Privacy policy

Effective Date: November 21, 2026

This Privacy Policy ("Policy") explains how we collect, use, and process your personal data when you use our mobile, web, and desktop applications (collectively, the "App"). The App allows you to control your Plaud devices ("Device") and use other related services offered by us (collectively, the "Services").

The Services are provided by Plaud Inc. ("Plaud", "we", "us", "our"), located at 8 The Green, Ste A, Dover, Kent County, Delaware 19901, US. Below is a summary of the information in this Policy. This summary is designed to help you navigate the key points, but it is not a substitute for reading the full document.

This document is provided in multiple languages for your convenience. If there is any inconsistency, the English version shall take precedence.

Special Notice

This Policy is intended to help you understand the functions we provide and the necessary personal information required for these functions to operate. For any non-essential personal information, we will obtain your explicit consent separately when you choose to use the relevant features.

For special categories of personal data (or sensitive personal information), we will obtain your explicit consent in advance through clear notices (e.g., pop-up prompts).

Device permissions are not enabled by default. When a specific feature requires important or sensitive permissions, we will request your consent through a pop-up prompt before activation. You may withdraw such permissions at any time in the in-app settings or your device's system settings. Refusing or disabling a certain permission will not affect the use of unrelated features.

Scope of This Policy

Please note that this Privacy Policy applies only to the Services provided by Plaud. It does not extend to any third-party websites, services, or applications, even if they are accessed through our platform (for example, via a link or a third-party SDK). When you interact with these third parties, they may collect your personal information independently. Their privacy policies and data-handling practices will govern their collection and use of your data. We strongly encourage you to review their privacy policies before providing them with any information. This Privacy Policy does not apply where we act as a data processor and process personal data on behalf of commercial customers using our commercial services.

What data do we collect? To create your account, enable you to control your Device, and provide our Services, we need to collect data that you provide to us as well as data that is automatically generated during your use of the App and, for cellular-connected Devices, Mobile Network Data transmitted directly by the Device itself. For more information, see Section 1.

How do we use your data? We use your data to deliver the core functions of our service, such as device management and AI-powered features (including our AI agent, content generation, and the optional personalization features you enable), as well as to manage your account, ensure the security and stability of our App and Devices, and respond to your support requests. For more information, see Section 2.

How do we retain and protect your data? We store your data on secure servers and apply appropriate technical and organizational measures to protect it. We retain your data only for as long as necessary for the purposes described in this Policy. For more information, see Section 3.

Who do we disclose your data to? To operate our Services, we may share your data with our corporate affiliates and trusted third-party service providers who act on our behalf. We may also disclose data when legally required, such as in response to a court order, or during a major corporate transaction like a merger. We ensure that any disclosure is legally compliant and contractually protected. For more information, see Section 4.

Where do we transfer your data? Depending on where you live and how you use the Services, your personal data may be transferred to, stored in, or accessed from locations outside of your country of residence. We implement appropriate safeguards for international transfers as required by applicable law (such as Standard Contractual Clauses, where relevant) to help protect your data. For more information, see Section 5.

What are your rights and choices? You are in control of your personal data. You have rights such as the ability to access, correct, or delete your information. You can exercise some of these rights directly within the App, and for all other requests, you can contact us. Your specific rights may depend on your location. For more information, please see Section 6.

How do we protect minors? Our Services are for adults and are not intended for children. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with data, please contact us. For more information, see Section 7.

What are your rights as a United States resident? If you are a California resident, state laws like the CCPA provide you with specific rights regarding your personal data. These include the right to know what data we collect, to correct inaccuracies, and to request deletion. Importantly, you also have the right to direct us not to "sell" or "share" your personal information. We recognize opt-out preference signals like Global Privacy Control (GPC). For more information, please see Section 8.

Additional Disclosures for Users in the EEA, UK, and Switzerland. We provide region-specific disclosures for users in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, including our privacy representative, international transfer safeguards, supervisory authority information, and automated processing disclosures. For more information, see Section 9.

Additional Disclosures for Users in Japan. If you are located in Japan, the Act on the Protection of Personal Information (APPI) provides you with specific rights and requires us to make certain disclosures. This section covers our purposes of use, cross-border data transfers, the safety management measures we implement, your rights as a data subject, and how to contact us or file a complaint with the Personal Information Protection Commission (PPC). For more information, see Section 10.

How can you contact us? If you have any questions about this Policy, wish to exercise your data protection rights, this section provides our detailed contact information, including dedicated email addresses for various regions. For more information, see Section 11.

