This Privacy Policy explains how Senseloom Solutions s.r.o. collects and uses personal data when you visit our website, when you contact us, and when you use the Senseloom product. It also explains your rights.
Who we are
Senseloom Solutions s.r.o., registered office Korunni 2569/108, 101 00 Prague, Czech Republic, company ID 24201863, registered in the Commercial Register kept by the Municipal Court in Prague, file number C 188220 (Senseloom, we, us).
For every question about personal data, and to use your rights, write to support@senseloom.com.
In this policy, the Website is senseloom.com, and the Application is the Senseloom product that you use after you sign in. The Terms of Service apply to the use of the Application.
Controller and processor
We have two roles under the General Data Protection Regulation (GDPR):
- Controller. We decide why and how we use the data about the visitors of the Website, about the people who contact us, and about the users of the Application (account, billing, usage and support data). This policy describes that use.
- Processor. A customer uploads recordings to the Application. For the personal data in the recordings, and in the transcripts and results that the Application makes from them, the customer is the controller and we are the processor. We process this data only on the instructions of the customer, under the data processing terms in the Terms of Service.
If you are a person in a recording that a customer uploaded, the customer decides how that recording is used. Send your request to that customer. If you write to us, we send your request to the customer when we can identify it, and we help the customer to answer you.
Personal data that we collect
When you visit the Website
- Technical data that your browser sends with each request: the IP address, the browser and device type, the page, and the time. Our hosting provider processes this data to deliver the Website and to protect it.
- Anonymous statistics: the pages that are visited, the referring site, the country, the device type, and loading times. These statistics use no cookies. A visitor is counted with a hash that is valid for one day and cannot follow a person across days or websites.
- Anonymous error reports: the error message, the technical details of the error, and the page address without its query part. They contain no IP address, no cookie and no user ID.
- Your cookie choice, which the cookie banner stores. To show the banner, your browser loads scripts from Google Tag Manager and from the provider of the banner when you open a page. These requests contain technical data such as the IP address.
- Only after your consent: the data that Google Analytics and Google Ads collect through cookies, such as a cookie identifier, the pages that you visit, and whether a visit leads to a sign-up.
When you contact us
- Contact form: your name, your email address, your company (if you give it), your message, the page that sent you to the form, and the campaign parameters of the link that brought you to the Website.
- Chat: your email address, which we confirm with a one-time code, and your messages. If you are signed in, the chat gets your verified email address, your user ID and your organization from the Application.
- Email: your email address and what you write to us.
Do not put recordings, transcripts or other confidential content into a support message. What you write there goes to our support inbox like any other message.
When you use the Application
- Account: your name, your email address, your profile picture when you sign in with Google, your sign-in method, and whether your email address is verified. Our sign-in provider stores your password in protected form. We cannot see it.
- Sign-in records: the time, the IP address and the browser of a sign-in, which our sign-in provider keeps to protect your account.
- Organization: the name of your organization, your role and status in it, invitations, and the workspaces that you have access to.
- Activity: the last time that you used the Application, who uploaded a recording or created a project, your display preferences, and your last 10 searches in each organization.
- Connected AI apps: the name of each app that you connected, the time of the connection and of the last use, and a protected form of its access key.
- Error reports: the error message, the technical details of the error, the page address without its query part, your user ID, and technical data of your browser.
- Only after your consent: product analytics, which record the pages of the Application that you open, linked to your user ID. They never contain names, email addresses or content.
We get most of this data from you. We get your email address from an admin who invites you. We get your name and your profile picture from Google when you sign in with Google.
When your organization buys credits
- The plan, the credit balance, and the history of purchases, usage, returns and expiry of credits.
- For each purchase: the number of credits, the amount, the currency, the tax, the time, and the payment reference that the merchant of record gives us.
- The emails that we send to the admins about the trial and the credit balance.
The merchant of record for the credits collects the payment details, the billing address and the tax data. We do not receive or store your full card number.
Content that customers upload
For this data we are the processor:
- Audio recordings, with their file name, size, format and length, and the cover image when the file contains one.
- Transcripts with speaker labels and the detected language.
- AI summaries, categories, sentiment and topics.
- The names and descriptions of projects and workspaces.
A recording can contain any personal data that the people in it say, also special categories of data such as health data. The customer decides what to upload.
Why we use personal data
This section applies to the data for which we are the controller.
Provide the Application: accounts, organizations, workspaces, and the processing of recordings.
Data: Account, organization and activity data.
Legal basis: Contract (GDPR Art. 6(1)(b)). For the members of a customer's organization: our legitimate interest in providing the Application to that customer (Art. 6(1)(f)).
Count the use of credits, record purchases, and keep accounting records.
Data: Billing data.
Legal basis: Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
Send service emails about the trial, the credit balance, invitations and changes to our terms.
