Privacy Policy

BYKI Stenografen watches your calendar (read-only), sends a bot that joins your online meetings after being admitted, records and transcribes them with consent, and uses a language model to generate meeting notes that are delivered to you. This policy explains how we process personal data under the EU General Data Protection Regulation (GDPR).

1. Data controller

Byki.ai is the data controller for your account. The service is provided by Byki.ai. Contact details are available at byki.ai. Contact us at the contact form for privacy enquiries, or via the contact form for general and support enquiries. For the content of your meetings, Byki.ai acts as a data processor on your behalf as the account owner.

2. What data we process

• Account data: name and email address from your Google or Microsoft sign-in.
• Calendar data: only the time, title, meeting link and attendee email addresses of upcoming events — never the contents of your email or files.
• Meeting data: audio — and video on plans that include video recording — transcripts, speaker labels and generated notes for the meetings the bot attends (with your and the participants' consent), plus any notes or comments you add yourself.
• Delivery data: where you enable it, generated notes delivered to your chosen channel (email, Slack, a webhook, Notion, Google Docs or a Word document).
• Billing data: handled by Stripe — card numbers never touch our systems.
• Organisation number: the organisation number you enter for invoicing — for a sole proprietorship this is your personal identity number — is stored with our payment provider Stripe and used only for invoicing and VAT. It is shown masked in the portal.
• Contact requests: name, email address, optionally company, and your message when you get in touch via the contact form. Kept for at most 180 days, so that we can reply.
• Website visitors: cookies and similar storage in your browser. Statistics are only stored if you consent. See the Cookies page.

3. How your meeting data flows

The service works as a chain: (1) calendar watching reads your upcoming meetings read-only; (2) a bot joins the online meeting (Google Meet or Microsoft Teams) once admitted by the host, and posts a consent message in the meeting chat; (3) the meeting is recorded and transcribed, with speech-to-text within the EU; (4) a language model generates the meeting notes; (5) the notes are delivered to the app and by email, and optionally to Slack, a webhook, Notion, Google Docs or as a Word document. If several Stenografen users attend the same meeting, a single bot attends and each user receives their own private copy of the notes — your own notes and comments are never visible to other users. Each step is described on our Sub-processors page.

4. Google user data and Limited Use

When you sign in with Google, Stenografen requests the following permissions:

• openid, email, profile — to create and identify your account (name and email).
• Google Calendar, read-only (.../auth/calendar.events.readonly) — to read the time, title and meeting link of your upcoming events so the bot knows when and where to join. We never read your email, contacts, Drive files or any other content.
• Google Drive, per-file access (.../auth/drive.file) — only where you choose to have notes delivered to Google Docs, and only to create that document. This is the most restricted Drive permission Google offers: it grants access only to files this application itself creates. We cannot see, open or modify any other file in your Drive.

We use Google data solely to provide the service's features to you. We never sell Google data, never use it for advertising, and never use it to train generalized AI/ML models. No human reads your Google data except with your explicit consent, where required for security or troubleshooting, or where required by law.

What we store from Google

• Access and refresh tokens for your Google connection, encrypted in our database. We use them only to read your upcoming events and, if you turned on Google Docs, to create your notes document.
• Upcoming events: for each event we store its start time, title, meeting link and the email addresses of its attendees (used when you choose to deliver notes to the participants), plus the event's identifier so that we recognise it at the next sync. We read an event's location and description only to look for a meeting link; they are not stored.
• We store nothing else from your calendar, and nothing from your email, contacts or Drive.

How long: the tokens are kept for as long as the connection exists. The event details stay on the meeting record for your plan's text retention period, counted from when the meeting ended (see section 10); after that the title, link, attendees and event identifier are erased from it.

Calendar data and the language model

Calendar fields never reach the language model. It receives only the transcript of the meeting and any notes you wrote yourself; the title, link, attendees and time from your calendar are not sent to it. The meeting link is used by our meeting bot, which runs in our own hosting, to join the meeting. If you turn on Google Docs, the document is named after the meeting title and date and is created in your own Drive.

Sharing

We do not sell or share Google data. It is processed only by the sub-processors that run the service for us (hosting and database, and backups) — see the Sub-processors page — and, where law requires it, by authorities.

Deleting your data and revoking access

• Disconnect in the app: the Disconnect calendar button in the calendar view deletes the stored tokens at once and cancels the upcoming meetings from that calendar. Disconnecting in the app does not remove the permission in your Google account — to do that too, remove Stenografen at myaccount.google.com/permissions. You can do this at any time, with or without disconnecting first; access then stops immediately.
• Delete your account: in the app. The tokens and all other data are removed at once; copies in our encrypted backups are rotated out within about five weeks.
• Meetings: events already turned into meetings keep their details until the retention period in section 10 ends, or until you delete the meeting.
• Documents in your Drive that we created for you are yours. We do not delete them; you can delete them yourself in Google Drive.

