Privacy Policy

Who publishes the service

ScanBiz is published by AUDIOLIZ, a French simplified joint-stock company (SAS), registered with the Versailles trade register under number 940 631 799, with its registered office at 19 rue du Pont Colbert, 78000 Versailles, France. VAT number: FR24 940 631 799.

Publication director: David Klajman. Contact: contact@scanbiz.ai.

Application hosting: Heroku (Salesforce), Europe region. File storage: Amazon Web Services, Paris region (eu-west-3). Transcription and analysis of conversations are carried out in the United States, for the duration of the processing (see "Recipients and sub-processors").

What this policy covers

It covers the www.scanbiz.ai website and the ScanBiz application you reach after signing in.

ScanBiz is a business service. For the content a customer company entrusts to us (calls, emails, meetings), that company is the data controller and AUDIOLIZ acts as a processor within the meaning of Article 28 GDPR. For account data, billing and the public website, AUDIOLIZ is the controller.

This policy is an information document. AUDIOLIZ's contractual obligations as a processor are set out in the data processing agreement (Article 28 GDPR), an annex to the terms of use accepted at signup.

Data we process

• Account: first and last name, business email address, password (stored hashed), language, display and notification preferences.
• Analysed content: recordings and transcripts of phone calls, email content, recordings and transcripts of video meetings, and the results produced from them (summaries, answers to question grids, alerts).
• Calendar (only if you connect a calendar): event title, start and end date and time, status, organiser and attendees, conferencing link.
• Technical data: sign-in logs, IP address, browser type, timestamps.
• Billing (if you subscribe online): company name, billing address, VAT number, payment and invoice history. Card details are entered on Stripe’s payment page and kept by Stripe: AUDIOLIZ never receives your card number.

Purposes and legal bases

• Providing the service — conversation analysis, alerts, dashboards: performance of the contract.
• Displaying your upcoming meetings and sending the meeting assistant to the meetings you selected: performance of the contract, triggered by your explicit calendar connection.
• Securing the service, preventing abuse, keeping technical logs: legitimate interest.
• Providing support and service communications: performance of the contract.

Connecting a Google or Microsoft calendar

Connecting a calendar is optional: it only happens if you start it yourself from Settings › Calendar, and you can revoke it at any time.

Requested permissions:

• Google — https://www.googleapis.com/auth/calendar.events.readonly (read-only access to events) and https://www.googleapis.com/auth/userinfo.email (the email address of the connected account, to attach the connection to the right user).
• Microsoft — Calendars.Read (read-only access to events), openid, email and offline_access (keeping the sync alive without asking you to sign in again).

What we do with it: display your upcoming meetings inside ScanBiz so you can choose which ones should be recorded, and detect the conferencing link (Google Meet, Microsoft Teams, Zoom…) of the meetings you opted in, so the meeting assistant can join them at the scheduled time.

What we never do: we never write to your calendar; we never use this data for advertising; we do not sell it; we do not share it with any third party other than the sub-processor performing the sync (Recall.ai, European Union region). No AUDIOLIZ employee reads your events, except at your request for support, where required by law, or for security reasons.

Deletion: disconnecting the calendar (Settings › Calendar) immediately stops the sync and deletes the synced events. You can also revoke access from your Google account (Security › Third-party apps) or Microsoft account (App permissions).

Meeting recording

When a meeting is recorded, the ScanBiz assistant joins it as a participant under an explicit name ("ScanBiz - Assistant de réunion"), so its presence is visible to everyone in the meeting.

By default, only meetings with at least one attendee outside your organisation are recorded; every other rule (internal meetings, recurring meetings, meetings you do not host…) is off by default and can be changed at any time.

It is your responsibility to inform participants that the meeting is recorded and to collect any consent required by applicable law, in particular where participants are located in a jurisdiction that requires it.

Recipients and sub-processors

We only share your data with the providers strictly required to run the service:

• Salesforce, Inc. (Heroku) — application and database hosting — European Union ("eu" region).
• Amazon Web Services EMEA SARL — storage of audio files and documents — Paris, France (eu-west-3).
• Recall.ai, Inc. — calendar sync and meeting assistant — European Union (eu-central-1).
• Stripe Payments Europe, Ltd. — online payment, invoicing and subscription management — Ireland (European Union).
• Redis Ltd. (Redis Cloud) — processing cache and job queue — European Union.
• ElevenLabs, Inc. — transcription of audio recordings — United States.
• OpenAI Ireland Ltd (and OpenAI affiliates) — conversation analysis (question grids, summaries, alerts), through its business API — United States.
• Twilio Inc. (SendGrid) — sending of alert and notification emails — United States.
• Functional Software, Inc. (Sentry) — application error monitoring — United States.
• SolarWinds (Papertrail) — application logs — United States.

This is the list in Annex 2 of the data processing agreement, kept up to date from the actual configuration of the service; any addition or replacement is notified to customer companies thirty (30) days in advance, under its Clause 6.

We may also disclose data where the law requires it (court order, regulatory obligation).

Location and transfers

Data is stored durably in the European Union (database, audio files, documents): Heroku "eu" region for the application and the database, Amazon Web Services Paris for the files.

Transcription of recordings (ElevenLabs), analysis of conversations (OpenAI) and technical monitoring (Sentry, Papertrail, SendGrid) are, however, carried out in the United States, for the duration of the processing: the audio or text of a conversation is transferred there. The other providers are used in their European regions (Recall.ai, Stripe, Redis).

Those transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified under it and, failing that, on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). The detail, recipient by recipient, is in Annex 2 of the data processing agreement.

Retention periods

• Account data: for the duration of the contract, then deleted or anonymised within 12 months of its end.
• Analysed content (calls, emails, meetings): for the period agreed with the customer company, and deleted at its request.
• Calendar data: until the calendar is disconnected, which deletes it.
• Technical logs: 12 months.

Security

Traffic is encrypted in transit (HTTPS/TLS). Customer workspaces are isolated from one another and access to data is limited to the people who need it. Provider API keys stay server-side and are never exposed to the browser. Access is logged.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your personal data.

Data protection (GDPR) contact: contact@scanbiz.ai, with the subject "RGPD". Use this address for any question about your data and to exercise your rights.

If you work for a company that uses ScanBiz, contact that company first: it is the controller for the analysed content, and we assist it in answering your request.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

Cookies and local storage

The website and the application use no advertising cookie, no third-party tracker and no analytics tool. The only items stored are:

• lang — the display language you selected (13 months);
• darkMode — your light or dark mode preference (13 months).

Your session token is kept in your browser’s local storage for the duration of your session. These items are strictly necessary to run the service and therefore require no prior consent.

Changes

This policy may change as the service evolves. The last update date is shown at the top of this page; customers are notified by email of any substantial change.

Contact

For any question about this policy: contact@scanbiz.ai, or by post to AUDIOLIZ, 19 rue du Pont Colbert, 78000 Versailles, France.