Recording and Consent Policy — Scope

DRAFT — NOT LEGAL ADVICE — REQUIRES REVIEW BY A QUALIFIED SOLICITOR BEFORE PUBLICATION

Jurisdictions this draft assumes: the United Kingdom first, the EU/EEA second.

Jurisdictions this draft does not cover: the United States and its states (including Illinois BIPA, Texas CUBI, Washington RCW 19.375, and the nine all-party consent states), Canada and Quebec, Australia, New Zealand, India, the UAE and the wider GCC, Singapore, Brazil, South Africa and Japan. Sections 6 and 8 below describe those risks so a reader understands what is missing; they are not a substitute for local advice, and nothing here should be published to customers in those places until local counsel has reviewed it.

Version: [TO CONFIRM: version number] · Effective date: [TO CONFIRM: effective date]

1. What this policy is for

Scope records meetings, turns the recording into a transcript, and turns the transcript into a priced quote.

Recording another person is regulated almost everywhere, and the rules differ from country to country and, in the United States, from state to state. This policy sets out who is responsible for what, what Scope gives you to make it straightforward, and — just as importantly — what this policy cannot do for you.

Read section 7 even if you read nothing else.

2. The short version

3. How consent works in the product

Before a recording starts, Scope shows a consent screen. It is a screen, not a tick box, and it cannot be skipped.

1. Name who is there. You enter the client's name. This matters: naming the person is part of what makes consent informed rather than generic.

2. Play the announcement. A short script is shown on screen, and the app can speak it aloud so it does not have to be mumbled. The default wording is:

"I'm going to record our conversation so I can put your quote together accurately. It's stored securely and you can ask me to stop at any time. Is that alright?"

You can edit this wording for your business. Defaults differ by jurisdiction. If you edit it, the wording becomes your responsibility — see section 5.

3. Capture the answer. The recording opens with the client's spoken response. That response is saved as a consent artefact: a separate object, stored apart from the main recording, with a timestamp and the version of the app that captured it.

4. Keep it longer than the audio. The consent artefact has its own retention schedule and deliberately outlives the recording it relates to. If the audio is deleted on schedule and someone later asks whether they agreed, the evidence is still there.

If the client says no. Stop. Scope offers a manual-notes path instead, and you can still build a quote by hand. A refusal is a normal outcome, not an error.

4. Why the announcement is spoken aloud, everywhere, by default

Scope is built to the strictest rule it might meet, not the most convenient one.

• Some places need every participant to agree, not just one. Nine US states are unambiguously in this group, and several more are split or unclear. The UAE is stricter still and attaches criminal penalties.
• Some places need an audible notice rather than an affirmative yes — Montana and Oregon are the clear examples.
• Under UK and EU data protection law, agreeing to be recorded is not the same thing as having a lawful basis to process the recording. You need both, and you need to be able to show you had them.

A spoken announcement followed by a recorded spoken answer satisfies all three shapes of rule at once, and it produces a dated artefact you can hand to a regulator or a court. That is why it is the default and why it is not a paid feature.

5. What you are responsible for

You are responsible for all of the following. Scope does not do any of them for you.

1. Knowing the law where the meeting happens. Not where your business is registered — where you and the client are physically sitting.
2. Obtaining consent from everyone present. That includes a spouse in the kitchen, a tenant, a neighbour, a colleague who joins halfway through, and anyone on a speakerphone.
3. Stopping when asked. If anyone withdraws consent, stop recording and delete the recording if that is what is required.
4. Any wording you change. If you edit the announcement script, you own the wording. We do not review it.
5. Telling people what happens to the recording — that it is transcribed, that AI is used to draft a quote, roughly how long it is kept, and how they can ask for it to be deleted.
6. Having a lawful basis under UK/EU data protection law for recording your client and for what you do with the recording afterwards, and being able to evidence it.
7. Handling requests from the people you record. They are your client, not ours. If they contact us, we will pass the request to you and help you answer it — but the duty to respond is yours.

6. Special cases you should know about

6.1 Health and other sensitive topics

Real conversations wander. A client saying "I need the doorway widened for my wheelchair" has just given you health data, which UK and EU law treats as a special category needing extra protection — the moment it is transcribed, whether or not either of you meant it that way.

Scope flags likely sensitive passages in the transcript and gives you a one-tap redaction. You decide what to redact. We do not redact automatically, because deleting something the quote depends on would be worse.

Note also a common and expensive misconception: financial information is not a special category under UK/EU law. Health information is.

6.2 Speaker separation (diarization) and voice data

Scope can optionally label who said what. It is off by default and must be switched on deliberately. When it is on, the separation is worked out while the transcript is produced and thrown away afterwards — Scope does not store voice embeddings or voiceprints.

That design is deliberate, and it exists because this is live litigation territory, not because it is tidy. In February 2026 five Illinois residents sued Microsoft over exactly this feature in Teams, alleging that speaker diarization extracts unique vocal characteristics that function as a regulated voiceprint under the Illinois Biometric Information Privacy Act, captured without written notice and written consent. One published analysis projects $41–61m of settlement exposure, and the claim is explicitly framed as a template for "all diarization-enabled SaaS products".