How will this policy be updated? We may update this Policy from time to time. If we make significant changes to how we process your personal data, we will provide you with prominent notice and re-obtain your consent before the new terms apply. We always recommend reviewing the latest version of our Policy regularly. For more information, see Section 12.

1 What data do we collect?

We are committed to providing you with an exceptional service while respecting your privacy. To achieve this, we strive to collect only the personal data that is necessary to deliver and improve our Services.

"Personal data" means any information that can be used to identify you, directly or indirectly. We collect this data when you interact with us, such as when you create an account, pair your Device, or use the App's features. The data we collect is detailed below:

Information You Directly Provide or Create

Account Information: Email address, encrypted password, nickname, avatar, country/region, industry, profession, role, and account ID.
Subscription and Payment Information: Subscription type, order details (such as order number, amount, and payment status), and purchase history. Please note, we do not directly collect or store your sensitive payment details (like credit card numbers); this is handled securely by our third-party payment partners.
Contact Information: Name, email address, phone number, and mailing address.
Your Content: Content you choose to upload, provide, or create through the Services. This may include audio files, photos, documents, email content or messages you choose to share with the Services, text prompts, and other materials, as well as associated metadata (e.g., file names, timestamps).
Agent Conversation Data: When you chat with our AI agent (for example, the "Ask Plaud" or "Plaud Agent" feature), we collect the messages you send, the agent's responses, and associated metadata (such as timestamps and references to the files, recordings, or memory items used in the conversation).
Third-Party Service Data: If you choose to connect a third-party service to your Plaud account (such as Google Calendar or Notion), we may collect data from that service to provide and improve our features. For example, if you connect Google Calendar, we may access your calendar event information — such as event titles, dates, times, durations, attendees, and descriptions — to associate your recordings with the relevant meetings. This also includes third-party services that you authorize our AI agent to connect to and interact with on your instruction. We only access the data necessary to provide the specific feature you have enabled, and you can disconnect the service at any time through the App settings.
AI-Processed and Generated Content: Outputs produced at your request when you use AI-powered features, such as transcriptions, summaries, answers, analysis, or other generated content, and associated metadata.
Extracted or Structured Information: Information we may extract from your content to provide the Services (for example, key points, meeting-related details, or other structured fields), including text extracted from images or scanned documents where applicable. This includes segmented and numbered portions of your transcriptions that are used as context for the AI agent and to provide source citations that link generated content back to the original audio segments.
Speaker Recognition Data: Information generated within a recording to distinguish different speakers, speaker labels you assign, and labels associated with your own voice.
Sharing and Access Data: If you choose to share content with others, we process information necessary to enable sharing and access controls, such as sharing settings, link or access identifiers, recipient information (for private sharing), and related metadata (e.g., creation time, expiration, and revocation status).
Skills Data: Skills you create through the Services, including their names, descriptions, instructions, and configurations. If you choose to publish a skill to a public or community area of the Services, the published skill and associated public profile information (such as your account name) will be visible to other users.
Web Search Queries: If you ask the AI agent to search the internet, we process the search request derived from your instruction and the search results returned to your chat, as described in Section 2.
Automation Settings: Your settings for optional automated features you choose to enable (e.g., the schedule and delivery preferences for automatic summary emails, and the custom instructions for AI processing).
Inferences and Personalization Data: Information we generate or organize based on your interactions or content to personalize the Services, such as saved preferences, memory items you choose to add or that are created based on your use, and profile descriptions or summaries (where applicable). If you enable the optional Memory feature, this includes key information we extract from your historical conversations, notes, and transcriptions, and the associated profile we generate, which are used solely to personalize the agent's responses to you as described in Section 2. You can view, edit, or delete memory items at any time in "Manage Memory".
Support and Feedback Information: Order number, issue details (type, description, device involved), communication records (chat logs, emails, call recordings), and any supporting files you provide (pictures, videos).
Device Setup Information: Wi-Fi name and password, Bluetooth name.
Contract Information: Records of your consent to our policies and terms (e.g., version number, timestamp).

