Palyro Privacy Policy

Effective date: 14 July 2026

We wrote this to be read, not skimmed past. It says what data Palyro touches, who touches it, where it goes, and how to get rid of it.

1. Who is responsible

The controller for your account, billing and website data is:

Novotrio OÜ
Registry code 17503604
Pärnu mnt 388b, Nõmme linnaosa, 11612 Tallinn, Estonia
Privacy contact: support@palyro.com

2. The two roles — read this first

Palyro processes two very different kinds of data, and our legal role differs:

1. Your account data — email, billing, settings, usage. We are the controller. Sections 3–5 cover this.
2. Meeting content — what you and other participants say: audio, transcripts, translations, notes, coach output. The account holder who runs the meeting is the controller, and we process it on their behalf as processor. If you were in a meeting where someone used Palyro, that person or their company decides why the meeting was processed; we act on their instructions. Section 6 covers this, including your rights as a meeting participant.

3. Account and website data (we are controller)

We run no third-party advertising or tracking on the site.

Cookies: only what’s necessary to sign you in and keep your session (authentication/session cookies and, during sign-up, short-lived signed cookies that carry your invite code, your Terms-acceptance and marketing choice, and the page you were heading to — so they survive the Google sign-in round-trip). These sign-up cookies are strictly necessary, HTTP-only and expire within minutes. That’s why there is no cookie banner — there’s nothing to consent to.

4. Voice clone (special note)

If you opt in to voice cloning, we send your voice sample to ElevenLabs to create a voice model used to synthesize your translated speech.

• Legal basis: your explicit consent. We treat your voice model as biometric-grade data and hold ourselves to the strictest standard for it. We store which version of the consent text you agreed to, and when.
• One clone per account; your own voice only.
• Withdrawal: delete the clone in your dashboard at any time — this deletes the model at ElevenLabs and withdraws your consent. Withdrawal doesn’t affect processing that already happened.
• Your voice model is used solely to voice your own translated speech in your meetings. Not for training, not for anyone else.

5. How long we keep account data

6. Meeting content (the account holder is controller; we are processor)

What is processed

When a Palyro meeting runs: meeting audio, live transcripts (source language and translation), synthesized voice output, and — depending on mode — meeting notes and coach output (private suggestions shown only to the account holder). Anything the account holder gives the Meeting Coach as briefing or context is treated as meeting content too. In room mode, audio comes from participants’ phones instead of a meeting bot.

Who processes it

We are transparent about this because participants deserve to know which AI is listening:

We use these AI providers through their business/API terms. For each AI provider we rely on, those terms include a documented commitment not to use API customer content to train their models — as of the date of this policy that covers OpenAI, Anthropic and ElevenLabs (API tiers), and it is a condition we require of any provider we add (for Google, we would use only the paid API tier, which carries the same commitment). We don’t train models on your meeting content either.

Storage and retention of meeting content

Recordings, transcripts and notes are stored on our servers in the EU (or with our EU-region storage provider) so the account holder can access them in their meetings library. They are automatically deleted 90 days after the meeting. The account holder can delete any meeting earlier at any time, and closing the account deletes them too.

Your rights as a meeting participant

If someone used Palyro in a meeting with you and you have questions or objections, the account holder — the person who brought Palyro into the meeting — is your first contact: they control that data. But we will help. Write to support@palyro.com and we will forward your request to the account holder and, where data-protection law obliges us directly, act on it ourselves. Our Terms require account holders to inform participants in advance and to stop Palyro in a meeting where a participant objects.

7. Where your data lives — international transfers

Storage is EU-based: accounts and billing in Frankfurt, and recordings and transcripts on our servers in the EU or with our EU-region storage provider. But we won’t pretend Palyro is a fully-EU-hosted product: to do its job, meeting content is streamed in real time to the named processors above, several of which process in the United States, and our engine is developed and operated by Apsara Turizm Seyahat Medya Danışmanlık Ticaret İthalat İhracat LTD. ŞTİ. in Fethiye, Türkiye.

One thing we want to be explicit about, because “storage in the EU” alone would be misleading: our development and operations processor, Apsara (Fethiye, Türkiye), may access personal data from Türkiye in order to build, run and maintain the engine — and under EU data-protection rules, remote access from outside the EU counts as an international transfer, even when the data itself stays stored in the EU. Türkiye has no EU adequacy decision. This access therefore happens under an Art. 28 processing agreement with EU Standard Contractual Clauses (Module 2, controller→processor) and supplementary measures, and is limited to what operating the service requires.

For every other transfer outside the EU/EEA we rely on the EU Standard Contractual Clauses or, for US providers certified under it, the EU–US Data Privacy Framework, backed by transfer impact assessments. You can request information about these safeguards at support@palyro.com.

8. Emails we send you

Three kinds, treated differently:

• Sign-in email (no opt-out, no unsubscribe link): login magic links. That’s the service working, not marketing.
• Service notifications you control: post-meeting notes emails and recording-ready notifications. If you don’t want them, tell us at support@palyro.com and we’ll disable them for your account; a settings toggle is on its way to the dashboard.
• Product updates (opt-in only): at signup we show an unticked checkbox — “Palyro updates — occasional product news from us, never from anyone else.” We send product news only if you tick it, every such email has an unsubscribe link, and we never share your email with anyone for their marketing. You can withdraw this consent at any time.

9. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw any consent (like the voice clone or product updates) at any time. Write to support@palyro.com — we answer within one month.

You can complain to a supervisory authority: in Estonia the Andmekaitse Inspektsioon (AKI), or the data-protection authority of the country where you live or work.

10. Automated decision-making

Palyro’s AI translates, transcribes, advises and summarizes. It does not make automated decisions with legal or similarly significant effects about you.

11. Changes

We announce material changes to this policy by email before they take effect, and keep the current version at this address.