Privacy Policy

• Sorinai is a desktop notepad for meetings. We process audio, transcripts, and notes from the meetings you choose to record.
• For the personal data of other people that flows through Sorinai, you (or your organisation) are the controller and we act on your instructions. You are responsible for obtaining recording consent from the other people in your meetings. Our Data Processing Addendum forms part of these terms.
• We do not sell your data, and we do not train foundation AI models on your Customer Content.
• If you connect a calendar (Google or Microsoft), we read your upcoming events to show your agenda and add context to your notes. We only request read-only access, we do not sell this data, and we do not use it to train AI models. See Section 6.
• Our infrastructure runs primarily in Western Europe (Cloudflare R2, Supabase, Redis Cloud, Render, Recall.ai EU, PostHog EU). See Section 5 for the full subprocessor list.
• You can export or delete your data at any time. Email hello@sorinai.com.

This Privacy Policy describes how Sorinai Ltd, a private limited company registered in England and Wales (company number 17153714) with its registered office at 4 Baltimore Wharf, London, E14 9AQ, United Kingdom (“Sorinai,” “we,” “us”), collects, uses, and shares personal information in connection with the Sorinai desktop application, website, and related services (collectively, the “Service”).

Sorinai Ltd is the controller of personal information about Sorinai users (account holders and administrators). For personal information about other meeting participants that flows through the Service, our customer (your employer or you, if you signed up directly) is the controller and we are the processor acting on their instructions.

From you, the user

• Account information: name, email address, password (managed by WorkOS AuthKit), organisation, role.
• Billing information: we use Stripe to process payments. Stripe collects your card details directly; we receive only billing metadata (last 4 digits, country, plan, invoice history).
• Usage and device information: app version, operating system, IP address, crash logs, feature usage events, approximate location derived from IP. We use this to operate and improve the Service.
• Communications: messages you send to support, survey responses, and feedback.

From your meeting sessions (Customer Content)

• Audio:when you start a session, Sorinai captures audio from your device's microphone and/or system audio via the Recall.ai Desktop SDK. Audio is streamed to our transcription providers and is not retained by Sorinai after the transcript is produced, unless you explicitly enable recording storage in settings.
• Transcripts: text transcripts of the captured audio, with speaker labels and timestamps.
• Participant-related fields: names, the answers Sorinai fills into your note templates, notes, and any other information you or the other participants provide during the session.
• AI outputs: assistive content generated from your session and reference material to support the meeting.
• Reference data you connect: if you upload a document or a note template, we process that content (including extracting text from PDF and DOCX files) to generate context-aware suggestions.

When you connect a calendar (optional)

Connecting a calendar is optional and always initiated by you. If you connect Google Calendar or Microsoft Outlook, we access:

• Account profile: the account identifier, display name, and email address of the calendar account you connect, so we can label the connection.
• Upcoming events: for each event, its title, start and end times, time zone, and the names and email addresses of other attendees. We use this to show your agenda and to add context to the note you take for a meeting.

We request read-only access — Sorinai cannot create, edit, or delete anything on your calendar. For Google, we read only your primary calendar and exclude all-day events. How this data is used, stored, shared, and deleted is described in Section 6.

From your browser, on this website

We use Vercel Analytics for aggregate website analytics and PostHog EU for product and conversion analytics. These tools help us understand page views and aggregate usage of the website. We do not send contact form message content to analytics, and we do not use advertising trackers.

We use information to:

• provide, maintain, and improve the Service;
• generate transcripts, suggestions, and summaries during and after sessions;
• where you connect a calendar, show your upcoming meetings and add meeting context (such as the event title and attendees) to the note you take for that meeting. When a note uses this context, the event title and attendees are included in prompts to our AI subprocessor and stored with that note. Calendar data is not sold, not used for advertising, and not used to train AI models;
• authenticate you, process payments, and prevent fraud or abuse;
• respond to support requests and communicate with you;
• monitor for security incidents and enforce our Terms of Service;
• comply with legal obligations.

We do not sell personal information. We do notuse your Customer Content to train foundation AI models, and our AI subprocessors are contractually prohibited from doing so. We may use de-identified, aggregated telemetry (for example, “average session length”) to improve product quality.

We rely on the following legal bases under the UK GDPR and, where applicable, the EU GDPR:

• Performance of a contract — to deliver the Service you have signed up for.
• Legitimate interests — to operate, secure, and improve the Service, including telemetry and abuse prevention, where those interests are not overridden by your rights.
• Consent — for any optional feature that requires it (and you can withdraw consent at any time), including connecting a calendar. Connecting Google Calendar or Microsoft Outlook relies on your consent (Article 6(1)(a)); you can withdraw it at any time by disconnecting the calendar in the app.
• Legal obligation — where we must process data to comply with law.

