Privacy notice

Scope of this notice

This version describes the public website and the planned scope of the application. It is not a substitute for the final GDPR notice for paid operation. Before the service is activated, the production roles of controller and processor, legal bases, suppliers, regions and retention periods must be approved and technically verified.

Expected categories of personal data

• Account and identity: email address, name, sign-in provider and account identifiers.
• Meeting content: audio, transcript, minutes, tasks, decisions, time references and data from integrations selected by the user.
• Operations and security: IP address, device information, request time, session data, audit records and error logs.
• Subscription: plan, confirmed processing duration, subscription status and accounting information; Catch Minutes will not store complete payment-card details.
• Support and rights requests: communications, identity-verification information and records of how a request was handled.

Purposes, roles and legal bases

Fabricode will generally act as controller for account, security, support and its own contractual relationship data. For corporate meeting content, the customer may act as controller and Fabricode as processor under a DPA. The detailed matrix of purposes and legal bases is still awaiting legal approval.

The application does not itself create a legal basis for recording. Before a recording begins, the organiser or customer must identify a lawful purpose, inform participants and respect their rights and applicable workplace rules.

Recipients, transfers and retention

The marketing website is intended to be hosted on Vercel, which may process network and operational request data. The production application will not launch until an approved subprocessor register has been published, the relevant DPAs and SCCs have been concluded, and transfer assessments have been completed.

Exact retention periods for audio, transcripts, minutes, security logs, backups and supplier-held data have not yet been approved. Public launch of the application is blocked until retention and deletion have been implemented and tested across all relevant layers.

Your rights

Depending on the circumstances, you may request access, rectification, erasure, restriction or portability, object to processing, and lodge a complaint with the Czech Office for Personal Data Protection. A monitored privacy contact and a production request-handling process must be operational before public user accounts are launched.