You took part in a meeting that was minuted with Protoki

The controller within the meaning of the GDPR is the organisation that issued the invitation — that is, the organisation using Protoki. It decides whether a recording is made, how long the data is kept and who can see it. Address your requests to that organisation first; we will forward them on request (section 8).

rooom AG operates Protoki on behalf of that organisation as a processor under Art. 28 GDPR and pursues no purposes of its own with your data. Where rooom AG issued the invitation itself, it is also the controller.

rooom AG, Löbstedter Str. 47a, 07749 Jena, Deutschland · info@rooom.com
Data protection officer: Landgraf Datenschutz GmbH, Markt 22, 07743 Jena · dsb@landgraf-datenschutz.de

Protoki joins online meetings (alternatively, audio files are uploaded), the recording is transcribed and AI-assisted minutes with tasks are created from it. The purposes are:

• Business documentation: minutes, overviews and tasks from meetings.
• Assigning meetings to client contexts based on the email domain of external participants.

No performance or behaviour monitoring takes place. No speaking-time statistics and no personal evaluations across meetings are produced, and there is no emotion or sentiment analysis. No permanent voiceprints are stored; speaker-separation data exists only temporarily while a meeting is being processed and is deleted together with the audio recording.

• Audio recording of the meeting (temporary only, see section 6).
• Transcript with speaker assignment.
• Public chat messages from the meeting (for example shared links), where the platform makes them available to the recording participant — they are included in the minutes.
• Technical meeting metadata from the recording service (the platform's participant list, start and end of the recording) — the basis for the attendance details in the minutes.
• AI-generated minutes, including the tasks assigned in them.
• Participant metadata: display name from the meeting platform, where applicable the email address from the calendar invitation, approximate time present.

Source (Art. 14(2)(f) GDPR): from the meeting itself (audio, the platform's participant list), from the corresponding calendar invitation of the inviting organisation and — where the speaker assignment is corrected afterwards — from manual entries made by users. The recording is announced before it starts: by the bot name with the addition “is recording”, by a notice in the meeting and, where applicable, by an email sent before the meeting.

• External participants: as a rule Art. 6(1)(f) GDPR — legitimate interest in documenting business meetings, based on a documented balancing of interests. You have a right to object (section 7).
• Employees of the inviting organisation: Art. 6(1)(b) and (f) GDPR, as a rule supplemented by an internal usage policy or a works agreement that defines permitted meeting types, access rights and retention periods and rules out performance monitoring.

Which basis applies in a specific case is decided by the inviting organisation as the controller.

To operate Protoki, rooom AG uses the following service providers as sub-processors (Art. 28 GDPR). Processing and storage take place in the European Union; we name the “group headquarters” regardless, because some of these providers are companies headquartered outside the EU.

• Spoke SAS („Meeting BaaS") — The recording bot joining the online meeting, and the audio recording. Processing location France (EU), group headquarters France.On our deletion request the provider removes the recording, transcript, chat history and the names of participants and speakers. The session metadata — bot ID, status, timestamps, duration and token consumption — remain with them, and that includes the meeting URL. According to the provider on 31 August 2026 these rows are currently retained indefinitely; deletion or redaction is possible only on request via their support.
• Scaleway SAS — engaged through Meeting BaaS — The data centre and storage on which Meeting BaaS runs its service. Processing location Paris, France (EU), group headquarters France.
• Gladia SAS — engaged through Meeting BaaS — Speech recognition within the Meeting BaaS offering. Processing location France (EU), group headquarters France.Protoki switches off transcription at Meeting BaaS and transcribes itself. On 31 August 2026 Meeting BaaS confirmed in writing that with transcription disabled no audio is sent to Gladia. That confirmation is conditional: it holds only as long as the provider’s own transcription stays switched off — for real-time streaming transcription Gladia would be the provider’s default. We therefore continue to list Gladia as a recipient, so that the condition remains visible.
• Mistral AI SAS — Transcription with speaker separation, and production of minutes and tasks. Processing location France (EU), group headquarters France.
• Supabase, Inc. — Database and file storage of the application. Processing location Frankfurt am Main, Germany (EU), group headquarters United States.
• Vercel, Inc. — Operation and delivery of the web application. Processing location EU region (Frankfurt am Main), group headquarters United States.
• Plus Five Five, Inc. („Resend") — Sending of the minutes emails and system emails. Processing location EU region (Ireland) for sending, group headquarters United States.

“Engaged through” means: this provider has no contract with us, but with the service provider named before it (Art. 28(4) GDPR). We name it regardless, because it sees the data.

In addition, those people at the inviting organisation who are entitled to the minutes are given access. No data is passed on for advertising purposes.

• Audio recordings: deleted after successful transcription. The inviting organisation can set a limited retention period — at most 12 months; after that the recording is deleted automatically. Uploaded files without a speaker assignment are deleted after 7 days at the latest.
• Transcripts: 12 months by default.
• Minutes: 24 months by default.
• At the bot provider: recording, transcript, chat history as well as participant and speaker names are deleted as soon as Protoki has taken over the recording. The bot's session metadata — identifier, status, timestamps, duration, token consumption and the meeting URL — remain stored at the provider; according to the provider on 31 August 2026 indefinitely. Redaction of the meeting URL or deletion of these details is possible only on request via the provider’s support.

Database backups expire after 7 days at the latest; after a restore from a backup, deletions that have already been documented are carried out again.

You can object to a recording during the meeting — verbally or in the meeting chat. The recording bot is then removed.

You have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20 GDPR). These rights are directed against the responsible organisation. If you do not know which one that is, write to us: we will name the body or forward your request — you need neither an account nor any form other than the one above.

We confirm receipt and reply within one month (Art. 12(3) GDPR). Where your data is collected from a calendar invitation, the responsible organisation will inform you within one month at the latest, and earlier on first contact (Art. 14(3) GDPR).

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for rooom AG this is Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit, Häßlerstraße 8, 99096 Erfurt.

• No voiceprints and no recognition of voices across meetings.
• No emotion, sentiment or engagement analysis.
• No speaking-time or performance evaluation.
• No use of your content to train AI models — neither by us nor by our providers.
• No chat with the bot; it accepts no input from the meeting.

Minutes are created with the help of AI and are labelled as such. The verbatim transcript and the generated minutes remain separate. AI results can be wrong.