Information We Obtain from Other Sources

Business and Professional Information: We may obtain information about you from third-party business-data providers and from publicly available sources in order to supplement, verify, or update the information we already hold. This may include your business email address, general location (city, state, country), and professional or business information such as your employer, job title, role, seniority, and industry. We obtain this information under contracts that require the provider to have collected it lawfully and to act only on our behalf. We do not obtain your recordings, transcripts, or any of your Content from these sources. We use this information to keep our records accurate, to understand the composition of our user base, and to tailor communications about our products and services to you, as described in Section 2. If you are in the EEA, the UK, or Switzerland, we rely on our legitimate interests in operating and growing our business (Article 6(1)(f) GDPR), and you may object at any time as described in Section 6.
Organization Inference from Your Email Address: We may infer an affiliation between you and an organization from the domain of your account email address. We use this inference only for the purpose described in Section 2 and, where applicable, for the workspace disclosures described in Section 4.

Information We Collect Automatically

Device & App Information: Plaud Device serial number, model, and firmware version; your mobile device's brand, operating system, unique device identifier, and version, or your computer's operating system and version.
Usage & Performance Data: Operational logs (e.g., clicks, feature usage, timestamps), diagnostic and performance data (e.g., system events, crash reports), and paired device status (e.g., battery level, network connectivity).
Mobile Network Data: If your Device has built-in cellular (4G/eSIM) connectivity, we will collect your mobile network information, including carrier and country codes (MCC/MNC), network registration status, and it does not include your audio recordings, their content, or the content of your conversations with the AI agent.
Cookie Information: Data collected via cookies and similar technologies when you use our web services. For more information, see Cookie Policy.

2 How do we use your data?

Legal Bases for Processing

We process your personal data only when we have a valid legal basis to do so. Depending on the specific context, our processing activities are based on one or more of the following legal grounds:

Contract Necessity: Processing is necessary to provide the Services you request, including recording, transcription, summarization, account management, and device functionality, as well as AI agent conversations, file processing, and content generation you request.
Your Consent: Certain optional features are enabled only with your explicit consent, which you may withdraw at any time through the App settings.
Legitimate Interests: Processing is necessary to improve the quality, security, and functionality of our Services, provided that such interests are not overridden by your rights and interests. We also rely on this basis to send you optional communications about plans, features, user research, and feedback opportunities relevant to your use of the Services; you can opt out of these communications at any time.
Legal Obligations: Processing is necessary to comply with applicable laws and lawful requests from authorities.

Processing Purposes

Core Services and AI-Powered Features

We process your personal data to provide and operate the Services and AI-powered features you use, including device recording, content management, AI-based processing, and cross-platform access. This includes all functionalities that are necessary or incidental to providing the Services you choose to use, whether available now or introduced in the future.

Our Services include a cloud synchronization feature that allows you to store recordings, transcriptions, summaries, and related content in your private cloud so that you can access and manage them across supported devices and platforms. For the Web App and Desktop App, cloud synchronization is required in order to provide the Services, because these platforms rely on cloud storage and processing to function.

The Desktop App allows you to create recordings and make them available across your devices by uploading them to your private cloud after recording ends. The Desktop App may also offer an automatic recording feature, which can detect system-level signals on your device (for example, whether a supported meeting application is running) to start recording. This detection operates on your device and does not access or analyze meeting content.

We also process your Content to provide AI-powered features available within the Services. These features may include transcription, summaries, reasoning, analysis, and other AI-generated outputs requested by you as part of the Services. AI-generated outputs may take a variety of formats, including text, images, video, audio, and documents.

Speaker Labeling. If you enable speaker labeling, we use a mathematical representation of each speaker's voice characteristics (a "voiceprint") for one purpose: to identify and label speakers in your recordings and transcripts, so that your transcripts attribute speech to the right person and the AI agent can refer to speakers by name. We do not use voiceprints for identity verification or authentication, for security screening, for advertising or marketing, to train or improve AI or machine-learning models, to infer any characteristic about a speaker such as age, gender, health, or emotion, or for any purpose other than the labeling feature you have enabled. We never sell, lease, or trade voiceprints.

AI Agent Conversations and File Processing. Our Services include an AI agent that you can converse with (for example, "Ask Plaud" and "Plaud Agent"). To provide this feature, your conversations with the agent and any files you upload for processing are transmitted to and stored in our cloud storage service, and relevant portions of your conversations, files, and other Content are shared with our third-party LLM service providers solely to perform the task you request, subject to the commitments described in "Our Commitment Regarding Your Content and AI" below. When you ask the agent to work with your recordings, your transcriptions may be segmented and numbered so that the agent can use them as context to generate content and to provide source citations that let you jump back to, and replay, the original audio segment.

