Data and GDPR

In short; details in the privacy policy and pilot terms (both in Croatian).

• Storage, transcription and speaker separation in the EU (Paris region), under EU contracts. Encrypted in transit; at rest with the infrastructure provider's keys (protects against loss of physical media, not against the provider). You are the controller, we are the processor — with an Art. 28 GDPR agreement.
• Language model: decisions and action items are extracted from the text transcript by an external language model — contracting party in the EU, model infrastructure also in the USA, no training on your data. Only the transcript text goes there; the recording never leaves the EU.
• Retention: audio is deleted 90 days after processing, unsent recordings after 30 days (exceptionally longer when it is in your interest, e.g. so a recording is not lost); the minutes stay until you delete them. A recording you delete in the app is unavailable immediately; its copy in storage is permanently removed within 30 days at the latest. Deletion on request within 72 hours (all our copies). The language-model provider deletes the transcript text within 30 days of processing, and may keep content flagged by its safety system for up to 2 years; we cannot shorten that.
• We do not do: emotion or tone analysis, performance scoring or biometric voice templates. All participants must know about the recording — the app asks for this with every submission.