1. Who is responsible#
Regcall is run by Giuseppe Pelligra, based in Italy, who is the data controller for the processing described in this policy where Regcall decides why and how data is used (see section 2).
- Controller
- Giuseppe Pelligra, Italy
- Contact
- [email protected], for any question or request about your data
2. Our role and yours#
Regcall as controller. We decide how and why we process your account data, sign-in and security data, invitation requests and support messages. For this data, this policy is our notice to you.
Regcall on your behalf. The content of your recordings, such as the voices, names and, with video, the images of the other participants, and the transcripts and notes made from it, is processed on behalf of the user who records it, only to provide the service to that user. The user decides what to record and why.
Business customers. If you use Regcall for an organisation and need a data processing agreement (Article 28 GDPR), write to [email protected] and we will provide one.
3. What we collect#
- Account data
- Your name and email address, your password in hashed form (never the password itself) and the secret used to check the codes from your authenticator app.
- Meeting recordings
- Recordings you make with the Chrome extension: the audio of the call tab and of your microphone and, if you turn it on, the video of the call tab. Only the call tab is captured, never other tabs, other windows or the rest of your screen.
- Meeting details
- Title, date and duration, the call platform, the call tab's title and address, the names of participants as they appear in the call and, on Google Meet when you turn captions on, the captions shown on screen. If you connect a calendar link, the details of the matching events, such as title, guests and agenda.
- Transcripts and meeting notes
- The transcript with speaker names, the summary, decisions and action items generated from your recordings, and any corrections you make.
- Settings and connections
- Your extension and account settings, the share links you create, your extension keys and agent tokens (stored only as hashes), the integrations you configure, such as a webhook address, and, if you connect your own model provider, the address and credentials you enter for it.
- Security logs
- IP address, browser type and time of requests and sign-ins, used to protect accounts and investigate abuse.
- Invitation requests
- If you ask for an invitation on regcall.app: the name, email, company and message you send us, and the IP address of the request, used to protect the form from abuse.
Required and optional
Required to use Regcall
- Name and email address
- A password
- An authenticator app for two-step sign-in
- The recordings you choose to make
Optional, only if you turn it on
- Calendar link
- Video of the call tab
- Notice in the call chat
- Your own model provider
- Integrations, webhooks and agent tokens
- Company and message in the invitation form
4. Purposes and legal bases#
We use personal data only to provide Regcall to you, on the following legal bases under the GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Providing your account and the service: recording, transcribing, recognising who is speaking, writing meeting notes, keeping your archive | Account data, recordings, meeting details, transcripts and notes | Contract (Art. 6(1)(b)) |
| Emailing your meeting notes to you and showing a meeting to the people you send a share link to | Meeting notes and details, share link settings | Contract (Art. 6(1)(b)) |
| Optional features you turn on: calendar link, call video, the notice in the call chat, your own model provider, integrations | The data each feature needs, listed in section 3 | Contract, at your request (Art. 6(1)(b)): each feature runs only while you keep it on |
| Keeping accounts secure, preventing abuse, limiting repeated requests | Security logs, IP address of requests | Legitimate interest in protecting Regcall and its users (Art. 6(1)(f)) |
| Answering invitation requests and support messages | Name, email, company, message | Steps taken at your request before a contract (Art. 6(1)(b)) |
| Invoices and accounting, once paid plans start | Billing details | Legal obligation (Art. 6(1)(c)) |
What we never do. We do not sell or rent personal data. We do not show ads, build advertising profiles or track you across other websites. We do not use your recordings, transcripts or notes to train models, and the providers we use by default do not either. If you connect your own model provider, its terms apply (see section 6). We look at the content of your meetings only if you ask us to, for example to solve a problem, or if the law requires it.
5. Automated processing#
Regcall uses AI models to transcribe calls, separate the speakers and draft meeting notes, decisions and action items. This is automated processing, but it makes no decision about anyone that has legal or similarly significant effects (Article 22 GDPR). The notes are drafts for you: you review them, correct them and decide what to do with them.
