PRIVACY POLICY

1. DATA WE COLLECT

We collect the following data when you use ScrumPilot:

• Account data: name, email, organisation name (via Clerk)
• Meeting data: audio recordings (temporarily), transcripts, action items, decisions
• Usage data: product analytics events (only with your consent via PostHog)
• Payment data: billing details handled securely by Stripe — we never see card numbers
• Technical data: IP address hash (never raw), browser type, device type

2. HOW WE STORE YOUR DATA

Meeting audio is stored in Cloudflare R2 with a 90-day automatic deletion policy. All other data is stored in PostgreSQL hosted on Neon/Supabase with row-level security enforced — your data is never accessible across organisations.

All data is encrypted at rest and in transit (TLS 1.3). Encryption keys are managed by the cloud provider.

3. THIRD-PARTY SUBPROCESSORS

To deliver the service we share data with the subprocessors below, each only to the extent needed for their function:

• Recall.ai — the meeting bot that joins your call and captures audio for transcription
• Deepgram — speech-to-text transcription (default provider; audio processed, not retained)
• AssemblyAI — alternative speech-to-text provider on premium plans (audio processed, not retained)
• Anthropic / OpenAI — AI extraction of action items, decisions, and summaries from transcripts (your content is not used to train their models)
• Clerk — authentication and user management
• Stripe — payment processing and subscription management (we never see full card numbers)
• Google / Microsoft — the calendar you explicitly connect, so the bot can be scheduled for your meetings
• PostHog — product analytics (only if you grant analytics consent)
• Resend — transactional email delivery
• Sentry — error monitoring (no meeting content in error reports)

4. INTERNATIONAL DATA TRANSFERS

Some subprocessors above are located outside the European Economic Area (for example, in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or an applicable adequacy decision. You can request details of the safeguards in place by contacting us.

5. YOUR RIGHTS (GDPR)

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Correction — ask us to correct inaccurate data
• Erasure — request deletion of your data (“right to be forgotten”)
• Portability — receive your data in a portable format
• Objection — object to processing based on legitimate interest

To exercise any right, email us at contact@scrumpilot.online. We will respond within 30 days.

6. DATA RETENTION

We retain your data for as long as your account is active. Upon cancellation, data is retained for 90 days to allow reactivation, then permanently deleted. Meeting audio is automatically deleted after 90 days.

7. COOKIES

We use essential cookies to keep you signed in, and optional analytics cookies (PostHog) to understand product usage. You control analytics cookies via the cookie consent banner.

8. CONTACT

For privacy questions or data requests, contact: contact@scrumpilot.online