Data: Account and billing data.
Legal basis: Contract (Art. 6(1)(b)) and our legitimate interest in keeping customers informed (Art. 6(1)(f)).
Answer questions and give support.
Data: Contact and support data.
Legal basis: Steps before a contract and contract (Art. 6(1)(b)), and our legitimate interest in answering requests (Art. 6(1)(f)).
Find and correct errors, and keep the Website and the Application secure.
Data: Error reports, sign-in records and technical request data.
Legal basis: Our legitimate interest in a working and secure service (Art. 6(1)(f)). Error reports do not depend on the analytics consent. They store nothing on your device.
Understand how customers use the Application, so that we can support them and prevent misuse of free offers.
Data: Organization data, the time of the last use, and billing data.
Legal basis: Our legitimate interest in running and protecting the service (Art. 6(1)(f)).
Measure the use of the Website without cookies.
Data: Anonymous statistics.
Legal basis: Our legitimate interest in improving the Website (Art. 6(1)(f)).
Product analytics in the Application.
Data: Analytics events linked to the user ID.
Legal basis: Your consent (Art. 6(1)(a)).
Website analytics and the measurement of advertising with Google cookies.
Data: Cookie identifiers and visit data.
Legal basis: Your consent (Art. 6(1)(a)).
Protect our rights, handle disputes, and obey the law.
Data: The data that the case requires.
Legal basis: Our legitimate interest in defending legal claims (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)).
You must give us an email address to create an account. Without it we cannot provide the Application. You can withdraw a consent at any time. The withdrawal does not affect the processing before it.
We do not sell personal data. We do not make decisions about you by automated means alone that have a legal or similarly significant effect on you.
Recordings and AI processing
- Storage. The audio files, the transcripts and the AI results are stored in the European Union.
- Transcription. Our speech recognition provider processes the audio in the European Union. We use its zero retention mode, so it does not keep the content of the audio or of the transcript after the request is completed.
- Backup transcription. When our main provider is not available, we can move new recordings to a backup provider until the incident ends. The first backup processes the audio in the European Union, and we delete the job at that provider after the recording is processed. The second backup can process the audio outside the European Union, with zero data retention.
- Summaries and classification. An AI language model makes the summary, the category, the sentiment and the topics. We send it the text of the transcript and the name of the recording, not the audio. Each request requires zero data retention: it goes only to a model provider that agreed to keep no data after the request, and it fails when no such provider is available. The model providers keep one exception for themselves: they can keep a request that their abuse detection flags, under their own policies. This processing can take place in the United States.
- No training. We do not use recordings, transcripts or results to train AI models, and our providers are not allowed to use them for training.
- Access. Only the people who have access to a workspace can see its recordings. Our team gets access to customer content only when it is necessary to solve a problem that the customer reports, to protect the security of the service, or to obey the law.
Connected AI apps
A user can connect an AI app, for example Claude or ChatGPT, to the Application. The app can read what that user can read: the recordings, transcripts, summaries and classifications in the workspaces that the user has access to. When the user allows it, the app can also add an audio file that the user gives it to a project of the user. Then the provider of the app sends that file to us, and we process it as any other recording. The app cannot change or delete data. The user approves each app in the Application, and can disconnect it at any time on the profile page.
From the moment that the app reads data, the provider of the app processes that data under its own terms and its own privacy policy, and under the account that the user has with it. That provider is not our service provider. We do not control what it keeps or how it uses the data.
Service providers
We use the providers below. Each of them processes personal data for us under a contract and only on our instructions, except where the list says that a provider is a controller.
Providers that process customer content
These are the other processors under the data processing terms.
Convex, Inc.
Purpose: Database and application backend.
Data: Transcripts, summaries, classifications, the names of recordings, projects and workspaces, and the account, organization and credit data.
Location: European Union (Ireland).
Cloudflare, Inc.
Purpose: Storage of the audio files.
Data: Audio recordings.
Location: European Union. The storage is restricted to the EU jurisdiction.
ElevenLabs (Eleven Labs Inc.)
Purpose: Speech recognition. This is our main provider.
Data: The audio of a recording and the transcript that it makes.
Location: European Union (EU data residency). We use its zero retention mode: it does not keep the content of the audio or of the transcript after the request is completed.
Vercel Inc., with OpenAI and Microsoft Azure as model providers
Purpose: AI summaries, categories, sentiment and topics.
Data: The text of a transcript and the name of the recording. We do not send the audio.
Location: Can be the United States. Each request requires zero data retention (see "Recordings and AI processing").
Soniox Inc.
Purpose: Backup speech recognition. We use it only while our main provider is not available.
Data: The audio of a recording and the transcript that it makes.
Location: European Union, for processing and storage. We delete the job at the provider after the recording is processed. If a delete fails, the provider deletes the job after 30 days.
