1. Who is the controller
The controller of your personal data is [PENDING: name or company name of the owner of GrabaNota], tax ID [PENDING], with registered address at [PENDING]. For any question about your data you can write to [PENDING: privacy contact email].
2. What data we process
- Account data: name, email, language and password (stored hashed, never in clear text). In company accounts, your role and the company you belong to.
- Recordings: the audio you record or upload, its title, date and duration, and the markers you add.
- Generated content: the transcript with its speakers and the results (summaries, minutes, notes and tasks) generated from it.
- Usage data: minutes used, access dates and the technical logs needed to keep the service secure. Technical logs contain no transcripts or audio.
Recordings may contain the voice and data of other people. Whoever records is responsible for telling the attendees that the meeting is being recorded and that the audio is processed with artificial intelligence.
3. What we use it for and on what legal basis
- Providing the service (transcribing, summarising, storing and sending you the results): performance of the contract.
- Emailing you when a recording is ready or there is a problem with it: performance of the contract.
- Keeping the service secure and preventing abuse: legitimate interest.
- Complying with legal obligations, such as tax obligations: legal obligation.
We do not use your recordings to train artificial intelligence models or for advertising.
4. Who else processes the data
To provide the service we use these providers, which act as processors:
- ElevenLabs: audio transcription.
- Anthropic: generation of summaries, minutes, notes and tasks from the transcript.
- Hetzner (Germany): server and audio storage.
- The email provider we use to send notifications.
[PENDING: confirm with legal counsel the data processing agreements, where each provider stores the data and, if there are transfers outside the European Economic Area, their safeguards.]
We do not sell your data or share it with third parties for their own purposes.
5. How long we keep it
- Audio: 5 years from the date of the recording (or from when you uploaded it, if the audio is older). After that it is deleted automatically.
- Transcripts, results and tasks: indefinitely, for as long as the service is provided and your account exists.
- Trash: a recording you delete is permanently removed after 30 days.
- Account deletion: removes all your data within 24 hours, except accounting entries with no content (minutes used and costs).
- Backups: kept for 30 days. Deleted data may remain in a backup until that backup expires.
6. Your rights
You can access your data, rectify it, erase it, object to its processing, restrict it and request its portability.
- Export your data: in "Settings" you can request a file with your profile and your recordings (audio, transcript, results, tasks and markers).
- Delete your account: in "Settings", confirming your password.
- For any other right, write to [PENDING: privacy contact email].
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
Communications are encrypted. Recordings are private by default: only you can see them unless you share them. In a company account, the administrator cannot see members' private content. Support staff only access a recording to check that the system works.
8. Changes to this policy
If we change this policy we will publish the new version here with its date. If the change is significant we will let you know by email.