Privacy Policy — Scope

DRAFT — NOT LEGAL ADVICE — REQUIRES REVIEW BY A QUALIFIED SOLICITOR BEFORE PUBLICATION

Jurisdictions this draft assumes: the United Kingdom first (UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025), the EU/EEA second (GDPR).

Jurisdictions this draft does not cover: the United States and its state privacy and biometric laws, Canada and Quebec (Law 25), Australia, New Zealand, India (DPDP Act), the UAE and the wider GCC, Singapore (PDPA), Brazil (LGPD), South Africa (POPIA) and Japan (APPI). A US launch in particular needs a separate notice and a state-by-state review.

Version: [TO CONFIRM: version number] · Effective date: [TO CONFIRM: effective date]

1. Who we are

[TO CONFIRM: legal entity name] ("Scope", "we", "us") provides the Scope app and website.

• Registered in [TO CONFIRM: country of incorporation], company number [TO CONFIRM: company registration number]
• Registered office: [TO CONFIRM: registered office address]
• Data protection contact: [TO CONFIRM: privacy contact email address]
• ICO registration: [TO CONFIRM: ICO registration number]
• Data Protection Officer: [TO CONFIRM: whether a DPO is legally required and, if so, the name and contact details]
• EU representative under Article 27: [TO CONFIRM: whether an EU representative is required and, if so, who]

2. The most important thing in this policy

Scope wears two different hats, and your rights depend on which one applies.

Hat one — we are the controller. For your account: your name, your email address, your business details, your billing information, how you use the product, and your conversations with our support team. We decide what to do with that data and this policy explains it.

Hat two — we are the processor. For the contents of your meetings: the audio, the transcript, the consent recording, the extracted scope of work and the quote. That data belongs to your business. Your business decided to record the meeting, for its own commercial purposes. In law that makes your business the controller and us the processor: we hold and handle that material on your instructions and we do not use it for our own purposes.

If you were recorded in a meeting and you are not a Scope customer, section 11 is written for you. In short: the business that recorded you is the one who decides what happens to that recording. Contact them first. If you contact us, we will pass your request to them and help them answer it — we are not permitted to act on it ourselves.

3. What we collect, and why

3.1 Account and business data — we are the controller

We do not sell personal data, and we do not use your data or your meeting content to train AI models. [TO CONFIRM: this must be true of every vendor contract too — see §6 and the DPA subprocessor schedule]

3.2 Meeting data — you are the controller, we are the processor

We process this only to provide the service to you and only on your instructions. The full terms are in the Data Processing Addendum.

Sensitive information appears in real conversations. A client mentioning a health condition creates special category data under Article 9 the moment it is transcribed. Scope flags likely sensitive passages so you can redact them. Deciding what to redact is yours. Note that financial information is not a special category under UK/EU law — health information is.

3.3 Website

Website analytics. On the public pages of spokequote.com, we use Google Analytics 4, provided by Google Ireland Limited, to count visits and sign-ups. It runs only on those pages, never inside the app or on a client's quote link, and only if you accept analytics cookies in the banner. If you decline, or don't choose, it never loads.

When it runs, it sets the cookies _ga and _ga_4NSTXSKB4E, which last up to two years. Google keeps the event data for two months. We have turned off Google's optional data-sharing settings.

Your banner choice is stored in your browser's local storage, not in a cookie, so we can remember it.

[TO CONFIRM: the app's own sign-in cookies, named with their purpose and lifetime]

4. How we use AI, and what it means

Scope uses AI in three places:

1. Speech to text. Turning the recording into a transcript.
2. Scope extraction. Reading the transcript and filling in the fields of your own template. The model chooses from a fixed vocabulary taken from your template — it does not invent categories — and every line it produces carries a link back to the exact moment in the transcript it came from.
3. A checking pass. A second, cheaper pass verifies that each extracted line is actually supported by the transcript. Unsupported claims are dropped.

Three things follow, and we build them in rather than disclaiming them:

• Every quote is marked as AI-assisted. You will see it on the document, and so will your client.
• You cannot send a quote without reviewing it. The review screen cannot be skipped and every line has to be touched. This is a real gate in the software, not a sentence in these terms.
• You can hear the evidence. Tap the timestamp on any line and the audio plays. If the AI got it wrong, that is how you find out.

We do not make automated decisions about you that produce legal effects or similarly significantly affect you.

5. Where your data lives

5.1 The one place data leaves the UK and EU, stated plainly

The AI model that reads your transcripts runs on Anthropic's API in the United States. Transcript text is sent there. Audio is not.