Stenografen's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Microsoft user data

When you sign in with Microsoft, Stenografen requests the following permissions:

• openid, profile, email, User.Read — to create and identify your account (name and email).
• Calendars.Read — read-only access to your calendar, to read the time, title, meeting link and attendees of your upcoming meetings so the bot knows when and where to join. We never create, edit or delete events.
• offline_access — lets us renew the connection with a refresh token, so that the bot can join your meetings and we can read your calendar when you are not signed in.
• Files.ReadWrite.AppFolder — only where you choose to have notes delivered as a Word document: the document is written to the application's own folder in your OneDrive. The permission gives access to that folder only; we have no access to any of your other files.

We never read your mailbox, contacts or other content, and we use Microsoft data only to provide the service's features to you.

What we store from Microsoft

The same as for Google: access and refresh tokens, encrypted in our database, and for each upcoming event its start time, title, meeting link, attendee email addresses and event identifier. To find a meeting link we also read an event's location and body; they are not stored. The tokens are kept for as long as the connection exists, and the event details for your plan's text retention period (section 10). Calendar fields never reach the language model, and the data is shared only with the sub-processors described in section 8.

Deleting your data and revoking access

The Disconnect calendar button in the calendar view deletes the stored tokens at once and cancels the upcoming meetings from that calendar. Deleting your account removes all data; copies in our encrypted backups are rotated out within about five weeks. Disconnecting in the app does not remove the permission in your Microsoft account. To revoke it, remove Stenografen at myapps.microsoft.com or myaccount.microsoft.com. A document already written to your OneDrive is yours; we do not delete it.

6. Purposes and legal basis

We process data to deliver the service (performance of a contract) and for invoicing (legal obligation, VAT). Recording of meetings is based on consent; the bot posts a consent message in the meeting chat when it joins.

7. Where your data is stored and processed

We store and run the processing in EU regions: hosting and database, backups, and speech-to-text and language models. The region of each other provider is stated on our Sub-processors page.

The region is not the only factor. Our providers' data processing agreements may allow the provider and its authorised sub-processors to process data remotely where needed for security and service maintenance, and may provide for transfers within the provider's group under the EU Standard Contractual Clauses. Providers that belong to groups with a US parent company — Google and Microsoft, if you choose those sign-in and delivery integrations, and Stripe for payments — process data under their own terms and the transfer mechanisms that apply to them. The regions above state where the processing is stored and run; they are not a guarantee that data is never accessed from elsewhere in the cases described here.

8. Sub-processors

We engage sub-processors for hosting and database, backups, speech-to-text and language models, email delivery and payments (Stripe), and the sign-in and delivery integrations you choose to connect. See our Sub-processors page for the categories, including each provider's role, the data processed and the region. The named list with company details is provided to account owners on request.

9. AI training on your data

Your meetings are never used by us to train AI models, and our own models learn nothing from your data. For one of our speech-to-text and language-model providers, the provider's terms state that it has no knowledge of inputs and outputs and does not reuse them in any way; that statement does not apply to all of the provider's services (for example not to batch services). For our other providers, their own terms apply.

10. Retention

Notes and transcripts are kept for your plan's text retention period, and recordings (video and audio) for the plan's own — sometimes shorter — media retention period; the two periods are not always the same length. Currently: text 30 days on Starter, 90 days on Standard, 1 year on Plus, Business and Business Pro (Enterprise: as agreed); media 30 days on Starter, Standard and Business, 180 days on Plus and Business Pro (Enterprise: as agreed). The trial follows Starter's periods. No plan retains meeting data longer than 1 year, and deletion happens automatically when the relevant period expires. You can delete individual meetings at any time — deleted meetings go to a trash bin for 30 days, or you can delete them permanently right away, which also removes the recording on the meeting-bot side. When you delete your account, all your data is removed. Inactive or unpaid accounts are deleted no earlier than 91 days after the account was locked, and only after we have reminded you by email.

11. Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object. Delete your account directly in the app, or contact the contact form. You can lodge a complaint with your supervisory authority (in Sweden, the Swedish Authority for Privacy Protection, IMY).

12. Security

Data is protected with encryption in transit (TLS), access control, tenant isolation and an immutable audit log. OAuth tokens and integration secrets are encrypted in the database, and backups are encrypted.

← Back to start