Internet Search. If you ask the agent to search the internet, we work with a third-party search service vendor to process the search request and return the results to your chat. Our search vendor is contractually required to maintain a zero-data-retention policy, meaning it may not retain your search queries or the returned results after the search is completed.

Automated Features You Enable (Opt-In). Certain automated features operate only if you opt in — for example, an automatic summary email delivered to you on a schedule you configure (such as every day at 8:00 a.m.). When you enable such a feature, we process the data necessary to run it (such as your schedule settings and the content being summarized) for as long as the feature remains enabled. You can disable any automated feature at any time in the App settings.

Memory and Personalization (Opt-In). If you enable the optional Memory feature, we automatically extract key information from your historical conversations, notes, and transcribed content, and proactively use that information in future interactions so the agent can better understand you and respond in a way that reflects your context and preferences. This may involve generating a profile about you. We use Memory and any associated profile solely to provide more relevant and personalized responses to your requests within the Services. We do not use Memory or the associated profile to segment or group users for marketing, to target advertising, or to make promotional product recommendations, and we do not use it for any purpose unrelated to your use of the agent. You can view, edit, or delete individual memory items at any time in "Manage Memory", and you can turn the Memory feature off at any time in the App settings.

Certain features operate only based on your choices, settings, or specific requests, such as, but not limited to, speaker labeling, memory-related functionality, and Personal AI Cognitive Aide features.

When you connect a third-party service (such as Google Calendar or Notion), we use the data obtained from that service solely to provide and improve the user-facing features you have enabled — for example, to automatically match recordings with calendar events, display meeting context, or identify participants, or to enable the agent to perform the actions you request with that service. We do not use data obtained from third-party APIs for marketing, advertising, or any purpose unrelated to the feature you have enabled.

Account Management and Communications

We use your Account Information and Contact Information to create and manage your account, authenticate access, process subscriptions, and communicate with you about essential service-related matters. If you opt in to automated features such as scheduled summary emails, we will send those communications to you until you disable the feature.

Optional Communications. With your contact information, we may occasionally invite you to participate in optional surveys, user research, or feedback programs, or send you communications about our products and features, where permitted by applicable law. These communications are optional: you can opt out at any time by using the unsubscribe link included in each email or by contacting us as described in Section 11, and opting out will not affect your use of the Services. When we invite you to provide feedback or participate in user research, we rely on our legitimate interest in studying and improving the Services, and your participation is always voluntary.

Marketing and Advertising

We may use certain identifiers (such as hashed email addresses) to support our marketing and advertising, including measurement, attribution, personalization, and suppression. You can opt out of this processing as described in Section 6 and Section 8. We may use business and professional information obtained from third-party data providers, and the organization inferred from your email domain, to tailor these communications and to identify which of our products may be relevant to you and your organization.

Security, Stability, and Service Improvement

We process Device & App Information, Usage & Performance Data to ensure the security, stability, and reliability of the Services and the Device, detect abnormal activity, prevent fraud, diagnose device, connectivity, and firmware issues, measure how device features perform and are used, and improve performance.

We may also offer an optional user experience improvement program, which operates only with your explicit consent. Participation in this program allows us to use anonymized or aggregated data for service improvement and quality analysis.

Aggregated Statistics. We may compile aggregated, non-identifying statistics about use of the Services, such as the number of active users associated with a particular organization or email domain, for internal analysis, planning, and business purposes. We may disclose these aggregated statistics to the organization associated with that email domain and to prospective business customers. These statistics do not identify you, and we do not disclose individual user’s identity, usage, frequency, or content, to any organization, the public, or other third parties.

Legal and Regulatory Compliance

We may process personal data as necessary to comply with applicable laws, regulations, or lawful requests from public or governmental authorities.

Our Commitment Regarding Your Content and AI

We want to be perfectly clear about how we handle your most sensitive data:

We will never use your Content (such as your audio files, photos, or text, the files you upload, or your conversations with the agent) to train, optimize, or develop our own or any third-party artificial intelligence (AI) or machine learning models unless we have obtained your explicit and informed consent in advance.

We share certain content you submit to AI features with our LLM service providers solely to perform the requested task. Our agreements require that such data is not used to train their models and is retained only for a limited period as necessary to provide the service and meet security and compliance requirements.

For more information about how and where AI is used in the Services, including the identity of our third-party AI model providers and how AI-generated content is disclosed, please see the Plaud AI Data Usage Transparency Policy available at https://www.plaud.ai/pages/ai-data-usage-transparency-policy.

Our Commitment Regarding Google API Data

Plaud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google API data to provide and improve user-facing features that are prominent in the App.
We do not transfer Google API data to third parties except as necessary to provide or improve user-facing features (with your consent), for security purposes, to comply with applicable laws, or as part of a merger or acquisition (with your prior consent).
We do not use Google API data for serving advertisements, including retargeting, personalized, or interest-based advertising.
We do not allow humans to read Google API data unless we have your affirmative agreement, it is necessary for security purposes or legal compliance, or the data is aggregated and anonymized for internal operations.

3 How do we retain and protect your data?

Your personal data is processed and stored on secure servers in the region corresponding to your location (see Section 5 for details). We retain your data only for as long as it is necessary to fulfill the purposes described in this Policy, primarily to provide you with our Services. Most of your data is associated with your account and is kept for as long as your account remains active. When you deactivate your account, we will take steps to delete or anonymize this data in accordance with applicable laws.

We retain a voiceprint only for as long as it is needed for the speaker-recognition feature in the account that generated it. We permanently destroy each voiceprint at the earliest of: (i) the date you delete the voiceprint, the associated speaker label, or the underlying recording in the App; (ii) the date you disable the speaker labeling feature; (iii) the date on which the initial purpose for collecting it has been satisfied; and (iv) twenty-four months after your last interaction with us. Once any of those triggers occurs we destroy the voiceprint on the earliest reasonably feasible date, and in no case later than 45 days after that trigger occurs. Destruction is permanent and propagates to our backups, and any residual copy ages out of the backup window within 30 days.

We are committed to protecting your data and have implemented a range of appropriate technical and organizational security measures designed to safeguard it against unauthorized access, use, alteration, or disclosure. These measures are regularly reviewed and updated to adapt to new threats and best practices.

Protecting your data is a shared responsibility. Your role is also crucial. We strongly encourage you to use a unique and complex password for your account and to keep it confidential. If you ever suspect your account's security has been compromised, please contact us immediately. While we take all reasonable measures to secure your information, please be aware that no internet transmission is ever 100% secure. Any data you send to our services is therefore at your own risk.

4 Who do we disclose your data to?

We do not sell your personal data. However, in limited circumstances and for specific purposes, we may disclose your data to the following parties:

With Our Service Providers and Affiliates

We work with trusted third-party service providers and our corporate affiliates to help us operate, provide, and improve our Services. For example, we use them for services like cloud hosting, AI and large language model (LLM) processing, internet search, device observability and product analytics, customer support, IT assistance, and advertising and analytics. We only share the necessary data for them to perform these services on our behalf. We have strict contracts in place that require them to keep your data confidential and secure, and they are prohibited from using your data for any other purpose. Our LLM service providers are contractually prohibited from using your data to train their models, and our search service vendor is contractually required to maintain a zero-data-retention policy with respect to your search queries. For data obtained through Google APIs, disclosure to service providers is further limited by Google's Limited Use requirements as described in Section 2.

At Your Direction

Certain features allow you to share your content with others. When you choose to share, the recipients you authorize (or anyone with the link, if you choose public sharing) may access the content you share, subject to the settings you select and any access controls we provide. This includes skills you choose to publish to public or community areas of the Services, which will be visible to and usable by other users. In addition, when you connect the agent to a third-party service (such as Google Calendar or Notion), we disclose to that service the data necessary to perform the actions you request, and that service's own privacy policy governs its handling of the data it receives.

With Your Organization (Business and Enterprise Workspaces)

If you choose to join a business or enterprise workspace managed by an organization (for example, your employer), we may disclose account-related information about you — such as your email address and account status — to that organization and its administrators, once the organization has verified its ownership of the associated email domain. Joining an organization’s workspace is voluntary: we will not disclose your account information to the organization, or move your account into its workspace, unless you choose to join. Before any transition of your account takes effect, you will receive advance notice and the opportunity to export your personal content.

For Legal Compliance and Safety

We may be required to disclose your personal data to comply with applicable laws, or in response to a valid legal process, such as a court order, subpoena, or a request from a public or governmental authority. We may also share your information with our legal advisors, auditors, or other professional consultants when it is necessary for purposes like auditing or defending our legal rights.

In Connection with a Business Transfer

If Plaud is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be shared or transferred as part of that transaction. We will ensure that the new entity is bound by privacy commitments that are at least as protective as this Policy.

5 Where do we transfer your data?

We operate servers in the United States, Germany, Japan, and Singapore. Depending on your location, your personal data is stored in the data center that corresponds to your region. Due to the global nature of our operations, our affiliates and service providers may also access your data from other countries only to the extent necessary for providing and operating the services described in this Policy.

We understand that data protection laws vary between countries. To ensure an adequate level of protection when we transfer your data internationally, we rely on legally-recognized safeguards. These may include, for example, implementing approved contractual clauses (such as the Standard Contractual Clauses for Europe) or transferring to countries deemed to provide adequate protection by relevant authorities.

6 What are your rights and choices?

We believe you should be in control of your personal data. Depending on your location, you have certain rights regarding the information we hold about you.

We have made it easy for you to exercise many of these rights directly within the App. For instance, you can access and correct your account information through your profile settings in our App. You can also delete individual files within the App, delete your entire account and associated data through the same menu, or unbind and reset a specific device to remove its linked data.

You are also in control of the AI agent features you use. You can export your conversations and interactions with the agent using the export functionality in the App. If you have enabled the Memory feature, you can view, edit, or delete individual memory items at any time in "Manage Memory", or turn Memory off entirely in the App settings. Optional automated features (such as scheduled summary emails) can be disabled at any time in the App settings.

You may also have other rights under applicable law, such as the right to data portability, the right to withdraw consent, or the right to object to or restrict certain types of data processing. To exercise these rights, or for any request you cannot complete within the App, please contact us using the details in Section 11.

If you have connected a third-party service (such as Google Calendar or Notion) to your account, you can disconnect it at any time through the App settings. Upon disconnection, we will stop accessing new data from that service and will delete the data previously obtained from it within 30 days, unless retention is required by law. You may also revoke Plaud's access directly through the third-party service's security settings (for example, your Google Account permissions page at myaccount.google.com/permissions).

Please note that the specific rights available to you can vary by region. We have provided additional details for California residents in Section 8. When you submit a request, we will need to verify your identity before we can proceed and will respond in accordance with applicable data protection laws. You also have the right to lodge a complaint with your local data protection authority.

7 How do we protect minors?

Our Services are not intended for or directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you do not meet the legal age requirement for adults in your jurisdiction, please do not use our services. If you are uncertain about meeting the age requirement, kindly consult your guardian for verification.

If you are a parent or guardian and become aware that a minor is using our services, please contact us to stop relevant provision of Services by using the contact details provided in Section 11 below.

8 What are your rights as a United States resident?

California

If you are a California resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (CCPA) provides you with the rights listed below regarding your personal data. For details on the categories of personal data we have collected and disclosed in the preceding 12 months, please refer to Section 1 and Section 4 of this Policy.

Your California Privacy Rights

Right to Know: You have the right to request information about what personal data we have collected, used, and disclosed about you.
Right to Correct: You have the right to request that we correct inaccurate personal data we hold about you.
Right to Delete: You have the right to request that we delete your personal data, subject to certain legal exceptions.
Right to Opt-Out of Sale / Sharing: You have the right to direct us not to "share" your personal data. As we use certain analytics and performance cookies and may share certain identifiers (such as hashed email addresses) with advertising platforms, this activity may be considered "sharing" under the CCPA. You can exercise your right to opt out by enabling the Global Privacy Control (GPC) signal in your browser, or by contacting us.
Right to Limit Use of Sensitive Personal Data: You have the right to request that we limit the use of your sensitive personal data. However, please note that this right is subject to certain exceptions under the law. For example, your account password is considered sensitive data. We use it only for essential purposes, such as to authenticate your access, maintain the security and integrity of your account, and enable core features of the Services. Because these uses are necessary to provide the service you have requested, the right to limit use does not apply to this essential processing. We do not "sell" or "share" your password or other sensitive personal data.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
A Note on Personalization: If you enable the optional Memory feature, we generate memory items and profile information about you solely to personalize the agent's responses to you within the Services. We do not use this information to make decisions that produce legal or similarly significant effects concerning you, and we do not use it for cross-context behavioral advertising or to segment users for marketing.

How to Exercise Your Rights

To submit a request to exercise these rights, please contact us using the details in Section 11. We will need to verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

If you wish to appeal a decision we have made regarding your request, you may do so by contacting us. If your appeal is denied, you have the right to contact the California Attorney General.

Other California Disclosures

Shine the Light: Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact us using the details in Section 11.

Minors: We do not knowingly "sell" or "share" the personal information of users under 16 years of age.

