# Privacy notice

> **Draft: needs the owner's lawyer review.** Not legal advice. Replace every `<...>` before publishing. It describes what the repository
> does today; counsel decides the legal bases, wording and any missing sections. Roles: processor for customer content, controller for account and billing data.

**Controller of account and billing data:** <Provider legal name>, <registered address>, <company number>. Contact for privacy questions: <privacy contact email>.
**Data protection officer or representative (UK, EU):** <name and address, or "not appointed">.
Effective **<date>**.

## 1. Two roles
- **Customer content** (what people say to the agents, meeting audio and transcripts, task inputs and outputs): we process it for the
  customer on its instructions, as a processor. The customer's own privacy notice to its staff and guests applies; our terms are the
  DPA (the Data Processing Agreement). Requests about this data go to the customer first.
- **Account and billing data** (sign-in identity, contact details, subscription and invoices): we decide why and how, as a controller.

## 2. What we process
| Data | Examples | Where it comes from | Role |
|---|---|---|---|
| Account | Name, work email, identity provider ids, role assignments | The customer's admin or the person at sign-up (Microsoft Entra or Google sign-in) | Controller |
| Billing | Company name, billing contact, plan, seats, invoices | The customer | Controller (Stripe controls its own payment data) |
| Chat | Messages to Bill or Ben in Teams, answers, task records | The person | Processor |
| Meetings | Audio, transcript, chat messages of meetings the agent joins, participant names | Teams meeting through Attendee | Processor |
| Agent work | Task inputs and outputs, files in the sandbox, agent session files, company library documents | The person or the customer | Processor |
| Usage and logs | Meter counts, model usage records, service logs | Our services | Controller for billing meters; processor for model logs |
| Audit | Who did what and when (logins, setting and role changes, denied requests, exports, deletions) | Our services | Controller (security and accountability) |
| Sign-up and enquiries | Name, work email and company given on the sign-up or contact form, plan asked about | The person | Controller. <Counsel review> |
| Website visits | Page, referrer, browser and country class, and clicks on the sign-up and sales buttons, counted by our own Umami with no cookie and no stored IP address (a visitor id is a hash that changes daily). Switch it off with the link in the website footer, or with Do Not Track. <Counsel review: confirm this fits the audience-measurement exemption of your supervisory authority> | Visitors | Controller |
| Website errors | The text and stack trace of a script error in your browser, sent to our own GlitchTip with no user data, no cookies and IP scrubbing switched on. <Counsel review> | Visitors | Controller |

## 3. Why, and on what legal basis
<Counsel fills this table. The repository does not decide legal bases.>

| Purpose | Data | Legal basis |
|---|---|---|
| Provide the service the customer ordered | Account, chat, meetings, agent work | <contract / legitimate interests / other> |
| Take payment and issue invoices, keep tax records (usage and billing records are kept 7 years) | Billing | <contract; legal obligation> |
| Security, abuse prevention, audit trail | Audit, logs | <legitimate interests> |
| Meeting recording and transcription | Meetings | <customer's basis as controller; see the meetings DPIA> |
| Marketing email, if any | Contact | <consent / legitimate interests / not used> |
| Answer sign-up and contact requests | Sign-up and enquiries | <contract steps at the request of the person; legitimate interests> |
| Understand which pages and buttons work; keep the website working | Website visits, website errors | <legitimate interests; counsel confirms whether consent is needed> |

## 4. Who receives data
The sub-processors and where they process are listed in the Sub-processors list; customers get 30 days notice of a change.
Categories: cloud hosting (Hetzner), language model vendors (Anthropic, OpenAI, Google), speech services (Deepgram, ElevenLabs),
Microsoft (Teams, Graph, sign-in), sandbox and web tools (E2B, Exa, Firecrawl), payments and tax (Stripe), monitoring (Better Stack)
and email delivery (<SMTP provider>). A customer can exclude a model vendor with its model allow-list in the console. Transfers outside the
UK or EEA rely on <SCCs / UK Addendum / adequacy decision: counsel decides>.

## 5. AI use
People talk to AI agents named "Bill (AI)" and "Ben (AI)". The agent says it is an AI assistant before its first answer in a Teams
conversation and when it joins a meeting (see the AI transparency notice). Automated decisions with legal or similarly significant
effects on a person: <counsel confirms there are none>.

## 6. How long we keep data
Defaults a customer can change per data class in the console (section "Data classes and retention"):

| Data class | Default |
|---|---|
| Meeting transcripts and recordings | 90 days |
| Chat, agent sessions, task journal | 365 days |
| Model logs | 365 days |
| Usage records | 7 years (tax) |
| Knowledge documents | Until the customer sets a policy or deletes them |
| Audit log | Pruned nightly by the retention job once older than your plan's period: 365 days on Trial and Team, up to 2555 days (7 years) on Business and Enterprise. <owner to confirm the period promised> |
| Sign-ups never verified | 30 days <owner to confirm> |
| Contact-form enquiries | 24 months <owner to confirm> |
| Website visit counts and error reports | Counts: kept as aggregate numbers; error reports: 30 days <owner to confirm the count period> |
| Backups | Encrypted copies are kept by rotation: 7 daily, 4 weekly and 12 monthly, so up to about 12 months. They are not edited when you ask for erasure; erased data leaves them as old copies expire. <owner to confirm the period promised> |

A nightly job deletes expired data from our database, the agents' working storage, the company knowledge base, meeting recordings and
transcripts, and model logs. When a tenant is deleted, its data, agent storage, model access and sign-in organisation are removed; the
Stripe customer is kept in a minimal form for tax.

## 7. Your rights
Access, rectification, erasure, restriction, portability, objection, and complaint to a regulator (<ICO / your EU authority>).
- **Account and billing data:** write to <privacy contact email>.
- **Customer content:** ask your employer or the organisation that invited you; we help them answer within the legal time limit.
- A tenant administrator can request an export or deletion in the console (Privacy page); the export is delivered within 72 hours.
  Erasing one person's meeting audio and transcript is not possible in Attendee today,
  so such a request is refused with an explanation until a policy is decided: <counsel and owner decide>.

## 8. Security
Per-tenant isolation (the database hides one tenant's rows from another, and each tenant has a separate agent environment), a permission check on every action, a tamper-evident audit log,
encryption in transit and backups. The full measures are Annex 2 of the DPA.

## 9. Cookies and the console
The console uses a session cookie needed to keep you signed in. The marketing website sets no cookies. Its visit counts (Umami) and error reports (GlitchTip) run on our own servers, use no cookies and no device storage except one flag that remembers your choice to switch counting off. <Counsel and owner confirm whether any other cookies exist.>

## 10. Changes
We post changes here and tell customers <by email, 30 days before material changes>.