Privacy Policy
Deep Thought Cloud
- Last Updated: October 10, 2026
- Version: 1.2.2
Data Controller
Dolutions AB Org.nr 556981-0293 Box 150, 101 22 Stockholm, Sweden VAT: SE556981029301
Contact: legal@deep-thought.cloud
1. Introduction
Deep Thought Cloud (“we”, “us”, “Dolutions AB”) provides AI-powered transcription and analysis services. This policy explains how we handle your data.
2. Information We Collect
Account: Username, email, hashed password, Google or Apple sign-in identifier (if used)
Usage: Transcription history, login timestamps, IP addresses
Content: Audio and video files and other files you upload, transcriptions, tags, AI-generated insights, voice profiles (see §5)
Waitlist and tester sign-up (if you sign up on deep-thought.cloud or record-me.app before you have an account): your e-mail address, a short tag for the page or link you signed up from (for example the tester form), the website the form was on, your browser’s user agent, your IP address and the time you signed up (see §7 for how long we keep it)
Meetings (if you use the meeting assistant): the audio of meetings you send the meeting assistant to, the participants’ names and — when the meeting platform provides them — e-mail addresses, and when each participant spoke (see §6); if you connect a calendar, the events needed to decide which meetings are recorded (see §6)
3. How We Use Your Information
- Provide transcription and AI analysis services
- Record the meetings you send the meeting assistant to, and suggest who is speaking in them (see §6)
- Manage your account
- Contact you about testing access when you have signed up for the waitlist or as a tester, and see which page or link sign-ups come from; the IP address and browser user agent are kept to stop abuse of the sign-up form. We do not use these addresses for marketing
- Send service-related communications — including a notice by e-mail and in the app a few days before a plan ends and on the day it ends. These notices are sent because of your account; they are not marketing.
- Ensure security and prevent abuse
Legal Basis (GDPR): Contract fulfillment, legitimate interests, legal compliance
4. Data Storage and Security
Location: All data stored on our own physical servers in Stockholm, Sweden. The meeting assistant’s recordings are made by Recall.ai, which stores them in its EU region in Frankfurt, Germany, before they reach our servers; Recall.ai is a US company and may access them from the United States under the EU Standard Contractual Clauses (see §6).
Security:
- Passwords hashed with bcrypt
- SSL/TLS encryption for all transmissions
- Access controls and authentication
Audio Files: Kept with the recording on our own servers in Stockholm, so you can play it back. Older audio may be moved to an archive in a smaller speech format, also on our own servers.
5. AI Processing
Speech-to-text and speaker identification
Audio you record or upload never leaves our own hardware. Transcription (KB-Whisper, and OpenAI Whisper deployed locally) and speaker identification (pyannote, deployed locally) run on our own GPUs in Stockholm. There is no configuration in which your audio is sent to a third party for transcription. The meeting assistant (§6) is the one case where a third party handles audio: Recall.ai records the meeting and passes the audio to us; it does not transcribe it, and the transcription runs on our own hardware like any other recording.
Recognising voices across recordings
On every plan, by default, when a recording is transcribed we store a voice profile (a numerical representation of a voice) for each speaker in it, with the recording. For each person named in your account, and for unnamed voices that speak for a noticeable part of a recording, we also keep a combined voice profile, and compare the voices in new recordings with it to name or suggest who is speaking. This covers everyone who speaks in a recording, including people who do not have an account and the participants of meetings recorded by the meeting assistant. It runs on our own GPUs in Stockholm, only within your account; voices are never compared across accounts.
Text analysis
After transcription, the resulting text is analysed to produce summaries, entities, keywords and insights. Depending on your account settings, this step may use a third-party inference provider:
| Setting | Where text analysis runs |
|---|---|
| Free plan | Our own hardware only. A Free account gets a title made by our own model; no content of a Free account is sent to an external AI provider. |
| Default (Premium and Enterprise) | Berget.ai — a Swedish inference provider. Your text is sent to Berget.ai, which performs inference on servers in Sweden. This is a third party operating under Swedish and EU jurisdiction. |
| Your own API key (BYOK) | Your chosen provider, and no other external provider. See below. |
| Local-only mode | Our own hardware only. No text is sent to any third party. |
We name Berget.ai explicitly because it is the default. Your text is processed within Sweden, but it is processed by a separate company, and you are entitled to know that.
