# Privacy policy > What Odrivyn collects, where it goes, how long we keep it and how you control it. URL: https://odrivyn.vercel.app/privacy Updated: 2026-09-25 Odrivyn is a Windows desktop app, written in Rust, that helps you before, during and after calls, plus the website at odrivyn.com where you manage your account and company. This policy explains what we collect, where it goes and how you control it. We follow the EU General Data Protection Regulation (GDPR). ## 1. Who is responsible Odrivyn, Athens, Greece, controls your personal data. You can reach us at contact@odrivyn.com. When a company uses Odrivyn, the company decides who joins and which files go into its shared knowledge base. For that shared material the company acts as controller and we process it on its behalf. ## 2. What stays on your computer The desktop app keeps your call transcripts, the answers it showed you, your recaps and follow-ups, your custom modes and your settings in a local database at %APPDATA%\Odrivyn\odrivyn.db. We do not copy this database to our servers. The app stores its sign-in credential in Windows Credential Manager. You can delete a call in the app. To remove everything, uninstall the app and delete that folder. ## 3. What leaves your computer during a call - Audio: while you listen, the app streams call audio to AssemblyAI, which returns the transcript. We do not receive or store the audio. - Answers: when the other side asks a question, or you type one, the app sends the question, recent transcript lines and the passages that match it from your files to our API. Our API passes them to the answer model you chose (OpenAI or Google Gemini) and streams the answer back. We do not store the question or the answer. - Screenshots: when you ask about your screen or watch a region, the app sends that image with your question to the answer model. We do not store the image. - Recaps: when a call ends, the app sends its transcript once to our API to write the recap and follow-up. The recap comes back to your computer and we do not keep a copy. - Web search: for some typed questions, our API sends a search query to Brave Search. ## 4. What we store on our servers - Account: your name, email address and a hashed password, managed by our own authentication service. - Desktop pairing: an identifier for each computer you approved, so the app can sign in without a password. - Files and web pages you add as material: the original file in Cloudflare R2, and its text passages and search vectors in our database. Google Gemini creates the vectors and reads scanned pages; Apify reads web pages you add. - Company data: your company name, its members, departments, roles and pending invitations, and which files members shared into the company brain. - Usage: how many answers and seconds of transcription you used each day, so we can apply your plan's limits. - Disclosure records: when you confirm that you told the people on a call about AI assistance, we record that confirmation and the region you chose. - Billing: your plan and subscription status. Stripe holds your payment details. ## 5. Company brain Files you add to your company's brain become readable by every member of that company, in every department. Answers on their calls can quote those files. Your other files stay private to you. The person who shared a file, or a company owner or admin, can take it out of the brain. ## 6. Why we process your data (legal bases) - To provide the service you signed up for: Art. 6(1)(b) GDPR. - To keep records that tax and accounting law require: Art. 6(1)(c) GDPR. - To secure the service, prevent abuse and measure site performance without cookies: Art. 6(1)(f) GDPR, our legitimate interest. - For anything else we ask you first, and you can withdraw that consent at any time: Art. 6(1)(a) GDPR. ## 7. How long we keep it - Account, company and file data: until you delete them or your account. - Rate-limit counters: a few minutes. - Server logs: up to 30 days. They record that a request happened, not what you said. - Payment records: as long as Greek tax law requires, up to 10 years. When you delete your account in Settings, we delete your uploaded files first, then your account, file index, company membership and usage records. ## 8. Who else processes your data The providers below process data for us under contracts that limit them to that purpose. The security page lists what each one receives. - AssemblyAI (United States): Receives meeting audio from the desktop app while you listen and returns the transcript, under its data processing terms. - OpenAI (United States): Writes answers, recaps and practice questions when you choose the OpenAI answer model (the default). - Google (Gemini) (United States): Writes answers when you choose the Gemini model, turns your files into search vectors, and reads scanned pages (OCR). - OpenRouter (United States): Carries Gemini requests when we route them through OpenRouter instead of calling Google. - Brave Search (United States): Runs a web search when a typed question needs information that is not in your files. - Apify (European Union): Reads the web pages you add as material. - Cloudflare (R2) (Global (Cloudflare network)): Stores the original files you upload and the signed desktop installers. - Neon (United States): Hosts our Postgres database: accounts, companies, usage counts, and the text passages and search vectors of your files. - Vercel (United States): Hosts the website and API, and measures page performance with cookie-free Web Analytics and Speed Insights. - Upstash (United States): Counts requests per account for a few minutes to stop abuse. - Ably (United States): Tells your desktop app when a web page finished reading or an update is ready. It carries no file content. - Stripe (European Union and United States): Takes payments and manages subscriptions. We never see your card number. - Resend (United States): Sends account, billing and invitation emails. ## 9. Transfers outside the EU Most of these providers operate in the United States. We rely on the EU-US Data Privacy Framework where a provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. ## 10. Your rights You can ask to see, correct, delete, restrict or export your personal data, and you can object to processing based on our legitimate interest. Email us at contact@odrivyn.com and we answer within 30 days. You can also complain to the Hellenic Data Protection Authority (dpa.gr) or the authority where you live. ## 11. Recording and consent on calls Some places require every participant to agree before anyone records or transcribes a call. You are responsible for telling the people on your calls and getting consent where the law requires it. The app asks you to confirm this and records your answer. ## 12. Children Odrivyn is not for anyone under 16. If we learn that an account belongs to a child, we delete it. ## 13. Changes When we change this policy we update the date above. For changes that affect your rights, we email you before they take effect.