1. Who is Nabrah and what does this Policy cover?
Nabrah Notetaker (the 'Notetaker', and together with its website, dashboard, meeting bots and APIs, the 'Services') is operated by Deep Scan Technologies, a company incorporated under the laws of the Kingdom of Saudi Arabia, with registered address at Al Abbas Ibn Abd Al Mouttaleb, At Taawun, Riyadh 12476 and Commercial Registration No. 1010801178 ('Nabrah', 'we', 'us', or 'our').
The Notetaker is an AI meeting assistant. It sends a bot into meetings on platforms such as Google Meet, Microsoft Teams, Zoom and Webex, records their audio, transcribes that audio into text, and generates summaries, topics and action items from the transcript. It reads a connected calendar to decide which meetings to join, accepts audio uploaded directly, and offers developer APIs and webhooks for retrieving the results.
1.1 Relationship to the Nabrah platform policy
The Notetaker is one product within the wider Nabrah.ai platform. This Policy describes how the Notetaker handles personal data; it sits alongside, and does not replace, the master documents published at nabrah.ai:
Those documents apply to you in full whenever you use the Notetaker. Where a provision here addresses something specific to the Notetaker — meeting recordings, transcripts, calendar data, or the notes generated from them — and cannot be read consistently with the master Privacy Policy, this Policy governs for the Notetaker only. On every other matter the master Privacy Policy governs.
We take your personal data and privacy seriously. This Privacy Policy (the 'Policy') explains our practices regarding the collection, use, protection, and disclosure of Personal Data. It is designed to comply with the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and other applicable data protection laws and standards.
This Policy applies to the Personal Data we process from three main groups of individuals:
Website Visitors: Individuals who visit or interact with our public-facing websites (e.g., nabrah.ai).
Customers: Authorized users representing an organization that has entered into an agreement with Nabrah to use our Services.
Meeting Participants: Individuals whose voice, words, name, or image are captured because a Customer recorded a meeting they attended — including people who have no account with us and never agreed to anything with us. Anyone audible in a recorded meeting, and anyone named in a transcript or in the notes generated from it, falls into this group.
A critical distinction is whether Nabrah acts as a 'Data Controller' or a 'Data Processor'. For Website Visitors and Customers, Nabrah acts as the Data Controller, meaning we determine the purposes and means of processing. For Meeting Participant data that we process on behalf of our Customers — meeting audio, transcripts, speaker attribution, attendee lists, calendar entries, and the notes derived from them — our Customer is the Data Controller and Nabrah acts as the Data Processor, processing such data only on the documented instructions of our Customer.
The legal responsibility for having a valid legal basis to record a meeting and process what it captures — including any consent or notice the participants' law requires, and any treatment of voice as biometric data — rests solely with our Customer, the person who chose to bring the Notetaker into that meeting. If you were recorded in a meeting and want to know why, or want the recording removed, the organisation that recorded it is the party who decides; Section 11 explains how to reach us and how we will pass such a request on.
Please read this Policy carefully. By accessing our websites or using our Services, you acknowledge that you have read, understood, and agree to the practices described here. If you do not agree with this Policy, you must not use our websites or Services.
2. What personal data do we collect about you and how do we collect it?
We collect Personal Data through various means to provide and improve our Services. The types of data we collect depend on your relationship with us, as detailed below. This approach adheres to the PDPL principle of data minimization.
Data You Provide Directly to Us
Account and Contact Information: When you register for an account, request a demo, or contact us for support, we collect information such as your full name, business email address, phone number, company name, job title, and billing or physical address.
Payment Information: For paying Customers, we collect billing details and payment information, which are processed securely by our third-party payment processors (e.g., Stripe or local KSA gateways). We do not store full card numbers on our systems.
Communications and Support Data: If you contact us via email, support tickets, feedback forms, or other channels, we collect the information contained in your correspondence, including any attachments.
Uploaded Audio: When you (or your authorized representatives) upload a recording for transcription and analysis, we collect that recording together with any associated metadata you provide (such as a title, the language, and consent records).
Data We Collect Automatically
Usage and Log Data: Information about your interactions with our Services, such as the features you use, the pages you visit, the API endpoints you call, the dates and times of access, and performance statistics.
Device and Connection Information: IP address, browser type and version, operating system, device identifiers, and approximate location derived from your IP address.
Cookies and Other Tracking Technologies: We use cookies and similar technologies to operate and administer our websites, gather usage data, and support our marketing efforts. For details, see Section 12.
