This Privacy Policy explains how Propela (“Propela”, “we”, “our” or “us”) handles personal information when you visit propela.io, use the Propela platform and the Propela Notetaker (together, the “Service”), or contact us. Propela is a customer intelligence platform: it joins sales and customer calls, transcribes them, and turns what is said into insights for your team.

Because Propela is built for businesses, we act in two different roles. Please read section 1 first, as it explains which parts of this policy apply to you.

1. Our roles: controller and processor

• Propela as controller. For information about visitors to our website, people who contact us or join a pilot, and the individual users of our platform (such as account holders and administrators), we decide how and why the data is used. This policy describes that use.

• Propela as processor. For call recordings, transcripts, participant details, insights and other content that our customers upload or capture using the Service (“Customer Data”), the customer is the controller and Propela is its processor. We process Customer Data only on the customer’s documented instructions and under our Data Processing Agreement, which is available on request at team@propela.io. If you were on a call recorded by one of our customers, that customer is responsible for telling you about the recording and for answering your privacy requests. See section 9.

2. Information we collect

Information about our customers’ users

• Account details. Name, work email, organisation, role and workspace membership, collected when an administrator is set up or a team member is invited.

• Usage and technical data. Pages viewed, features used, device and browser type, IP address and log data, used to keep the Service secure and working.

• Content users create. Comments, @mentions, collections, saved insights and questions asked of the AI assistant.

• Billing details. Plan, billing contact and invoice information. Card details are handled by our payment provider and are not stored by us.

Customer Data captured by the Service

• Call content. Audio, transcripts and speaker names and email addresses from meetings where our customer has asked the Propela Notetaker to join. This includes people outside the customer’s organisation, such as the customer’s own clients and prospects.

• Meeting details. Meeting links, titles and times.

• Companies and stakeholders. Company records and contact details (name, email, role, sentiment) created from calls or entered by hand.

• AI-generated output. Insights, quotes and summaries extracted from the call content.

Information from visitors and enquiries

• Get started and pilot requests. Name, work email, company, role, team size, the features you are interested in, the tools you have tried and any notes you share.

• Correspondence. Emails and messages you send us.

• Website analytics. Aggregated, cookie-free page-view statistics.

3. How and why we use information

• To provide the Service: recording, transcribing and analysing calls, linking calls to companies, and showing insights to your workspace. Legal basis: performance of our contract with the customer.

• To manage accounts and security: authentication, access control, preventing abuse and investigating incidents. Legal basis: contract and our legitimate interests in keeping the Service secure.

• To communicate with you: service notices, @mention notifications, support, and replying to enquiries and pilot requests. Legal basis: contract and legitimate interests.

• To improve the Service: understanding how the product is used, using aggregated or de-identified data. We do not use Customer Data to train AI models (section 6).

• To send marketing about Propela to business contacts where permitted. You can opt out at any time. Legal basis: legitimate interests or consent, depending on where you are.

• To meet legal obligations, such as tax, accounting and responding to lawful requests.

We do not sell personal information, and we do not share it for third-party advertising.

4. Who we share information with

We use a small number of trusted service providers (“sub-processors”) to run Propela. Each is bound by a data processing agreement and may only use the data to provide its service to us:

• Recall.ai — meeting bot, recording and transcription. Receives call audio, participant names and emails, and transcripts. Based in the United States.

• OpenAI — analyses transcripts to generate insights and powers the AI assistant. Receives transcripts and insights. Under our API terms, OpenAI does not train on this data, and may retain it for up to 30 days for abuse monitoring.

• Supabase — database hosting for application data.

• Clerk — sign-in, organisations, roles and invitations. Receives user names, emails and sign-in data. Based in the United States.

• Zoho ZeptoMail — sends @mention notification emails. Receives the recipient’s name and email and the comment text. Operates in the European Union.

• Vercel — website and application hosting, and cookie-free page-view analytics.

We keep this list up to date and will give customers notice of new sub-processors, with an opportunity to object, as set out in our Data Processing Agreement. We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets, in which case we will tell affected customers.

