Privacy Policy

Pocket Recall

Last updated: March 26, 2026

This privacy policy (the "Privacy Policy") sets out the conditions under which Pocket Recall processes personal data in connection with the website, mobile application, web application and related services made available under the name Pocket Recall (together, the "Services").

Pocket Recall is committed to processing personal data in compliance with Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation or "GDPR"), the French Data Protection Act as amended, and any other applicable data protection laws and regulations.

By accessing or using the Services, users acknowledge that they have read this Privacy Policy.

1. Identity of the Data Controller

Unless otherwise specified, the data controller for processing activities described in this Privacy Policy is:

EP FACTORY
SASU
420 Route de Lachal
42740 Saint-Paul-En-Jarez
France
Email: contact@pocketrecall.ai

For any question relating to the processing of personal data or to exercise data protection rights, data subjects may contact: privacy@pocketrecall.ai

2. Purpose of the Privacy Policy

The purpose of this Privacy Policy is to inform users and other relevant individuals of:

the categories of personal data processed through the Services;
the purposes for which such data is processed;
the legal bases relied upon for such processing;
the recipients or categories of recipients of such data;
the retention periods applied;
the possible transfers of personal data outside the European Economic Area;
the rights available to data subjects under applicable law.

3. Scope

This Privacy Policy applies to the processing of personal data relating to:

visitors to the Pocket Recall website;
users creating or using an account on the Services;
business users using Pocket Recall in the context of trade fairs, events, conferences, meetings or business development activities;
individuals whose professional data is entered, imported, synchronized or otherwise processed through the Services by Pocket Recall users;
individuals whose conversations may be recorded, transcribed or summarized through the Services, where such functionality is activated by the user.

This Privacy Policy does not apply to third-party websites, platforms, software, customer relationship management tools, social networks or services that may be linked to or integrated with Pocket Recall. Such third parties remain subject to their own privacy policies and legal terms.

4. Roles of the Parties

4.1 Pocket Recall as data controller

Pocket Recall acts as a data controller where it determines the purposes and means of processing personal data for its own purposes, including in particular for:

account creation and account administration;
user authentication and access management;
service security and fraud prevention;
subscription, invoicing and payment management;
customer support and incident management;
internal analytics, service improvement and legal compliance.

4.2 Pocket Recall as data processor

Pocket Recall may also act as a data processor on behalf of its business customers where such customers use the Services to upload, record, organize, enrich, synchronize or otherwise process personal data relating to their own prospects, customers, partners, exhibitors, participants or other professional contacts.

In such circumstances, the relevant customer remains responsible for ensuring that the personal data is processed lawfully, including that an appropriate legal basis exists and that any information obligations or consent requirements are complied with.

5. Categories of Personal Data Processed

Depending on the features used and the context of use, Pocket Recall may process the following categories of personal data.

5.1 Account and identification data

first name and last name;
professional email address;
password hash and authentication credentials;
organization name;
role or position;
account preferences and settings;
language and interface preferences;
optional profile picture or avatar.

5.2 Technical, authentication and security data

IP address;
user-agent;
browser type and device information;
authentication events;
session identifiers;
logs relating to access, usage, security and audit trails.

5.3 Professional contact data

first name and last name;
employer or company name;
job title or role;
professional email address;
professional phone number;
LinkedIn profile URL or other public professional profile data;
notes, tags, meeting context, follow-up status and interaction history.

5.4 Badge scan and business card data

Where a user scans an event badge, business card, QR code or similar medium, Pocket Recall may process:

images captured through the Services;
text extracted through OCR;
professional identification and contact data appearing on the scanned medium.

5.5 Audio recordings, transcripts and meeting content

Where recording features are activated by the user, Pocket Recall may process:

audio recordings of conversations;
metadata relating to such recordings (date, time, duration, format, device context);
live or deferred transcription data;
summaries, action items, extracted key points and follow-up suggestions derived from such recordings.

5.6 AI-assisted outputs and enrichment data

Pocket Recall may process:

prompts submitted through the Services;
context data associated with a contact, company or interaction;
transcripts, notes and structured records used to generate AI-assisted outputs;
summaries, draft messages, extracted actions and other generated content;
professional enrichment data obtained from public or licensed sources, where applicable.

5.7 Integration and synchronization data

Where users connect third-party tools or services, Pocket Recall may process:

CRM records and associated metadata;
synchronization status and mapping data;
OAuth tokens or other connection credentials;
imported or exported data linked to connected services.

5.8 Billing and commercial data

For paid subscriptions or commercial relations, Pocket Recall may process:

billing identity and invoicing details;
subscription status;
customer identifiers;
transaction metadata;
invoice records.

Pocket Recall does not store full payment card data.

5.9 Support and troubleshooting data

correspondence with support;
technical issue descriptions;
screenshots or files voluntarily provided for support purposes;
diagnostic information and logs relevant to resolving incidents.