In rare cases — when both Berget.ai and our own hardware are unavailable — analysis falls back to OpenRouter, which processes outside the EU. This path is a last resort. You can prevent it entirely with local-only mode.
Images and PDF pages of Premium and Enterprise accounts are read by a vision model at Berget.ai in Sweden (with your own API key: your chosen provider), with OpenRouter as the last resort when Berget.ai is unavailable; Free accounts do not process images or PDFs.
BYOK (Bring Your Own Key)
If you configure your own API key — from OpenAI, Anthropic, Berget.ai or OpenRouter — the key you choose as primary is used for all text analysis and for images and PDF pages, under your own contract with that provider and its privacy policy.
With your own key, your provider is the only external one. If your key stops working — refused, out of quota, or the provider unreachable — analysis waits and you are told by e-mail and in the Web App; it is not sent to Berget.ai, OpenRouter or any other provider instead. It resumes once the key works again. Transcription stays on our own hardware either way.
Local-only mode
Setting local-only on your account prevents external inference for transcription and text analysis. All text analysis runs on our own hardware, cloud transcription spillover is disabled, and cloud-dependent integrations (such as the meeting assistant, §6) are unavailable.
Images and PDF pages wait in local-only mode. They are stored but not read: no vision model is called, the file shows that it waits because your account is local-only, and it is processed if you turn local-only off.
The restriction is enforced at five independent points in our system, and three of them fail closed: if the check itself cannot complete, processing is treated as local-only rather than allowed to proceed.
Local-only mode uses smaller models than the default, which makes processing slower. Contact support@deep-thought.cloud to enable it.
Complete list of processors
Every service that may process your content is listed in our AI Transparency Disclosure, §3.
6. The Meeting Assistant
What it does
On accounts whose plan includes it, you can send Deep Thought’s meeting assistant to a Zoom, Microsoft Teams or Google Meet meeting — by giving it the meeting link, or by connecting your calendar and letting it join meetings by your account’s rule. It joins the meeting as a participant, records the meeting’s audio, and leaves when the meeting ends. The recording then becomes a recording in your account like any other: it is transcribed on our own hardware (§5) and kept as described in §7. While the meeting assistant is in beta it may not be enabled for every account, and connecting a calendar may not yet be available; the assistant can then be sent by its meeting link. It is not included in every plan, and it is not available in local-only mode.
Who is recorded
Everyone who speaks in the meeting is recorded — including people who do not have a Deep Thought account, people outside your organisation, and people who join after the assistant.
How the participants are told
- Its name. The assistant joins under the name “
notetaker” — for example “Alex notetaker” — or “Deep Thought notetaker” if we do not know your first name. Your first name is therefore shown to everyone in the meeting. - Its picture. Its camera shows only the Deep Thought logo.
- A message in the chat. When it joins, it posts one message to everyone in the meeting chat, in Swedish and English — for example “Alex notetaker spelar in mötet åt Alex. / Alex notetaker is recording this meeting for Alex.”
Some meeting platforms or organisations do not let a bot post in the chat; the name and the picture are still shown. The host can refuse to let the assistant in, and the host or participants can remove it from the meeting; it then stops recording.
Your responsibility
You decide which meetings the assistant records. Before a meeting is recorded, you are responsible for informing its participants that it will be recorded, and for having a lawful basis to record it and to have it processed — for example their consent, or a legitimate interest that is not overridden by theirs. Do not send the assistant to a meeting where a participant has objected to being recorded, or where recording is not permitted. The assistant’s name, picture and chat message help participants notice it; they do not replace your own information to them.
What is collected
| Data | Source | Kept |
|---|---|---|
| The meeting’s audio (one track for the whole meeting) | Recall.ai’s recording | With the recording in your account (§7); erased at Recall.ai as described below |
| The participants’ names, and whether each was the host | The meeting platform, through Recall.ai | With the recording in your account |
| The participants’ e-mail addresses, when the platform provides them | The meeting platform, through Recall.ai | With the recording in your account |
| A speech timeline: when each participant joined, left and was speaking | The meeting platform’s speaker signal, through Recall.ai | With the recording in your account |
| The meeting link, time and title | Your link or your calendar | With the recording in your account |
We instruct Recall.ai to record the meeting’s audio only: no video of the meeting is recorded, and Recall.ai makes no transcript of it for us.
How it is used
The audio is transcribed and its speakers separated on our own hardware (§5). The participants’ names, e-mail addresses and speech timeline are used to suggest who is speaking in the recording. You confirm or correct the suggestions.