Other States

If you are a resident of a US state other than California that has enacted a comprehensive consumer privacy law, this section describes additional rights available to you and how to exercise them. This section applies to residents of: Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, Utah, and any other state that enacts a comprehensive consumer privacy law after the date of this Policy. Where your state law provides rights that are more protective than those described in Section 6, the more protective standard applies.

Biometric information (Illinois, Texas, Washington, Colorado, and other states)

If you enable the speaker labeling feature, we collect and store biometric information as described in Sections 1, 2, and 3. This section is the written notice required by the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code §503.001), Washington's biometric privacy law (RCW 19.375), and the Colorado Privacy Act as amended.

What we collect. A mathematical representation of the characteristics of a speaker's voice, generated from the audio in your recordings.

Why we collect it. Solely to identify and label speakers in your own recordings and transcripts, as described in Section 2.

How long we keep it. As set out in Section 3.

Your written release. We collect, store, and use a voiceprint only after you have been shown this notice and have given consent through the in-App prompt for the speaker labeling feature. Acceptance in the App is an electronic signature and constitutes a written release. You may withdraw consent at any time by disabling the feature, which causes your stored voiceprints to be destroyed.

Speakers other than you. Your recordings may contain the voices of other people. We do not create or store a persistent voiceprint of any speaker other than you unless you have assigned that speaker a name in order to have them recognized across recordings. If you do so, you confirm to us that you have obtained that person's consent to the creation and storage of their voiceprint. Obtaining that consent, and complying with the recording-consent laws that apply where you record, is your responsibility.

No sale. We do not sell, lease, or trade your biometric information.

Disclosure. We do not disclose, redisclose, or otherwise disseminate biometric information except with your consent; where the disclosure completes a transaction you requested or authorized; where required by state or federal law or municipal ordinance; or in response to a valid warrant or subpoena.

Security. We store, transmit, and protect biometric information using a reasonable standard of care within our industry, in a manner at least as protective as that in which we handle other confidential and sensitive information.

If you do not want us to collect biometric information, do not enable the speaker labeling feature. Every other feature of the Services remains available to you.

9 Additional Disclosures for Users in the EEA, UK, and Switzerland

This section provides additional information for individuals located in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland.

EU and UK Privacy Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

United Kingdom (UK)
European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/plaud

International Transfers

As described in Section 5, depending on your location and how you use the Services, we may store and process your personal data in, and access it from, jurisdictions outside of your country of residence. Where required by applicable law, we implement appropriate safeguards for such international transfers, which may include:

For transfers subject to the EU GDPR: the European Commission's Standard Contractual Clauses (SCCs);
For transfers subject to the UK GDPR: the UK International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU SCCs;
For transfers involving Switzerland: the EU SCCs with Switzerland-specific modifications, where applicable.

You may request information about the relevant transfer safeguards (and, where available, how to obtain a copy) by contacting us using the details in Section 11.

Supervisory Authorities

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that our processing of your personal data infringes applicable law. In particular:

UK: the Information Commissioner's Office (ICO);
Switzerland: the Federal Data Protection and Information Commissioner (FDPIC);
EEA: your local supervisory authority (for example, in your habitual residence, place of work, or the place of the alleged infringement).

We encourage you to contact us first using the details in Section 11 so we can try to resolve your concerns promptly.

Automated Processing and Personalization

Certain features of the Services use automated processing to generate outputs you request and to personalize your experience (for example, by using recent interactions or content you choose to provide to improve the relevance of summaries, recommendations, or responses, including, if you opt in, the Memory feature described in Section 2). Where required, we provide additional feature-specific transparency information and controls so you can understand how the feature works and manage your choices.

This automated processing does not produce legal effects concerning you or similarly significantly affect you. We do not use solely automated decision-making that produces such effects. You can manage applicable settings and choices as described in Section 6.

Requirement to Provide Personal Data

Certain personal data is required to provide the Services. If you choose not to provide such data, we may be unable to provide some or all of the Services. Where processing is optional and based on your consent, you may refuse or withdraw consent as described in this Policy.

10 Additional Disclosures for Users in Japan

This section provides supplemental information for individuals located in Japan, as required by the Act on the Protection of Personal Information (Act No. 57 of 2003, as amended) ("APPI"). The disclosures below are provided in addition to, and should be read together with, the rest of this Policy.

Name and Address of the Business Operator

The business operator responsible for handling your personal information is Plaud Co., Ltd., Shibuya Hikarie 33F, 2-21-1 Shibuya, Shibuya-ku, Tokyo.

