Privacy Policy

1. Information we collect

Information you provide

• Account information. Your email address, display name, and password (stored as a one-way hash, never in plain text) when you create an account.
• Authentication data. If you sign in with Apple or Google via Firebase Authentication, we receive your name and email as provided by the identity provider.
• Audio and video files. The recordings you upload or record in the app for transcription. These may include the voices of meeting attendees, clients, and other participants.
• Transcript and meeting data. Titles you assign, company names, notes, generated transcripts with speaker labels, AI-generated summaries, action items, and formal minutes.
• Chat messages. The questions you ask and responses you receive when chatting with your transcripts.
• Waitlist information. Your email address (and optionally your name) if you join our waitlist before creating an account.
• Subscription information. Your subscription tier and status, managed through our payment provider.

Information collected automatically

• Usage data. The number and duration of transcriptions you process, used to enforce plan limits and bill correctly.
• Device and technical data. IP address, device type, operating system, and app version, collected in server logs for security and troubleshooting.

2. How we use your information

• To provide the Service — transcribing your audio, identifying speakers, generating minutes, and powering AI chat.
• To create and manage your account and authenticate you across devices.
• To sync your transcripts and minutes across your devices via cloud storage.
• To track usage against your plan's limits and process subscription payments.
• To send you service-related emails (verification codes, password resets, and important account notices).
• To maintain and improve the Service, including debugging and resolving technical issues.
• To detect, prevent, and address fraud, abuse, and security issues.
• To comply with our legal obligations.

We do not sell your personal information or your audio content to anyone.

3. Third-party services

We rely on trusted third-party providers to deliver the Service. Each provider processes data only as needed to perform their function, under their own privacy policies. We require every provider that receives your content — including our AI providers, AssemblyAI and DeepSeek — to protect it to the same or an equal standard as we do: to use it only to deliver the feature you asked for, never to sell it, never to use it to train their own AI models, and to delete or discard it once processing finishes.

• Amazon Web Services (S3). Stores your uploaded audio files, generated transcripts, and exported PDFs. Data is stored in the EU (Ireland) region.
• AssemblyAI. Processes your audio to produce transcripts with speaker diarization. Audio is sent to AssemblyAI for transcription and deleted from their servers immediately after processing completes.
• DeepSeek. Powers all AI features — minutes generation, summaries, action items, AI chat, and document editing. DeepSeek is our sole AI provider.
• Recall.ai. Sends the notetaker bot into your meetings and returns the audio, transcript, and participant data. Also syncs your connected Google or Microsoft calendar. Processes this data only to provide those functions, under its own privacy policy.
• Google Firebase. Provides authentication when you sign in with Apple or Google.
• RevenueCat. Manages subscription billing and entitlements for in-app purchases.
• Email delivery. Used to send verification codes, password resets, and account notifications.

4. Google Calendar data

If you choose to connect your calendar, we access a limited part of your Google Calendar so the notetaker can join your meetings automatically instead of you pasting each meeting link by hand. This section describes exactly what we access and what we do with it.

What we access

• Event titles. Used to label the meeting in your history and in your minutes.
• Start and end times. Used to schedule the notetaker to join at the right moment.
• Conferencing links. The Google Meet or other video link attached to the event, so the notetaker knows where to join.
• Your calendar email address. Used to show which account is connected.

We request the read-only scope calendar.events.readonly. We donot read event descriptions, attendee lists, attachments, or any other calendar content, and we never create, edit, or delete events on your calendar. We do not request access to any other Google service.

How we use it

Solely to provide the calendar feature you asked for: identifying which upcoming meetings have a conferencing link, scheduling the notetaker for them, and labelling the resulting transcript and minutes. Calendar data is not used for advertising or profiling, and it is never sold.

Who it is shared with

Calendar synchronisation is operated by our meeting-bot provider, Recall.ai. When you connect a calendar, your OAuth credentials are held by Recall.ai, which syncs your events and reports them back to us so the notetaker can be scheduled. Recall.ai processes this data only to provide that function, under its own privacy policy.

In addition, the meeting title is included when generating your transcript summary and minutes, which are produced by our AI provider,DeepSeek. DeepSeek does not use your data to train its models. No other calendar data is sent to DeepSeek, and no other third party receives your calendar data.

How it is protected

OAuth credentials are encrypted at rest, transmitted over TLS, and scoped to your account. No other user can access your calendar data.

Retention and deletion

Scheduled-meeting records are kept only until the meeting has passed. Disconnecting a calendar immediately revokes the connection with Google, deletes the stored credentials, cancels any scheduled notetaker, and stops all further syncing. Deleting your account does the same for every connected calendar.

Limited Use

Our use of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. Specifically: we do not use Google user data for advertising, we do not sell it or transfer it to data brokers or advertisers, and we do not use it to develop, improve, or train AI/ML models.

5. Data storage & location

Your account data and transcripts are stored in a PostgreSQL database hosted in the EU (Ireland) region on Amazon Web Services. Your uploaded audio files and generated PDFs are stored in AWS S3 in the same region. Data is encrypted at rest using AWS-managed encryption (AES-256) and in transit using TLS.

6. Data retention

You control your data. We do not retain your content longer than necessary, and you can delete anything at any time — we never hold your data hostage.

