Privacy policy
In all cases, the French version prevails.
Last updated: 22 October 2026
How KISMO processes the personal data of visitors to the kismo.ai website, of the clients and members of the service, and of the people whose conversations are captured
Contents
- 1. Who we are
- 2. Who this Policy is for
- 3. Our roles: controller or processor
- 4. Data processed, purposes, legal bases and retention
- 5. Where the data comes from
- 6. You are a speaker or a person mentioned
- 7. Recipients and processors
- 8. Transfers outside the European Union
- 9. Security
- 10. Artificial intelligence and automated decisions
- 11. Connecting a calendar or a third-party account
- 12. Cookies and trackers
- 13. Your rights
- 14. Minors
- 15. Changes to the Policy
- 16. Contact
- 17. Personal information and rights in Quebec (Law 25)
1. Who we are
1.1. KISMO, a French simplified joint-stock company with a share capital of 10,000 euros, registered with the Avignon Trade and Companies Register under number 100 952 829, with its registered office at 21 chemin du Moulin, 84530 Villelaure, France (“KISMO” or “we”), publishes the website www.kismo.ai (the “Website”) and the KISMO service, an AI conversation assistant that turns conversations, recordings, documents and texts into structured memories (the “Service”).
1.2. Our data protection contact can be reached at dpo@kismo.ai or by post at the address of the registered office (marked “Data protection”). KISMO’s data protection lead is Mr Guillaume Sanchez, President. KISMO has started the appointment of an external data protection officer; this policy will be updated at that time.
1.3. This Privacy policy (the “Policy”) describes which data we process, why, on what legal basis, for how long, with whom we share it and what your rights are. It applies to the Website, to the Service (web application, mobile applications, KISMO phone number, meeting bot, AI assistant connector) and to our exchanges with you. Capitalized terms not defined here have the meaning given in our Terms of sale and subscription.
2. Who this Policy is for
This Policy concerns you if you are:
- a visitor to the Website or a person who contacts us (demo or contact form, email, social networks);
- a professional Client who opens a free trial or subscribes to a Subscription, a person who starts signing up, or a Member invited to use the Service by a Client;
- a speaker: a person whose conversation (call, meeting, video meeting) is captured by a Client using the Service, or who is mentioned in a memory, a document or a Client’s address book;
- a recipient of a sharing link or an invitation.
3. Our roles: controller or processor
3.1. KISMO is the controller for the data it decides to process for its own needs: account and access management, billing, security, support, communication and prospecting, Website audience measurement, and improvement of the Service through anonymized statistics.
3.2. KISMO is a processor for Clients for the Content and Results of their Space: recordings, transcripts, memories, files, connected calendars, address book cards, conversations with the Assistant, Brain concepts. The Client alone decides what it records, imports or connects; KISMO processes this data on its instructions, under the conditions of section 17 of the Terms of Sale. If you are a speaker or a person mentioned, the controller of your data is the Client using the Service (section 6).
