Privacy Policy

The short version: Kikoe transcribes your meeting audio in real time and discards it immediately — we never store raw audio. The Chrome extension captures only the tab you select and does nothing else. We do not sell your data. Ever.

1. Who We Are

Kikoe is a real-time conversation intelligence product operated by Kikoe ("we", "us", "our"). We provide transcription, AI-generated summaries, and meeting workflow integrations for individuals and teams.

For the purposes of the General Data Protection Regulation (GDPR) and other applicable privacy laws, we act as the data controller for the personal data described in this policy.

Questions about this policy can be directed to: support@kikoe.ai

2. Chrome Extension & Audio Capture

The Kikoe Chrome extension ("Extension") is an optional companion that captures audio from a browser tab you designate — for example, a Zoom, Google Meet, or Microsoft Teams tab running in Chrome — and streams it to the Kikoe web application for real-time transcription.

        The Extension has a single purpose: bridging browser tab audio into the Kikoe web app.
        It does not modify web pages, read your browsing history, or operate outside of a
        user-initiated recording session.
      

What the Extension does and does not do:

Does: capture audio from the single browser tab you actively select when starting a session.
Does: stream that audio over an encrypted connection (TLS 1.2+) to Kikoe's transcription relay.
Does: display a session status indicator in the Chrome toolbar while recording is active.
Does not: capture audio from any tab other than the one you selected.
Does not: capture screen video or take screenshots.
Does not: read, modify, or inject content into any web page.
Does not: access your browsing history, bookmarks, or saved passwords.
Does not: operate or collect any data when you are not in an active Kikoe session.
Does not: store any audio locally or on Kikoe's servers — audio is streamed directly to Deepgram for transcription and immediately discarded.

The Extension requests the tabCapture (or desktopCapture) Chrome permission solely to obtain the audio stream from your active meeting tab. No other permissions beyond communication with kikoe.ai and its subdomains are requested.

3. What Data We Collect

We collect data in the following categories:

Category	Examples	Legal basis (GDPR)
Account data	Email address, hashed password, account creation date, subscription plan	Contract performance
Audio & transcripts	Raw microphone or tab audio captured during a session; real-time and final transcription text; speaker diarization labels	Contract performance; explicit consent
AI-generated content	Insight cards, mind-map nodes, meeting summaries, key takeaways, action items, decisions surfaced from your transcripts	Contract performance
Billing data	Stripe customer ID, subscription status, minutes balance; payment card details are held solely by Stripe and are never stored on our servers	Contract performance; legal obligation
Consent records	Whether you have accepted this policy, which version, the timestamp, and your IP address at the time of acceptance	Legal obligation; legitimate interest
Integration data	OAuth tokens for Google Calendar and HubSpot (stored encrypted); Slack webhook URL; email addresses you supply for digest notifications	Consent; contract performance
Technical data	Server logs (IP address, request path, HTTP status, timestamp); browser and OS information included in standard HTTP headers	Legitimate interest (security & debugging)

Audio is streamed in real time to Deepgram for transcription. A copy of the recording is also stored privately so you can play it back later — it is kept in a private storage bucket accessible only to your account and to Kikoe administrators for support purposes, and is deleted when you delete the session. Transcripts and AI-generated content are stored in encrypted form in our database (see Security).

4. How We Use Your Data

Delivering the service: transcribing conversations, generating AI insights and summaries, saving sessions, and serving your history.
Billing and account management: tracking minutes consumed, processing payments via Stripe, and enforcing plan limits.
Integrations you choose to enable: posting recaps to Slack, emailing digests to participants you specify, pushing notes to HubSpot, or importing calendar events. These features are only activated when you explicitly configure them.
Security and fraud prevention: rate-limiting, anomaly detection, and maintaining server logs.
Legal compliance: retaining consent records as required by CCPA, GDPR, and applicable recording-consent laws.
Service improvement: aggregated, anonymised usage metrics to improve features. We do not sell or share individual user data for advertising.

