Privacy Policy

This Privacy Policy explains how COUBUS OÜ (“Spotrum”, “we”, “us”) collects, uses, shares, and protects personal data when you use the Spotrum websites and applications at spotrum.com and online.spotrum.com (the “Service”). We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.

Data controller: COUBUS OÜ (registry code 14419079), Vesivärava tn 50-301, 10152 Tallinn, Estonia. Privacy contact: privacy@spotrum.com.

1. Our roles: controller and processor

For your own account data (registration, billing, settings) we act as a data controller. For the content created inside rooms by a host and their participants — audio, video, chat, files, recordings and transcripts — we generally act as a data processor on behalf of the host, who is the controller of that content. Hosts are responsible for having a lawful basis and for informing their participants.

2. Data we collect

• Account data: username/display name, email, password hash or OAuth identifier (Google/Apple), language and profile preferences.
• Subscription and billing data: plan, billing country, VAT number (for businesses), and a Stripe customer reference. Card details are collected and stored by Stripe — we never see or store full card numbers.
• Room content: live audio/video streams, chat messages, uploaded files, and — when the host enables them — recordings, transcripts, and AI summaries.
• Usage and technical data: log data, device/browser information, IP address, approximate location derived from IP, timestamps, and diagnostic events used to operate and secure the Service.
• Support data: information you provide when you contact us.

3. How we use data and legal bases

• To provide the Service (host rooms, deliver recordings/transcripts you request, render reports) — performance of a contract (Art. 6(1)(b)).
• To process payments, invoicing and tax — contract and legal obligation (Art. 6(1)(b), 6(1)(c)).
• To secure the Service, prevent abuse and fraud, and maintain reliability — legitimate interests (Art. 6(1)(f)).
• To enable optional AI features — performed on your instruction when you turn them on (contract / consent).
• To communicate with you about service, security, and billing — contract and legitimate interests; marketing emails only with consent where required, with an opt-out in every message.
• To comply with legal obligations — Art. 6(1)(c).

4. AI features are opt-in

Auto-transcription and auto-summary are off by default on every new room. When a host enables them, the relevant audio is transmitted over TLS to our AI sub-processor (Groq, Inc., USA), transcribed and/or summarised, and the result is returned to the room. We do not use your audio, transcripts, or other content to train AI models, and our sub-processor does not retain inputs or outputs beyond short-window logging for abuse detection.

5. Recordings and host responsibility

Recordings, transcripts and summaries stay on Spotrum servers unless a host exports or shares them. Because recording laws vary, hosts are responsible for informing participants and obtaining any consent required by local law before recording or AI processing. Participants who have questions about a specific room should contact the host (controller) for that room.

6. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember preferences (such as theme and language), and secure the Service. To protect our website and API from bots and abuse we use Cloudflare Turnstile, which runs a silent (“invisible”) verification and may set a cookie and read basic browser signals; its use is governed by Cloudflare’s Turnstile Privacy Addendum. With your consent we use Google Analytics to collect anonymised usage statistics (IP anonymisation enabled, advertising signals disabled); you can accept or decline in the cookie banner, and change your mind by clearing site data. We do not use advertising cookies, and you can control cookies through your browser settings.

7. Sharing and sub-processors

We share personal data only with service providers that process it on our behalf under data-processing agreements, including:

• Stripe — payment processing, subscriptions, invoicing and tax.
• Groq, Inc. (USA) — AI transcription and summaries, only when enabled and only at the moment of processing.
• Cloudflare, Inc. (USA) — content delivery, network security, and bot/abuse protection (including Turnstile), governed by Cloudflare’s Turnstile Privacy Addendum.
• Hosting and infrastructure providers — to run our servers, media relay, storage and databases.
• Email/communications providers — to send transactional messages.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety, and security of Spotrum, our users, or the public. We do not sell personal data.

8. International transfers

Some sub-processors (such as our AI provider and certain infrastructure) are located outside the European Economic Area. Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, together with supplementary measures where necessary.

9. Retention

We keep personal data only as long as needed for the purposes above. Recordings auto-delete after the retention window for your plan (for example, 90 days on Pro and 365 days on Premium); files and database rows are removed automatically, and hosts can delete sooner. Account data is kept while your account is active and for a limited period afterwards. Billing and tax records are retained for the period required by law (typically seven years in Estonia).

10. Security

We use technical and organisational measures to protect personal data, including encryption in transit (TLS), access controls, secret management, hashed credentials, and signed, tamper-evident reports. No system is perfectly secure, but we work to protect your data and to notify you and the relevant authority of a personal-data breach where legally required.

11. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”) in certain circumstances;
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability for data you provided, where applicable;
• withdraw consent at any time, without affecting prior processing.

To exercise these rights, contact privacy@spotrum.com. If your data was processed inside a room by a host (where we act as processor), we will refer your request to that host. You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) — or the authority in your country of residence.

12. Children

The Service is not directed to children under 16 (or the age of digital consent in your country). We do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and, for material changes, provide additional notice (for example, by email or in-product notice).

14. Contact

COUBUS OÜ, Vesivärava tn 50-301, 10152 Tallinn, Estonia. Privacy enquiries: privacy@spotrum.com. For a data-processing agreement (DPA) for business customers, contact legal@spotrum.com.

This policy is provided in English. If we offer a translation, the English version prevails in case of conflict.