Privacy Policy

Last updated: 25 April 2026

1. Data Controller

Quentin Lemarié, sole proprietor
Email: privacy@aurascribe.com
Located in France

If you have questions about this policy or wish to exercise your data rights, contact us at the email above.

2. What Data We Collect

When you use auraScribe, including its Meeting Bot feature, we may collect and process the following categories of personal data:

Category	Description	Source
Account data	Name, email address, authentication credentials	Provided by you at registration
Audio recordings	Meeting audio captured by the Meeting Bot	Microsoft Teams, Google Meet via Meeting BaaS (Spoke)
Transcripts	Verbatim text generated from audio	Generated by Gemini AI from recordings
Speaker profiles	Speaker identification labels linked to voice segments	Generated by AI diarisation
Behavioural analysis	Structured observations about communication patterns (e.g., speaking time, interruptions, question frequency)	Generated by AI analysis
Meeting metadata	Date, time, duration, platform, participant count	Collected automatically during recording
Usage data	Feature interactions, session data, error logs	Collected automatically

For detailed information about which of these data categories are shared with third-party processors, see Section 3: Third-Party Audio & AI Data Processing.

3. Third-Party Audio & AI Data Processing

auraScribe uses third-party services to process your audio and generate analysis. No data is sent to any third party until you have provided explicit consent via the in-app consent dialog. This section describes exactly what data is shared, with whom, for what purpose, and how it is protected.

3.1 Google Gemini (Google LLC)

3.1.1 What data is sent

• Audio recordings you upload, record, or import
• Transcripts generated from your audio
• Speaker voice characteristics used for diarisation (distinguishing who spoke)
• Speaker names, roles, companies, and other metadata — whether identified by the AI or provided by you
• Behavioural audio cues extracted during analysis (tone, pace, hesitations, interruptions, laughter)
• Context you provide: meeting notes, speaker database entries, organisation database records, and context library files
• Follow-up questions you ask in chat about your analysed conversation

3.1.2 Who receives this data

Google LLC, via the Gemini API (models: Gemini Flash and Gemini Pro). Data is transmitted to Google’s API endpoints over encrypted connections (TLS 1.2+).

3.1.3 Why this data is sent

• Transcription: Audio is sent to produce a verbatim transcript with speaker diarisation
• Speaker identification: Audio and transcript are sent to identify speakers by name, role, and company
• Behavioural analysis: Audio and transcript are sent to generate an exhaustive log of conversational dynamics — communication patterns, interaction flow, speaking styles, and interpersonal signals
• Summary and coaching insights: Transcript and behavioural cues are sent to produce executive summaries, structured summaries, per-speaker remarks, and coaching observations
• Follow-up Q&A: Your questions about the analysis are sent alongside the conversation context to generate relevant answers

3.1.4 Data protection

Google processes auraScribe API data under their Data Processing Addendum, which includes Standard Contractual Clauses for international transfers. Google is certified under the EU-US Data Privacy Framework.

Under Google’s Gemini API Terms of Service for paid API usage, data sent via the API is not used to train Google’s models. Audio files and cached data are retained by Google only for the duration necessary to complete the requested processing and are not stored permanently by Google after the API call completes. Temporary data caches used for follow-up analysis are retained only for the duration of your active session, after which they are automatically deleted.

3.1.5 Your control

• You can decline consent — the app will not send any data to Google Gemini
• You can delete your account and all associated data at any time (see Section 8)
• You can request data export under GDPR Article 20

3.2 Meeting BaaS by Spoke (Spoke Technologies)

3.2.1 What data is sent

• Meeting URLs you provide (e.g. Zoom, Google Meet, Microsoft Teams links)
• Audio recordings captured by the meeting bot during live meetings
• Meeting metadata (participant names if visible, meeting title, duration)

3.2.2 Who receives this data

Spoke Technologies, via the Meeting BaaS API. The meeting bot joins the meeting on your behalf, records the audio, and transmits it to auraScribe’s servers for processing.

3.2.3 Why this data is sent

• Meeting recording: To capture audio from live meetings you request to be recorded
• Delivery: To transmit the recorded audio to auraScribe’s secure storage for subsequent analysis via the pipeline described in Section 3.1

3.2.4 Data protection

Meeting BaaS processes data under their service terms. Recorded audio is transmitted to auraScribe’s secure cloud storage (Google Cloud Storage) promptly after the meeting ends and is not retained by Spoke beyond the delivery period. Once delivered, the recording is stored in your personal, isolated storage path and is subject to the same protections described in this privacy policy.

3.2.5 Your control

• Meeting bot recording is entirely opt-in — you must explicitly request a bot to join a meeting
• You can remove the bot from a meeting at any time
• You can delete any bot recording from your library at any time

3.3 In-App Consent Mechanism

Before any audio is processed or any data is sent to the third-party services described above, you must explicitly consent via an in-app dialog. This dialog:

• Identifies Google Gemini by name as the AI processor
• Describes the categories of data that will be sent
• Requires checkbox acceptance before you can proceed
• Links to this privacy policy and to our AI Transparency Notice for further detail

Your consent is recorded in your account profile with a timestamp. You cannot use the app’s audio processing features without consenting. Consent is requested once and persisted — you are not re-prompted on every use.