5. Third-Party Processors

We share data with the following sub-processors to operate the service:

Processor	Purpose	Data shared
Deepgram Privacy policy ↗	Real-time speech-to-text transcription (Nova-2 model)	Raw audio stream during active recording. Deepgram offers a Model Improvement Program (MIP); you can opt out via Deepgram's dashboard. We transmit audio under Deepgram's data-processing terms.
Anthropic Privacy policy ↗	AI insight cards, mind-maps, and meeting summaries (Claude models)	Transcript text segments and AI-generated session content. Anthropic does not use API inputs to train models by default.
Supabase Privacy policy ↗	Database, authentication, and file storage	All account, session, and profile data. Supabase is our primary data store. Data is hosted in the region you are assigned at signup.
Stripe Privacy policy ↗	Payment processing and subscription management	Email address and payment card details (held solely by Stripe). We store only Stripe customer IDs and subscription metadata.
Google Privacy policy ↗	Google Calendar OAuth integration (optional)	OAuth tokens if you connect your Google Calendar. We read event titles and attendee lists to pre-fill the session save modal. We never write to your calendar.
HubSpot Privacy policy ↗	CRM push integration (optional)	Meeting summaries, action items, and participant names are pushed to your HubSpot portal only when you initiate a push or enable auto-push. OAuth tokens are stored encrypted.
Resend / SendGrid (email digest, optional)	Transactional email delivery	Recipient email addresses and meeting recap content, only when you specify participants for email digest in a session's save modal. Recipients may unsubscribe via a one-click link in every email.

We do not sell personal data to third parties, and we do not use your data for cross-context behavioural advertising.

6. Data Retention

Session transcripts and AI content: retained for as long as your account is active. You can delete individual sessions at any time from the sessions page.
Account and billing data: retained for the duration of your account plus 7 years to comply with financial record-keeping obligations.
Server logs: retained for up to 90 days, then automatically purged.
Consent records: retained indefinitely as evidence of your agreement, even after account deletion, to satisfy legal obligations.
Email unsubscribe records: retained indefinitely to honour your opt-out preference.
Integration tokens: cleared immediately when you disconnect an integration. You can disconnect at any time from Settings → Integrations.

When you delete your account, we remove your profile, sessions, and integration tokens within 30 days. Consent records, anonymised billing logs, and email unsubscribe entries are retained as noted above.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data. To exercise any right, contact us at support@kikoe.ai.

Right	GDPR (EEA/UK)	CCPA (California)
Access / Know	Request a copy of your personal data	Request disclosure of categories and specific pieces of data collected
Correction / Rectification	Correct inaccurate data	Correct inaccurate personal information
Erasure / Deletion	Request deletion in most circumstances	Request deletion (subject to legal exceptions)
Portability	Receive your data in a structured, machine-readable format	Not applicable
Restriction / Objection	Restrict or object to processing in certain circumstances	Not applicable
Opt-out of sale / sharing	Not applicable	We do not sell or share personal data; no opt-out required
Non-discrimination	Not applicable	Exercise privacy rights without receiving discriminatory service

If you are in the EEA or UK and believe your rights have not been upheld, you may lodge a complaint with your local data protection authority (e.g., the ICO in the UK or the relevant EU supervisory authority in your member state).

We will respond to verified requests within 30 days (GDPR) or 45 days (CCPA), with one possible extension of equal length where necessary.

8. Security

We take reasonable technical and organisational measures to protect your data:

End-to-end session encryption: session transcripts and AI-generated content are encrypted client-side using AES-256-GCM before being stored. The encryption key is derived from your Supabase auth token; we cannot read your session content server-side.
Transport security: all connections between your browser and our servers use TLS 1.2 or higher.
Secret management: API keys and OAuth tokens are stored as environment variables or as encrypted columns in the database; they are never embedded in client-side code.
Access controls: every API endpoint requires a valid, short-lived Supabase JWT. Service-role credentials are only used server-side and never sent to clients.
Minimisation: we do not store raw audio. Audio is streamed to Deepgram in real time and never persisted on our infrastructure.

No system is perfectly secure. If you discover a security vulnerability, please disclose it responsibly to support@kikoe.ai.

9. Children

Kikoe is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us at support@kikoe.ai and we will delete the account promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our data practices, or the features we offer. When we make a material change, we will:

Update the version number and "Last updated" date at the top of this page.
Increment the CONSENT_VERSION constant in our application code.
Show a re-consent modal the next time you open the app. You will need to review and accept the updated policy before you can continue using Kikoe. This ensures we have a fresh, timestamped record of your consent for the current version.

Continuing to use Kikoe after accepting the updated policy constitutes your agreement to the revised terms. If you do not wish to accept the updated policy, you may close the modal to return to the homepage, or delete your account by contacting us.

11. Contact

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a security issue, please contact:

Kikoe
Email: support@kikoe.ai

We aim to respond to all privacy-related enquiries within 5 business days.