1. Who we are
BrainPen Meet is a service of O&R Solutions B.V., located at Swammerdamstraat 1, 2516 GJ Den Haag, registered with the Netherlands Chamber of Commerce under number 66375940. In this policy, "we" and "us" mean this company.
This policy covers the website meet.brainpen.ai, the web application and the apps for iPhone, iPad and Android. It explains which personal data we process, why, for how long, with whom we share it and which rights you have.
Questions about privacy can be sent to info@brainpen.ai.
2. Our role: processor and controller
BrainPen Meet is used by professionals in organisations such as care providers, consultancies and local authorities. For the content of conversations, the organisation that uses BrainPen Meet is the controller. We are then the processor: we process that data only on the organisation's instructions and under the data processing agreement.
Conversation content includes recordings, transcripts, reports, translations, tasks, forms, and the templates and documents the organisation keeps in BrainPen Meet. If you want to know what happens to a conversation you took part in, or want to exercise your rights, please contact that organisation first. If your request reaches us, we pass it on.
For account data, billing, the security of the service, support and our website, we are the controller ourselves.
3. Which data we process
- Account data: name, e-mail address, organisation, role, language and display preferences, and when you sign in with Google or Apple, the details that service shares with us (name, e-mail address and a fixed user identifier).
- Conversation content: audio and video of conversations you record or hold, transcripts, speaker labels, live translations, reports and forms drafted by AI, tasks, and documents and templates your organisation uploads.
- Conversation details: title, date, length, participants and invitations.
- Usage and audit data: who did what and when, use of the features (for example how much audio was transcribed), and technical data such as IP address, device type, browser or app version and error reports.
- Device data in the app: a push token so we can send notifications, and the platform (iOS or Android).
- Payment data: if your organisation pays online, our payment provider handles the payment. We never receive full card numbers.
- Contact: what you send us through the contact form, e-mail or support.
We do not use advertising cookies, tracking pixels or third-party analytics. The website only sets a cookie for your language and a cookie that records your cookie choice. After you sign in, a session cookie keeps you signed in.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating an account, signing in and providing the service | Account data, device data | Performance of the contract (Art. 6(1)(b) GDPR) |
| Recording, transcribing and translating conversations and drafting reports | Conversation content | On behalf of your organisation; the organisation determines the legal basis |
| Security, preventing misuse and keeping a verifiable audit log | Usage and audit data | Legitimate interest and the duty to secure data (Art. 6(1)(f) and Art. 32 GDPR) |
| Billing and subscription | Account data, usage, payment data | Performance of the contract and legal retention duties (Art. 6(1)(b) and (c) GDPR) |
| Sending notifications in the app | Push token, name of the conversation or report | Performance of the contract; you choose whether to allow notifications |
| Answering questions and providing support | Contact details, your message | Legitimate interest or performance of the contract |
We do not use your data for advertising and we do not sell it.
5. Health data and other special categories
Many of our customers work in healthcare, so conversations can contain health data, and sometimes other special categories of personal data or the Dutch citizen service number (BSN). The GDPR gives this data extra protection.
The care organisation is responsible for a valid legal basis, for example the treatment agreement or an exception under Article 9 GDPR and the Dutch GDPR Implementation Act. We process this data only to provide the service to that organisation, secure it under the data processing agreement, and do not look at it, unless the organisation explicitly asks us to for support or the law requires us to.
6. Recordings and consent
Everyone in a conversation must know it is being recorded. Before a recording starts, BrainPen Meet asks the professional to confirm that everyone taking part knows. Without that confirmation, the recording does not start.
The organisation decides when recording is allowed, how participants are informed and whether consent is needed. Calls between members of an organisation run through BrainPen Meet itself, and the same rules apply to them.
7. Processing with AI
BrainPen Meet uses AI to turn speech into text, translate live, draft reports and forms, read documents and answer questions about your own conversations and documents. To do this, we send the data needed to the AI services in the table below, which run in the European Union.
Your conversations and documents are never used to train AI models, not by us and not by our AI suppliers. This is fixed in our agreements and in the software, and is not a setting anyone can switch off.
What the AI writes is a draft. The professional checks and approves it before it is used. BrainPen Meet makes no decisions about people; there is no automated decision-making within the meaning of Article 22 GDPR. An organisation can also choose to mask names and other identifying details before text is sent to an AI service.
