EchoBrief Privacy Policy
Last updated: 5 November 2026
EchoBrief records meetings you send it to, transcribes them, and writes summaries. That means we handle recordings of conversations, which is about as sensitive as business data gets. This page says plainly what we collect, who else sees it, how long we keep it, and how to get it back or get rid of it.
EchoBrief is operated by Oltaflock AI, India. In Indian data protection law we are the Data Fiduciary for your account data, and the processor acting on your instructions for your meeting content.
1. What EchoBrief does, and what it does not
A recording bot joins a meeting only when you send it to one, or when you have switched on auto-join for a calendar you connected. It appears in the participant list under a name you choose. It cannot join a meeting nobody admits it to, and it never listens to anything outside a meeting.
We do not sell or rent data, we do not use it for advertising, and we do not train AI models on your meetings. Our AI vendors process your content to return a result and for nothing else.
Some features do analyse what people said, to produce insights for you, the account owner. The coaching report on an external call measures your talk time and questions and includes a sentiment timeline for the other participant; the pre-call brief on each external contact is written from the meetings you had with them. These are generated for the account owner, are not included in share links or workspace shares, are deleted with the meeting's content when its retention window ends, and are not used by us for any purpose of our own.
2. Getting consent is your responsibility
Recording laws differ by country and by state, and several require every participant to agree. You are responsible for having that agreement before you send the bot into a call. The bot is visible in the participant list precisely so nobody is recorded without seeing it happen.
3. What we collect
- Meeting audio and video — captured while the bot is in the call.
- Transcripts and derived content — the transcript, summary, action items, decisions, metrics and coaching notes.
- Participant information — names and email addresses of people in the meeting or on the invite.
- Account information — your name, email, and settings.
- Calendar data — event titles, times and attendees, only if you connect a calendar.
- Usage and billing records — how many meetings and hours you used, and your subscription status.
- Technical logs — error reports and request metadata, used to keep the service working.
Small talk before and after the meeting
EchoBrief estimates when external attendees were actually present and excludes what was said outside that window from summaries, insights, coaching and the summary email. The full transcript remains available to you, the account owner.
Notes for meeting guests
About 15 minutes after a recorded meeting, everyone on the calendar invite (except the account owner) gets a short email from EchoBrief on the owner's behalf: a short thank-you note in the owner's name, the topics covered, decisions, action items and agreed next step, taken only from the part of the call the guests were in. It never includes the recording, the transcript, the summary written for the owner, sales deal notes or coaching. The owner can stop it before it is sent. Replies go to the owner. Every email has an unsubscribe link; we keep an unsubscribed address only to make sure we never email it again.
Google user data
If you connect a Google account, EchoBrief asks Google for three permissions and uses them only for these features:
- See your list of calendars (Google scope: calendar.calendarlist.readonly) — so you can choose which calendars EchoBrief watches. Calendars other than your main one stay off until you turn them on.
- Read events on the calendars you chose (Google scope: calendar.events.readonly) — titles, times, attendees and video-call links, so the notetaker joins the meetings you opted to record, your dashboard shows what is coming up, and summaries spell attendees' names correctly.
- Create events on your own calendar (Google scope: calendar.events.owned) — only when you click Schedule follow-up, or when you have turned on automatic follow-ups and a specific date and time was agreed in the call. EchoBrief never edits or deletes events it did not create.
Google access tokens are stored encrypted (AES-256-GCM). Upcoming events are kept so the dashboard and auto-join work, and are removed when you disconnect the account, which also revokes our access at Google. We do not sell Google user data, use it for advertising, or use it to train AI models. People at EchoBrief do not read it unless you ask us to for support, it is needed for security, or the law requires it. It is passed to the sub-processors below only to provide the features above.
EchoBrief's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who else processes your data
We use the vendors below. Each one processes your data only to deliver a part of EchoBrief, under contract, and none of them may use it for their own purposes. We will update this list before adding anyone new.
| Vendor | What it does | What it sees | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account details, transcripts, summaries, a short-lived working copy of meeting audio | India (Mumbai) |
| Recall.ai | The meeting bot that joins and records your call | Meeting audio and video, participant names | Japan (Tokyo) |
| Sarvam AI | Speech-to-text across 22 Indian languages | Meeting audio | India |
| Anthropic | Summaries, deal cards, action items and coaching | Transcript text | United States |
| OpenAI | Fallback for summaries and coaching; fallback transcription | Transcript text; meeting audio when the fallback transcribes | United States |
| Cloudflare | Storage of the archived audio copy used for playback (R2) | Meeting audio | Chosen by Cloudflare (not pinned to a country) |
| Resend | Summary and account email | Email address, meeting summary content | United States |
| Vercel | Web app hosting and audio processing | Meeting audio in transit, request logs | United States |
| Dodo Payments | Subscription billing (merchant of record) | Name, email, billing details | United States |
| Google Analytics | Website traffic measurement | Page path (identifiers removed), device, approximate location | United States |
| Microsoft Clarity | How visitors use our public web pages (session replay, public pages only) | Clicks and scrolling on public pages, device, approximate location — never the app or your meetings | United States |
| Sentry | Error monitoring | Technical error reports, user ID | United States |
| Google (only if you connect it) | Calendar sync and sign-in | Calendar event titles, times and attendee emails | United States |
| Microsoft (only if you connect it) | Outlook calendar sync | Calendar event titles, times and attendee emails | United States |
| Zoho (only if you connect it) | A note on the matching CRM contact or lead | Attendee email, meeting summary, decisions and action items | Your Zoho data centre (India by default) |
| Slack, ClickUp and Notion (only if you connect it) | Posting the summary to the channel or database you pick | Meeting summary, decisions, action items and next steps | United States |
Your data leaves India. Speech-to-text (Sarvam AI) and the database (Supabase) are in India, but recording runs in Japan (Recall.ai's Tokyo region), summarisation, email and web hosting run in the United States, and the archived audio copy is stored wherever Cloudflare places it. If that is a problem for your organisation, tell us before you sign up rather than after.