Data We Process on Behalf of Our Customers (as a Data Processor)
When our Customers use our Services to record, transcribe, and analyse their meetings, we process the data captured on our platform. Nabrah has no direct relationship with the Meeting Participants whose data is processed in this context. The collection of this data is managed by our Customers, who are the Data Controllers. This data includes:
Participant Information: The display names of the people in a meeting, their join and leave times, and — where the meeting platform or the connected calendar provides it — their email addresses.
Interaction Content: The audio of a recorded meeting, per-speaker audio where the platform provides it, and the transcripts, summaries, topics, and action items generated from it. Meetings are unrehearsed, so this content may contain Personal Data and, potentially, Sensitive Personal Data of Meeting Participants — including things said in passing about health, beliefs, or private life.
Interaction Metadata: The meeting platform and meeting link, the scheduled start time and the actual duration, when the bot joined and left, how long it waited to be admitted, the length of the recording, and other technical details associated with the run.
Calendar and Integration Data: If a Customer connects a calendar (e.g., Google Calendar, Microsoft Outlook) or another third-party application, we may access and process data from that system as directed by the Customer — including event titles, descriptions, times, meeting links, and invitee lists, which is how the Notetaker knows which meetings to join.
3. Meeting recordings, voice, and biometric data
A meeting recording is unusually sensitive: it captures whatever was said, by whom, and often the names, images, and email addresses of everyone present. Voice characteristics used to identify a person may also constitute biometric data — a special category of Personal Data under the Saudi PDPL and similar laws. This Section explains how that data is handled and where responsibility lies.
3.1 What a recording contains
When the Notetaker joins a meeting it may process the meeting's audio; a transcript of that audio; attribution of speech to individual speakers, including per-speaker audio where the platform provides it; the participant list, display names, and join and leave times; the calendar entry behind the meeting, including its title, description, and invitee list; and the summaries, topics, and action items generated from the transcript.
Some of this may qualify as biometric data depending on context and purpose, and is treated with additional safeguards.
3.2 Customer responsibility for consent and notice
Where you (as a Customer) send the Notetaker into a meeting, upload a recording, or enable automatic joining, you are solely responsible for having a valid legal basis to record and for giving every participant whatever notice or consent their law requires — including all-party consent where that applies. You must honour any withdrawal of consent and instruct us to delete the relevant data where the law requires it.
Our bot joins under a visible name that identifies it as a notetaker and appears in the participant list. That is a courtesy, not a legal notice, and it does not discharge your obligation.
Section 6 of our Terms of Service sets out these recording and consent obligations in full.
3.3 Nabrah's role
For meeting data processed on behalf of a Customer, Nabrah acts as that Customer's Data Processor. We do not use meeting audio, transcripts, or the voices in them to identify, profile, or contact participants on our own behalf, and we do not sell meeting data or voice data. Subject to your plan and contract, we may use this data to operate, maintain, secure, and improve the Services as described in Section 4 and — on the Basic and Pro plans only — to train and evaluate our models as described in Section 5. Enterprise data is never used for training.
4. How and why do we use your personal data?
We follow the PDPL principle of purpose limitation. We only use your Personal Data for specific, explicit, and legitimate purposes that we have disclosed to you, and we do not process your data for purposes that are incompatible with those original intentions.
As a Data Controller (For our own business purposes)
To Provide Services and Manage Your Account: We use your Account and Contact Information to create and maintain your account, process payments, provide you with access to our Services, and send essential service-related communications (e.g., billing notices, security alerts).
To Provide Customer Support: We use your communications data and account information to investigate and respond to your inquiries, troubleshoot technical issues, and provide other support services.
For Marketing and Communications: With your consent where required by law, we may use your Contact Information to send you newsletters, promotional materials, and other information about our products and services. You can opt out at any time using the unsubscribe link in any marketing email or by contacting us at support@nabrah.ai.
To Improve Our Services and Websites: We analyze Usage and Log Data to understand how users interact with our platform, improve functionality, enhance the user experience, and develop new features.
For Security, Fraud Prevention, and Legal Compliance: We use your Personal Data to maintain the security and integrity of our platform, detect and prevent fraud and abuse, enforce our legal agreements (such as our Terms of Service), and comply with our legal obligations.
As a Data Processor (On behalf of our Customers)
When we process Meeting Participant data on behalf of our Customers, our role is strictly limited to providing the Services as instructed by the Customer in our contractual agreement. Our purposes for processing this data are:
To Deliver the Core Services: We process meeting audio, Interaction Content, Interaction Metadata, and Calendar Integration Data to perform the functions contracted by our Customer. This includes sending a bot into a meeting, recording and storing its audio, producing transcripts and speaker attribution, generating summaries, topics and action items, answering questions about a meeting, and displaying all of it within the Customer's Nabrah account. The legal basis for this processing is the contract between Nabrah and the Customer.