8. Sub-processors and recipients
We only use the parties below. We have a data processing agreement or equivalent terms with each of them.
| Party | What for | Where |
|---|---|---|
| Worldstream | Hosting of servers, database and storage | The Netherlands |
| Mistral AI | Transcription of recordings, AI reports and forms, text recognition in documents, document search | European Union (France) |
| Soniox | Live speech recognition, live translation and spoken translation | European Union (EU servers) |
| Google (Firebase) | Push notifications in the app and Sign in with Google | United States and EU |
| Apple | Push notifications and incoming calls on iPhone, Sign in with Apple | United States and EU |
| Stripe | Online payments, if your organisation pays that way | Ireland and United States |
| Hostinger | Sending e-mail, such as sign-in codes and invitations | Germany |
When we add or replace a sub-processor, we tell the organisations that use BrainPen Meet in advance, so they can object.
We only give data to public authorities when the law requires it. Where we are allowed to, we tell the organisation concerned first.
9. Transfers outside the European Union
Conversations, documents and reports are stored in the Netherlands and processed by AI in the European Union. Only for push notifications, signing in with Google or Apple, and payments can data go to the United States. A push notification contains as little as possible and never conversation content.
For those transfers we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses with supplementary measures.
10. How long we keep data
- Conversation content and documents: for as long as your organisation wants. The organisation can set its own retention period, separately for conversations and for documents, for example 90 days, 1 year, 3 years or 7 years. After that we delete them automatically.
- Account data: for as long as you have an account. After your account is deleted, we erase it, except what we are legally required to keep.
- A workspace the organisation asks us to delete is erased for good after a 30-day cooling-off period, with all its conversations, documents and files.
- A trial without an account is deleted automatically after 7 days.
- Invoice records: 7 years, because Dutch tax law requires it.
- Audit log: for as long as the workspace exists. The log cannot be altered, so the organisation can show who did what.
- Backups are encrypted and overwritten automatically after 30 days, so deleted data also disappears from the backups.
11. Security
We protect data with encrypted connections (TLS), strict access rights per organisation and role, two-step verification, an audit log that can only be added to, and servers in a secured data centre in the Netherlands. Only staff who need it for their work have access to systems, and that access is logged.
If we discover a data breach, we report it without undue delay to the organisation concerned, and where we are the controller, within 72 hours to the Dutch Data Protection Authority.
12. Your rights and how to use them
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Where you have given consent, you can withdraw it at any time.
Much of this you can do yourself in Settings. For anything else, e-mail info@brainpen.ai. We respond within one month. To protect your data, we may ask you to confirm it is really you.
If your request concerns a conversation held by an organisation, for example your care provider, that organisation is the right party. We help it handle your request.
13. Deleting your account
You can delete your account in the app and on the website, under Settings > Profile > Delete account. Without the app, you can also ask by e-mail.
14. Notifications and permissions in the app
The app only asks for access at the moment you need it, and you can switch it off again at any time in your phone's settings.
- Microphone: to record conversations, make calls and join video meetings. The app never records unless you choose to; during a recording or call you can see it on screen.
- Camera: only for video meetings and to photograph a document.
- Photos: only when you choose a photo to upload yourself, or ask to save a report as an image.
- Notifications: to let you know a report is ready, a meeting is starting or someone is calling you. A notification never contains conversation content.
- In the background: a recording or call in progress continues when you briefly leave the app or turn off the screen. After that, the app stops.
The app does not track you outside BrainPen Meet, shows no advertising and shares no data with advertising networks.
15. Children
BrainPen Meet is meant for professionals and is not intended for anyone under 16. Only someone aged 16 or over can create an account. If a child takes part in a conversation, for example in youth care, the organisation is responsible for the consent and information this requires.
16. Complaints
If you have a complaint about how we handle your data, please tell us first at info@brainpen.ai and we will look for a solution together. You always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in the country where you live or work.
17. Changes
We may update this policy, for example when the service or the law changes. The date at the top shows when it last changed. For important changes, we inform the organisations that use BrainPen Meet in advance, by e-mail or in the app.
18. Contact
O&R Solutions B.V., Swammerdamstraat 1, 2516 GJ Den Haag. Chamber of Commerce 66375940. Privacy questions: info@brainpen.ai. Other questions: info@brainpen.ai.