3.3. The table below summarizes our processing as a controller.
4. Data processed, purposes, legal bases and retention
| Processing | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Account and access to the Service | Last name, first name, email address, phone number (verified with a code), organization, role, password (hashed), two-factor authentication settings, language, time zone, login logs, date of acceptance of the terms and conditions | Create and secure your account, authenticate you, manage Members and roles; choose the country of your KISMO number, the language of your account and invoices and the time zone of your memories, based on the language of your sign-up, your billing address or your phone | Performance of the contract | As long as the account exists, including after the end of a trial or a Subscription; deleted within the month following the account deletion request, then from our backups as they expire; login logs 12 months at most |
| Subscription and billing | Billing identity and contact details, VAT number, country, payment and invoice history, pay-as-you-go overage authorizations (amounts chosen, version of the accepted text, date and Member who gave it); card data is processed by our payment provider and is not stored by KISMO | Fulfil the order, invoice, collect, keep the accounts | Performance of the contract; legal obligation (accounting, tax) | 10 years from the end of the financial year for accounting records; overage authorizations, as long as the account exists; your customer file at our payment provider (name, email address, phone, billing address, tax number, invoices) is not deleted with your account |
| Support and reports | Identity, email address, content of requests, messages from the “Send feedback” button and screenshots, history of exchanges | Answer your requests, fix defects, improve the Service | Performance of the contract; legitimate interest (quality of the Service) | 24 months after the request is closed |
| Security and fraud prevention | Technical logs, IP addresses, device identifiers, security events, authorized phone numbers | Detect and prevent unauthorized access, abuse and fraud; establish proof of operations | Legitimate interest (security); legal obligation | Logs: 12 months at most; authorized phone numbers: as long as the account exists; longer in the event of an incident or proceedings |
| Information about the Service | Email address, Space, notification preferences | Inform you of new features, maintenance, incidents and contractual changes; inform you of your usage, your top-ups, the end of your trial or subscription and what happens to your KISMO number | Performance of the contract; legitimate interest | As long as the account exists |
| Prospecting and customer relations | Identity, position, organization, business contact details, history of exchanges, interest expressed, demo requests | Answer your requests, offer you a demo, send you information about our plans | Pre-contractual measures; legitimate interest, with the right to object at any time | 24 months after the last contact for Website forms; 3 years after the last contact for prospecting |
| Audience measurement and advertising on the Website | Pseudonymized browsing data (pages viewed, source, device, events), cookie identifiers | Measure Website traffic, improve our content, measure our campaigns | Consent (Axeptio banner) | 14 months for measurement data; consent choice 6 months; consent register 24 months |
| Improving the Service | Aggregated and anonymized usage statistics; aggregated and anonymized quality indicators for transcripts and memories | Steer and improve the Service, calibrate its settings, monitor costs | Legitimate interest (improving the Service) | Anonymized data kept without limit; no identifying data |
| Beta testing program | Testers’ account data, feedback, reports, exchanges | Run the beta, collect and process feedback | Performance of the beta testing agreement | Duration of the beta plus 12 months |
KISMO never uses your Content or Results to train artificial intelligence models, and never sells them. Excerpts of Content are viewed by authorized KISMO staff only at your request (support), to handle a defect you reported, for security reasons or when required by law, under a confidentiality commitment.
5. Where the data comes from
We collect data directly from you (subscription, forms, settings, use of the Service), from the Client who invites you as a Member, from the services you connect (Google or Microsoft calendar, third-party artificial intelligence assistants through the connector) and, for speakers and people mentioned, from the conversations and documents submitted by Clients. Payment data is collected by our payment provider, Stripe. When you pay on our Website, it sends us your name, your email address, your phone number and the country, region and postal code of your billing address. From this we derive the country of your KISMO number and the language and time zone of your account, and we keep only the country and region of this address. Your tax number and card data stay with Stripe.
6. You are a speaker or a person mentioned
6.1. A KISMO Client may record and transcribe, using the Service, a conversation in which you take part: a phone call to its KISMO Number, an in-person meeting recorded from its application, a video meeting to which it invites the KISMO Meeting bot. The Client is responsible for informing you before the recording and for obtaining your consent where the law requires it. Our Contractual documents impose this obligation on the Client and prohibit covert recording.
6.2. To help you know that you are being recorded: the Meeting bot appears in the video meeting under the name KISMO, followed by the first name of the person who invited it through a meeting link, and displays, while recording, an image with the KISMO logo marked “REC”; the host can remove it at any time and the Client must remove it if you object; the telephone greeting of the KISMO Number introduces itself: “This is Kismo. Go ahead, I’m listening.”; the Website page dedicated to the Meeting bot (https://kismo.ai/en/meeting-bot) explains how the Service works.
6.3. The Service produces, for the Client, a transcript and a memory that attribute statements to speakers, identify the people mentioned and may fill the Client’s address book (name, position, organization, contact details mentioned, relationships). These elements are generated automatically: contact cards are created automatically, and the Client checks, corrects or deletes what they contain. The Service creates no voiceprint and identifies no one by their voice.
6.4. To exercise your rights (access, rectification, erasure, objection) over a conversation or a memory concerning you, first contact the Client who made the recording: it has the tools in the Service to correct or delete your data. You can also write to dpo@kismo.ai: we pass your request on to the Client concerned within five business days and assist it in responding; without its instruction, we cannot change the content of its Space, except where required by law.
