Empy Privacy Policy

1) Scope

This policy covers personal information processed through Empy websites, apps, and services. If you use Empy through your employer or organization, we process meeting data under their instructions. In that case your organization is the controller. A Data Processing Addendum is available on request.

2) What we collect

We collect only what we need to run and improve Empy.

Account and identifiers

Name, email, password hash or SSO identifiers.

Product usage

Events, session and device data, crash logs, performance metrics, basic interaction data.

Meeting and conversation data

Audio-derived transcripts, timestamps, speaker labels, meeting title and timing, analytics and metadata required for Empy features. If you upload files or notes, we process that content.

Inferences we generate

Metrics and scores derived from usage and meeting data to power recommendations and progress insights.

Cookies and similar tech

Cookies and similar tools on the site to keep you signed in and to understand usage. See Section 6.

Sensitive information

We do not seek sensitive personal information. Meeting transcripts may incidentally include it if shared by participants. We use such content only to provide and secure the service or as required by law.

Children

Empy is for adults 18+. We do not knowingly collect data from anyone under 18. If you believe a minor provided data, email aram@empy.ai and we will delete it.

Your responsibility

Record or transcribe only where you have the legal right and participant permission.

3) Sources

• You, when you create an account, use features, or upload data.
• Your organization, if they provision your account.
• Automatic collection in the app and website.
• Service providers that help us operate Empy.

4) How we use data

We use data to:

• Provide core functionality, including real-time analysis and transcripts.
• Maintain, secure, debug, and improve Empy.
• Research and develop new features using aggregated or de-identified data.
• Communicate about service updates and security. You can opt out of non-essential emails.

We do not sell personal information.

5) How we share data

We share personal information only with service providers that help us run Empy, under contracts that limit their use:

Hosting and infrastructure

DigitalOcean for compute, storage, and networking.

AI processing

OpenAI APIs to power AI features. OpenAI states that API and enterprise business data is not used to train models by default. We use those business offerings. OpenAI Platform

Analytics

Google Analytics 4 for website and product analytics. Google documents that GA4 does not log or store IP addresses and provides regional privacy controls. Google Help

We may disclose data to comply with law, respond to lawful requests, or protect Empy, our users, or the public. We do not allow providers to use your meeting content for their own advertising or model training unless you or your organization explicitly opt in with that provider.

6) Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember preferences, measure performance, and understand site usage. GA4 provides region controls and does not log or store IP addresses. You can control cookies in your browser and through our cookie banner where available. Google Help

We do not engage in cross-context behavioral advertising. If this changes, we will update this policy and provide required opt-outs.

7) Retention

• We keep personal information while your account is active.
• After your subscription ends, we retain data for 30 days, then delete it.
• We may keep aggregated or de-identified data that no longer identifies you.
• If law or security requires longer retention for specific records, we keep only what is necessary and only as long as required.

8) Security

We use industry-standard measures such as access controls, encryption in transit, key management, environment isolation, audit logging, and vendor due diligence. No system is perfectly secure. If a breach affects your data, we will notify you consistent with law.

9) Your responsibilities

• Get any required consent from meeting participants before recording or transcribing.
• Do not upload content you are not allowed to share.
• Secure your account and devices. Notify us promptly if you suspect unauthorized access.

10) Your privacy choices and rights

Everyone can:

• Access basic account info in settings.
• Request access or deletion by emailing aram@empy.ai.
• Opt out of non-essential emails using the unsubscribe link.

State privacy rights in the United States

The rights below apply where the relevant state law covers you and us. We honor these rights as required.

California - CCPA as amended by CPRA

California residents may have rights to know, access, delete, correct, and portability, and to opt out of sale or sharing for cross-context behavioral advertising. You may limit use of sensitive personal information for certain purposes. This policy serves as our Notice at Collection. We do not sell personal information and we do not share it for cross-context behavioral advertising. California Privacy Protection Agency

Virginia - VCDPA

Virginia residents may have rights to access, correct, delete, portability, and to opt out of targeted advertising, sale of personal data, and certain profiling. An appeals process is available if we decline a request. Virginia Law

Colorado - CPA

Colorado residents have similar rights. Covered entities that engage in targeted advertising or sale must recognize universal opt-out mechanisms as of July 1, 2024. We will honor valid universal opt-out signals where required. Colorado General Assembly

Connecticut - CTDPA

Connecticut residents have access, correction, deletion, portability, and opt-out rights. As of January 1, 2025, controllers must honor opt-out preference signals such as the Global Privacy Control. We will honor valid signals where required. CT.gov

Utah - UCPA

Utah residents have rights including access, deletion of data you provided, portability, and opt-out of sale and targeted advertising. dcp.utah.gov

Nevada - SB 220

Nevada residents may direct website operators not to sell covered information collected online. We do not sell personal information, but you can still contact us to register an opt-out. Nevada Legislature

How to exercise rights

Email aram@empy.ai with your request, your state of residence, and the email you use for Empy. We will verify your identity using your account email or other reasonable steps. You may use an authorized agent if your state permits. If we decline your request, you can appeal by replying to our decision email. We will explain how to contact your state Attorney General if you remain unsatisfied.

We do not discriminate against you for exercising your rights.

11) AI specific disclosures

Empy uses OpenAI business offerings to process meeting content. According to OpenAI, data sent via the API and enterprise services is not used to train OpenAI models by default. We configure our use to align with those commitments. OpenAI Platform

12) International transfers

We process data in the United States and where our providers operate. If you access Empy from outside the United States, you consent to transferring your data to the United States.

13) Changes to this policy

We may update this policy. We will post the new version with a new effective date. For material changes we will notify you by email or in-app.

14) Contact us

Retreat Zone Inc.

Email: aram@empy.ai

For privacy or security issues, put "Privacy Request" in the subject line.

15) Notice at Collection - short version for signup and checkout

"We collect your name, email, usage logs, and meeting transcripts to run Empy and improve it. We host on DigitalOcean, use OpenAI for AI features, and Google Analytics for analytics. We keep data while your account is active, then 30 days after your subscription ends, and then we delete it. You can request access or deletion at aram@empy.ai. We do not sell personal information."