Privacy & Data Protection Policy

1. Introduction and Scope

Pockevltpopptly Intelligence Systems Ltd. ("Pockevltpopptly", "we", "our", or "us"), registered in the United Kingdom under Company Registration Number #14892015, provides an automated artificial intelligence meeting action management platform. This Privacy Policy governs our collection, processing, storage, and handling of personal and enterprise information gathered via pockevltpopptly.boats and connected API interfaces.

We operate as a Data Processor regarding meeting recordings, audio streams, and transcripts submitted by corporate clients, and as a Data Controller regarding customer account records, billing contacts, and website visitor analytic metadata.

2. Information We Collect

To deliver our deterministic meeting extraction services, we collect and process the following categories of data:

• Audio and Audiovisual Submissions: Voice recordings, conference bridge audio streams, and video files explicitly uploaded or ingested via authorized conferencing bots.
• Synthesized Transcripts and Metadata: Text strings generated during speech recognition, including speaker tags, time offsets, conversational turns, and organizational jargon dictionaries.
• User Profile Records: Full name, corporate email address, organizational job title, user authentication hashes, and enterprise directory identifiers (LDAP/SSO tokens).
• Technical and Network Telemetry: IP addresses, browser agent headers, session cookies, compute resource utilization logs, and network protocol timestamps.

3. Legal Bases for Data Processing (UK GDPR / EU GDPR)

Under Article 6 of the General Data Protection Regulation (GDPR), our processing activities are justified on the following legal bases:

• Contractual Performance (Art. 6(1)(b)): Delivering core extraction algorithms, syncing action items to corporate calendars, and providing customer support.
• Legitimate Interests (Art. 6(1)(f)): Securing our infrastructure against unauthorized intrusion, monitoring system availability, and refining algorithmic extraction models (using de-identified telemetry only).
• Legal Compliance (Art. 6(1)(c)): Fulfilling statutory accounting requirements, tax obligations, and responding to valid judicial mandates.
• Explicit Consent (Art. 6(1)(a)): Administering optional marketing communications and non-essential analytical cookies.

4. Ephemeral Compute Enclaves and Audio Retention Policy

A central tenet of Pockevltpopptly is our Ephemeral Processing Architecture. Raw audio and video files ingested by our system are held in volatile RAM within encrypted compute enclaves solely for the duration required to complete diarization, transcription, and action item derivation. Once structured JSON artifacts are generated:

• Raw audio files are immediately purged from volatile memory and are not written to persistent disk storage, unless an enterprise client explicitly enables cold-storage acoustic playback in their administrative console.
• Transcripts and extracted task metadata are encrypted at rest using AES-256 and retained strictly according to client-configured data retention rules (e.g., 30 days, 90 days, or immediate deletion post-export).

5. Third-Party Processors and Sub-processors

We work with vetted enterprise infrastructure providers to deliver high-availability processing. All sub-processors are bound by strict Data Processing Agreements (DPAs) incorporating standard contractual clauses:

• Tier-1 Cloud Hosting Providers: Enterprise bare-metal infrastructure operating within ISO 27001, SOC 2 Type II certified data centers located in the United Kingdom and European Union.
• Authentication & Security Services: SSO and identity verification providers handling zero-trust cryptographic handshakes.
• Transactional Communications: Email and webhook routing providers used strictly for delivering action-item digests and verification codes.

6. International Data Transfers

Where personal data originates in the United Kingdom or European Economic Area and must be processed by server nodes outside these jurisdictions, we ensure adequate protective mechanisms are in place, including UK International Data Transfer Agreements (IDTAs) and European Commission Standard Contractual Clauses (SCCs).

7. Your Statutory Rights (GDPR / UK DPA / CCPA)

Depending on your geographic location, you possess defined legal rights regarding your personal information:

• Right of Access: You may request copies of all personal data held in relation to your profile.
• Right to Rectification: You may correct inaccurate or incomplete operational profile data.
• Right to Erasure ("Right to be Forgotten"): You may demand the permanent deletion of your account and associated task histories, subject to statutory retention exceptions.
• Right to Restrict Processing: You may request temporary suspension of processing during active disputes regarding data accuracy.
• Right to Data Portability: You may request your structured task ledgers in standard machine-readable JSON or CSV format.
• California Consumer Rights (CCPA/CPRA): We do not sell or share personal information for cross-context behavioral advertising. California residents possess the right to know, delete, and opt out of automated profiling.

8. Data Protection Officer (DPO) Inquiries

For inquiries, rights requests, or audit verification regarding our privacy architecture, contact our Data Protection Officer directly: