Privacy policy

DeciDesk is operated by Dennis Heemskerk, Voorhouterweg 25, 2231 NB Rijnsburg, the Netherlands (Chamber of Commerce/KVK 42123032, VAT NL005511818B93). For any privacy question, you can reach us at legal@decidesk.ai.

DeciDesk is the controller for the data we process for ourselves: data about visitors to our website, contact and support requests, feature requests, demonstrations and contact with prospective customers, the customer relationship with your organization, the subscription and invoicing, the acceptance register, the log of administrative actions, and technical data for security and administration.

All other data in an organization’s environment, including accounts, meetings, recordings, transcripts, actions and messages, we process as a processor on behalf of that organization. Your organization is responsible for that data. It is covered by your organization’s privacy policy and by the Processing Agreement between your organization and DeciDesk (decidesk.ai/dpa). This also applies to participants in a recorded meeting who do not use DeciDesk themselves.

This privacy policy describes both kinds of processing, so that you know what happens to your data. For the data we process on behalf of an organization, we follow the arrangements in the Processing Agreement.

We process the following data:

• Account information: your name, email address, role and position in the organization, language, time zone, notification preferences, the time of your last use, and your password (hashed, never stored in clear text).
• Profile photo: optional. If you upload one, it is stored in Vercel's file storage in the EU and shown next to your name in DeciDesk. The photo is at a web address with a long, random code. Anyone who has that link can see the photo without signing in. You can remove the photo at any time from your profile page.
• Meeting recordings: anyone who can open a meeting in DeciDesk can record it: in a room with a phone or computer, or online in Teams, Google Meet or Zoom with our recording bot. The recording bot joins under the name DeciDesk. Recall.ai, the provider of the recording bot, sees the names under which participants appear in the online meeting; DeciDesk does not store those names.
• Transcripts: the audio is stored in Vercel's file storage in the EU and sent to ElevenLabs. ElevenLabs creates a written transcript from it. To spell names correctly, we pass the names of the participants and of the colleagues in your organization to Microsoft's AI (EU Data Zone), which improves the transcript. The transcript is posted in the meeting and is kept until the meeting is deleted.
• Recording audio: DeciDesk automatically deletes audio files 90 days after the recording. If your organization deletes the recording earlier, we delete the audio immediately. If it deletes the meeting or the organization, we delete the audio and the attachments within 30 days. The person who made the recording, managers in the company, and the owners and administrators of the organization can delete the audio of a recording at any time. The transcript then remains with the meeting. You can read more about the copy at ElevenLabs in section 5.
• Spoken updates: if you record a spoken update on an action, the audio goes to ElevenLabs to be converted into text. We keep only the text, as an update, and do not store the audio.
• Questions to the DeciDesk Assistant: your question is sent, together with the DeciDesk data you may see yourself and that the answer needs, to Azure OpenAI (EU Data Zone) to create an answer. We do not keep your conversations with the assistant. If you submit a feature request through the assistant, we keep that question with your name, so that we can assess the request and let you know when the feature is available.
• Organization data: the name of your organization, company and projects, the organization's logo, and the meetings, agenda items, decisions, actions, updates, messages and attachments that you and your colleagues record in DeciDesk. Attachments are stored in Vercel's file storage in the EU. The logo, like a profile photo, is at a web address with a long, random code.
• Notifications: notifications in the app, by email and as push notifications on your phone or computer. A notification may contain names and titles of meetings, actions and projects, and the text of updates.
• Technical data: the type of browser and operating system of the devices on which you are signed in, a code per device for push notifications, and data about the use of features, such as the number and length of recordings and the organization's AI usage. Our hosting processes your IP address with every request to deliver the page and to fend off attacks, and records technical data in server logs, such as the time, the requested address and error messages. When you sign in we use your email address, and when you sign up also your IP address, to limit abuse.
• Website statistics: we measure visitor numbers and loading times with Vercel Web Analytics and Speed Insights. These services do not use cookies. A visit is recognized by an encrypted code that is calculated from the request and expires after 24 hours. Vercel receives the address of the page, the referring page, the country, and the type of device, operating system and browser.
• Acceptance records: when an owner accepts the Terms of Service and the Processing Agreement, we record the name, email address, organization, role, time, document versions and IP address as proof of that agreement.
• Log of administrative actions: when DeciDesk performs an administrative action, such as an export of personal data, the removal of a member or the deletion of an organization, we record that action with the email address of the person concerned.
• Billing information: if you pay through Stripe, the details of your payment method, such as card or bank account details, are collected and stored by our payment processor Stripe. We never see or store your full card number. If you pay an invoice by bank transfer, we see your account number on our bank statement and keep it in our accounts for as long as the statutory tax retention period applies. We also store the billing email, company/VAT details, and an identifier that lets us look up your invoices in Stripe.
• Communications: if you contact us by email or via the contact form, we keep the message so that we can reply.
• Demo environment: for a demonstration we set up a separate environment on demo.decidesk.ai, with its own database. For this we use the name of your organization, public information from your website, and the name and email address of the people who receive a login. We use the text of your website to have Azure OpenAI create sample content. We use that data only for the demonstration.