When the meeting platform identifies a participant (for example by e-mail address) and you have confirmed that participant as the same person in three meetings, the assistant names that participant automatically in later meetings; you can still correct it. A speaker is never named automatically this way from their voice alone, and never when voice memory is turned off for your account or for that person.
Recall.ai — our processor for meetings
The assistant is provided by Recall.ai (Hyperdoc Inc., San Francisco, USA), which runs the bot that joins the meeting and records it, on our behalf and on our instructions, under a data processing agreement with us. Recall.ai stores the recording in its EU region, in Frankfurt, Germany. Recall.ai is a US company, and its staff and systems may access the data from the United States; that transfer is made under the EU Standard Contractual Clauses, which are part of our data processing agreement with Recall.ai.
Recall.ai’s own sub-processors are listed at security.recall.ai/subprocessors. The AI services listed there as optional, which Recall.ai uses for its own transcription, are not used for our meetings: Recall.ai makes no transcript for us.
What Recall.ai holds: the recording of the meeting, the participant list and speech timeline, the meeting link and the assistant’s settings (its name and chat message); and, if you connect a calendar, the calendar authorisation and your calendar’s events (below).
When it is erased:
- As soon as the audio has reached our servers and we have checked that our copy is complete, we ask Recall.ai to erase the recording.
- At the latest, Recall.ai erases the recording 7 days after the meeting, even if something on our side has failed.
- If you delete the recording in Deep Thought before then — including moving it to the Trash — we ask Recall.ai to erase its copy at once. What deleting does on our own servers is described in §7.
What stays at Recall.ai after a meeting: the assistant’s record of the meeting — the meeting link, the assistant’s name, the participants’ names and when the assistant joined and left. Recall.ai lets us delete that record only for a meeting the assistant has not yet joined, so for a meeting it recorded the record stays at Recall.ai after the recording itself has been erased. Our data processing agreement requires Recall.ai to return or delete it when its service to us ends.
Your calendar (through Recall Calendar)
If you connect a Google or Microsoft calendar, you give Deep Thought Cloud read-only access to your calendar’s events on Google’s or Microsoft’s consent screen. We receive the access grant once and pass it straight to Recall.ai, which keeps it on our behalf and keeps the events in sync; we do not store it ourselves, and we never receive your Google or Microsoft password. We never create, change or delete events.
- Read: each event’s title, start and end, organiser, attendees and their e-mail addresses, your response (for example declined), whether it is marked private, and its meeting link.
- Used for: deciding which meetings the assistant joins by your account’s rule, showing you which coming meetings will be recorded, and titling the recording.
- The rule: the account owner or an admin chooses one rule for the account — no meetings, meetings the calendar’s owner organises, meetings with external participants, or all meetings — and it applies to every connected calendar in the account, including members’ calendars. A newly connected calendar records nothing until a rule is chosen or a single meeting is switched on. Meetings marked private and meetings the calendar’s owner has declined are never recorded by a rule. The account owner or an admin can also switch any single meeting or series on or off.
- Kept by us: for coming meetings, the title, times, number of attendees, whether you are the organiser, the meeting link and the decision. We keep an event for 30 days after the meeting and then delete it; when you disconnect a calendar, all of its events are deleted at once. A meeting the assistant recorded keeps its title and time with the recording.
- Revoke it at any time: disconnect the calendar in the Web App’s Settings — the assistant is then removed from every meeting scheduled from it — or remove Deep Thought’s access in your Google or Microsoft account.
- Shared with: only Recall.ai, our processor, to schedule the assistant. Calendar data is never sold, never used for advertising, and never used to train AI models.
Google user data — Limited Use. Deep Thought Cloud’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide the meeting assistant feature described above, transfer it only to Recall.ai to provide that feature, and do not allow humans to read it except with your consent, for security purposes, to comply with the law, or when it has been aggregated and anonymised.
