We collect and process your personal data only when necessary to provide our service, execute our contract, comply with our legal obligations (e.g., invoicing), or with your explicit consent.
We are committed to conducting our activities in accordance with these principles to ensure that the confidentiality of personal information is protected and maintained.
We use trusted service providers. Our applications, databases and your encrypted files (audio and transcripts) are hosted by Scaleway, a French company, in its Paris data centers (fr-par region).
The AI inference required for transcription and speaker identification runs on GPU servers located in the European Union, operated by Runpod, Inc., a US company. Files sent there are encrypted at rest and in transit; they are decrypted in memory only, for the duration of the processing, and results are returned encrypted. No content is retained in plaintext by this provider, and processing is ephemeral.
Analysis and summary features rely on Google's Gemini API (paid tier) and run only at your request. Under Google's paid API terms, user content is neither retained after processing nor used to train Google models.
By default, processing occurs globally under EU Standard Contractual Clauses (SCCs). Business customers can purchase an EU data residency option using Vertex AI (EU multi-region). All our vendors commit to processing data in compliance with the General Data Protection Regulation (GDPR).
Our complete sub-processor list is published on the “Sub-processors” page.
Our Data Processing Agreement (DPA) governs how we process personal data for business customers under Article 28 of the GDPR. It is available on the “Data Processing Agreement” page and is automatically deemed accepted by any business customer using the Service.
Any account creation or use by an individual below the legal age of digital consent (15 in France, or 13 to 16 elsewhere in the EU) requires verifiable authorization from a parent or legal guardian.
Vook acts in two distinct capacities depending on the data involved:
Data Controller: Vook is the controller for account, billing, support, and analytics data (such as name, email, billing address, support messages, and technical logs). This Privacy Policy applies to this processing.
Data Processor: For content uploaded by a business customer on behalf of end users (including audio and video files, transcripts, AI summaries, and chat history), the business customer is the controller and Vook acts as a processor under Article 28 of the GDPR. This processing is governed by our DPA, which forms part of our Terms of Service.
Individual users who create an account using a personal or work email act as both customer and data subject. Vook serves as controller for their account data, while processing their transcripts in accordance with the security standards detailed in Section 3 below.
The table below outlines each category of personal data processed, alongside its specific purpose and legal basis under the GDPR:
| Data category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account and contact data (name, email) | Account creation, authentication, support | Art. 6(1)(b) Contract |
| Billing and payment details | Payment processing, tax invoicing | Art. 6(1)(b) Contract and Art. 6(1)(c) Legal obligation |
| Uploaded audio, transcripts, derived artefacts | Automated transcription, diarization, storage | Art. 6(1)(b) Contract (individual users) / Art. 28 DPA instructions (business customers) |
| AI analysis, summaries, chat | User-triggered LLM features | Art. 6(1)(a) Explicit consent (activated per user action) |
| Technical and session logs | Service security, incident diagnosis, fraud prevention | Art. 6(1)(f) Legitimate interest |
Due to the sensitive nature of recordings and transcripts, we take privacy protection extremely seriously, and it is one of our top priorities for all our clients.
All transcription files (recordings and transcripts) are encrypted using an encryption key unique to each account.
If the client wishes, they may choose to store their encryption key on Vook.ai’s servers when creating their account. In this case, it is stored strictly confidentially and is never used to access the client’s files without their explicit consent.
The client may also choose to keep their key (passphrase) themselves. In this case, Vook.ai has no access to it and cannot view or decrypt the data under any circumstances.
The client may decide to send their transcript to Vook’s customer support in order to receive feedback on service quality. In this case, a decrypted version of the transcript will be sent to customer support solely for the purpose of improving the service.
The customer may decide to request a summary or analysis of the transcript via our AI assistant. This only happens upon the customer's explicit action. In this case, a decrypted version of the selected text is sent to Google Gemini's paid-tier API. This processing is temporary: the data is processed in a global region under the SCC, is never used to train AI models (per the Gemini paid-tier terms), and is deleted immediately after the result is generated.
Vook ensures that all customer account data (email address, billing address, etc.) remains private and confidential. Access is strictly limited to Vook.ai's founding team on a need-to-know basis, bound by confidentiality obligations.
Your personal data and transcription files, including encrypted audio recordings and transcripts, are retained only for the time necessary to provide the service and to meet legal obligations.
Personal data, transcripts, and audio files from accounts inactive for more than two (2) years will be permanently and securely deleted. You may also delete your data at any time from your account settings, whether an entire account or an individual transcript; deleted data is permanently removed from our systems within thirty (30) days.
Technical logs follow their own retention period, set out in section 7.
We use cookies that are necessary for the operation of the site (authentication, security, session maintenance). These cookies are essential and cannot be disabled.
We also use optional analytics cookies to understand how our users interact with the site and to improve our services. You can block or delete them at any time through your browser settings. The analytics cookies we use include: a device identifier, a session identifier, Google Analytics (via Google Tag Manager), and performance monitoring tools. No data is shared with third parties for advertising purposes.
Running the service generates technical logs. They record a pseudonymous account identifier, technical request identifiers (the page or endpoint called, response code, duration, error message). They contain neither the content of your transcripts nor your audio files.
Your IP address is not recorded as such in these logs: on sign-in and sign-up attempts it is replaced by a fingerprint (a hash), used to detect abusive access attempts. That fingerprint remains personal data and is handled as such. Our hosting providers do process the IP address itself, as any web host does, to route requests and to protect against attacks.
These logs are not intended to contain your email address: it is automatically stripped before they are sent. They are used solely for technical diagnostics, incident resolution, and service security (detection of abusive use). This processing relies on our legitimate interest in keeping the platform working and secure (Article 6(1)(f) GDPR).
The logs are hosted by Datadog, on its European site (Germany), where the data is stored at rest within the European Union. As Datadog, Inc. is a US company, any transfer is covered by the European Commission's SCC.
They are retained for 15 days, extended to 90 days for payment-related logs. After that they are deleted automatically. The separate administrative-operations audit log is retained for twelve (12) months on our own servers.
Vook does not sell or rent personal information to third parties. Data sharing is strictly limited to technical providers necessary for the provision of the service (hosting and user-activated AI tools), as detailed in the previous sections and enumerated on the “Sub-processors” page.
Payments are handled by Stripe and PayPal. PayPal acts as an independent data controller for payment data, and Stripe acts as an independent controller for fraud-prevention and regulatory-compliance purposes; their processing of your payment data is governed by their own privacy statements (Stripe, PayPal).
However, we may disclose personal information when we believe there has been a violation of our terms of service, or when required to comply with the law, protect our rights or those of our users, and safeguard our users from fraudulent, abusive, or illegal use of our site.
We reserve the right to disclose personally identifiable information if required by law and if we believe such disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, or legal process served on our website.
In accordance with the GDPR, you may access your data, request its correction or deletion, or exercise your right to data portability.
To exercise these rights, you may view, modify, or delete your personal information from within your account (the “Settings” page for your name, address, language…), or by contacting us at contact@vook.ai.
You may also permanently delete your account and transcripts from the settings page at any time. This action is irreversible and may require the resolution of any outstanding debt, order, or ongoing service. If you receive an unsatisfactory response or no response at all, you may file a complaint with the French Data Protection Authority (CNIL).
Vook will notify its clients by email of any significant changes to this policy. In case of a detected breach of your account or any unauthorized use, please contact us as soon as possible.
For any questions regarding your personal data or to exercise your rights, contact us at contact@vook.ai.