Privacy Policy

1. Who we are

The controller of your personal data is:
biowissen.ai operator — full legal entity details to be added before first external user

Contact for privacy questions, data-subject requests, and complaints: privacy@biowissen.ai.

2. What we collect

When you use Handedover we process the following categories of data:

• Account data: your name, work email, organisation, role, and authentication identifiers (from Google, Microsoft, or email/password sign-in).
• Handover recordings: screen and voice recordings you create, plus derived transcripts.
• Structured knowledge: the AI-extracted facts, accounts, milestones, and follow-ups we derive from your recordings.
• Contributor input: answers given by colleagues you invite via a contributor link.
• Integration data: calendar events and meeting metadata, only if you connect a Google Calendar.
• Operational logs: IP address, user agent, and minimal request logs required to run the service securely.

3. Why we process it (legal basis)

• Performance of contract (Art. 6(1)(b) GDPR): providing the core handover functionality your employer licensed.
• Consent (Art. 6(1)(a) GDPR): storing recordings, AI processing, manager access, and optional analytics — each gathered explicitly on the consent screen and revocable at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): security monitoring, fraud prevention, and product integrity.
• Legal obligation (Art. 6(1)(c) GDPR): responding to lawful authority requests and retaining limited records as required.

4. Where your data lives

We are honest about data residency because you need to know:

• Primary storage (recordings, transcripts, structured data, user accounts): Supabase, hosted in Frankfurt, Germany (EU region). Data at rest is encrypted.
• Speech-to-text transcription:Audio recordings are sent to AssemblyAI's EU endpoint (Dublin, Ireland) at https://api.eu.assemblyai.com for transcription. EU endpoint routing is enforced in code.
• AI knowledge extraction: Transcripts are analysed by AI models running on EU infrastructure. The primary model is Mistral Large (La Plateforme, France/EU). Quality calls use Google Gemini 2.5 Pro on Vertex AI (EU region, europe-west4). Neither provider trains on API data. No content leaves the EU.
• Application compute: Vercel, US East region. Requests from your browser to our APIs are handled by Vercel functions in the United States, using TLS in transit. This means personal data transits the US at request time even though it is stored in the EU. We rely on the EU–US Data Privacy Framework and Standard Contractual Clauses as the transfer mechanism under Art. 46 GDPR.

5. Subprocessors

Handedover uses the following subprocessors. Each is bound by a data processing agreement.

Mistral AI and Google Vertex AI do not train their models on API data. AssemblyAI does not retain audio after transcription under our processing terms. Google only sees calendar data you explicitly authorise.

* Vercel compute handling requests is US-based; personal data transits the US in memory but is not stored there. See Section 4.

6. Retention

• Recordings and transcripts: retained for the lifetime of your organisation’s account. You can request deletion or export at any time via Settings → Privacy.
• Structured knowledge: kept for the lifetime of your organisation’s account, then deleted within 30 days of contract termination.
• Account data: kept while you have an account, deleted within 30 days of closure.
• Operational logs: 30 days, then aggregated or deleted.

7. Your rights

Under GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• rectify inaccurate data (Art. 16),
• erase your data (Art. 17),
• restrict processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time without affecting prior lawful processing (Art. 7(3)),
• lodge a complaint with your supervisory authority (Art. 77).

To exercise any of these rights email privacy@biowissen.ai. We respond within 30 days.

8. Security

TLS in transit, AES-256 at rest, row-level security for tenant isolation, least-privilege service keys, and mandatory authentication on all non-public routes. Contributor, verification, and reschedule links use single-use signed tokens rather than account credentials.

9. Changes to this policy

We may update this policy as the product evolves. Material changes trigger a consent version bump and you will be re-prompted to accept on next sign-in.