Microsoft, through the AI gateway of Vercel Inc.
Purpose: Second backup for speech recognition. We use it only while our main provider is not available.
Data: The audio of a recording and the transcript that it makes.
Location: Can be outside the European Union. Each request requires zero data retention.
Providers for accounts, payments, email and support
WorkOS, Inc.
Purpose: Sign-in, user accounts, organization membership, and the emails for invitations, email verification and password reset.
Data: Name, email address, profile picture, password (stored in protected form), sign-in method, and sign-in records such as the IP address and the browser.
Location: United States.
Stripe (merchant of record for credit purchases, through its Link service)
Purpose: Payment for credits, tax, receipts and invoices.
Data: Payment details, billing name and address, email address, and the purchase. For this data Stripe is a controller under the privacy policy of Link.
Location: European Union (Ireland) and United States.
Resend (Plus Five Five, Inc.)
Purpose: Delivery of the emails about the trial and the credit balance, of the notice to our support address when an admin deletes an organization, and of contact form messages when our support inbox is not available.
Data: Email address, the name of the organization, and the content of the email. The deletion notice has the name of the organization and the email address of the admin who deleted it.
Location: United States.
Plain (Not Just Tickets Ltd)
Purpose: Our customer support inbox: the contact form, the chat on the website and in the application, and email to our support and sales addresses.
Data: Name, email address, company, the messages, and for a signed-in user the user ID and the organization. We never send recordings, transcripts or summaries to this provider.
Location: United Kingdom. Some of its own providers are in the United States, for example for email delivery and for AI features (at the date of this policy: OpenAI, Anthropic, Baseten and xAI). The AI features process only support messages.
PostHog, Inc.
Purpose: Error reports from the application and the website and, with your consent, product analytics in the application.
Data: Error details, the page address without its query part, the user ID in the application, technical data of the browser, and analytics events after consent.
Location: European Union (Germany).
Google Cloud EMEA Limited (Google Workspace)
Purpose: Our company email. It receives the email to our support and sales addresses before our support inbox does.
Data: Email address and the content of the email.
Location: European Union (Ireland) and United States.
Providers for the Website
Vercel Inc.
Purpose: Hosting of the website and of the application pages, and website statistics and speed measurements without cookies.
Data: Technical request data such as the IP address and the browser, and anonymous usage data.
Location: United States, and the worldwide network of the provider, which answers each request from a location near the visitor.
Google Ireland Limited
Purpose: Google Tag Manager loads the tags of the website. After your consent, Google Analytics measures the use of the website, and Google Ads measures which advertisements lead to a sign-up.
Data: Cookie identifiers, the IP address, the pages that you visit, and technical data of the browser. For Google Ads, Google is also a controller under its own privacy policy.
Location: European Union (Ireland) and United States.
CookieYes Limited
Purpose: The cookie banner of the website. It stores your cookie choice.
Data: Your choice, a consent ID, the time of the choice, your country, and a partly masked IP address.
Location: European Union (Ireland). The provider is a company in the United Kingdom.
Other recipients
We give personal data to authorities and courts when the law requires it, and to our legal, tax and accounting advisers when it is necessary. If our business or a part of it moves to another company, the data moves with it under the same protection, and we tell you before.
Where we process data
We store recordings, transcripts and AI results in the European Union, and standard transcription runs in the European Union.
Some providers in the list above are in the United States or the United Kingdom, or can process data there. This applies, for example, to AI summaries and classification, sign-in, email delivery, payments and customer support. Some providers that store data in the European Union are companies in the United States, and their staff can get access to the data from there when it is necessary for support or security. For a transfer to the United States, we rely on the EU-US Data Privacy Framework when the provider is certified under it, and on the Standard Contractual Clauses of the European Commission in other cases. For the United Kingdom, we rely on the adequacy decision of the European Commission.
Write to us if you want more information about the protection of a specific transfer, or a copy of the clauses.
How long we keep data
Recordings, transcripts and AI results
Until the customer deletes the recording, its project or the organization. A deleted recording is no longer available at once. We then delete the audio file from storage, normally within minutes.
Data of an organization
Until the organization is deleted. A deletion by an admin ends the access of every member at once and then deletes the recordings, workspaces, projects, members and settings of the organization. When we end the service for an organization, we delete its content within 30 days after the end, or after an export that the customer asked for in that time.
Billing records
The name of the organization, the plan, the credit history, the purchase records, and the user IDs of the people who created and deleted the organization stay after the organization is deleted, for the time that accounting and tax law require. This is up to 10 years after the end of the year of the transaction.
User account
As long as the account exists. To delete your account, write to us. We delete it within 30 days, unless you are the only admin of an organization that still exists.
