Privacy Policy

How we improve the product

1. Anonymized telemetry. Which features are used, where errors occur, how fast the Service responds, device type and app version, technical request IDs. It never carries audio, video, transcript fragments, summaries, meeting titles, participant names, email addresses, phone numbers, organisation names, or your prompts and outputs.
2. Aggregate figures only. Counts and timings that cannot be matched to a specific user, workspace, or meeting.
3. Never model training. Whatever we measure, none of it is used to train or fine-tune IronMemo's own AI models.

Data you provide

Data we receive automatically

Data from third-party sources

We may receive data from security partners to prevent fraud and abuse, and from payment systems to process transactions.

What AI processing IronMemo performs

Learn more about our AI: ironmemo.com/our-ai.

Third-party AI providers

We use third-party AI providers for processing. The set of providers depends on the meeting language and the type of processing. Each of them operates under enterprise (enterprise / API) modes and contractual terms, including:

• No training — your meeting content is not used to train, fine-tune, or improve third-party providers' models.
• Minimal retention — Zero Data Retention (ZDR) where the provider offers it; otherwise the provider's own limited retention window, published per provider on our Sub-processors page, with a contractual ban on using the data.
• API-only transfer — TLS 1.2 or later, with no data passed to consumer interfaces or open channels.
• Sub-processor role — providers process data strictly under our instructions.
• Processing locations — customer data is stored in Austria (EEA); AI processing takes place in the United States, and in Ireland for certain OpenAI operations.

The current list of sub-processors is published on our Sub-processors page and in Annex III of the DPA. When we add a new sub-processor, we notify account owners and enterprise administrators 30 days in advance.

What is never used to train AI models

IronMemo does not use Customer Content, including recordings, transcripts, summaries, prompts, outputs, uploaded files, or meeting metadata, to train, fine-tune, or improve IronMemo's own AI models or any third-party AI models. This restriction applies to all plans and does not require the user to opt out. The providers listed above process this content only to produce your results, under terms that forbid training on it.

What happens to the feedback you send us

If you rate a result or write to support, we use it to find out what is going wrong. A rating is not a channel for your meeting content:

• a rating on its own tells us that something was wrong, not what was said — meeting content is not attached to it automatically;
• if a fragment of content would help us reproduce a problem, we ask first, and you send it deliberately;
• feedback is never passed to a third-party AI provider for training;
• support correspondence follows the retention period for support requests in section 07.

When we are required to disclose data

We may disclose personal data:

• when required by law, a court order, or a regulator's request;
• to protect the rights, property, or safety of IronMemo, our users, or third parties;
• to prevent fraud, abuse, or violations of our terms;
• as part of corporate transactions (merger, acquisition, reorganization) — with notice to users.

Integrations the customer connects

If a customer connects Zoom, Google Meet, Teams, Slack, Jira, Salesforce, HubSpot, or other services, data may be transferred to those services according to the workspace administrator's settings. Such transfers are performed on the customer's instructions and are governed by the privacy policies of the respective services.

Where data is stored

Retention periods

Enterprise workspaces can set different periods for audio and video and for text materials; the setting is applied by an administrator or owner and covers the whole workspace. When a period set here expires, the automatic deletion job removes the data from active systems within 48 hours. Deletion that you request yourself follows the timeline in “How to request deletion” below. Final deletion always runs in the same order: the data disappears from the interface immediately, leaves the main active systems within 30 days, is removed by the automatic job within 48 hours once a configured period expires, expires from backups by the end of the 30-day backup cycle, and is deleted at each sub-processor within the period published for that provider on our Sub-processors page. The only exception is a documented legal hold or a retention obligation imposed by law.

What happens when a subscription is cancelled

1. Workspace access switches to read-and-export-only mode for 30 days.
2. The administrator can export all data (transcripts, summaries, tasks) to JSON/CSV.
3. After 30 days, workspace data is deleted unless we are legally required to keep it.

How to request deletion

We confirm receipt of the request within 3 business days and complete deletion within 30 days, unless the law requires otherwise. We may ask you to verify your identity before deletion.

Security breach notification

In the event of a confirmed security breach affecting personal data:

• we notify affected customers by email within 72 hours of discovery (in accordance with GDPR Art. 33);
• we notify the relevant supervisory authority within the timeframes required by law;
• we provide a description of the incident, the data affected, the measures taken, and recommendations.

Response times

GDPR: without undue delay, within one month. May be extended by two months for complex requests — with notice.

CCPA / CPRA: within 45 calendar days. May be extended by an additional 45 days — with notice.

Verification

To protect your data, we may ask you to verify your identity before fulfilling a request. If we cannot verify your identity, we will not be able to fulfill the request.

Authorized agents

You may submit a request through an authorized agent. The agent must present written authorization, and we may additionally ask you to verify your identity. Send agent requests to dsar@ironmemo.com.

Appeals

If you disagree with our decision on your request, send an appeal to dsar@ironmemo.com. If the GDPR applies to you, you may also contact the data protection supervisory authority in your country of residence.

How to manage cookies

• Cookie banner on your first visit to the site — choose which cookie categories to allow.
• Browser settings — restrict or block cookies. Some features may not work correctly without strictly necessary cookies.

Responsibility for consent

The workspace administrator and the customer organization are responsible for obtaining meeting participants' consent in accordance with applicable laws, internal policies, and contractual obligations. This includes notifying participants about recording, transcription, AI processing, and storage.

Recording notice

By default, IronMemo enables a visual recording notice (bot name, banner in the meeting platform's interface) where the platform supports it. The administrator can configure notices in workspace settings.

Jurisdictions with stricter requirements

In a number of jurisdictions (California, Germany, Austria, several US states, and others), recording a call requires the consent of all participants. The customer must account for the legal requirements of the countries, regions, and industries where meeting participants are located.

Changes that would need your consent, not just a notice

A notice would not be enough if we ever decided to:

• use meeting content to train AI models, which we do not do today;
• use your data for advertising;
• pass your data to a new independent controller;
• use voiceprints or biometric identification;
• change the purposes of processing to something incompatible with the purpose the data was collected for.

Each of those would require a separate opt-in. None of them is in place today, and none is planned.

Transfer mechanisms (EEA/UK → US)

• Standard Contractual Clauses (SCC) — in place with every sub-processor that processes EU/UK residents' data.
• Data Processing Addendum (DPA) — available to enterprise customers on request at dpa@ironmemo.com.

Who is responsible inside IronMemo

Privacy is owned by an internal Privacy Officer function within Legal and Compliance. We publish the function rather than a person's name. It is responsible for data subject requests, privacy complaints, privacy reviews of sub-processors, the record of processing activities, updates to this Policy, coordination with Security, and international transfer assessments. IronMemo has not appointed a statutory Data Protection Officer under GDPR Article 37 or an EU representative under Article 27; each appointment would follow a documented assessment before any commercial launch in the European Economic Area. Reach the function at privacy@ironmemo.com.

Right to contact a supervisory authority

If the GDPR applies to you, you may contact the data protection supervisory authority (Data Protection Authority) in the country of your residence, your place of work, or the alleged violation.