Most data you provide yourself, or it arises when you use DeciDesk. We receive other data from your organization, for example when an owner or administrator invites you and records your name, email address, role and manager. Colleagues may also record your name in meetings, actions and messages, and your voice may appear in a recording of a meeting you take part in. We receive data about payments from Stripe, such as the status of a payment.

For the data we process on behalf of an organization (section 2), that organization determines the purpose and the legal basis. We process that data only to provide, secure and support the service for that organization, as the Processing Agreement describes. This includes the emails of the service, such as the confirmation of your email address, password resets, invitations and notifications. We never use that data for profiling or marketing.

For our own processing, the following purposes and legal bases apply:

• To maintain the customer relationship and to process subscriptions and invoices. Legal basis: the performance of the contract with your organization; for the contact persons of that organization, this is our legitimate interest in performing that contract. We keep invoices to meet a legal obligation (tax record keeping).
• To keep the service and the website secure, limit abuse and find errors. Legal basis: our legitimate interest in a secure, well-functioning service.
• To measure visitor numbers and loading times of the website and the app. Legal basis: our legitimate interest in a well-functioning website and service.
• To answer your support questions and to assess your feature requests. Legal basis: our legitimate interest in answering your question and improving DeciDesk.
• To be able to show which arrangements apply with a customer (the acceptance register). Legal basis: our legitimate interest in being able to prove those arrangements.
• To be able to account for the administrative actions of DeciDesk (the log of administrative actions). Legal basis: our legitimate interest in demonstrably careful administration.
• To give a demonstration of DeciDesk. Legal basis: your request for a demonstration, before there is a contract, and our legitimate interest in showing DeciDesk to prospective customers.

Where we rely on our legitimate interest, you can object to that processing (see section 9).

We do not sell your data and do not use it for advertising. We do not share it with third parties, except with the recipients in section 6. Most recipients process the data strictly on our behalf; Stripe and the app stores partly process data as independent controllers.

DeciDesk uses AI for meeting summaries, suggestions for actions and titles, an overview of the previous meeting, agenda items that were deferred to a next meeting, the status of meetings, improving transcripts, and the DeciDesk Assistant. The relevant text is processed by AI models from Microsoft (Azure OpenAI Service) within the EU Data Zone. Processing may take place in any EU country. Microsoft does not use inputs and outputs to train models. Microsoft may retain inputs and outputs to detect abuse. We do not train AI models with your data ourselves.

To convert speech to text we use ElevenLabs in the United States. As soon as we have received the transcript, we instruct ElevenLabs to delete the transcript. According to ElevenLabs, this immediately removes the audio and the text from the ElevenLabs database. ElevenLabs keeps deleted data in backups for up to 30 days. ElevenLabs’ logs for debugging and moderation may contain data about the request. ElevenLabs does not state a retention period for those logs. The use of this data to improve ElevenLabs’ services is switched off.

DeciDesk does not take decisions about people that are based solely on automated processing. AI makes suggestions, such as summaries and actions, which users assess themselves. A suggested action is only created when a user adopts it, and a user can change the status of a meeting themselves. DeciDesk does not recognize or identify people by their voice.

