Privacy & Data Usage

Last updated: October 2026

In short

• We never train AI models on your data. Recordings, transcripts, notes and summaries are never used to train Noota's models or any third-party model, on any plan, including Free.

• Your meeting data is hosted in the EU. We use Google Cloud in Belgium and the Netherlands, or Scaleway in Paris with our sovereign option.

• You control retention. Deleted meetings are erased from production and backups in under 24 hours. Enterprise admins set retention from 1 day to 3 years.

• Your data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Noota is ISO 27001 certified.

• For meeting content, your organisation decides. Noota acts as a processor on its behalf, under our Data Processing Agreement (DPA).

• Questions or requests: dpo@noota.io. We answer within 30 days at most.

1. Who we are

Noota is operated by NOOTA SAS, a French simplified joint-stock company registered with the Toulouse Trade and Companies Register under number 888 965 951, with its registered office at 13 rue Sainte Ursule, 31000 Toulouse, France.

This policy explains how we handle personal data when you visit noota.io, create an account, or use the Noota platform, apps, bot, integrations and API (the "Services").

Our Data Protection Officer is an external firm, BOLD. You can reach them at dpo@noota.io.

2. Our role: controller or processor

Noota plays two different roles under the GDPR, depending on the data.

• Processor, for meeting content: audio, video, transcripts, notes, summaries, AI outputs, participant names and voices, uploaded files, connected emails and calendar events. The customer (your organisation, or you if you use Noota on your own) decides. We process this data only on documented instructions, under the DPA.

• Controller, for account and billing data, website and product usage data, support conversations, and sales and marketing contacts.

When Noota is a processor, the customer is responsible for having a legal basis to record and process meetings, and for informing participants. Section 10 explains how we help. Our Data Processing Agreement governs this processing and is available on request in our Trust Center (trust.noota.io).

3. Data we collect

• Account data: name, work email, company, role, password (hashed) or SSO identity, language and settings.

• Meeting content (processed on behalf of the customer): audio and video recordings, transcripts, speaker labels, notes, summaries, action items and other AI outputs, meeting title, date, duration and participant list.

• Connected services data: calendar events, emails, CRM or ATS records you choose to sync through an integration (Google Workspace, Microsoft 365, Salesforce, HubSpot and others).

• Billing data: billing contact, address, VAT number, invoices. Card details are handled by our payment provider; Noota never stores them.

• Usage and technical data: IP address, device and browser type, logs, feature usage, error reports.

• Communications: support conversations, emails and feedback you send us.

• Website and marketing data: forms, newsletter sign-ups, demo requests, cookies (see our Cookie Policy).

4. Why we use it and on what legal basis

• Providing the Services (recording, transcription, summaries, AI features, integrations): contract with the customer; Noota acts as processor for meeting content.

• Creating and managing your account, support: contract.

• Billing, accounting, tax obligations: legal obligation.

• Security, fraud prevention, abuse detection, service reliability: legitimate interest.

• Improving the product using aggregated, de-identified usage statistics (never meeting content): legitimate interest.

• Product and service emails to customers: legitimate interest (you can unsubscribe at any time).

• Newsletters and marketing to prospects, non-essential cookies: consent.

• Responding to legal requests, defending our rights: legal obligation or legitimate interest.

We do not sell personal data, and we do not share it with third parties for their own marketing.

5. Artificial intelligence and our no-training commitment

Noota uses AI to transcribe meetings and to generate summaries, notes, action items, emails and other outputs. Noota does not build or train its own foundation models: it uses third-party models through secured, contractually bound providers.

• Customer recordings, transcripts, notes, summaries, emails and any other meeting content are never used to train, fine-tune or improve any AI model, whether Noota's or a third party's, on any plan, including Free.

• Our AI providers are contractually bound to zero data retention: they process content only to return a result, then discard it, and may not use it for their own purposes.

• In the standard environment, frontier models (such as Anthropic Claude, Google Gemini and Mistral) are accessed only through Google Cloud Vertex AI in the EU, never through consumer APIs. Transcription is performed by Gladia in Europe.

• In the sovereign environment, AI processing uses Mistral AI and open-weight models hosted in France.

• Noota staff do not read your meeting content. Support can access it only if you explicitly share a dedicated access identifier with them, for the time needed to solve your request.

AI outputs can contain errors. Users should review them before relying on them for important decisions. Customers can turn off specific AI features, such as sentiment analysis, for their organisation.

Google Workspace APIs. Noota's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google Workspace APIs is not used to develop, improve, or train generalized AI and/or ML models.

