Privacy Policy

This Privacy Policy explains how COUBUS OÜ (“Spotrum”, “we”, “us”) collects, uses, shares, and protects personal data when you use the Spotrum websites and applications at spotrum.com and online.spotrum.com (the “Service”). We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.

Data controller: COUBUS OÜ (registry code 14419079), Vesivärava tn 50-301, 10152 Tallinn, Estonia. Privacy contact: privacy@spotrum.com.

1. Our roles: controller and processor

For your own account data (registration, billing, settings) we act as a data controller. For the content created inside rooms by a host and their participants — audio, video, chat, files, recordings and transcripts — we generally act as a data processor on behalf of the host, who is the controller of that content. Hosts are responsible for having a lawful basis and for informing their participants.

2. Data we collect

• Account data: username/display name, email, password hash or OAuth identifier (Google/Apple), language and profile preferences.
• Subscription and billing data: plan, billing country, VAT number (for businesses), and a Stripe customer reference. Card details are collected and stored by Stripe — we never see or store full card numbers.
• Room content: live audio/video streams, chat messages, uploaded files, and — when the host enables them — recordings, transcripts, and AI summaries.
• Usage and technical data: log data, device/browser information, IP address, approximate location derived from IP, timestamps, and diagnostic events used to operate and secure the Service.
• Push-notification data: if you allow notifications in the mobile apps — the push token issued by Google or Apple, a per-install device identifier, the platform, app and OS version, and your language (see section 5).
• Support data: information you provide when you contact us.

3. How we use data and legal bases

• To provide the Service (host rooms, deliver recordings/transcripts you request, render reports) — performance of a contract (Art. 6(1)(b)).
• To process payments, invoicing and tax — contract and legal obligation (Art. 6(1)(b), 6(1)(c)).
• To secure the Service, prevent abuse and fraud, and maintain reliability — legitimate interests (Art. 6(1)(f)).
• To enable optional AI features — performed on your instruction when you turn them on (contract / consent).
• To communicate with you about service, security, and billing — contract and legitimate interests; marketing emails only with consent where required, with an opt-out in every message.
• To comply with legal obligations — Art. 6(1)(c).

4. AI features are opt-in

Auto-transcription and auto-summary are off by default on every new room. When a host enables them, the relevant audio is transmitted over TLS to our AI sub-processor (Groq, Inc., USA), transcribed and/or summarised, and the result is returned to the room. We do not use your audio, transcripts, or other content to train AI models, and our sub-processor does not retain inputs or outputs beyond short-window logging for abuse detection.

5. Push notifications

Notifications in the Spotrum mobile apps are delivered through Google (Firebase Cloud Messaging) and, on iPhone, onward through Apple (Apple Push Notification service). When you allow notifications, your device registers a push token with that provider; we store the token together with a per-install device identifier, the platform, the app and OS version, and your language, so that a notification reaches the right device and stops going to devices you no longer use.

To deliver a notification we pass its text to those providers. Depending on the event it can contain the display name of the person involved, the name of the room or event, and — for a chat mention or reply — up to the first 140 characters of the message. In end-to-end encrypted rooms we cannot read the message, so the notification carries a neutral placeholder instead of a preview. This content is processed for delivery only; it is not used for advertising.

Delivering notifications is part of providing the Service (Art. 6(1)(b)) and depends on the permission you grant on your device. You can withdraw it at any time in your device settings — notifications then stop and no further content is sent to those providers. You can also keep notifications and turn off “Message text in notifications” in the app’s notification settings: the name and the message are then removed on our servers before the notification is handed over, so only the fact that something happened leaves us. Individual notification types, event reminders and quiet hours are in the same place.

6. Recordings and host responsibility

Recordings, transcripts and summaries stay on Spotrum servers unless a host exports or shares them. Because recording laws vary, hosts are responsible for informing participants and obtaining any consent required by local law before recording or AI processing. Participants who have questions about a specific room should contact the host (controller) for that room.

7. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember preferences (such as theme and language), and secure the Service. To protect our website and API from bots and abuse we use Cloudflare Turnstile, which runs a silent (“invisible”) verification and may set a cookie and read basic browser signals; its use is governed by Cloudflare’s Turnstile Privacy Addendum. With your consent we use Google Analytics to collect anonymised usage statistics (IP anonymisation enabled, advertising signals disabled); you can accept or decline in the cookie banner, and change your mind by clearing site data. We do not use advertising cookies, and you can control cookies through your browser settings.

8. Sharing and sub-processors

We share personal data only with service providers that process it on our behalf under data-processing agreements, including:

• Stripe — payment processing, subscriptions, invoicing and tax.
• Groq, Inc. (USA) — AI transcription and summaries, only when enabled and only at the moment of processing.
• Cloudflare, Inc. (USA) — content delivery, network security, and bot/abuse protection (including Turnstile), governed by Cloudflare’s Turnstile Privacy Addendum.
• Google — push notifications (Firebase Cloud Messaging), Google Play billing, and Google sign-in.
• Apple — push notifications (Apple Push Notification service), App Store billing, and Sign in with Apple.
• Mapbox (USA) — maps and geocoding in the web and Android apps.
• Hosting and infrastructure providers — to run our servers, media relay, storage and databases.
• Email/communications providers — to send transactional messages.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety, and security of Spotrum, our users, or the public. We do not sell personal data.

9. International transfers

Some sub-processors are located outside the European Economic Area — our AI provider, the map provider, and the push-notification, billing and sign-in services operated by Google and Apple — as is certain infrastructure. Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, together with supplementary measures where necessary.

10. Retention

We keep personal data only as long as needed for the purposes above. Recordings auto-delete after the retention window for your plan (for example, 90 days on Pro and 365 days on Premium); files and database rows are removed automatically, and hosts can delete sooner. Account data is kept while your account is active and for a limited period afterwards. Push tokens are deleted when you sign out or delete your account, and are pruned automatically after roughly 90 days without use. Billing and tax records are retained for the period required by law (typically seven years in Estonia).

11. Security

We use technical and organisational measures to protect personal data, including encryption in transit (TLS), access controls, secret management, hashed credentials, and signed, tamper-evident reports. No system is perfectly secure, but we work to protect your data and to notify you and the relevant authority of a personal-data breach where legally required.

12. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”) in certain circumstances;
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability for data you provided, where applicable;
• withdraw consent at any time, without affecting prior processing.

To exercise these rights, contact privacy@spotrum.com. If your data was processed inside a room by a host (where we act as processor), we will refer your request to that host. You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) — or the authority in your country of residence.

13. Children

The Service is not directed to children under 16 (or the age of digital consent in your country). We do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and, for material changes, provide additional notice (for example, by email or in-product notice).

15. Contact

COUBUS OÜ, Vesivärava tn 50-301, 10152 Tallinn, Estonia. Privacy enquiries: privacy@spotrum.com. For a data-processing agreement (DPA) for business customers, contact legal@spotrum.com.

This policy is provided in English. If we offer a translation, the English version prevails in case of conflict.