Two things follow, and we would rather say them than not:

• That claim is against the platform, not the meeting host. The law there runs at whoever captures and processes the voice data. Turning the feature on makes it our exposure as well as yours.
• Illinois law requires a publicly available written retention schedule for biometric data, separately from any consent. If Scope ever ships diarization to Illinois users, that schedule has to exist and be published. [TO CONFIRM: whether diarization ships at launch, and whether Illinois and Texas users are blocked from it]

6.3 Recording in someone's home

Scope's core use case is a quote given inside a customer's house. In the UK, that setting is where a person's expectation of privacy is at its highest, and there is no neat statutory carve-out for in-person recording the way there is for telephone calls. A recording that is not criminal can still support a civil claim for misuse of private information.

This is a reason to use the announcement properly, not a reason to avoid the product.

6.4 Recording colleagues and employees

Different rules again. Recording staff, or recording during anything that resembles a workplace dispute or collective bargaining, is a separate area with its own risks in the UK, the US and Australia. Scope is not designed for it, and this policy does not address it.

7. The limits of this allocation — read this part

Everything above puts the duty to obtain consent on you. That is a normal, defensible way to divide responsibility between a software supplier and its customer, and it reflects how the law actually classifies the two of us: you decide to record your client for your own commercial purposes, so you are the controller; we process the recording on your instructions, so we are the processor.

But an allocation of responsibility in a contract does a narrower job than people expect it to. Four limits, stated plainly.

1. This agreement binds you and us, and nobody else. The person you recorded never signed it. Neither did the Information Commissioner's Office, a foreign data protection authority, or a prosecutor. If a recorded third party sues, they sue whoever they choose to sue, and a clause in our contract does not remove us from that claim or you from it. It only decides who ultimately pays, and only if the clause is enforceable and the payer is solvent.

2. Some obligations attach to us regardless of what you agree. Under UK and EU data protection law a processor has duties of its own — to process only on documented instructions, to keep the data secure, to control its sub-processors, to help with data subject requests, to notify breaches, and to be able to demonstrate all of that. Those sit on us directly. You cannot agree them away on our behalf, and we cannot delegate them to you.

3. Where voice data is regulated as biometric data, the law follows the processing, not the contract. Illinois's biometric statute runs at the entity that captures and processes the voiceprint. The pending claim against Microsoft is against the platform, not against the person who hosted the meeting. If Scope's speaker separation were held to create a regulated voiceprint, an indemnity from you would not be a defence to that claim — it would at best be a route for us to try to recover afterwards, from a small business that may not be able to pay a statutory-damages award. That is why the feature is off by default and why no voice embeddings are stored.

4. Criminal liability cannot be indemnified. In some places, recording without everyone's consent is a crime rather than a civil wrong. The UAE is the sharp example: unlawful recording or disclosure of private conversations carries a minimum of six months' imprisonment and fines of AED 150,000–500,000. No indemnity, in any contract, transfers criminal liability. If you record unlawfully somewhere that criminalises it, you are personally exposed and this policy does nothing for you.

What this means in practice. The allocation is worth having. It is not worth relying on to the exclusion of actually obtaining consent. The tools in section 3 exist because the artefact they produce — a dated, spoken, specific agreement — is the thing that actually works when someone objects. The contract is the fallback.

8. Where we do and do not operate

[TO CONFIRM: the list of countries Scope is sold into at launch, and whether any territory is geo-blocked]

Scope cannot tell where a meeting is taking place. The app does not know which country or US state you are standing in, and it does not attempt to enforce local recording law. The default announcement is written to the strictest rules we know of, on the basis that assuming the strictest rule is the only safe design when the jurisdiction is unknown.

Three specific gaps you should be aware of if you work outside the UK and EU:

• The United States. Nine states require all parties to agree, with statutory damages — California alone allows $5,000 per violation. Several more states are split or unsettled. This policy has not been reviewed against any US state law.
• The UAE, and probably the wider GCC. All-party consent, criminally enforced. Saudi Arabia is likely similar but has not been verified.
• Australia. Every state and territory has its own act, they disagree with each other, Victoria's classification is genuinely unclear across sources, and a new statutory privacy tort has been in force since 10 June 2025 that needs only recklessness and explicitly calls out poor data governance.

9. What happens to a recording

A short summary. The full detail is in the Privacy Policy and the Data Processing Addendum.

10. If someone objects

If a person you recorded contacts us directly, we will:

1. Tell them that the recording belongs to your business and that you are the one who decides what happens to it.
2. Pass the request to you without undue delay.
3. Help you act on it — including deleting the recording, the transcript and anything derived from it.

We will not act on their request without your instruction, because we are not permitted to. That is the same processor rule that protects your data from being handed to anyone who asks for it.

11. Changes to this policy

We will publish a new version and tell account owners by email before a material change takes effect. [TO CONFIRM: notice period for changes to this policy]

12. Contact

[TO CONFIRM: legal entity name] [TO CONFIRM: registered office address] [TO CONFIRM: privacy contact email address]

Evidence index

Every clause below exists because of a specific finding in docs/research/01-legal-and-compliance.md. If one of these findings is wrong or has moved, the clause needs re-examining.