6. Where your data is hosted

All meeting content is stored and processed in the European Union, in both environments.

• Standard environment: hosting on Google Cloud Platform in Belgium and the Netherlands; AI models via Google Vertex AI (EU) and Mistral AI; Noota meeting bot with Recall.ai in Europe; European subprocessors.

• Sovereign environment: hosting on Scaleway in Paris, France; Mistral AI and open-weight models hosted in France; meeting bot developed and operated by Noota on Scaleway; French and European subprocessors only.

The sovereign environment is designed for public sector and regulated organisations. Contact sales to activate it.

7. Subprocessors and international transfers

We use a limited number of subprocessors, each bound by a written agreement with GDPR-level obligations, security requirements and, for AI providers, zero data retention. The up-to-date list is published in our Trust Center (trust.noota.io). We notify customers before adding a subprocessor that processes meeting content, so they can object.

• Google Cloud Platform, including Vertex AI: hosting and AI models, EU (Belgium, Netherlands).

• Scaleway: hosting (sovereign environment), France.

• Mistral AI: language models, France.

• Gladia: transcription, EU.

• Recall.ai: meeting bot infrastructure (standard environment), EU.

• Telnyx: telephony (sovereign environment), EU.

• Twilio: telephony and optional phone recording (standard environment), EU / US.

• Brevo: transactional email, France.

• Intercom: customer support, EU / US.

• Stripe: payments, EU / US.

• Bastion Technologies: security and compliance management, France.

International transfers. Meeting content is stored in the EU. One exception: in the standard environment, the optional feature that records calls from your own phone number routes those calls through Twilio, which may process call data in the US. Payment and support providers may also process limited account or contact data outside the EU. Such transfers rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, with additional safeguards where needed. In the sovereign environment, no data is transferred outside the EU.

8. Retention and deletion

• Meeting content on paid plans: as long as the account is active, or the period set by the admin (1 day to 3 years on Enterprise).

• Meeting content on the Free plan: archived after 30 days.

• A meeting you delete: erased from production and backups in under 24 hours.

• Account closure or end of contract: meeting content deleted in under 24 hours; account data deleted within 30 days.

• Backups: metadata backed up every 4 hours and kept 1 year at most. Audio and transcripts are excluded from routine backups unless agreed by contract.

• Billing and invoices: 10 years (French Commercial Code).

• Prospect and marketing contacts: 3 years after the last contact.

• Security logs: 12 months.

You can delete a meeting, a folder or your whole account at any time from your settings, or by writing to dpo@noota.io.

9. Security

• Encryption: AES-256 at rest, with keys managed in Google Cloud KMS; TLS 1.2 or 1.3 in transit.

• Access control: owner, admin and member roles; SSO and SAML on Enterprise; mandatory MFA for Noota staff; least-privilege access to production.

• Certifications and audits: ISO 27001 certified; SOC 2 Type II audit in progress; annual independent penetration tests; internal audits every six months.

• Resilience: physically and logically separate backups, tested restore procedures, business continuity and disaster recovery plans.

• Incidents: if a breach affects your data, we notify affected customers without undue delay, in line with the GDPR and the DPA.

Details and evidence are available on our Security page (noota.io/security) and in our Trust Center (trust.noota.io).

10. Recording consent and meeting participants

Recording a conversation requires a legal basis and a clear notice to participants. The customer is responsible for both. Noota helps by design:

• Participants are automatically told that the meeting is recorded.

• The host or any admin can remove the bot or stop the recording at any time, and can exclude specific meetings or calendars.

• A text-only mode keeps the transcript without storing audio or video.

If you were a participant in a meeting recorded with Noota, the organisation that recorded it is the controller of that data. Send your request to them first. You can also write to dpo@noota.io: we will forward your request to the customer and help them answer it.

11. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to the processing of your data, and to data portability. You can withdraw consent at any time. You can also give instructions on what happens to your data after your death.

To exercise your rights, write to dpo@noota.io from the email linked to your account. We answer within one month, extendable by two months for complex requests. We only ask for additional identification if we have a reasonable doubt about your identity.

You may lodge a complaint with the French data protection authority, the CNIL (cnil.fr), 3 place de Fontenoy, 75007 Paris.

12. Changes to this policy

We will notify customers by email and in the app at least 30 days before any material change takes effect. The date at the top of this page shows the latest version.

13. Contact

• Data Protection Officer: dpo@noota.io

• Security issues: security@noota.io

• General questions: contact@noota.io

• Postal address: NOOTA SAS, 13 rue Sainte Ursule, 31000 Toulouse, France