Privacy Policy

Data controller

The data controller is Oopercast. For any question about this policy or to exercise your rights, contact us at contact@oopercast.com.

Data we process

We process the following categories of data:

• Sign-in identity: your Google account's name, email address and profile photo, used only for sign-in.
• Meeting audio: each participant's audio stream from a Google Meet call in the Oopercast workspace, processed transiently to produce the transcript, then deleted once transcription succeeds.
• Meeting content: the text transcript, participant names and email addresses (including external guests), and AI-generated notes (summary, decisions, action items, sourced quotes).
• Usage logs: sign-in history, and sharing/export actions, for security and support purposes.

Purposes of processing

This data is processed to: authenticate you and give you access to meetings you attended or that were shared with you; produce the transcript and AI notes; power search across your meeting library and Ask AI's answers; keep the service secure (abuse detection, sign-in logs).

Legal basis

For members of the Oopercast workspace, processing relies on Oopercast's legitimate interest in documenting its internal meetings, and on the performance of the employment or service contract that binds you to Oopercast.

For external guests in a meeting (participants outside the Oopercast workspace), processing relies on Oopercast's legitimate interest in documenting a meeting they knowingly attended, and on their implicit consent to being recorded by joining a call where the Ooperflow bot is present as a visible participant.

Processors

We use the following processors, each bound by a data-processing agreement:

• Google Workspace / Google Meet API — for sign-in and the bot's participation in meetings.
• Supabase (database hosting, eu-west-1 region, European Union) — for storing transcripts, notes and metadata.
• Vercel — web application hosting (runs in Dublin, Ireland).
• Groq (United States) — speech recognition (transcription) and AI note generation from transcripts. This is the only processing of meeting content outside the European Union; it is covered by this provider's contractual safeguards (European Commission standard contractual clauses).

Retention periods

Each participant's raw audio is never kept beyond what transcription requires: it is deleted as soon as the transcript is successfully produced. The transcript, AI notes and meeting metadata are kept for as long as the associated Oopercast account exists, or until an administrator explicitly deletes the meeting.

Access controls

A meeting is visible only to the people who attended it, the people it was explicitly shared with (by email or a deliberately created public link), and Oopercast workspace administrators. Sharing one meeting never grants access to any other meeting.

Your rights

Under the GDPR, you have the right to access, rectify, erase and object to the processing of your data. To exercise it, contact contact@oopercast.com. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), if you believe your rights are not respected.

Use of Google data — Limited Use

Ooperflow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: data from your Google account is used only for sign-in (authentication) and for the bot's participation in workspace meetings. It is never sold, never used for advertising, and never used to train general-purpose AI models.

Contact

For any question about this policy or your data: contact@oopercast.com.