5. How does Nabrah's Artificial Intelligence process meeting data?
The core value of the Notetaker is its ability to turn a recorded meeting into something readable. This section explains how our AI systems work and the safeguards we apply.
Core AI Functionality
Speech-to-Text Transcription: Our AI converts recorded meeting audio into searchable text, in Arabic and English. A meeting recording shorter than three minutes is not sent for transcription or any other AI processing: its audio is kept under the retention periods in Section 9, and nothing further is derived from it.
Speaker Attribution: Where the meeting platform makes it possible, our AI separates the audio by participant so that lines of the transcript can be attributed to the person who spoke them.
Summarisation, Topics, and Action Items: Our AI generates a short summary, a longer summary, the topics discussed and the share of the meeting each occupied, and a list of action items with owners and due dates where the meeting stated them.
Meeting Assistant: Our AI answers questions about a meeting, or across several meetings, using the transcripts and notes you already hold.
These outputs are generated automatically and are not verified by a person. They may mishear speech, attribute a line to the wrong speaker, omit something that was said, or state something that was not.
AI Model Training and Improvement
To keep our AI models accurate and effective, they require continuous training and refinement. Using Customer data for model improvement is a separate processing activity from delivering the Services and is subject to additional controls.
Data Protection Safeguards: Before any data is used for training purposes, we apply technical measures to anonymize or pseudonymize it to the greatest extent possible, including removing or obscuring direct personal identifiers.
Which plans this applies to: Whether a meeting may be used for training depends on the plan the Customer is on.
Basic and Pro. Some recordings, transcripts, and notes created on these plans may be used to train, evaluate, and improve Nabrah's models, after the safeguards above have been applied. Not every meeting is used — we select material where it will measurably improve accuracy, most often Arabic dialects and difficult audio.
Enterprise. Enterprise data is isolated. It is never used to train, evaluate, or improve any model, ours or a third party's, under any circumstance, whatever any setting says, and there is no option to turn it on. It is processed solely to deliver the Services to that Customer.
Opting out: Customers on Basic or Pro can opt out by writing to us at support@nabrah.ai, or through their contract. An opt-out applies to future training only: a trained model holds no copy of a meeting and cannot be made to un-learn what it was trained on, though we will stop using the underlying data and delete it on request as described in Section 9. If you attended a meeting but are not the Customer who recorded it, that choice belongs to them, not to us — Section 16 explains how to reach us.
6. What is our legal basis for processing your data?
Under PDPL and similar laws, all processing of Personal Data must be justified by a legal basis. The bases we rely on are:
Performance of a Contract: When processing is necessary to fulfill our contractual obligations to you (e.g., providing the Services you have subscribed to).
Consent: When you have given us your explicit and informed permission to process your Personal Data for a specific purpose (e.g., for sending marketing materials).
Legitimate Interest: When we have a legitimate business interest in processing your data (for example, security, fraud prevention, or service improvement), and that interest is not overridden by your fundamental rights and freedoms. We do not rely on legitimate interest as a basis for processing sensitive or biometric data. We rely on this basis, alongside the Customer's contract, to train and evaluate our models on Basic and Pro plan material — only after the de-identification described in Section 5, and never on Enterprise data.
Legal Obligation: When we are required to process your Personal Data to comply with a law or a binding legal order.
7. Who do we share your personal data with?
We do not sell your Personal Data. We share Personal Data only in the limited circumstances described below, and only after taking steps to ensure that any third party with whom we share data provides an adequate level of protection.
Sub-processors and Service Providers: We engage third-party companies and individuals to perform services on our behalf, including cloud hosting, payment processing (e.g., Stripe), speech-to-text and AI model providers, identity providers, data analytics, and customer support. We share the minimum data necessary, and we put binding Data Processing Agreements in place requiring sub-processors to protect the data, process it only on our instructions, and not train their own models on it.
Third-Party Integrations Chosen by the Customer: When a Customer chooses to connect our Services to a third-party application (e.g., a calendar, a conferencing platform, or any other system), we will share data with that service as directed by the Customer. We are not responsible for the privacy practices of these third-party services, and we encourage our Customers to review their privacy policies.
Legal and Regulatory Bodies: We may disclose Personal Data in response to a lawful request by public authorities, such as to comply with a court order, a legal proceeding, or national security or law-enforcement requirements. We will only disclose what is required by law and will notify the relevant Customer before disclosure where we are not legally prohibited from doing so.
Business Transfers: In the event of a merger, acquisition, bankruptcy, or other sale of all or part of our assets, your Personal Data may be transferred to the acquiring entity. We will notify you of any such change in ownership or control of your Personal Data.