5.10 Invitation and referral data

email address of invited users;
invitation metadata;
referral or invitation tokens;
timestamps and status of invitations.

6. Sources of Personal Data

Personal data may be collected:

directly from the individual concerned when using the Services;
from the user's employer or organization, where an account is created in a professional context;
from data manually entered by users;
through badge scans, business card scans, QR scans or OCR workflows;
through audio recordings and transcription features activated by users;
through connected third-party services and integrations;
from publicly available or lawfully licensed professional data sources used for enrichment;
automatically through the use of the Services, including via logs and security-related tools.

7. Purposes of Processing and Legal Bases

Pocket Recall processes personal data only where a valid legal basis exists.

7.1 Provision of the Services

Personal data is processed to create accounts, authenticate users, provide requested features, manage contacts, store records, generate summaries and enable integrations.

Legal basis: performance of a contract or implementation of pre-contractual measures.

7.2 Management of contact capture and business interactions

Personal data is processed to enable users to prepare business events, capture leads, organize meetings, record notes, manage follow-up actions and structure post-event workflows.

Legal basis: performance of a contract and/or legitimate interests pursued by Pocket Recall or its customers in managing professional interactions and business development activities.

7.3 Audio recording, transcription and summarization

Where recording features are used, Pocket Recall processes audio and transcript data to provide transcription, summarization and meeting intelligence features.

Legal basis: performance of a contract and, where required under applicable law, consent obtained by the user from the recorded individuals.

Pocket Recall users are solely responsible for ensuring that they provide any required prior notice and obtain any consent required by applicable law before initiating a recording.

7.4 AI-assisted productivity features

Personal data is processed in order to generate summaries, extract action points, suggest follow-up messages and provide other AI-assisted outputs requested by the user.

Legal basis: performance of a contract and legitimate interests in providing and improving requested productivity features.

7.5 Security and fraud prevention

Personal data is processed for authentication, access control, platform security, misuse detection, incident response and the protection of the integrity of the Services.

Legal basis: legitimate interests in ensuring the security, availability and resilience of the Services.

7.6 Billing, invoicing and subscription management

Personal data is processed for subscription administration, billing, invoice issuance, payment tracking and commercial relationship management.

Legal basis: performance of a contract and compliance with legal obligations.

7.7 Customer support and service improvement

Personal data is processed to respond to requests, resolve incidents, troubleshoot issues and improve the quality and reliability of the Services.

Legal basis: performance of a contract and legitimate interests in ensuring proper support and service improvement.

7.8 Compliance with legal obligations and defense of rights

Personal data may be processed to comply with applicable laws, accounting and tax rules, court orders, regulatory requests, or to establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations and legitimate interests in the defense of rights and claims.

8. Specific Information on Recordings and Transcriptions

Pocket Recall may offer functionalities enabling the recording of professional conversations and the generation of transcripts and summaries.

Such features must only be used in strict compliance with applicable law. In particular, users must ensure, prior to any recording, that:

participants are clearly informed that the conversation is being recorded;
any consent required under applicable law has been validly obtained;
the recording is limited to a legitimate professional purpose;
the recording is stopped if any participant objects where consent is required.

Trade shows, conferences and other events may have their own rules and policies regarding recording. Users must familiarize themselves with and comply with any applicable event-specific recording rules in addition to applicable law.

Pocket Recall does not process voice data for the purpose of uniquely identifying individuals through biometric recognition.

9. Data Relating to Third Parties

Users may enter into the Services personal data relating to third parties, including prospects, clients, partners, exhibitors, event participants or other business contacts. Users must ensure they have obtained all necessary authorizations and have a valid legal basis before submitting any third-party personal data to the Services.

Third-party data processed through the Services may include, but is not limited to:

badge scan data (e.g., data captured from event badge scans);
business card scan data (e.g., data captured via OCR from business cards);
imported contacts (e.g., contacts uploaded or synchronized from external sources);
recordings and transcriptions of conversations involving third parties;
meeting notes, summaries, follow-ups and action items referencing third parties;
AI-generated outputs derived from any of the above data.

Pocket Recall processes such third-party data on behalf of and based on the actions and instructions of the user. Where Pocket Recall acts as a processor, it processes such data solely on behalf of the customer and in accordance with the customer's documented instructions, subject to applicable law.

The relevant user or customer warrants that it has a lawful basis for such processing and that it has complied with any applicable information, notice and consent obligations.

Any person who believes that personal data concerning them has been processed unlawfully through Pocket Recall may contact privacy@pocketrecall.ai.

10. Recipients of Personal Data

Personal data may be disclosed, on a strict need-to-know basis, to:

authorized personnel of Pocket Recall;
hosting and cloud infrastructure providers;
database, authentication and storage providers;
customer support, monitoring and security service providers;
transcription, AI and professional data enrichment providers;
payment service providers;
email delivery service providers;
CRM, productivity or integration partners connected at the request of the user;
legal advisers, auditors and professional consultants;
competent administrative, judicial or regulatory authorities where required by law.

