Privacy Policy

The data controller responsible for your personal data is:

Ponora International GmbH
Hammfelddamm 4A
41460 Neuss, Nordrhein-Westfalen, Deutschland
Email: privacy@ponora.ai

Our Data Protection Officer (DPO) can be reached at dpo@ponora.ai.

We process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our Services, including audio recording, transcription, and AI summarization.
• Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for analytics cookies, marketing communications, or optional AI features.
• Legitimate Interests (Art. 6(1)(f)): For product improvement, fraud prevention, and security, where our interests do not override your rights.
• Legal Obligation (Art. 6(1)(c)): Where processing is required by law, such as tax and accounting records.

You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Account Information

When you create an account, we collect your name, email address, and optionally your professional role and organization.

Recording Device Data

Our Ponora recording card connects to your mobile device via Bluetooth Low Energy (BLE). During pairing and use, we collect:

• Device identifier and firmware version
• Bluetooth connection metadata (signal strength, session duration)
• Audio recordings captured by the device (stored locally on your phone until you choose to upload)
• Battery status and usage statistics

Audio recordings are stored locally on your device by default. They are only uploaded to our servers when you explicitly initiate transcription or backup.

Audio and Transcription Data

When you use our transcription service, audio files are uploaded to our secure servers for processing. The resulting transcriptions and AI-generated summaries are stored in your account.

Usage Data

We automatically collect technical data including IP address, browser type, device type, operating system, pages visited, and interaction patterns.

Payment Information

Payment transactions are processed by Stripe, PayPal, or SEPA direct debit. We do not store full credit card numbers; we retain only transaction references and billing addresses as required.

Our Services use artificial intelligence to process your audio recordings. Here is how it works:

Transcription

Audio files are processed using speech-to-text AI models to generate text transcriptions. This processing is performed on secure servers located in the EU (Frankfurt, Germany).

AI Summarization

Transcribed text may be further processed by AI models to generate structured summaries, including key points, action items, and participant identification. This is an automated process, but:

• No legally significant decisions are made solely by automated means
• You can review, edit, or delete any AI-generated content at any time
• AI outputs are tools to assist you, not replacements for professional judgment

Speaker Diarization

Our AI may identify and label different speakers in a recording. This feature uses voice pattern analysis but does not perform biometric identification — it distinguishes speakers within a single recording without matching them to a persistent identity.

You have the right to request human review of any AI-processed content. Contact us at privacy@ponora.ai.

We use your personal data for the following purposes:

• Service Delivery: Processing recordings, generating transcriptions and summaries, managing your account
• Product Improvement: Analyzing anonymized usage patterns to improve our AI models and user experience (only with your consent)
• Communications: Sending service notifications, security alerts, and (with consent) marketing communications
• Security: Detecting and preventing fraud, abuse, and unauthorized access
• Legal Compliance: Meeting regulatory requirements, responding to legal requests

We do not use your audio recordings or transcriptions to train AI models unless you explicitly opt in to our improvement program.

We use cookies and similar technologies on our website and applications:

Essential Cookies

Required for basic functionality (authentication, security, language preferences). These cannot be disabled.

Analytics Cookies

Help us understand how visitors interact with our website (e.g., page views, navigation patterns). These are only activated with your consent.

Marketing Cookies

Used to deliver relevant advertisements and measure campaign effectiveness. These are only activated with your consent.

You can manage your cookie preferences at any time using the cookie settings button in the footer of our website, or through your browser settings.

We do not sell your personal data. We share data only with trusted service providers under strict Data Processing Agreements (DPAs):

• Cloud Infrastructure: Google Cloud Platform (EU region) — hosting, storage, and compute
• Payment Processing: Stripe, PayPal — payment transactions only
• Email Services: For transactional and marketing emails (with consent)
• Analytics: Anonymized usage data only (with consent)

All sub-processors are contractually obligated to process data only as instructed and to maintain appropriate security measures.

We may also disclose data when required by law, court order, or to protect our legal rights.

Your data is primarily stored and processed within the European Economic Area (EEA), specifically in Google Cloud's Frankfurt (europe-west3) data center.

In limited cases, data may be transferred outside the EEA (e.g., when using certain AI processing services). Such transfers are protected by:

• EU Standard Contractual Clauses (SCCs): Approved by the European Commission
• Adequacy Decisions: Where the European Commission has determined the receiving country provides adequate protection
• Supplementary Measures: Additional technical and organizational safeguards as required

You can request a copy of the applicable transfer safeguards by contacting our DPO.

We implement comprehensive technical and organizational measures to protect your data:

• Encryption in Transit: All data transmitted between your device and our servers uses TLS 1.3
• Encryption at Rest: All stored data is encrypted using AES-256
• Access Control: Strict role-based access with multi-factor authentication for all staff
• Infrastructure: Servers located in EU data centers (Frankfurt, Germany) with CE and FCC certification
• Audio Security: Uploaded audio files are encrypted immediately upon receipt and processed in isolated environments
• Regular Audits: Annual security assessments and penetration testing

In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours as required by Art. 33 GDPR.

We retain your data only as long as necessary for the purposes described in this policy:

• Account Data: Retained while your account is active, deleted within 30 days of account closure
• Audio Recordings: Stored until you delete them, or within 30 days of account deletion
• Transcriptions and Summaries: Same retention as audio recordings
• Usage Logs: Anonymized after 90 days, deleted after 12 months
• Payment Records: Retained for 10 years as required by German tax law (§ 147 AO)
• Cookie Consent Records: Retained for 12 months, then re-requested

You can delete your recordings, transcriptions, and account data at any time through your account settings.

As a data subject under the GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data we process
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restriction (Art. 18): Request limitation of processing in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw any previously given consent at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority. In Germany: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

To exercise any of these rights, contact us at privacy@ponora.ai. We will respond within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of personal information we have collected
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Categories of personal information collected: Identifiers (name, email), commercial information (purchase history), internet activity (usage data), audio data (recordings), and inferences (AI-generated summaries).

To submit a CCPA request, email privacy@ponora.ai with the subject line "CCPA Request".

Our Services are not directed to children under the age of 16 (or 13 in the United States under COPPA). We do not knowingly collect personal data from children.

If you believe a child has provided us with personal data, please contact us immediately at privacy@ponora.ai and we will promptly delete such information.

For users between 16 and 18 years of age, parental or guardian consent may be required in certain jurisdictions.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

For significant changes, we will:

• Notify you via email or in-app notification at least 30 days before the changes take effect
• Update the "Last updated" date at the top of this page
• Where required by law, obtain your renewed consent

We encourage you to review this policy periodically. Continued use of our Services after changes take effect constitutes acceptance of the updated policy.

For any privacy-related inquiries, requests, or complaints:

Data Protection Officer
Ponora International GmbH
Hammfelddamm 4A
41460 Neuss, Nordrhein-Westfalen, Deutschland
Email: dpo@ponora.ai

General Privacy Inquiries
Email: privacy@ponora.ai

Supervisory Authority
If you are unsatisfied with our response, you have the right to lodge a complaint with:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4
40213 Düsseldorf
Website: www.ldi.nrw.de