Terms of Service · Privacy Policy · Data Processing Agreement · Sub-processors

Privacy Policy

Last updated: 15 October 2026

This policy explains what personal data EchoVerb (the "Service") handles, why, where it goes, how long we keep it, and your rights. The Service is run by Leading Edge AI, a company registered in England and Wales (company number [NUMBER]), registered office 1 Hutton Close, South Church Enterprise Park, Bishop Auckland, County Durham, DL14 6XG ("we", "us"). EchoVerb is a Leading Edge AI product. We are registered with the Information Commissioner's Office, registration number [ICO NUMBER].

Contact for anything in this policy: privacy@echoverb.app.

1. Who is responsible for your data

• Your account, billing and use of the Service: we are the controller.
• Meetings run by a business customer (recordings, transcripts, translations, notes, calendar meetings): the business that uses the Service is the controller and we are its processor. We act only on its instructions, under a Data Processing Agreement. If you were in a meeting run by one of our business customers and want to exercise your rights, contact that business; we will help it respond.
• Meetings run by an individual customer: that person decides to bring the Service into the meeting and is responsible for telling the other participants (see section 6). We process the meeting data to provide the Service to them.

2. What we collect

When you sign up and use the Service

• Name, email address, and, if you sign in with Microsoft, your Microsoft account and organisation identifiers and any roles your organisation assigns.
• Your company, your role in it (owner or member), whether you hold a licence, your settings, and when you were last active.
• Billing details: billing name, email, address and VAT number. Card details go straight to Stripe; we never see or store them.
• Usage: meetings held, minutes used, and what was billed.

When the bot joins a meeting

• The meeting link, its name, start and end times, and the names participants display in the meeting.
• Live interpreting: each participant's speech is streamed to us, turned into text, translated and spoken back into the meeting. We keep the text of what was said and its translation (the "interpreter log"). We do not keep the audio of live interpreting unless recording is switched on.
• Recording (only if switched on): the meeting's video and audio, held at our recording provider.
• Transcript and AI notes (only if switched on): the full transcript, a summary, decisions, action items and open questions, and how each agenda item landed.
• A preview picture of the meeting (a frame from the recording), shown on the meeting card.
• The languages each participant was heard speaking.

If you connect your calendar (Microsoft 365, read-only)

• For the next 24 hours only: online meetings' names, times, joining links, organiser, the invited people's names, email addresses and replies, and the invitation text (used to find an agenda).
• Your choice for each meeting (what the bot should do), and when you were asked.

Meeting coach

• The agenda for a meeting (from the invitation, typed by you, or suggested by our AI), how far each item got in the meeting, and how early the meeting finished.
• We email organisers about missing agendas and replies. Those emails contain the names of invited people who haven't replied or have declined.

Sharing

• If you share a meeting, the email addresses you share it with, and how often a shared link was opened.

Technical

• Your browser keeps your sign-in in local storage. We set short-lived cookies only during Microsoft sign-in and calendar connection (security checks, deleted within 10 minutes). We use no advertising or analytics cookies and no tracking.
• Our pages use fonts served from our own servers, not from a third party.
• Server logs (IP address, time, request) for security and troubleshooting, kept for 30 days.

3. Why we use it (lawful bases)

For business customers' meetings, the business decides the lawful basis and we process on its instructions.

AI and automated processing. We use AI to recognise speech, translate, summarise, track agendas and suggest agendas. Nothing it produces has legal or similarly significant effects on anyone. AI output can be wrong: check notes and translations before relying on them. We do not use your data to train AI models, and our providers may not either (see our sub-processors).

4. Who we share it with

• Our service providers (sub-processors), listed with what each does and where at our sub-processor list: Recall.ai (the meeting bot and recordings), OpenAI (speech recognition), Anthropic (translation, notes, the meeting coach), Supabase and Amazon Web Services (database and hosting, London), Microsoft (sign-in, calendar, email), Stripe (payments), and, only if switched on, ElevenLabs (premium voices) and Expo (phone notifications).
• People in your company: owners can see the company's meetings; members see their own and those shared with them.
• People you share a meeting with, by email or a public link you create (your company can switch either off).
• Your company's own systems, if your company sends meeting notes to its own tools (a webhook) or keeps recordings in its own storage.
• Authorities, if the law requires it.

We do not sell personal data.

5. International transfers

Our database and servers are in the United Kingdom (London) and the meeting bot runs in the EU (Frankfurt). Some providers (OpenAI, Anthropic, and, if used, ElevenLabs and Expo) process data in the United States. For those transfers we use appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

6. Recording and telling participants

When the bot joins, it announces itself in the meeting (spoken, and on its video tile), saying that an AI is interpreting, recording or transcribing. A company can switch the spoken announcement off; it is then responsible for informing participants another way. Whoever brings the bot into a meeting must make sure the participants are told, and must get their consent where the law requires it.

7. How long we keep it

If your company keeps everything in its own storage ("exclusive" mode), we copy recordings, transcripts and notes there and then remove our copies straight away.

8. Security

• Encryption in transit (TLS) everywhere, and encryption at rest in our database.
• Microsoft calendar access tokens are additionally encrypted.
• Each company's data is kept apart by the database itself, as well as by our application.
• Staff access is limited, requires Microsoft sign-in, and every action staff take on a customer account is recorded.
• Our staff tools do not show meeting content.
• Shared links can be withdrawn at any time.

9. Your rights

You can ask us to:

• give you a copy of your data
• correct it
• delete it
• restrict or object to how we use it
• transfer it to you or another provider

You can also withdraw consent you gave us, at any time.

Owners can delete meetings in the app, and we can export everything we hold for a company. Email privacy@echoverb.app; we reply within one month.

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We'd appreciate the chance to put things right first.

10. Children

The Service is for people aged 18 and over. We do not knowingly collect children's data.

11. Changes

We'll post any change here and, if it matters, email account owners before it takes effect.

EchoVerb is a Leading Edge AI product · Leading Edge AI, 1 Hutton Close, South Church Enterprise Park, Bishop Auckland, County Durham, DL14 6XG