Purposes of Use

We use your personal information for the purposes described in Section 2 of this Policy. Under the APPI, we will not use your personal information beyond the scope necessary to achieve these stated purposes without obtaining your prior consent, except where permitted by law.

For details on the categories of personal data we collect and the parties to whom we may disclose it, please refer to Section 1 and Section 4 of this Policy.

Cross-Border Transfers and Entrustment of Processing

As described in Section 5, your personal data is stored on secure servers in Japan. However, to provide certain AI-powered features (such as transcription and summarization, agent conversations, file processing, and content generation), we entrust the processing of your data to our LLM service providers located outside of Japan, which may include the United States, countries within the European Economic Area, and other jurisdictions. In addition, some device Information and Usage & Performance Data from cellular-connected Devices is transmitted directly by the Device to, and processed by, our observability and product-analytics service providers located in the United States. The framework of contractual and organizational measures described in this section applies equally to these providers.

Under the APPI, we have established a framework of contractual and organizational measures to ensure that these overseas service providers continuously implement data protection measures equivalent to those required under Japanese law. These measures include:

Contractual safeguards: We have executed data processing agreements with each service provider that impose obligations equivalent to those under the APPI, including strict purpose limitations, prohibitions on unauthorized use or disclosure, and requirements for data deletion after the processing is complete.
Prohibition on secondary use: Our agreements prohibit service providers from using your data for any purpose other than performing the requested task, including for training or improving their own models.
Data minimization and limited retention: Only the data necessary to perform the requested task is transmitted. Data shared with service providers is retained only for a limited period as necessary to provide the service and meet security and compliance requirements.
Encryption: All data transmissions to service providers are encrypted using industry-standard protocols.
Ongoing monitoring: We periodically verify that our service providers maintain the agreed-upon data protection measures and take corrective action if any deficiencies are identified.

You may request additional information about the specific safeguards we have implemented by contacting us using the details in Section 11.

Safety Management Measures

We implement the following categories of safety management measures to protect your personal information, taking into account the nature and volume of the data we handle and the external environment of the countries in which it may be processed:

Organizational measures: Establishment of internal policies and procedures for personal information handling, appointment of a person responsible for the management of personal information, and regular internal audits.
Personnel measures: Regular training and education of employees on the handling of personal information, and confidentiality obligations in employment agreements.
Physical measures: Access controls at facilities where personal information is handled, and measures to prevent theft or loss of equipment.
Technical measures: Access control systems, encryption of data in transit and at rest, intrusion detection, logging, and regular security assessments.
Understanding of the external environment: When personal data is processed outside of Japan for AI-powered features or for device observability and product analytics, we take into account the data protection laws and practices of the relevant country and implement additional safeguards as necessary (see "Cross-Border Transfers and Entrustment of Processing" above).

Your Rights Under the APPI

Under the APPI, you have the following rights with respect to your retained personal data:

Right to disclosure: You may request that we disclose the personal data we hold about you, as well as the purposes of use, and records of any third-party provision. You may specify whether you wish to receive this information in writing or by electronic means.
Right to correction: If your personal data is inaccurate, you may request that we correct, add to, or delete the inaccurate information.
Right to cessation of use: You may request that we stop using or erase your personal data if it is being handled beyond the scope of the stated purposes of use, was acquired by improper means, or if the continued handling is likely to harm your rights or interests. You may also request that we cease providing your personal data to third parties in certain circumstances.

To exercise any of these rights, please contact us at privacyjp@plaud.ai. We may need to verify your identity before processing your request. We will respond without delay in accordance with the APPI. We may charge a reasonable fee for disclosure requests, which we will communicate to you in advance.

Complaints and the Personal Information Protection Commission

If you have any concerns about how we handle your personal information, we encourage you to contact us first using the details in Section 11.

You also have the right to lodge a complaint with Japan's Personal Information Protection Commission: Website: https://www.ppc.go.jp/ Consultation desk: https://www.ppc.go.jp/personalinfo/pipldial/

11 How can you contact us?

If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about your data, please do not hesitate to contact us at privacy@plaud.ai.

Our data controller is Plaud Inc., located at 8 The Green, Ste A, Dover, Kent County, Delaware 19901, US.

12 How will this policy be updated?

We will update this Policy in a timely manner, and we recommend that you regularly check the latest version of this Policy via "Me > About Plaud > Privacy Policy" of the App. If there are any substantial changes to this Policy, depending on the nature of such changes, we will notify you in advance through pop-ups, push notifications, emails, and other appropriate means.