8. Where is your data stored and is it transferred internationally?
The location and transfer of Personal Data are subject to strict legal requirements under the Saudi PDPL. We have designed our infrastructure and policies to respect data residency and to ensure that all cross-border data transfers are lawful.
Primary Data Storage Location: Customer data, including voice inputs, generated voices, Interaction Content, and Metadata, is primarily stored on secure servers within the Kingdom of Saudi Arabia, to help Customers meet their data localization and compliance obligations.
International Data Transfers: In certain circumstances (such as 24/7 support, specialized AI sub-processors located outside the Kingdom, or globally distributed infrastructure), it may be necessary to transfer Personal Data internationally. We will only conduct such transfers in strict compliance with PDPL and other applicable laws.
Legal Safeguards for Transfers: Any transfer of Personal Data outside Saudi Arabia will be protected by appropriate legal safeguards as mandated by PDPL, which may include: (a) transferring to countries deemed by the Saudi Data & Artificial Intelligence Authority (SDAIA) to provide an adequate level of protection; (b) using approved Standard Contractual Clauses or Binding Corporate Rules where adequacy is not available; and (c) conducting a documented risk assessment for the transfer.
9. How long do we keep your personal data?
We adhere to the PDPL principle of storage limitation: we do not retain Personal Data for longer than is necessary to fulfill the purposes for which it was collected or to comply with our legal and contractual obligations.
Customer-Controlled Data: The retention period for meeting recordings, transcripts, notes, and metadata processed on behalf of our Customers is configured and controlled by the Customer. Our platform provides Customers with retention controls to meet their industry, legal, and business requirements.
Data Deletion Upon Contract Termination: When a Customer terminates their contract with us, all data associated with their account, including recordings, transcripts, notes, and Calendar Integration Data, will be permanently deleted from our production systems after a brief grace period (typically up to 90 days) to allow for account reactivation, unless we are legally required to retain it.
Material Already Used for Training: Deleting a meeting removes the recording and everything derived from it from our systems. It cannot remove what a model has already learned from it, because a trained model holds no copy of the meeting. Enterprise data is never used for training, so this never applies to it.
Account and Billing Data: We retain Account and Billing data for the duration of the customer relationship and for the period required to comply with tax, accounting, and other legal obligations.
Marketing Data: Personal Data used for marketing purposes is retained until you withdraw your consent by unsubscribing from our communications.
10. How do we secure your data and respond to incidents?
10.1 Security Measures
We implement technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, loss, or destruction. These measures include encryption in transit and (where appropriate) at rest, access controls and least-privilege permissions, network and infrastructure security controls, secure development practices, logging and monitoring, periodic vulnerability assessments, and employee training.
10.2 No Guarantee of Absolute Security
Although we use reasonable measures to protect Personal Data, no method of transmission over the internet, no method of electronic storage, and no AI/ML system is 100% secure. We cannot and do not guarantee absolute security. You are responsible for keeping your account credentials, API keys, and integration secrets confidential, and for using strong, unique passwords.
10.3 Breach Notification
If we become aware of a Personal Data breach that is likely to cause significant harm, we will notify the competent supervisory authority and, where required by PDPL or other applicable law, affected Customers and individuals without undue delay. Customers are responsible for notifying the participants of their meetings where required.
11. What are your rights regarding your personal data?
We respect your right to control your Personal Data. In accordance with PDPL and other applicable data protection laws, you have the following rights:
The Right to be Informed: You have the right to be informed about the collection and use of your Personal Data, which is the purpose of this Policy.
The Right of Access: You have the right to request a copy of the Personal Data we hold about you.
The Right to Correction (Rectification): You have the right to request that we correct any inaccurate or incomplete Personal Data we hold about you.
The Right to Destruction (Erasure): You have the right to request the deletion of your Personal Data when it is no longer necessary for the purpose for which it was collected, or when you withdraw your consent.
The Right to Withdraw Consent: Where we process your Personal Data based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
The Right Regarding Automated Decision-Making: Where applicable, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you, except as permitted by law.
How to Exercise Your Rights
If you are a Customer or Website Visitor and wish to exercise any of these rights, please contact us at support@nabrah.ai (see Section 16 below). We will respond to your request in a timely manner, in accordance with applicable law. We may need to verify your identity before responding.
If you are a Meeting Participant who was recorded by one of our Customers, please note that Nabrah processes your data as a Data Processor on behalf of that Customer. Therefore, to exercise your rights, you must direct your request to the relevant Customer (the organisation that brought the Notetaker into the meeting). We are legally and contractually obligated to act only on the documented instructions of our Customers regarding the data they control.