7. Data Retention
| Data Type | Retention |
|---|---|
| Account data | Until deletion requested |
| Transcriptions | Until deletion requested |
| Audio files | Kept with the recording so you can play it back (see §4) |
| Meeting recordings, with their participant list and speech timeline | As transcriptions and audio files: with the recording, until deletion requested |
| Meeting recordings at Recall.ai (EU region, Frankfurt) | Erased once our copy is verified, and at the latest 7 days after the meeting (see §6) |
| Calendar events of connected calendars | 30 days after the meeting; all of a calendar’s events are deleted when you disconnect it (see §6) |
| Waitlist and tester sign-ups (e-mail, page tag, website, user agent, IP address, time) | Until we have given you testing access, and at most 12 months from the day you signed up; then deleted. Ask us to delete it sooner at any time (see §10) |
| Server logs | Kept to operate and secure the Service |
8. Analytics
We measure how our websites and apps are used with doable.services, our own analytics service, operated by Dolutions AB. On deep-thought.cloud and record-me.app it records page views: the page address and title, the referring page and campaign parameters (utm_*), browser type, screen size, language, time zone and a random session identifier that lasts until the browser tab is closed. The record-me iPhone app sends six usage events through our servers to doable.services — signing in, signing out, starting a recording, stopping one (with its length), uploading, and opening a transcript (with the transcript’s identifier) — without your username or any account identifier. The Web App at app.deep-thought.cloud uses Matomo for usage statistics. We do not use Google Analytics. We do not use advertising cookies or sell data to advertisers.
9. Third-Party Services
| Service | Purpose |
|---|---|
| Google OAuth | Authentication (optional) |
| Sign in with Apple | Authentication (optional) |
| Mailgun (EU region) | Sending e-mail, including transcripts you ask to receive by e-mail, and receiving files you e-mail to us for upload |
| Recall.ai (Hyperdoc Inc., USA; recordings stored in the EU region, Frankfurt) | The meeting assistant: joining and recording meetings you send it to, and reading connected calendars (see §6) |
| doable.services (Dolutions AB) | Usage statistics |
| Matomo | Usage statistics (Web App) |
When using BYOK, additional providers apply based on your configuration.
10. Your Rights
You can:
- Access your data
- Correct inaccurate data
- Delete your account and data
- Export your transcriptions
EU Users (GDPR): Data portability, right to erasure, restrict/object to processing, lodge complaints with supervisory authority.
If you signed up for the waitlist or as a tester and want your sign-up removed, e-mail support@deep-thought.cloud from that address (or tell us which address it was) and we delete it.
Participants in a recorded meeting who do not have an account can contact legal@deep-thought.cloud; we will help the account holder who recorded the meeting answer their request.
We do not sell personal information.
11. Data Sharing
We do NOT:
- Sell your data
- Share with advertisers
- Train AI on your content without consent
We may share data when required by law or to prevent fraud.
12. Children
Service not intended for users under 18.
13. Changes
Policy updates communicated via email or in-app notification.
14. Contact
Email: legal@deep-thought.cloud
By using Deep Thought Cloud, you accept this Privacy Policy.
Changes in version 1.2.2 (October 10, 2026)
- §2: what we store when you sign up for the waitlist or as a tester — e-mail, the page or link tag, the website the form was on, browser user agent, IP address and time.
- §3: why — to contact you about testing access, to see where sign-ups come from, and to stop abuse of the form; not marketing.
- §7: how long — until testing access is given, and at most 12 months from sign-up.
- §10: how to have a sign-up removed — e-mail support@deep-thought.cloud.
Changes in version 1.2.1 (October 10, 2026)
- §6: the meeting assistant’s chat message is posted in Swedish and English, not in your account’s language.
Changes in version 1.2 (October 7, 2026)
- New §6, the meeting assistant: who is recorded, how participants are told (its name “
notetaker”, its camera showing only the Deep Thought logo, and a chat message), your responsibility to inform participants and to have a lawful basis, what is collected (audio only — no video and no transcript at Recall.ai; participants’ names and e-mail addresses from the meeting platform; the speech timeline), how names are suggested, Recall.ai (Hyperdoc Inc.) as our processor — recordings stored in its EU region in Frankfurt, access from the United States under the EU Standard Contractual Clauses, its own sub-processors, and when it erases recordings — and calendar access through Recall Calendar. - §2, §3, §4, §5: the meeting assistant added where it changes what we collect, why, and where audio is handled.
- §3: a notice a few days before a plan ends and on the day it ends.
- §5: local-only mode now holds images and PDF pages instead of reading them, and is enforced at five points.
- §7: rows for meeting recordings, Recall.ai and calendar events.
- §9: Recall.ai added.
- §10: how a meeting participant without an account can reach us.
- Sections from §7 on are renumbered by one (the former §6 is now §7).