Privacy Policy

1. In short

Quorum turns documents your organisation already holds into short spoken briefings for people attending a meeting.

Three things are worth stating plainly at the top, because they are the questions people actually ask:

1. We do not train AI models on your content. Not ours, not anyone's. Our model and speech providers are engaged under terms that forbid it.
2. We do not clone anyone's voice. Briefings are narrated by a fixed pool of pre-made synthetic voices we license. The platform has no voice capture or cloning capability.
3. We only read what we are pointed at. Calendar access is limited to basic event details. Document search runs over the storage locations you connect, and you approve which files are used before a briefing is generated.

2. Who is responsible for what

For business customers, your employer is in charge of the content.

When an organisation subscribes to Quorum, that organisation decides what meetings are created, whose data goes in, and which documents are searched. In data protection terms it is the controller and we are its processor. We act on its instructions, under a Data Processing Addendum.

If you are an attendee, a meeting participant, or someone named in a document that Quorum read, and you want to know why your information was processed or want it deleted, contact the organisation that runs the workspace. We will help them respond, but we cannot act on your request without them.

We are the controller for a narrower set of things we decide ourselves: account administration, billing, security and abuse prevention, support correspondence, and our own website.

Quorum Technologies GmbH, Heumattstrasse 18, 8906 Bonstetten, Switzerland (CHE-196.262.518), is the controller for those purposes. Contact: privacy@quorumtech.ch.

Quorum has a single establishment, in Switzerland, and we currently offer the Services to organisations in Switzerland. Swiss data protection law, the FADP, is the law that governs our processing.

Where a customer is itself subject to the GDPR or UK GDPR, or where the people named in a meeting are in the EEA or the UK, those laws may reach the processing we carry out for that customer. We have written this notice and our security and transfer arrangements to that standard throughout, so the answer does not change depending on who is asking.

3. What we process, and why

3.1 Account and billing data — we are controller

Card details are handled by our payment provider. We do not store full card numbers.

3.2 Meeting and content data — your organisation is controller

Processed on the instructions of the customer whose workspace it is:

• Meeting details — title, date, duration, goals.
• Attendees — name and email address, including people outside the customer's organisation.
• Connected calendar data — basic event information from Microsoft, limited to the Calendars.ReadBasic.All permission. The calendar connection cannot read message bodies or mailboxes, and Microsoft enforces that limit, not us.
• Connected email data — some of our services read email message content, and only for people who connect their own mailbox. Each person makes that connection themselves through Microsoft's consent screen, it covers their own mailbox alone, and the content is used to sort and summarise their mail for them. Message content is stored encrypted, is never used to train models, and is deleted when they disconnect.
• Documents — files in the storage locations the customer connects (SharePoint, OneDrive, Dropbox, Google Drive) that the scan identifies as relevant, and their contents. These documents may contain personal data about employees, clients, and other third parties, which is why the customer decides what to connect and approves what is used.
• Generated material — briefing scripts, show notes, and audio episodes, one per attendee.
• Playback and generation events — enough to run the product and show progress.

3.3 Website and support widget

Our website uses analytics cookies to tell us which pages are read and how people find us. We ask before we set them, and nothing is measured until you agree. If you decline, or simply ignore the question, the analytics never load.

You can change your answer whenever you like through the Cookie settings link in the footer of any page. Declining costs you nothing, because the site works exactly the same either way.

If you use the Quincy support assistant, your messages and, where you give it, your email address are processed to answer you and to open a support conversation.

4. Automated processing

Briefings are produced automatically. The platform selects which documents are relevant, decides what to include for each attendee, and generates the script and audio without a person reviewing each one.

This is content preparation. It does not evaluate people, score them, or make decisions that produce legal or similarly significant effects for them, and it is not used for recruitment, credit, insurance, or performance management. If you use it in a way that does, you become responsible for the additional obligations that follow, and you should tell us.

You can ask the customer whose workspace it is to have a briefing reviewed, corrected, or deleted by a person.

5. Who we share data with

We use the following categories of provider. Each is bound by contract to process data only on our instructions and to appropriate security.

Our own services run on servers in Amsterdam, and the database sits in the same country. Storage, database and application compute are all inside the European Union.