12. How do we use cookies and other tracking technologies?
We use cookies and similar tracking technologies on our websites to provide and improve our services, analyze usage, and for marketing purposes.
What are Cookies? A cookie is a small text file that a website stores on your computer or mobile device when you visit the site. It enables the website to remember your actions and preferences over a period of time.
How We Use Cookies: We use different categories of cookies:
Strictly Necessary Cookies: Essential for you to browse the website and use its features, such as accessing secure areas.
Performance and Analytical Cookies: These cookies collect aggregated, anonymized information about how you use our website (such as pages visited and links clicked) to help us improve how our website works.
Functional Cookies: These cookies allow our website to remember past choices, such as your preferred language or region.
Marketing and Targeting Cookies: These cookies track your online activity to help advertisers deliver more relevant advertising or to limit how many times you see an ad.
Managing Your Preferences: When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or reject different categories of non-essential cookies. You can also control and manage cookies through your browser settings. Disabling certain cookies may affect the functionality of our website.
13. What is our policy regarding children's data?
Our Services are intended for business use and are not directed at individuals under the age of 18. We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected Personal Data from a child without verification of parental consent, we will take steps to delete that information from our servers as quickly as possible. If you believe we may have collected information from a child, please contact us at support@nabrah.ai.
14. Limitation of liability and disclaimers
14.1 Best-Efforts Security; No Guarantee
We use reasonable technical and organizational measures to protect Personal Data, but no system, network, or AI service is 100% secure. To the maximum extent permitted by applicable law, Nabrah disclaims any warranty, guarantee, or commitment that the Services, our websites, or any of our data-protection measures will be uninterrupted, error-free, fully resistant to attack, or that any Personal Data processed through the Services will be entirely free from risk of unauthorized access, loss, or alteration.
14.2 No Liability for Customer-Controlled Use of the Services
Where Nabrah acts as a Data Processor on behalf of a Customer, the Customer is the Data Controller and is solely responsible for: (a) the legal basis for processing Meeting Participant data (including any consent or notice required to record a meeting, any treatment of voice as biometric data, marketing, and any other processing); (b) the accuracy, lawfulness, and content of the data the Customer captures through or submits to the Services; (c) responding to data-subject requests from Meeting Participants; and (d) any consequence of the Customer's configuration, deployment, integration, or use of the Services. To the maximum extent permitted by applicable law, Nabrah shall have no liability whatsoever to any Meeting Participant or other third party for any claim arising out of or related to a Customer's use of the Services, and the Customer agrees to indemnify Nabrah for any such claim in accordance with Section 17 of our Terms of Service.
14.3 No Liability for Third-Party Services
Our Services may rely on, integrate with, or be used alongside third-party services chosen by the Customer (including AI / model providers, speech-to-text providers, the meeting platforms our bots join, payment processors, identity providers, hosting and cloud providers, calendars, and other vendors). To the maximum extent permitted by applicable law, Nabrah shall have no liability for any act, omission, security incident, data loss, downtime, or breach by any such third-party service, even where data is shared with or received from that service in the course of providing the Services.
14.4 Relationship to the Terms of Service
This Privacy Policy is part of, and is governed by, our Terms of Service. The disclaimers, exclusions, limitations of liability, indemnification, governing law, and dispute resolution provisions of the Terms of Service (including without limitation Sections 14 through 19) apply to this Policy and to any claim arising out of or related to our processing of Personal Data, to the maximum extent permitted by applicable law. In the event of any conflict between this Policy and the Terms of Service, the Terms of Service shall prevail unless the conflict relates to a matter of mandatory data-protection law, in which case the relevant data-protection law shall control.
14.5 Mandatory Carve-Outs
Nothing in this Policy excludes or limits any liability that cannot lawfully be excluded or limited under applicable law (for example, mandatory liability under PDPL for the obligations of a Data Controller or Data Processor, or under KSA law for fraud, willful misconduct, or gross negligence).
15. How will you be notified of changes to this policy?
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will update the 'Last updated' date at the top of this Policy. If we make a material change, we will provide you with notice — for example, by sending an email to the address associated with your account or by posting a prominent notice on our website — before the change becomes effective. We encourage you to review this Policy periodically to stay informed.
16. How can you contact us about your privacy?
If you have any questions, concerns, or complaints about this Privacy Policy or our data-protection practices, or if you wish to exercise your rights, please contact us:
Email: support@nabrah.ai
Postal Mail: Riyadh, Kingdom of Saudi Arabia
We are committed to working with you in good faith to obtain a fair resolution of any complaint or concern about privacy.