Legal basis and international transfers
Account data (your name, email, settings, billing) is processed to provide the service you signed up for, and on the consent you give when you sign up and when you connect a calendar or another integration. You can withdraw that consent by disconnecting the integration or deleting your account.
Meeting content is processed on your instructions: you decide which meetings the bot joins, and having the participants' agreement to record is yours to establish (section 2). Anyone in the call can type /stop in the meeting chat to end the recording; what was recorded before that is processed for the account owner only and is not sent automatically to anyone else.
Where it goes. Data is transferred outside India to the countries listed in the table above:
- Japan (Tokyo) — Recall.ai
- United States — Anthropic, OpenAI, Resend, Vercel, Dodo Payments, Google Analytics, Microsoft Clarity, Sentry, Google, Microsoft, Slack, ClickUp and Notion
- Chosen by Cloudflare (not pinned to a country) — Cloudflare
- Your Zoho data centre (India by default) — Zoho
Each vendor receives the data under its own data processing terms with us. Ask us and we will tell you which terms apply to a given vendor.
Cookies and analytics. Signing in uses a session token stored in your browser, which the app needs to work. Google Analytics and Microsoft Clarity measure how our website is used and set cookies of their own. Clarity runs only on public pages, never inside the app. In the EEA, the UK and Switzerland both stay off until you allow them in the cookie banner; anywhere, you can turn them off from Cookie settings at the foot of the page.
5. How long we keep things
| Data | Kept for |
|---|---|
| Meeting video and audio held by Recall.ai (the recording bot) | 30 days, then deleted by Recall.ai — or straight away when you delete that meeting or your account. We never keep a copy of the video. |
| Archived audio for playback (an MP3 copy, stored with Cloudflare) | Until your plan’s retention window ends — Starter 30 days · Pro 90 days · Sales Team 365 days · free trial and early access 30 days · no active plan 14 days — then deleted within a day. It can go sooner: if our total archived audio nears its storage limit, the oldest copies are deleted first. Deleting a meeting, or your account, deletes its copy straight away. |
| Working copy of audio used for transcription | 7 days after the meeting once it has been transcribed (1 day if storage runs low). If transcription failed, up to 30 days, so it can be retried. |
| Transcripts, summaries, insights and coaching, and the participant details kept with them (attendee list, join and leave times, contact links and briefs) | Starter 30 days · Pro 90 days · Sales Team 365 days · free trial and early access 30 days · no active plan 14 days |
| Meeting record (title, date, status) | While your account is open |
| Error and monitoring logs | 180 days |
| Billing and usage records | 8 years, as Indian tax law requires |
| Everything, after you delete your account | Deleted when you delete the account: your meetings, transcripts, insights, audio, Recall.ai’s copy of the video and our archived audio copy. Copies you sent to Slack, ClickUp, Notion, Zoho or your own webhook live in those tools and are yours to remove there. Database backups roll off within 30 days. A security-log entry recording that the account was deleted is kept, and billing records are kept as above. |
Deletion is automatic — a scheduled job removes expired content, it is not something you have to ask for. Retention windows count from the day a meeting was recorded, and use the plan your account is on when the job runs: if you cancel, the 14-day window applies from then on. In a team workspace, the longer of your own plan and the workspace owner's plan applies. Meetings recorded before 1 September 2026, when this schedule took effect, are kept until you delete them yourself.
6. Your rights
Under India's Digital Personal Data Protection Act, 2023 — and equivalently under GDPR if you are in the EU or UK — you may:
- See what we hold about you, and how it has been shared.
- Correct anything inaccurate or incomplete.
- Delete your data. Settings → Delete account removes your account, meetings, transcripts, insights, recordings (including Recall.ai's copy of the video) and Google tokens.
- Export your meetings and transcripts in a machine-readable form.
- Withdraw consent and disconnect your calendar at any time.
- Nominate someone to exercise these rights if you die or become incapacitated.
- Complain to us first, and to the Data Protection Board of India if we do not resolve it.
We answer rights requests within 30 days.
7. Security
- Everything travels over HTTPS, and is encrypted at rest by our infrastructure providers.
- Row-level security in the database means a query can only ever return your own rows — access control is enforced by the database, not only by application code.
- Every backend endpoint requires an authenticated caller; webhooks are signature-verified.
- Backups are encrypted and held separately from the production database.
- Access to production is limited to staff who need it.
We do not currently hold a SOC 2 or ISO 27001 certification. We would rather say so than imply otherwise.
If a breach affects your data we will notify you and the Data Protection Board without undue delay, with what happened and what to do about it.
8. Children
EchoBrief is for business use and not intended for anyone under 18. We do not knowingly collect data about children.
9. Data Processing Agreement
If your organisation needs a signed DPA, or a security review before purchase, email us and we will send one.
10. Changes
We will update this page when the service changes, and revise the date at the top. For anything that materially affects your rights we will email you rather than rely on you re-reading this page.
11. Contact and grievance officer
For privacy questions, rights requests, or a complaint under the DPDP Act, our Grievance Officer is reachable at:
admin@oltaflock.ai
Oltaflock AI, India