[SQUARE BRACKETS] must be replaced with your real information, and the whole document must be reviewed by qualified legal counsel before publication. It is not legal advice.1. Who we are
[COMPANY_LEGAL_NAME] ("Debriefr", "we", "us") is the controller of the personal information described in this policy. We are established at [STREET_ADDRESS], [CITY], [PROVINCE] [POSTAL_CODE], Canada.
Our Privacy Officer, as required under Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), is [PRIVACY_OFFICER_NAME], reachable at [PRIVACY_EMAIL].
2. Information we collect
Information you provide
- Account data — name, email address, password hash, and organization
- Session metadata — meeting title, meeting type, participant names you enter, and date
- Audio recordings — the audio captured during a session you start
- Billing data — handled by our payment processor; we never store full card numbers
Information generated by the service
- Transcripts — the text produced from your recordings
- AI analysis — summaries, decisions, action items, sentiment, and scores derived from transcripts
- Usage data — feature usage, session counts, crash logs, and device/OS version
Sensitive information
Recordings may incidentally capture sensitive personal information about you or third parties. Do not use Debriefr to record conversations involving health, financial, biometric, or other sensitive categories unless you have a lawful basis and the necessary consents.
3. Why we process it, and on what legal basis
- To deliver the service (transcription, analysis, storage) — performance of our contract with you
- To bill you — performance of contract and legal obligation
- To secure and improve the service — our legitimate interests, balanced against your rights
- To send service communications — legitimate interests; marketing email only with your consent
- To comply with law — legal obligation
Under Quebec Law 25, we collect personal information only for the serious and legitimate purposes stated above, and we do not use it for other purposes without obtaining your consent.
4. Recording consent is your responsibility
Recording laws differ by jurisdiction. Some require the consent of all parties to a conversation. You are responsible for obtaining any consent required before recording, and for informing participants that an AI system will transcribe and analyze the conversation. Debriefr provides the tool; it does not obtain consent on your behalf.
5. Automated processing
Debriefr uses automated systems to transcribe and analyze conversations, producing outputs such as sentiment labels, engagement scores, and closing probability estimates. These outputs are informational and can be inaccurate. In accordance with Law 25 and Article 22 of the GDPR, we do not use them to make decisions producing legal or similarly significant effects about an individual without human involvement. If your organization uses Debriefr outputs in performance evaluation, that use is your organization’s responsibility and must be disclosed to the individuals concerned.
6. Who we share it with
We do not sell personal information. We share it only with:
- Sub-processors that host, transcribe, or analyze data on our behalf, under written agreements: [LIST_SUBPROCESSORS]
- Your organization, if you use a Team or Enterprise workspace — administrators can see sessions shared within the workspace
- Authorities, where we are legally compelled and after assessing the validity of the request
7. Where your data is stored and transferred
Data is stored in [DATA_REGION]. Where personal information is communicated outside Quebec, we conduct the privacy impact assessment required by Law 25 and confirm that the information receives adequate protection. For transfers out of the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses.
8. How long we keep it
- Recordings, transcripts, and analyses — kept until you delete them, or [RETENTION_ACTIVE] after account closure
- Account data — [RETENTION_ACCOUNT] after account closure
- Billing records — [RETENTION_BILLING], as required by tax and accounting law
- Backups — purged within [RETENTION_BACKUP] of deletion
9. Security
We encrypt personal information in transit using TLS 1.3 and at rest using AES-256. Access to production data is restricted to personnel who need it, logged, and protected by multi-factor authentication. No system is perfectly secure; if a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information promptly, as Law 25 requires, and supervisory authorities within 72 hours where the GDPR applies.
10. Your rights
Wherever you live, you may ask us to:
- Access the personal information we hold about you
- Correct information that is inaccurate or incomplete
- Delete your information — see Delete your account
- Port your information to another service in a structured, commonly used technical format
- Withdraw consent at any time, without affecting processing already carried out
- Object to or restrict processing based on our legitimate interests
- Not be subject to a decision based exclusively on automated processing
Write to [PRIVACY_EMAIL] and we will respond within 30 days. If you are in Quebec and are unsatisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec. If you are in the EEA or the UK, you may complain to your local supervisory authority.
11. Children
Debriefr is not directed at children and is not intended for anyone under [MIN_AGE]. We do not knowingly collect their personal information. If you believe a child has provided us information, write to [PRIVACY_EMAIL] and we will delete it.
12. Cookies and analytics
Our website uses only the storage strictly necessary to operate. [DESCRIBE_ANALYTICS_OR_STATE_NONE].
13. Changes to this policy
We will post any material change here and update the date at the top. Where the change requires it, we will ask for your consent again or notify you before it takes effect.
14. Contact
Privacy Officer — [PRIVACY_OFFICER_NAME]
[COMPANY_LEGAL_NAME]
[STREET_ADDRESS], [CITY], [PROVINCE] [POSTAL_CODE], Canada
[PRIVACY_EMAIL]