Sign-in records and connected AI apps
Sign-in records stay for the retention period of our sign-in provider, and at most as long as the account exists. The record of a connected AI app stays until you disconnect the app or your account is deleted.
Contact and support messages
3 years after the last message, which is the period in which legal claims can be made.
Error reports and product analytics
For the retention period of our analytics provider, which is at most 2 years.
Backups
Deleted data can stay in the backups of our database provider for up to 14 days. We do not use backups to restore deleted customer content, except to recover from an incident.
Records of actions by our team
We keep a log of the changes that our team makes to customer accounts, for example a gift of credits, as long as we keep the billing records.
We can keep data longer when the law requires it, or when we need it for a legal claim that is open.
Cookies
A cookie is a small file that a website stores in your browser. Local storage is a similar store in the browser. We use them as follows.
On the Website
A cookie banner asks for your choice. Your browser loads the banner and the tag manager when you open a page, before your choice. Until you accept, the Website sets no analytics cookie and no advertising cookie. Our own website statistics use no cookies.
cookieyes-consent
Purpose: Stores your cookie choice on the Website.
Type: Necessary. Kept for 1 year.
Google Analytics cookies (_ga and cookies that start with _ga_)
Purpose: Tell visits and visitors apart, to measure the use of the Website.
Type: Analytics. Only after your consent. Kept for up to 2 years.
Google Ads cookies (for example _gcl_au)
Purpose: Measure which advertisements lead to a visit or a sign-up.
Type: Advertising. Only after your consent. Kept for up to 90 days. The Google advertising cookie IDE is kept for up to 13 months.
Support chat storage (entries that start with plain:)
Purpose: Keeps your chat conversation while you move between pages. It is local storage, not a cookie, and it exists only after you open the chat.
Type: Necessary for the chat. Removed when you sign out of the Application.
You can change or withdraw your choice at any time with the cookie settings of the banner on the Website. You can also delete cookies in your browser.
In the Application
The Application asks you once if you allow product analytics. Without your consent, it sends only error reports, and these store nothing in your browser.
Session cookie (wos-session)
Purpose: Keeps you signed in.
Type: Necessary.
Sign-in cookies (for example senseloom-auth-flow)
Purpose: Protect the sign-in flow and let you try again after an interrupted sign-in. A short entry in the session storage of the browser limits automatic reloads after a session error.
Type: Necessary. Removed after the sign-in, or after 10 minutes.
senseloom-analytics-consent
Purpose: Stores your choice about product analytics.
Type: Necessary. Kept for 1 year.
sidebar_state
Purpose: Remembers if the side menu is open.
Type: Functional. Kept for 7 days.
Product analytics cookie and local storage (names that start with ph_)
Purpose: Recognizes your browser for product analytics.
Type: Analytics. Only after your consent. Kept for up to 1 year.
To change your choice about product analytics, delete the cookie senseloom-analytics-consent in your browser and reload the Application. It then asks you again. You can also write to us.
Your rights
For the data for which we are the controller, you have the right to:
- get a confirmation that we process your personal data, and a copy of it,
- have wrong data corrected,
- have your data deleted,
- have the processing restricted,
- object to processing that is based on our legitimate interest,
- get the data that you gave us in a portable format,
- withdraw a consent at any time.
To use a right, write to support@senseloom.com. We answer within 1 month. We can ask you to confirm your identity. You can change your name on your profile page in the Application.
You can also make a complaint to a data protection authority. In the Czech Republic it is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You can also contact the authority of the EU country where you live or work.
For the personal data in a customer's recordings, send your request to that customer (see Controller and processor).
Security
We protect personal data with technical and organizational measures. These are the main ones:
- The data of each organization is separated from the data of every other organization.
- Each request checks that the user is an active member of the organization and has access to the workspace.
- Audio files are in private storage. The Application issues the link to an audio file only after an access check. The link stays valid until the recording is deleted, so keep it confidential.
- Data is encrypted when it moves between your browser, our systems and our providers.
- Payment details go directly to the merchant of record for the credits and never reach our systems.
- Only the members of our team who need it for their work have access to production systems.
No system is fully secure. If a personal data breach is likely to cause a high risk for you, we tell you without undue delay.
Children's privacy
The Website and the Application are for businesses and for professional use. They are not for people under 18, and we do not knowingly collect account data from them. A customer who uploads a recording that contains the voice of a child is responsible for the legal basis of that recording.
Changes to this Privacy Policy
When we change this policy, we publish the new version on this page and change the date at the top. For a significant change, we tell the admins of each organization by email before the change applies.
Contact us
Senseloom Solutions s.r.o., Korunni 2569/108, 101 00 Prague, Czech Republic.
Write to support@senseloom.com about privacy and support, or to sales@senseloom.com about sales. You can also use the contact page.