7. Recipients and processors
7.1. Your data is accessible to authorized KISMO staff, on a need-to-know basis. It is processed by providers acting on our behalf (processors): hosting of servers and databases in France (OVHcloud); storage of files and media in the European Union (Google Cloud Storage); artificial intelligence model providers (Anthropic, OpenAI, Google, Mistral AI, and, when the Member chooses one of their models, DeepSeek or open models such as Llama or Qwen); automatic choice of the artificial intelligence level (TypeSafe AI or one of the model providers above); speech transcription (Deepgram, AssemblyAI, Speechmatics); video meeting recording (Recall.ai, Attendee); telephony, and verification of your number by a code sent by SMS or by call (Twilio, Vonage, Telnyx); connection of third-party accounts, calendar included (Composio, Nango, Pipedream); WhatsApp messaging (Meta, or an approved intermediary such as Twilio, Vonage or 360dialog); weather requested from the voice assistant (Open-Meteo, OpenWeather or WeatherAPI, which receive only the name of a city); subscription management, invoicing and tax calculation (Stripe); speech synthesis (ElevenLabs, Cartesia, Azure Speech); web search (Brave Search, Bing Search, Mojeek); sending emails (Resend); help desk (Atlassian); error collection and monitoring (Sentry, Better Stack); content delivery network and protection, and anti-bot verification at sign-up, which receives your IP address and technical information about your browser (Cloudflare); Website publishing platform and database (Lovable, Supabase); consent management and Website audience measurement (Axeptio, Google). The artificial intelligence providers and their role are listed in Annex 2 of the Terms of Sale.
7.2. Some recipients process your data on their own behalf, as controllers: our payment provider (Stripe) to execute payments and fight fraud; the publishers of the artificial intelligence assistants, calendars and applications you connect to the Service yourself; our advisers (accountant, lawyers) and, where applicable, administrative or judicial authorities when the law requires us to.
7.3. We do not sell or rent your data.
8. Transfers outside the European Union
The components of the Service that we operate are hosted in the European Union (France). Some of our providers (artificial intelligence models, transcription, telephony, video meeting recording, monitoring, anti-bot verification, billing) are established in the United States or may process data there; we favor their European regions or endpoints where they exist. When the Member chooses some of the models offered for selection in the Service, the data sent may be processed and stored outside the European Union, including in China. When the Member links their WhatsApp, their messages go through the WhatsApp messaging platform, which processes them in its data centers, including outside the European Union. Any transfer outside the European Union is covered by an adequacy decision of the European Commission (in particular the EU-US data protection framework for certified providers) or by the European Commission’s standard contractual clauses, supplemented by additional measures (encryption in transit, minimization of the data sent, short or zero retention periods). You can obtain a copy of the applicable safeguards by writing to dpo@kismo.ai.
9. Security
We protect your data with appropriate measures: accounts protected by password and two-factor authentication, separation of Spaces and Members, encryption of data in transit and, at rest, of backups kept outside our servers and of stored files, authorized phone numbers, hosting of servers and databases in France, tested automatic backups, monitoring and alerts, logging of administrative access, penetration tests, deletion of recordings at the telephony and video conferencing providers as soon as they are retrieved. The details are on the Website’s Security page. In the event of a data breach likely to result in a risk to your rights, we inform you in accordance with the law.
10. Artificial intelligence and automated decisions
10.1. The Service produces transcripts, memories, summaries, contact cards and answers using artificial intelligence systems. These Results are suggestions intended to be reviewed by a human; they may contain errors. KISMO takes no decision about you based solely on automated processing producing legal effects or similarly significantly affecting you, and our Contractual documents prohibit Clients from using the Service for that purpose.
10.2. The “perceived sentiment” function, available for complaint memories, analyzes the transcribed text to help the Client qualify a complaint; it relies on no biometric data and must not be applied to employees or candidates. Our Artificial intelligence transparency notice describes the models used, their limits and the human oversight measures.