4. Legal Basis for Processing

4.1 Direct Users (Account Holders)

If you create an auraScribe account and use the service, we process your data on the basis of contract performance (Art. 6(1)(b) GDPR) — the processing is necessary to provide the service you signed up for.

4.2 Meeting Participants (Non-Users)

When our Meeting Bot joins a meeting, it may process the personal data of participants who are not auraScribe account holders.

We rely on legitimate interest (Art. 6(1)(f) GDPR) — both our own interest in providing the meeting analysis service to our users, and the meeting host’s interest in creating accurate meeting records, transcriptions, and obtaining communication insights. We balance these interests against participants’ rights through the following safeguards:

• In-meeting notice: The bot posts a clear entry message: “auraScribe (AI) is recording this meeting for notes and conversational coaching. Info: https://aurascribe.com/privacy”
• Identifiable bot name: The bot joins as “[User’s first name]’s auraScribe Notetaker”, making it clear a recording tool is present.
• Right to object: Any participant may ask the meeting host to remove the bot. The host can remove it at any time.
• Data minimisation: We process audio solely for the purposes described in this policy. Recordings are not used for training AI models, sold to third parties, or used for advertising.
• Participant rights: Non-user participants may exercise their data rights by contacting us at the email above.

4.3 Usage Analytics & Cost Monitoring

We log per-session usage metrics (API token counts, processing engine used, estimated processing cost, audio duration, and your user ID) to monitor service costs and detect anomalies. This data contains no audio, transcripts, or analysis content — only operational metadata. This processing is based on legitimate interest (Art. 6(1)(f)). Usage metrics are stored in Google Cloud Firestore (EU region: europe-west1).

The data controller (developer) may access usage metrics and user account data via the Google Cloud Console for service operation, troubleshooting, and support purposes. Access is protected by multi-factor authentication and Cloud Audit Logs.

4.4 Other Processing

For analytics, security, and service improvement, we rely on legitimate interest (Art. 6(1)(f)). For any processing not covered above, we will obtain your consent (Art. 6(1)(a)) before proceeding.

5. How We Use Your Data

We process personal data for the following purposes:

1. Transcription — Converting meeting audio to text
2. Speaker identification — Labelling who said what using voice diarisation
3. Meeting summaries — Creating structured notes from transcripts
4. Conversational coaching — Analysing communication patterns to provide behavioural observations for self-improvement
5. Service operation — Account management, authentication, support
6. Security and abuse prevention — Detecting and preventing unauthorised use

6. Third-Party Processors

For complete details about data shared with Google Gemini and Meeting BaaS, including what data is sent, why, and how it is protected, see Section 3.

We use the following sub-processors to deliver the service:

Processor	Purpose	Location	Safeguards
Google Cloud Platform (GCP)	Audio storage (Cloud Storage), database (Firestore), hosting (Cloud Run)	EU (europe-west regions)	EU Standard Contractual Clauses; Google Cloud Data Processing Addendum
Google Gemini AI	Audio recordings, transcripts, speaker metadata, behavioural audio cues, user-provided context, and follow-up chat messages — for transcription, analysis, and behavioural observation generation	EU/US	Google Cloud Data Processing Addendum; EU SCCs
Meeting BaaS by Spoke	Meeting Bot deployment — joins meetings, captures audio	US	Data Processing Agreement; EU SCCs

All sub-processors are bound by data processing agreements that require them to process data only on our instructions and implement appropriate security measures.

7. International Data Transfers

Your data is primarily stored and processed within the European Union (Google Cloud europe-west regions). Where data is transferred outside the EU/EEA (e.g., to US-based sub-processors), we rely on EU Standard Contractual Clauses (SCCs) as adopted by the European Commission, supplemented by technical measures including encryption in transit and at rest.

8. Data Retention and Deletion

• User-controlled retention: You may delete your recordings, transcripts, and analysis at any time through the auraScribe interface. We do not impose a fixed retention period — you decide when to delete.
• Account deletion: If you delete your account, all associated data (recordings, transcripts, analyses, speaker profiles) is deleted within 30 days.
• Backup retention: Deleted data may persist in encrypted backups for up to 30 days before being permanently purged due to standard cloud infrastructure backup cycles.
• Non-user participant data: If a meeting participant who is not an auraScribe user requests deletion of their data, we will delete all identifiable data associated with them within 30 days of a verified request.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right	GDPR Article	Description
Access	Art. 15	Request a copy of all personal data we hold about you
Rectification	Art. 16	Request correction of inaccurate data
Erasure	Art. 17	Request deletion of your data (“right to be forgotten”)
Restriction	Art. 18	Request that we limit how we process your data
Portability	Art. 20	Receive your data in a structured, machine-readable format
Objection	Art. 21	Object to processing based on legitimate interest
Complaint	Art. 77	Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at privacy@aurascribe.com. We will respond within 30 days.

Supervisory authority: If you are unsatisfied with our response, you have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) — www.cnil.fr — or your local supervisory authority.

10. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS) and at rest (AES-256)
• Access controls and authentication for all systems
• Regular security reviews
• Sub-processor security assessments

No system is perfectly secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority as required by GDPR Art. 33–34.

11. Children

auraScribe is not intended for use by anyone under 16 years of age. We do not knowingly collect data from children. If you believe a child’s data has been processed through our service, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notification. The “Last updated” date at the top reflects the most recent revision.

← Back to auraScribe