The service providers we engage as sub-processors for organizations’ data are listed, with the location of the processing and the basis for transfer, in Annex 3 of the Processing Agreement (decidesk.ai/dpa). Below are all recipients, including those for our own processing. Service providers that process data on our behalf are contractually required to protect that data and to process it only for the agreed purpose.

• Neon (part of Databricks, US): the database, in the EU (Frankfurt).
• Vercel (US): hosting of the application in the EU (Frankfurt), delivery via Vercel's global network, file storage in the EU for audio, attachments, profile photos and organization logos, and the website statistics (Web Analytics and Speed Insights).
• Microsoft Azure (EU Data Zone): AI models for the features in section 5 (Azure OpenAI Service).
• ElevenLabs (US): speech-to-text conversion for meeting recordings and spoken updates. You can read more about retention at ElevenLabs in section 5.
• Recall.ai (US; the bot runs in the EU region Frankfurt): the recording bot that joins an online meeting in Teams, Google Meet or Zoom at a user's request and records the audio. Recall.ai deletes the recording no later than 3 days after it ends.
• Apple (iPhone and iPad), Google (Android, Firebase Cloud Messaging) and Microsoft (Windows): delivery of push notifications. They receive a device code and the title and text of the notification, which may contain names and titles of meetings, actions and projects.
• Mijndomein (the Netherlands): delivery of the app's emails, such as notifications, invitations and invoices, and the mailboxes that receive undeliverable emails and calendar invitations for the recording bot.
• Microsoft 365 (Microsoft Ireland): our mailboxes, including support@ and legal@, and receiving and forwarding incoming email. Messages you send us, also through the support form, arrive there.
• Stripe Payments Europe, Limited (Ireland): payment processing, subscription management, invoicing and tax calculation (Stripe Tax). Stripe partly processes data as an independent controller, for example to prevent fraud and to meet legal obligations, under Stripe's privacy policy.
• Apple (App Store, and TestFlight for test versions), Google (Google Play) and Microsoft (Microsoft Store): distribution and updates of the apps for iPhone, iPad, Android, Mac and Windows. They process your data as independent controllers under their own privacy policies.

Our database and file storage are in the EU, and the AI models run within the EU Data Zone. ElevenLabs converts speech to text in the United States. Push notifications go through the global services of Apple, Google and Microsoft. A number of service providers are based in the United States or have a parent company there, and may have access to data from there: Neon (Databricks), Vercel, ElevenLabs, Recall.ai, Stripe, Apple, Google and Microsoft.

Transfers to the United States take place under the EU-U.S. Data Privacy Framework or under the standard contractual clauses of the European Commission. The Data Privacy Framework is an arrangement between the EU and the US on data protection. It applies to US companies that have committed to it and are certified under it. The standard contractual clauses are fixed contract terms that the European Commission has adopted for transfers outside the EU. Annex 3 of the Processing Agreement states the basis per sub-processor. You can request a copy of the safeguards at legal@decidesk.ai.

For the data we process on behalf of an organization, all retention periods are listed in Annex 1 of the Processing Agreement. The most important ones:

• Account information: for as long as you are a member of an organization in DeciDesk. If the owner or an administrator removes you from the organization, we immediately delete your email address, password, profile photo and login sessions. Your name remains with earlier meetings and actions, so that they stay readable; at your organization's request we replace that name. If the organization is deleted, we also delete within 30 days the accounts that are not a member of another organization.
• Meeting audio: 90 days after the recording, or earlier if your organization deletes the recording, the meeting or the organization (see section 3).
• Meetings, transcripts, actions and other content: until your organization deletes them, and at the latest until the organization is deleted.
• Data of an organization: for as long as the organization uses DeciDesk. When the subscription ends, we keep the data for another 90 days, so that the owner can resume the subscription. The owners receive an email at least 14 days before the deletion. An organization for which no subscription has been started after 30 days and in which nothing has been recorded is deleted 7 days after a warning by email. A sign-up whose email address has not been confirmed after 30 days and in which nothing has been recorded is deleted. The details are in Article 11 of the Processing Agreement.