For Customer Content (transcripts, participant information), the legal basis sits with our customer as the controller. We process that content on their instructions under our Data Processing Addendum.

We share information only as needed to run the Service and only with vendors bound by confidentiality and data-protection obligations. Our current subprocessors are:

Some subprocessors (notably Recall.ai) engage their own sub-processors to deliver their service. Those onward sub-processors are governed by the contract we hold with the direct subprocessor and are listed on the direct subprocessor's own website.

We will update this list when we add or change a subprocessor and will notify customers with an active subscription by email or in-product notice. We may also disclose information to comply with law, respond to valid legal process, protect the rights and safety of Sorinai or others, or in connection with a merger, acquisition, or sale of assets (in which case we will notify affected users).

This section applies when you connect a Google account to Sorinai. With your permission, Sorinai accesses your Google account profile (account identifier, name, and email) and, using the read-only scope calendar.events.readonly, your upcoming Google Calendar events — event title, start and end times, time zone, and attendee names and email addresses. We read only your primary calendar and exclude all-day events.

How we use it. We use this data solely to provide user-facing features of Sorinai: showing you your upcoming meetings and adding meeting context (such as the event title and attendees) to the note you take for a meeting. When a note uses this context, the event title and attendees are included in the prompt we send to our AI subprocessor (OpenAI, under a zero-data-retention, no-training arrangement) and are stored alongside that note.

What we never do. We do not sell Google user data, use it for advertising, or transfer it to data brokers. We do not use Google Calendar data to develop, improve, or train generalized or foundation artificial-intelligence or machine-learning models.

Where it is stored. When you connect a calendar we store a refresh token — encrypted at the application layer with AES-256-GCM — together with the connection metadata (Google account id, email, display name, granted scopes, and selected calendar) in our primary database (Supabase, Western Europe). We do not store your list of calendar events; the agenda is fetched from Google on demand each time you view it. The exception is the meeting context described above, which is stored with the note you create.

How to revoke access.You can disconnect a calendar at any time from within Sorinai; disconnecting a Google calendar revokes Sorinai's token with Google and deletes the stored connection. You can also review or revoke Sorinai's access directly from your Google Account at myaccount.google.com/permissions.

Sorinai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sorinai is operated from the United Kingdom and our primary data infrastructure (database, object storage, cache, backend hosting, transcription, and product analytics) is located in Western Europe. Some subprocessors — notably Google, OpenAI, WorkOS, and Sentry — are based in, or transfer data to, the United States. Where personal information is transferred out of the UK or EEA, we rely on the UK International Data Transfer Agreement, the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), or another lawful transfer mechanism.

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes:

• Account information: for the life of your account, then removed from active systems promptly after closure (longer where required for tax or legal reasons).
• Audio: not stored after transcription unless you enable recording storage; if enabled, retained until you delete it or close your account.
• Transcripts and session data: retained while your account is active so you can revisit past sessions; deleted on request, and removed from active systems promptly after account closure.
• Calendar connection: the encrypted refresh token and connection metadata are retained until you disconnect the calendar or delete your account. Calendar event context saved to a note is retained with that note and deleted when the note is deleted; the agenda view is fetched on demand and not stored.
• Billing records: retained for 6 years to meet UK tax and accounting obligations.
• Backups:may persist for a limited period after deletion in line with our infrastructure providers' backup cycles, then are overwritten.

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and encryption at rest at the infrastructure layer, authenticated access scoped to your organisation, application logging, and review of the vendors we rely on. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and the Information Commissioner's Office (ICO) within 72 hours where required by law.

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to our processing of your personal information, and to withdraw consent. You can delete your account from within the app, and you can exercise any other right by emailing hello@sorinai.com. We will respond within the timeframes required by applicable law (one month under the UK and EU GDPR).

Meeting participants whose information appears in a Sorinai session: please direct your request to the person or organisation that captured the session, since they are the controller of your data. We will assist them in honouring your request.

UK and EU residents:you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ico.org.uk). In the EU, you can complain to your local data protection authority.

California residents:you have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of “sharing” for cross-context behavioural advertising. We do not sell or share personal information for cross-context behavioural advertising.

The Service is for professional use and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact hello@sorinai.com and we will delete it.

Sorinai captures live conversations only when you start a session. Many jurisdictions require the consent of all participants before a conversation may be recorded or transcribed. You are responsible for obtaining the consents required by law from every participant in any session you capture with Sorinai. See our Terms of Service for the full obligation.

Sorinai Ltd is established in the United Kingdom. We will appoint an EU representative if and when Article 27 of the EU GDPR requires us to do so. In the meantime, individuals in the EU may contact us directly with privacy enquiries at hello@sorinai.com.

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or in-product notice and update the effective date above. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

Privacy questions, requests, or complaints: hello@sorinai.com.