At Neural Summary, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. We comply with the General Data Protection Regulation (GDPR) and are committed to protecting your personal data.
Data Controller
The data controller responsible for your personal data is:
Company Name: DreamOne Holding BV
Registration Number: 88073955
Contact Email: [email protected]
Data Protection Officer: [email protected]
What Data We Collect
We collect different types of information to provide and improve our Service:
Personal Information
- Email address
- Name (optional)
- Profile information from OAuth providers (Google)
- Payment information (processed securely via third-party providers)
Usage Data
- Audio files you upload for processing
- Conversations and their transcripts
- Lenses and generated insights
- User preferences and settings
Technical Data
- IP address and approximate location
- Browser type and version
- Device information and operating system
- Access logs and usage patterns
Legal Basis for Processing
We process your personal data based on the following legal grounds:
Contract Performance
Processing necessary to provide you with our conversation processing and lens generation services.
Consent
Processing based on your explicit consent for marketing communications and analytics.
Legitimate Interests
Processing necessary for our legitimate interests in improving our services and preventing fraud.
Legal Obligations
Processing necessary to comply with legal obligations, such as tax and accounting requirements.
How We Use Your Data
We use the collected data for various purposes:
- To provide and maintain our conversation processing and lens generation services
- To communicate with you about your account and service updates
- To improve and personalize your experience
- To detect, prevent, and address technical issues and security threats
- To comply with legal obligations and enforce our terms
- To analyze usage patterns and improve our service (with your consent)
Data Sharing and Third Parties
We may share your data with trusted third-party service providers who assist us in operating our Service:
Service Providers
- Google Cloud (Firebase): hosting, storage of your audio files, transcripts and account data, and sign-in
- AssemblyAI: receives your audio files to produce the transcript, including speaker labels and, when you enable it, live transcription while you record
- OpenAI: receives the transcript and the context you add to generate summaries, Lenses, chat answers and translations; OpenAI Whisper is also used as a transcription fallback
- Stripe: payment details for subscriptions bought on the web (mobile purchases go through Apple or Google and never reach us)
- Apple App Store and Google Play: mobile subscriptions bought in the app; they handle payment as merchant of record and we receive only the purchase receipt and transaction identifiers, never your payment details
- Resend: your email address, to deliver account and notification email
- Google Analytics for Firebase: usage data, only when you opt in
- Cloudflare: serves and protects our public website pages; sees standard web request data (IP address, user agent) for those pages, never your recordings, transcripts or account content
- Trustpilot: your email address, sent once, to invite you to share a review
Processing by AI services
To turn a recording into notes, the audio, its transcript and the title or note you add are sent to AssemblyAI and OpenAI. Both act as our data processors under a data processing agreement: they use your data only to provide the service to us, do not use it to train their models, do not use it for advertising. All data is encrypted in transit and at rest. In the mobile app you agree to this explicitly before your first upload, and you can withdraw that consent at any time with the Process my recordings switch in Settings; withdrawing pauses new uploads and transcription while existing conversations remain available.
We never sell your personal data to third parties. All service providers are bound by strict confidentiality agreements and can only use your data to provide services to us.
Google user data (Calendar and Drive)
If you connect your Google account, we access only what you approve: read-only calendar event details (title, time, organizer, attendees, location, and meeting link) for events you choose to link to a conversation, and the specific Google Drive files you pick for import. We never read your other files or events beyond what you select, never send email on your behalf, and never change anything in your Google account.
This data is used solely to provide features you request: labeling conversations with meeting context, suggesting meeting attendees when you share a summary, and importing recordings you picked. Picked Drive recordings and linked event details are processed by the service providers listed above (speech-to-text and AI analysis) solely to provide these features. Google user data is never used for advertising, never sold, never read by humans except with your explicit consent or where required for security or legal compliance, and never used to train general-purpose AI or machine learning models. You can withdraw access at any time by disconnecting Google in Settings or via your Google account security settings; deleting a conversation or your account removes the stored data.
Neural Summary's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:
Retention Periods
- Account Data: Until 12 months after account deletion
- Conversations: Keep until deleted
- Audio Files: Kept for as long as your account exists; deleted when you delete the conversation or your account
- System Logs: 1 year for audit/security purposes
- Analytics Data: 12 months
Your Rights Under GDPR
Under the General Data Protection Regulation (GDPR), you have the following rights:
Right to Access
You have the right to request copies of your personal data we hold.
Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal data.
Right to Erasure
You have the right to request deletion of your personal data under certain circumstances.
Right to Data Portability
You have the right to receive your data in a structured, commonly used, and machine-readable format.
Right to Restrict Processing
You have the right to request restriction of processing under certain circumstances.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw consent at any time.
To exercise any of these rights, please contact our Data Protection Officer at the email address provided below.
We will respond to your request within 30 days as required by GDPR.
Data Security
We implement appropriate technical and organizational measures to protect your personal data:
Security Measures
- End-to-end encryption for data in transit and at rest
- Strict access controls and authentication mechanisms
- Continuous security monitoring and threat detection
- Regular backups and disaster recovery procedures
- Regular security training for our staff
- Incident response and breach notification procedures
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.
International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA).
Safeguards
- Standard Contractual Clauses approved by the European Commission
- Adequacy decisions for countries with equivalent data protection laws
- Appropriate safeguards as required by GDPR Article 46
Children's Privacy
Our Service is not intended for children, and we do not knowingly collect personal data from anyone under the age specified below.
Minimum Age: 16 years
Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:
Data Protection Officer
Email: [email protected]
Supervisory Authority
You also have the right to lodge a complaint with your local data protection supervisory authority:
Authority Name: Netherlands – Autoriteit Persoonsgegevens (AP)
Website: https://www.autoriteitpersoonsgegevens.nl/en
Changes to This Privacy Policy
We may update our Privacy Policy from time to time. The updated version will be indicated by an updated 'Last Updated' date.
For material changes, we will notify you via email or through a prominent notice on our Service.