Privacy policy
Last updated: 13 October 2026
1. Data controller
IA Consulting Labs (iaconsultinglabs.com). Contact email: info@iaconsultinglabs.com.
IA Consulting Labs has not appointed a data protection officer; for any privacy matter, write to info@iaconsultinglabs.com.
2. Two different roles
- As controller, IA Consulting Labs processes the data of its customers and of whoever writes to it: the portal account, billing and contact requests. That is what this policy describes.
- As processor, IA Consulting Labs processes, on behalf of each customer, the data of the people who take part in that customer's meetings. The controller is the customer, who decides what the service is used for. That processing is governed by the data processing agreement (Article 28 GDPR) signed with each business customer. You can request it at info@iaconsultinglabs.com.
3. What data we process, why and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, company and message of whoever writes to us | Answering the request | Consent (Art. 6(1)(a)) and pre-contractual steps (Art. 6(1)(b)) |
| Portal account: name, email, password (only its hash), company, role and preferences | Providing the service and managing the account | Contract (Art. 6(1)(b)) |
| Billing details: legal name, tax ID, address and billing email | Invoicing and meeting tax and accounting duties | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Sessions and security: approximate IP address, browser and access dates | Protecting accounts and the service | Legitimate interest (Art. 6(1)(f)) |
| Service usage: minutes, closings and usage per key | Measuring, limiting and billing | Contract (Art. 6(1)(b)) |
We make no automated decisions with legal effects on anyone and build no marketing profiles.
4. What the service does not keep
Meeting audio, video and screen pass through the media server without being recorded. Recordings, if the customer turns them on, are delivered to the customer's storage, and the temporary encrypted copy is deleted once delivery is confirmed, after 72 hours at most. The AI works in memory, writes nothing to disk and no text to the logs, and never processes private messages or anyone who asks to be left out.
5. Who we share data with
With the providers we need to run the service, under data processing agreements and processing in the European Union.
In use today:
- Hetzner Online GmbH (Germany): hosting, with the servers in Falkenstein (Germany).
- Brevo (Sendinblue SAS, France, EU): sending the service's transactional emails (email verification, password changes, meeting and team invitations, and account and billing notices).
- Stripe Payments Europe, Ltd. (Ireland): payments and invoices. It runs in test mode today, with no real charges. Stripe may transfer data to the United States under the EU-US Data Privacy Framework or standard contractual clauses.
Planned, not contracted yet:
- Transcription and AI providers that process in the EU, which will only be contracted with zero retention confirmed. Planned: Speechmatics (live transcription), Mistral AI (live AI), EURouter (AI at the end) and Microsoft Azure, EU region (recording transcription). Neither IA Consulting Labs nor these providers use meeting content (audio, transcripts, context or results) to train AI models.
Beyond that, we only disclose data when the law requires it.
6. How long we keep it
- Account data, while the account is active and for 30 days after it is closed; then it is deleted, except billing data.
- Invoices and billing details, six years (Article 30 of the Spanish Commercial Code) and, for tax purposes, four years (Spanish General Tax Law).
- Meeting data (dates, settings and the customer's identifiers), 90 days after it ends; events, 72 hours.
- Contact requests, including early-access requests, 12 months.
- Technical and security logs, 12 months.
7. Your rights
You can ask for access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to info@iaconsultinglabs.com. If you are not satisfied with the answer, you can complain to the Spanish Data Protection Agency (www.aepd.es).
If you take part in a meeting of one of our customers, contact that customer first, as the controller; we will help them handle your request.