We are not going to bury this. If your business cannot accept a transfer to the US, tell us and we will move your account to an EU-hosted endpoint for the same model. [TO CONFIRM: whether an EU-hosted endpoint is available at launch, on which plans, and at what price]

For the transfer as it stands, we rely on:

• UK-originated data: the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
• EEA-originated data: the EU Standard Contractual Clauses. [TO CONFIRM: which module. The research brief assumes Module 2, controller-to-processor, but where Scope is itself the processor and Anthropic is a sub-processor the correct module is normally Module 3, processor-to-processor. Counsel must settle this.]
• A documented Transfer Impact Assessment. [TO CONFIRM: this must actually be written, not just referenced]
• [TO CONFIRM: whether Anthropic is certified under the EU–US Data Privacy Framework, and whether we are relying on it]

The EU–US Data Privacy Framework is operational but under appeal at the Court of Justice. We maintain Standard Contractual Clauses as the fallback so that an invalidation does not leave the transfer unlawful overnight.

6. Who else touches your data

We use a small number of suppliers. Every one of them is listed, with what it does and where it does it, in Schedule 2 of the Data Processing Addendum.

We will tell you before we add or replace a supplier that handles meeting data, and you can object. Details are in the DPA.

7. How long we keep things

Deletion is real deletion, run by a scheduled job, not a flag on a row.

One honest limit on erasure. When you or your client asks us to delete something, we delete it from the live systems. Backups are encrypted and roll off on the schedule above; we do not surgically edit a backup. Anything deleted therefore disappears from backups within [TO CONFIRM: confirm the maximum backup retention window] rather than instantly.

8. How we protect it

• Encryption in transit (TLS everywhere) and at rest.
• Audio is never in a public bucket. Every access is a short-lived signed link.
• Transcript text never appears in logs. We log the meeting identifier and nothing from inside it.
• Every record carries a business identifier and the separation between businesses is enforced twice — once in the data layer by default, and again by an automated test for every endpoint, which fails the build if it is missing.
• Secrets live in a managed secret store, never in code or configuration files, with an automated check that fails the build if one is committed.
• Rate limiting on sign-in from the first deployment.
• No production data in any other environment, ever. Debugging uses a scrubbed extract or a reproduction.
• Production database access is deliberate, time-boxed and logged — not routine.
• Dependency vulnerability scanning on every build.
• Restore drills are run and timed, not assumed. Recovery targets are [TO CONFIRM: confirm before publishing] five minutes of data loss and two hours to restore.

What we do not have, stated rather than implied. At launch, Scope has no SOC 2 report and no ISO 27001 certification, and a penetration test is planned but not yet done. We are a small team. If your business needs a certification before it can buy, tell us and we will tell you honestly where we are.

9. Your rights

If we are the controller of your data — your account, your billing, your usage — you can ask us to:

• give you a copy of it
• correct it
• delete it
• restrict or object to how we use it
• give it to you in a portable format
• withdraw consent, where we relied on consent

Ask at [TO CONFIRM: privacy contact email address]. We will answer within one month.

You can complain to the Information Commissioner's Office (ico.org.uk) or, in the EEA, to your national supervisory authority. We would rather you told us first, but you do not have to.

10. Automated decisions and profiling

We do not use your personal data to make automated decisions with legal or similarly significant effects.

The AI in Scope drafts a document. A person — you — reviews and approves it before it goes anywhere. That gate is enforced by the software.

11. If you were recorded in a meeting

You are reading this because a business recorded a meeting with you using Scope.

The recording belongs to that business, not to us. They decided to record it, they decided why, and they decide how long it is kept and when it is deleted. In law they are the controller and we are their processor.

What to do: contact the business that recorded you. They must answer your request.

If you contact us instead, we will pass your request to them without undue delay and help them act on it, including deleting the recording, the transcript and everything derived from it. We will not act on it without their instruction, because we are not permitted to — the same rule that stops anyone else from getting at their data.

We do not build a profile of you, we do not sell anything about you, and we do not keep a voiceprint of your voice.

12. Children

Scope is a tool for businesses and is not intended for anyone under [TO CONFIRM: minimum age — 16 or 18]. We do not knowingly collect data about children. Meetings recorded in a family home may capture a child's voice incidentally; that is the recording business's responsibility to manage, and the redaction tools are there for it.

13. Changes

We will publish any new version here and email account owners before a material change takes effect. [TO CONFIRM: notice period]

14. Contact

[TO CONFIRM: legal entity name] [TO CONFIRM: registered office address] General: [TO CONFIRM: general contact email address] Privacy and data protection: [TO CONFIRM: privacy contact email address] Security reports: [TO CONFIRM: security contact email address]

Evidence index