Pocket Recall undertakes to ensure that all processors acting on its behalf are subject to appropriate contractual obligations and provide sufficient guarantees regarding confidentiality, security and compliance.

11. International Transfers of Personal Data

Certain service providers or integration partners used in connection with the Services may be located outside the European Economic Area or may process personal data from outside the European Economic Area.

Where such transfers occur, Pocket Recall undertakes to implement appropriate safeguards in accordance with applicable law, which may include:

an adequacy decision of the European Commission;
the execution of the European Commission's Standard Contractual Clauses;
supplementary technical, organizational or contractual measures where necessary.

Additional information relating to such safeguards may be requested by contacting privacy@pocketrecall.ai, subject to confidentiality and legal limitations.

12. Retention Periods

Pocket Recall retains personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to any longer retention period required by law or necessary for the establishment, exercise or defense of legal claims.

Subject to final internal validation, the principal retention rules are as follows:

account data: retained for the duration of the account relationship and for a reasonable period thereafter as necessary for legal, evidentiary or operational purposes;
authentication and security logs: retained for a limited duration proportionate to security, monitoring and fraud prevention needs;
contact and interaction data: retained for the duration of the customer relationship or until deletion by the relevant user or customer;
badge scans, OCR data and imported contact records: retained as long as necessary for the relevant contact management purpose, unless deleted earlier;
audio recordings and transcripts: retained according to the configuration of the relevant feature and for no longer than necessary for the corresponding operational purpose;
support data and incident records: retained for the duration necessary to process the request, maintain support history and improve service reliability;
billing and accounting records: retained for the period required by applicable accounting, tax and commercial laws.

Pocket Recall reserves the right to anonymize data where identification is no longer necessary.

13. Rights of Data Subjects

In accordance with applicable data protection law, data subjects may, subject to legal conditions and limitations, exercise the following rights:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to object to processing based on legitimate interests;
right to withdraw consent at any time where processing is based on consent;
right to data portability, where applicable;
right to define instructions regarding the fate of personal data after death, where provided by applicable French law;
right to lodge a complaint with the competent supervisory authority.

In France, the competent supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

Requests relating to the exercise of rights may be sent to: privacy@pocketrecall.ai

To exercise your right to erasure, you may also submit an account deletion request at: pocketrecall.ai/delete-account

Pocket Recall may request proof of identity where necessary before responding to such requests.

14. Deletion and Account Closure

Users may request deletion of their account and associated data at any time by visiting pocketrecall.ai/delete-account, or directly from the Settings section of the Pocket Recall app.

Upon a valid deletion request, Pocket Recall will delete or anonymize the relevant personal data within 48 business hours, unless retention is required:

by law;
for compliance purposes;
for fraud prevention or security;
for the establishment, exercise or defense of legal claims;
or because the data is processed on behalf of a customer who remains the relevant controller.

Residual copies may temporarily remain in secure backups for a limited period before they are overwritten in accordance with backup cycle requirements.

15. Security Measures

Pocket Recall implements appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, including, where relevant:

access limitation based on authorization profiles;
authentication and credential protection measures;
encryption of data in transit and, where appropriate, at rest;
logging and monitoring mechanisms;
security review of key service providers;
incident response and remediation procedures.

Notwithstanding the foregoing, no system, network or electronic transmission can be guaranteed to be entirely secure. Pocket Recall cannot therefore guarantee absolute security, but undertakes to apply reasonable and appropriate measures in light of the state of the art, implementation costs, the nature of the processing and the risks involved.

16. Cookies and Similar Technologies

The website and, where applicable, the Services may use cookies or similar technologies for technical operation, authentication, security, audience measurement and service performance purposes.

Where required by applicable law, Pocket Recall will collect the user's consent prior to the use of non-essential cookies or similar technologies.

Further information may be provided in a separate cookie policy or cookie banner.

17. Data Relating to Minors

Pocket Recall is intended exclusively for professional and business use and is not directed to minors. Pocket Recall does not knowingly collect personal data from children through the Services.

18. Amendments to the Privacy Policy

Pocket Recall reserves the right to amend this Privacy Policy at any time in order to reflect legal, regulatory, technical or operational developments.

Any updated version shall be published on the relevant website or made available through the Services with an updated "Last updated" date. Where required by applicable law, users shall be informed by appropriate means.

19. Third-Party Integrations

Pocket Recall offers optional integrations with third-party services. Each integration has its own privacy notice detailing the data accessed, purposes, retention and deletion policies.

HubSpot CRM — see our HubSpot Integration Privacy Notice at /integrations/hubspot/privacy

20. Contact

For any question relating to this Privacy Policy or the processing of personal data, you may contact:

EP FACTORY / Pocket Recall
420 Route de Lachal
42740 Saint-Paul-En-Jarez
France
Email: privacy@pocketrecall.ai