6. Service providers#
By default, transcripts and meeting notes are produced only through zero data retention endpoints of external AI model providers: they process the data to return the result, do not keep it afterwards and do not use it to train their models. These are the providers that process personal data for us (processors):
| Provider | What it does | Where | Transfer safeguards |
|---|---|---|---|
| Hetzner Online GmbH, Germany | Hosting: the servers that store your data and run Regcall, including our own mail server | Germany and Finland (EU) | None needed: data stays in the EU |
| Cloudflare, Inc., USA | DNS, network protection and the encrypted connection to regcall.app and dashboard.regcall.app; processes IP addresses and request metadata, and carries the content of the traffic in transit (including uploaded recordings) without storing it | USA and Cloudflare's global network | EU-US Data Privacy Framework and standard contractual clauses |
| OpenRouter, Inc., USA | Default connector that routes transcription and note writing to AI model providers, only on zero data retention endpoints | USA | Standard contractual clauses |
| Speech-to-text and language model providers reached through OpenRouter | Turn the audio into a transcript and the transcript into meeting notes, on zero data retention endpoints: nothing is kept, nothing is used for training | May be outside the EEA, including the USA | Safeguards under Article 46 GDPR, such as standard contractual clauses |
| Your own model provider (optional) | Writes your meeting notes if you choose it in Settings, instead of the default | Wherever that provider processes data | Your own agreement with that provider |
Your own model provider (optional). In your settings you can choose your own provider of AI models for meeting notes, for example a service compatible with the OpenAI or Anthropic interface, or a model you host yourself. If you do, Regcall sends the text of the transcript, together with the meeting details needed to write the notes, such as the title and the participants' names, to that provider with the credentials you supplied. That provider processes the data under your own agreement with it, which determines whether and for how long it keeps the data and where it processes it; Regcall does not control it. Transcription is not affected and stays on zero data retention endpoints. You can go back to the default at any time.
Email. Emails, such as your meeting notes and invitations, are sent from Regcall's own mail server, hosted at Hetzner in the EU.
Anti-robot check. The invitation request form and the sign-in page use Cloudflare Turnstile, a service of Cloudflare, Inc., to block automated submissions. For this check, Turnstile processes technical data from the visitor's browser, such as the IP address and browser characteristics, under Cloudflare's Turnstile privacy addendum.
Integrations. When you set up an integration, such as a webhook or an external tool that reads your archive with one of your tokens, Regcall sends data to the destination you chose. That destination is under your control and its own terms apply.
Profile picture. If you have not uploaded a photo and have not turned this off in Account, Regcall asks Gravatar, a service of Automattic Inc., from its own server whether there is a picture linked to a hash of your account email (never the address itself), checks again about once a week and keeps a copy with your account; your browser never contacts Gravatar.
Regcall uses no analytics services, advertising networks or third-party trackers.
7. Where your data is#
- StoredOn Regcall's servers in the European Union, in Germany and Finland.
- On the wayThrough Cloudflare's network, encrypted end to end between your browser and Cloudflare and between Cloudflare and our servers.
- Transcripts and notesProcessed by zero data retention endpoints, which may be outside the EEA; nothing is kept there.
- Your own providerOnly if you choose one, wherever that provider operates.
8. Recording other people#
A recording contains the voices and names, and with video possibly the images, of the other participants. You decide what to record and why, and Regcall processes that content on your behalf, only to provide the service to you. You are responsible for informing participants and, where required, obtaining their consent, under the laws that apply to you.
Regcall helps you do this. The extension shows when a recording is in progress, and you can stop it at any time. You can also turn on the notice in the call chat: when a recording starts, the extension posts a short message you can edit, such as "This call is being recorded with Regcall to prepare the meeting notes", in the chat of the call. It is off by default. The message is visible to everyone in the call and is kept by the call platform under its own terms.
9. How long we keep data#
- Recordings, transcripts, notes and meeting details stay in your account until you delete them or your account is closed. There is no automatic deletion at the moment.
- When your account is closed, we delete its data.
- Security logs are kept only as long as needed to protect the service.
- Invitation requests are kept until the request is handled, and in any case for no longer than 12 months.