5. International transfers

Some of our providers are located in the United States or other countries outside the UK and European Economic Area. Where we transfer personal data to them, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional protections where needed. Details are available on request.

6. AI and your data

• Call content is analysed by third-party AI models to produce insights, summaries and answers within your workspace.

• We do not use Customer Data to train or improve AI models, and our AI provider does not train on it under our agreement.

• AI output is generated automatically and can be wrong. Please review it before relying on it for important decisions.

7. Sign in with Google and Google user data

You can choose to sign in to Propela with your Google account. This section explains how we handle information we receive from Google.

• What we access. Only the basic profile information needed to sign you in: your name, email address and profile picture. We do not request access to your Gmail, Drive, Calendar, Contacts or other Google data through sign-in.

• How we use it. To create and authenticate your account, show your name and photo in your workspace, and contact you about the Service. We use it only to provide and improve the features you see in Propela.

• How it is stored and shared. Sign-in is handled by our identity provider, Clerk, and your profile details are stored in our database, protected as described in section 10. We do not sell Google user data, share it for advertising, or transfer it to anyone except the service providers listed in section 4, and only as needed to run the Service or where the law requires.

• Retention and deletion. We keep this information while your account is active. You can stop Propela’s access at any time at myaccount.google.com/permissions, and you can ask us to delete your account and the associated Google profile information by emailing team@propela.io.

Propela’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertisements, build user profiles for advertising, sell it to data brokers, or train or improve generalised AI or machine-learning models.

8. How long we keep information

• Customer Data is kept for as long as the customer’s account is active, so that your team can keep using its insights. Customers can delete calls and their linked insights at any time in the Service, and we ask our recording provider to remove the recording and transcript it holds.

• On termination, we delete or return a customer’s workspace data within 30 days of the end of the contract, unless the law requires us to keep it or the customer asks for something different. Backups are overwritten on a rolling basis.

• Account and enquiry data is kept while the account is active and for a reasonable period afterwards for legal, tax and security purposes.

• Limited operational logs held by our service providers may persist for a short period (up to 90 days) after deletion.

9. People on recorded calls

The Propela Notetaker joins calls under the visible name “Propela Notetaker”. Our customers are responsible for telling participants that the call is being recorded and transcribed, and for obtaining consent where the law requires it (some countries and US states require every participant to agree). Our customers’ own privacy notices explain how they use call data.

If you were on a call recorded using Propela and want to see, correct or delete your information, please contact the organisation that recorded the call. If you would rather contact us, email team@propela.io and we will pass your request to the relevant customer.

10. Security

We protect information with measures that include:

• Encryption in transit (HTTPS) and at rest.

• Sign-in managed through a dedicated identity provider, with organisation-based access and administrator and member roles.

• Every record tied to a workspace, with database-level access rules so that users can only reach their own workspace’s data.

• Secrets and API keys kept on the server and never exposed to the browser, and signed verification of incoming webhooks.

• Call audio held by our recording provider rather than copied into our own systems.

• Reliance on infrastructure providers that maintain independent security certifications such as SOC 2.

No system is perfectly secure. If a personal data breach affects our customers, we will notify them without undue delay in line with our Data Processing Agreement and applicable law.

11. Cookies

We use only cookies that are strictly necessary, such as those that keep you signed in to the platform. Our website analytics are cookie-free. We do not use advertising cookies. More detail is in our Cookie Policy.

12. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to restrict or object to its use, to receive a portable copy, to withdraw consent, and to complain to your data protection authority. To exercise a right, email team@propela.io. We will respond within the time required by law. If your information is Customer Data, we will direct your request to the relevant customer, as they control it.

13. Children

The Service is for businesses and is not intended for anyone under 16. We do not knowingly collect information from children.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “last updated” date, and for material changes we will notify customers by email or in the Service.

15. Contact us

Questions about this policy, our Data Processing Agreement or your data? Contact us:

Email: team@propela.io
Website: propela.io