• Audio on third-party servers. Audio sent to AssemblyAI for transcription is permanently deleted from AssemblyAI's servers immediately after transcription completes — not retained on their infrastructure at all.
• Audio files on our servers. Raw audio files are deleted immediately after transcription completes. We do not keep your audio — once the transcript is produced, the audio is gone from our servers too.
• Transcripts & minutes. You decide how long to keep your transcripts and minutes. You can delete any transcript or minutes document at any time with one click — we do not control this. If you want automatic cleanup, you can enable "auto-delete" in your account settings and your transcripts and minutes will be deleted after 30 days. If auto-delete is off, they remain until you choose to delete them. You are always in control.
• AI processing data. When you use AI features (minutes generation, chat, document editing), your transcript text is sent to DeepSeek for processing. DeepSeek does not retain your data after processing — it is not used to train their models and is discarded after the response is returned.
• Chat sessions. You can delete any chat session at any time — immediately, with one click. We do not retain chat sessions after you delete them.
• Account data. Retained for as long as your account is active. You can delete your entire account and all associated data at any time (see Your rights).
• Waitlist data. Your email is retained until you ask us to remove it or until you create an account, at which point it is associated with your account.
• Server logs. Retained for up to 90 days for security and troubleshooting. Log entries do not contain transcript or minutes content.

7. AI processing

CosecScribe uses AI to transcribe your audio, identify speakers, generate summaries and minutes, and answer your questions. We use two AI providers:

• AssemblyAI — transcribes your audio into text with speaker identification. Your audio is sent to AssemblyAI for processing and permanently deleted from their servers immediately after transcription completes. AssemblyAI does not retain your audio.
• DeepSeek — powers all other AI features: minutes generation, summaries, action items, AI chat, and document editing. When you use these features, the relevant transcript text is sent to DeepSeek for processing. DeepSeek does not use your data to train their models and discards it after processing.

We share only the data needed to perform the requested function — never more. We do not use your audio or transcripts to train AI models ourselves.

Your permission. Before any of this content leaves your device, the app shows you exactly what will be sent and who it is sent to, and asks for your explicit permission. You can review or withdraw that permission at any time in the app under Profile → AI Data Sharing. If you do not agree, transcription, minutes and AI chat stay switched off — nothing is sent to AssemblyAI or DeepSeek.

8. Security

We take the following measures to protect your data:

• Encryption in transit. All data sent between your device and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest. Data stored in our database and file storage is encrypted using AWS-managed AES-256 encryption.
• Per-user data isolation. Each user's transcripts, minutes, and chat sessions are scoped to their account. No other user can access your data.
• Hashed passwords. Passwords are stored as one-way hashes — we never see or store your plain-text password.
• Scoped IAM credentials. Our infrastructure uses least-privilege access controls.
• No transcript content in logs. Server logs contain metadata only (timestamps, request IDs, status codes) — never the content of your transcripts or minutes.
• Immediate third-party deletion. Audio is deleted from AssemblyAI's servers the moment transcription completes — not retained, not queued for later deletion.

No method of transmission or storage is completely secure, but we work to protect your information using industry-standard practices. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

9. Enterprise data protection

For enterprise and organisational clients, we provide additional data protection commitments:

• Organisation-scoped data. Minutes and reviews shared within an organisation are visible only to organisation members. Drafts are visible only to the drafter. Pending reviews are visible only to the assigned reviewer. Approved minutes are visible to participants.
• Role-based access control. Organisation owners and admins manage member roles (reviewer, approver). Members cannot access data outside their role.
• Self-review prevention. A drafter cannot review or approve their own minutes — the system enforces independent review.
• Data Processing Agreement. Enterprise clients may request a DPA specifying data handling, retention, and deletion terms.
• Audit trail. Enterprise review workflows track who submitted, reviewed, commented, approved, or bounced minutes, and when.
• Bulk deletion. Organisation owners can request deletion of all organisation data at any time.

10. Your rights & choices

Depending on where you live, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate or incomplete information.
• Erasure. Request that we delete your account and associated data.
• Restriction. Ask us to limit how we use your data in certain circumstances.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to certain processing of your data.
• Withdrawal of consent. Where processing is based on consent, withdraw it at any time.

You can delete individual transcripts and chat sessions directly in the app at any time. To delete your entire account or exercise any of the rights above, email us at hello@cosecscribe.com. We will respond within 30 days.

If you are in the UK or EU and you believe we have not handled your data correctly, you have the right to complain to your local data protection authority — for example, the UK Information Commissioner's Officeor your national supervisory authority under the GDPR.

11. Children's privacy

The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe we have collected data from a child, please contact us and we will delete it promptly.

12. International data transfers

Your data is stored and processed in the EU (Ireland) region on AWS. Our AI providers (AssemblyAI and DeepSeek) process data in their own infrastructure. Audio sent to AssemblyAI is deleted immediately after transcription. Data sent to DeepSeek for AI features is discarded after processing. We rely on appropriate safeguards, including the EU Standard Contractual Clauses where applicable, to ensure your data is protected when transferred internationally.

13. Cookies

Our website uses minimal cookies and does not use advertising or tracking cookies. We do not use analytics or advertising networks on the website. Any cookies used are strictly necessary for the site to function. The mobile apps do not use cookies.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify you via email or in-app notice. We encourage you to review this page periodically.

15. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Email: hello@cosecscribe.com
Website: cosecscribe.com