart from voiceprints, the Service is not otherwise intended for the processing of special-category data. Since meeting conversations may naturally contain such information, it remains the Customer's responsibility, as Data Controller, to ensure an appropriate legal basis and safeguards are in place before applying the Service to sensitive meeting contexts.

12. Children’s Privacy

The Service is not directed to, and is not intended for, persons under the age of eighteen (18). The Company does not knowingly collect personal data from minors. If it comes to our attention that personal data regarding a minor has been collected without proper parental consent, the Company will promptly take steps to permanently delete it.

13. Rights of the Data Subject

As a data subject, you have the right to request access, rectification, erasure, restriction and data portability. You have the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, and you can always object to processing for direct marketing, after which your data is no longer used for that purpose. Where processing is based on consent, you can withdraw it at any time; withdrawal does not affect the lawfulness of processing before it. Contact privacy@re-voice.io to exercise your rights. You do not need a ReVoice account for this, for example if you took part in a meeting a Customer recorded. The Company verifies your identity, and where the request concerns meeting content the Company processes on behalf of a Customer, it is handled according to the Customer's instructions (see section 2.2). Data that also concerns other people, recordings and providers' copies may need to be assessed and provided or erased in separate steps. You can stop receiving marketing email at any time under Settings > Marketing email or through the link in every message. We respond without undue delay and at the latest within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Data needed to create and use an account, such as name, email address and organisation number, is required to enter into and perform the agreement; without it the Service cannot be provided. Accounting data is processed because the Company is under a legal obligation. Providing other data, for example for marketing emails, web analytics or voiceprints, is voluntary.

14. Technical and Organizational Security Measures

The Company implements and maintains appropriate technical and organizational security measures to ensure a level of security proportionate to the risk (Article 32 GDPR). These include:

• Transport encryption (TLS/SSL) and encryption of sensitive tokens at rest.
• Strict authorization controls, Role-Based Access Control (RBAC), and network isolation of production environments.
• Systematic logging, vulnerability analyses, rate-limiting, and proactive protection mechanisms against automated incidents.
• Established routines for the handling and reporting of personal data breaches.

15. Cookies and Similar Technologies

The website and the Service use cookies and browser storage (local storage and session storage). Necessary cookies and storage are used without consent, because the website or the Service does not work without them or because the visitor has asked for the feature. Analytics is used only after the visitor has chosen Accept all in the cookie banner. The table shows what is used:

• Website Analytics: What the Company's own visitor analytics and Cloudflare Web Analytics process, and how long it is kept, is set out in sections 3 and 4.
• Changing or Withdrawing Your Choice: Every visitor, signed in or not, can reopen the cookie banner at any time through Cookie settings in the footer and choose Essential only there to withdraw consent to analytics; the page then reloads so that no analytics script keeps running. Signed-in users can also reset the choice under Settings > Privacy & data. A choice is valid for twelve (12) months. After that, and when the Company changes which cookies are used in a way that requires a new choice, the banner asks again. Withdrawing consent does not affect the lawfulness of processing that took place before.

16. Changes to this Policy

The Company reserves the right to unilaterally revise this Policy. In the event of material changes that affect the rights or obligations of data subjects, the Company will notify this in advance. The updated Policy applies from the date specified in the Policy. If a change requires consent or other action, the Company will obtain this where necessary.