Files are stored in a Cloudflare R2 bucket created under Cloudflare's EU jurisdiction, which means the objects themselves stay within the European Union rather than being placed wherever is nearest.

The three providers marked United States are the ones that receive text. Our document search sends extracts to OpenAI to be turned into embeddings, our briefing text and connected email content are processed by Groq, and the finished script is sent to ElevenLabs to be spoken. Section 6 explains the safeguards that apply.

Our model and speech providers do not train on data we send them.

Two companies that are not our subprocessors

A subprocessor acts only on our instructions. Two companies involved in the service do not, and it would be misleading to list them as though they did. Each answers for its own handling of data, under its own terms, and its own privacy notice applies alongside ours.

Microsoft. Calendar and document access runs against your own Microsoft tenancy, under the agreement your organisation already has with Microsoft. We read from a system you control, with permission you grant and can withdraw. We do not engage Microsoft on your behalf and we do not instruct them.

Stripe. Stripe processes card payments and decides for itself how it handles payment data in order to meet its own legal and anti-fraud obligations, which makes it a controller in its own right for that processing. We receive only the subscription status and the last four digits of the card.

The current list, with the safeguards for each, is kept in Annex III of our Data Processing Addendum at quorumtech.ch/legal/dpa. We will give customers 30 days' notice before adding or replacing a subprocessor that processes customer content, and you may object on reasonable data protection grounds.

We also disclose data where the law requires it, to protect rights and safety, and to a buyer if the business is sold — in which case we will tell you.

6. International transfers

We are a Swiss company and we run the platform in the European Union. Storage, database and application compute all stay in Europe.

Three providers are the exception. OpenAI, Groq and ElevenLabs process data in the United States, because that is where the document search, briefing generation and narration steps run. This means extracts of your documents, the generated briefing text, and the attendee context that shapes it are transferred to the United States.

Each of those transfers has a safeguard behind it:

In every case encryption in transit and at rest applies, and the provider is contractually barred from training on the data.

You can ask us for a copy of the safeguards used for a particular transfer.

7. How long we keep things

We keep personal data only as long as we need it. Different data has different periods.

Deleting content in the product removes it from the live service immediately. It then persists in encrypted backups for up to 30 days before those backups age out and are overwritten. We would rather state that plainly than imply deletion is instantaneous everywhere.

The periods above are maximums, not targets. If you want your data removed sooner than the schedule allows, ask us and we will do it, except where we are required to keep something — invoices and accounting records being the main case, which Swiss law fixes at ten years.

8. Your rights

Depending on where you are, you may have the right to access your personal data, correct it, delete it, restrict or object to processing, receive a copy in a portable form, and withdraw consent where we rely on it.

To exercise these rights over meeting content, contact the organisation whose workspace it is — they decide, and we act on their instruction.

For data we control ourselves — your account, billing, support, and our website — write to privacy@quorumtech.ch. We will respond within one month, and will tell you if we need longer.

You can complain to a supervisory authority:

• Switzerland — Federal Data Protection and Information Commissioner (FDPIC)
• EEA — the authority where you live or work
• UK — Information Commissioner's Office (ICO)

We would rather hear from you first.

9. Security

We protect personal data with access control on least privilege, authentication, encryption in transit and at rest, isolation between customer workspaces, vulnerability management, logging and monitoring, subprocessor oversight, and a tested incident response process.

Stored files are encrypted with a per-file key, wrapped by a per-tenant key, which is in turn wrapped by a root key held in our secret management. When a tenancy ends, the tenant key is destroyed and that tenant's files cannot be recovered.

If a breach is likely to result in a high risk to people, we notify the FDPIC as soon as possible, supervisory authorities in the EEA and UK within 72 hours where their rules apply, and affected individuals or our customer without undue delay.

10. Children

The Services are for business use and not directed at children. We do not knowingly process the personal data of anyone under 16. If you believe we have, tell us and we will delete it.

11. Changes

If we change this notice materially we will tell customers by email or in the product before it takes effect, and update the date at the top.

Quorum Technologies GmbH · Heumattstrasse 18, 8906 Bonstetten, Switzerland · CHE-196.262.518 · privacy@quorumtech.ch