- Once paid plans start, invoices are kept for as long as Italian tax law requires.
10. Cookies#
Regcall uses only these cookies. There are no analytics, advertising or third-party tracking cookies.
| Cookie | Where | Purpose | Duration | Type |
|---|---|---|---|---|
mr_session | dashboard.regcall.app | Keeps you signed in | 14 days, or until you sign out | Strictly necessary |
mr_share_<id> | dashboard.regcall.app, only on the shared meeting it belongs to | Remembers that you entered the password of a shared meeting | 12 hours | Strictly necessary |
regcall_lang | All regcall.app sites (.regcall.app) | Remembers the language you chose with the flags | 1 year | Preference, set only when you choose |
The home page also keeps a note in your browser's session storage so that it suggests the Italian version at most once per visit; it disappears when you close the tab. The extension keeps its own settings in your browser (see section 13).
Because these cookies are strictly necessary for the service you ask for, or store a preference you set with an explicit choice, no consent banner is needed.
11. Your controls#
- Delete any meeting, with its recording, transcript and notes, from your dashboard.
- Revoke share links at any time.
- Revoke extension keys and agent tokens from your account settings.
- Download your notes, transcripts, audio and video.
- Choose the provider that writes your meeting notes, or go back to the default zero data retention setup.
- Turn optional features, such as the calendar link, video or the chat notice, on and off.
- Close your account by writing to [email protected] from the email address of the account.
12. Security and incidents#
All connections use TLS encryption. Signing in requires a password and a code from an authenticator app, and accounts are by invitation only. Each account's data is kept in its own separate space on the server. Passwords are stored with a slow hash function; sign-in sessions, extension keys, agent tokens and share links are stored only as hashes.
No system is free of risk. If a personal data breach occurs, we notify the Italian data protection authority within 72 hours of becoming aware of it, where the law requires, and we tell you without undue delay if it is likely to put your rights at high risk, explaining what happened, the likely consequences and what we are doing about it.
13. The Regcall extension for Chrome#
The extension records the calls you take in Chrome and uploads them to your Regcall account. It sends data only to dashboard.regcall.app. It does not collect your browsing history. It runs automatically only on supported call sites; on any other site it does nothing unless you start a recording yourself.
- Tab capture
- Records the audio, and the video if you turn it on, of the call tab only, when you start a recording or when a call begins while automatic recording is on.
- Microphone
- Records your own voice during a recording, so the transcript includes what you say. Chrome asks for your permission first.
- Access to call sites and scripting
- On supported call sites only (Google Meet, Microsoft Teams, Zoom, Webex, Jitsi, Whereby, GoTo Meeting, Slack, Discord): detects when a call starts and ends, reads the participant names, the mute state and, on Google Meet, the captions if you turned them on, as shown in the call, so speech is attributed to the right person, and for automatic recordings takes the call audio from the page.
- Active tab
- Lets you record the current tab when you start a recording from the Regcall icon.
- Offscreen document
- Processes the recording and uploads it in the background while the call is in progress.
- Storage
- Keeps your extension settings and the key that links the extension to your account, in your browser.
- Side panel
- Shows the recording status and controls next to the call.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
14. Your rights#
Under the GDPR you can ask to:
- access your personal data and get a copy of it;
- correct it if it is wrong or incomplete;
- delete it;
- receive it in a portable, machine-readable format;
- restrict its processing;
- object to processing based on our legitimate interest.
How. Write to [email protected], ideally from the email address of your account, so we can confirm it is you. If you write from another address, we may ask you to confirm the request from your account's email address; we ask only for what we need to verify your identity. Requests are free of charge.
When. We reply within one month. For complex or numerous requests, the GDPR allows this to be extended by two further months: if so, we tell you within the first month and explain why.
Complaints. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live or work.
15. Children#
Regcall is a tool for professional use and is not intended for children under 16.
16. Changes to this policy#
If we change this policy, we update this page and the date at the top. If a change is significant, we tell account holders by email before it takes effect.
17. Contact#
For anything about privacy or this policy, write to [email protected].