For our own processing, these periods apply:

• Customer relationship and invoices: for as long as the contract runs. We keep invoices and the related records for 7 years, because of the statutory tax retention period.
• Acceptance register: for as long as the contract with the organization runs, and after that for as long as we must be able to show which arrangements applied. This also applies after the organization has been deleted.
• Log of administrative actions: for as long as we must be able to account for the administrative actions that were performed. This also applies after an organization has been deleted.
• Feature requests: for as long as the request is being handled or plays a role in the development of DeciDesk. At your request we delete your request earlier.
• Support emails and messages via the contact form: no longer than 2 years after the last contact.
• Technical data: login sessions until you sign out or a new sign-in replaces the session. Push notification codes until the platform rejects the code or you are removed from the organization. Failed sign-in attempts count for 15 minutes and sign-up attempts for 1 hour. Attempts older than 24 hours are cleaned up periodically. Server logs of the hosting are kept by Vercel under its own retention period, no longer than 30 days.
• Demo environment: until the demonstration is no longer needed, or earlier at your request.
• Backups: deleted data may remain in encrypted database backups for up to 14 days.

Under the GDPR, you can:

• Access the personal data we process about you.
• Have inaccurate data corrected.
• Have your data deleted.
• Receive your data in a portable format.
• Object to certain processing or have it restricted.
• Withdraw your consent, if processing is based on your consent.
• Lodge a complaint with the supervisory authority (in the Netherlands: the Autoriteit Persoonsgegevens).

You can update your profile photo and language yourself in your account settings. Your name and the days on which you receive notification emails are changed for you by the owner or an administrator of your organization; push notifications are turned on or off in the settings of your device.

If your request concerns data that we process on behalf of your organization, please address it to your organization. If we receive such a request, we forward it to your organization within 5 business days and help it to handle the request.

If your request concerns data we are responsible for ourselves, email legal@decidesk.ai. We respond within one month, as required by the GDPR.

We use only functional cookies: a cookie that keeps you signed in (no longer than 7 days after your last visit), a security cookie that prevents another website from doing something in DeciDesk on your behalf (CSRF token) and a cookie for the return address after signing in (both until you close the browser), a cookie that remembers your language (1 year) and, in the app, a cookie that remembers which company you are working in (1 year). These cookies do not require consent. We do not use advertising or tracking cookies, and Vercel’s website statistics work without cookies.

In addition, the app temporarily stores data on your device: a copy of a recording until the upload is confirmed (in the browser no longer than 14 days), a technical log of the recording feature, and some settings. If the upload fails, the app can save the audio file on your device. That file remains until you delete it.

We protect data with industry-standard measures: TLS encryption in transit, encryption at rest, with the content of meetings, actions and messages, among other things, also encrypted per field, hashed passwords (bcrypt), role-based access control, a log of administrative actions, and updating software when a known vulnerability calls for it. If you discover a security issue in DeciDesk, please report it immediately via legal@decidesk.ai. We respond within 24 hours.

In the event of a data breach, we inform the organization on whose behalf we process the data. For data we are responsible for ourselves, we inform you as required by law.

Only Dennis Heemskerk has administrative access. Administration takes place in a separate administration environment on its own domain. Signing in to that environment requires a password, a code from an authenticator app and a code sent by email. The administration environment records sign-ins, exports of personal data, the removal of members and the deletion of organizations in a log. For maintenance and recovery he also has direct access to the database; that access is not recorded automatically. He uses his access only when it is necessary to provide the service, for example for an incident, a problem reported by a customer or a deletion request. His account in the app is a member of a customer’s organization only while DeciDesk sets up the environment for that customer, or when the customer asks for it.

DeciDesk is a B2B product for adults in a work context. It is not directed at children under 16, and we do not knowingly collect data from them.

We may update this policy. The “Last updated” date at the top shows the most recent change. For material changes, we inform the owners of customer organizations by email or in the app.

Ask questions about using DeciDesk through the contact form at support.decidesk.ai. Questions, requests or concerns about privacy? Email legal@decidesk.ai or visit the contact page.