11. Connecting a calendar or a third-party account
If you connect a Google or Microsoft calendar, the Service accesses, with your authorization, the events in your calendar (title, times, participants, video meeting link) to display your meetings, invite the Meeting bot according to the rules you choose and link past meetings to their memories. We use this data for no other purpose, do not transfer it to any third party other than the processors needed for the Service, and do not use it for advertising or to train models; no person views it, except with your consent, for security reasons or when required by law. KISMO’s use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from your Space and from the security settings of your Google or Microsoft account; calendar data already imported is then deleted, except for the links between past meetings and existing memories. If you connect a third-party account (email, calendar, contacts, files, notes), the Service accesses it with your authorization, through our provider Composio, which keeps the access authorizations: it regularly collects what you have designated, for example a label in your mailbox, a folder in your files or pages in your notes, to turn it into memories, your contacts for your address book, and your calendar to invite the Meeting bot. The Assistant consults these accounts and acts on them at your request. If you connect your Plaud account, the Service reads it directly at Plaud, with no intermediary, to import the recordings you choose. You can disconnect an account at any time from your Space.
12. Cookies and trackers
The Website uses trackers needed for it to work and, with your consent, audience measurement and advertising trackers. You can change your choices at any time from the preference center available in the Website footer. The details (tools, purposes, durations) are in our Cookie policy. The Service uses only technical trackers needed for authentication, security and remembering your preferences. The “Choose a plan” page displays the pricing tables of our payment provider Stripe, loaded from its servers, which may set their own trackers, needed for payment and fraud prevention.
13. Your rights
13.1. Under the conditions provided for by the GDPR and French law, you have the rights of access, rectification, erasure, restriction of processing, objection (in particular to prospecting, at any time and without giving a reason), data portability, the right to withdraw your consent at any time for processing that depends on it, and the right to set guidelines on what happens to your data after your death.
13.2. To exercise your rights, write to dpo@kismo.ai or to KISMO, Data protection, 21 chemin du Moulin, 84530 Villelaure, France, stating the right exercised and the email address of your account. We may ask you for proof of identity when we have reasonable doubt. We reply within one month, which may be extended by two months for complex or numerous requests, informing you of the extension and its reasons within one month, in accordance with article 12 of the GDPR.
13.3. For data processed by KISMO as a processor for a Client (section 6), we pass your request on to the responsible Client and assist it.
13.4. You can lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or with the supervisory authority of your place of residence.
14. Minors
The Service is reserved for adults. We do not knowingly collect data from minors; if you think a minor has given us data, write to dpo@kismo.ai so that we delete it.
15. Changes to the Policy
We may change this Policy to reflect changes to the Service, to our providers or to the regulations. The version in force is published on the Website with its date; substantial changes are notified to Clients and Members in the Service or by email.
16. Contact
KISMO, 21 chemin du Moulin, 84530 Villelaure, France. Data protection: dpo@kismo.ai. General contact: hello@kismo.ai.
17. Personal information and rights in Quebec (Law 25)
This section applies to people located in Quebec, under Quebec legislation on the protection of personal information in the private sector (commonly called “Law 25”). It supplements the other sections of this Policy.
Person in charge of the protection of personal information. KISMO has appointed a person in charge of the protection of personal information: Mr Guillaume Sanchez, who can be reached at dpo@kismo.ai.
Your rights of access and rectification. You can request access to the personal information KISMO holds about you, and the rectification of inaccurate, incomplete or ambiguous information, by writing to the person in charge of the protection of personal information at the address above. We reply to any request within 30 calendar days.
Functions turned off by default. Functions that allow you to be identified, located or profiled (on the Website: audience measurement and advertising trackers) are turned off by default. They are turned on only after a positive action on your part, expressed through our consent management banner or the preference center (see the Cookie policy).
Disclosure outside Quebec. As KISMO is established in France, personal information is stored and processed outside Quebec, mainly in France, and by the providers mentioned in section 7.
Complaint. If, after contacting us, you believe your rights are not being respected, you can file a complaint with the Commission d’accès à l’information du Québec (CAI), in particular through its website (www.cai.gouv.qc.ca).