Language. This document is available in English and in Chinese. For consumers in Taiwan, the Chinese version prevails; otherwise, in case of discrepancy, the English version prevails.
1. What we collect
Account data. Name, email, and authentication metadata provided when you create a Sageio account or sign in via an identity provider.
Billing data. Handled by our Merchant of Record (Lemon Squeezy). We receive non-sensitive metadata such as plan, status, billing country, and the last four digits of your card. We do not store full payment card numbers.
Meeting content. Audio captured during meetings, the speech-to-text transcript derived from that audio, translations into your selected target languages, and speaker labels detected from the meeting interface, and AI-generated summaries and action items derived from the transcript.
How meeting audio is captured. Meeting audio reaches Sageio in one of two ways, both under your control: our meeting bot joins a meeting when you invite it; or, if you install the Sageio browser extension, the extension captures the audio of the meeting tab you are in — only while you have actively started a Sageio session, and you can stop it at any time. If you additionally grant the extension microphone permission, your microphone is captured as well during the session, so that your own speech is included in the transcription; if you decline, only tab audio is captured. In all cases the audio is transmitted securely to our servers and used solely to provide the real-time transcription and translation described in this policy; it is not stored (see Section 4), is not used for advertising, and is not used to train machine-learning models.
Dictation content.When you use Sageio Type, our dictation app for macOS and iOS: the audio you record while holding the dictation hotkey, the speech-to-text draft, the polished or translated text returned to you, and — where you enable it — a short snippet of text you have selected in the active app (read only, used as context so the result fits what you are writing). The name and bundle identifier of the app you are dictating into are also sent, so the result can match that app's tone.
How dictation audio is handled. Dictation audio leaves your device. It is sent to our servers and passed to the speech-to-text and text-refinement providers listed in Section 3 to produce your text. It is processed in memory only: we do not write it to storage, our logs never record audio or the text derived from it, and it is discarded once your text is returned to you. It is never used to train machine-learning models, by us or by those providers — see Section 2. What we do keep, and for how long, is set out in Section 4.
Contact and newsletter data. The name, email address, and message you submit through our contact form, and the email address you submit when subscribing to our newsletter.
Usage data. Request timestamps, IP address, browser user agent, and feature usage counters. Retained for security, abuse prevention, and product analytics. For Sageio Type we also record per-request usage counters — word count, audio duration, which engine served the request, latency, and error codes — with no transcript text or audio content, to enforce plan quotas, monitor quality, and prevent abuse.
Roles.Where meeting content is processed within a business customer's workspace, that customer is the data controller and Sageio processes the content as a processor under our Data Processing Agreement. This policy describes the processing for which Sageio itself is the controller: account, billing, website, communications, security and abuse prevention, and — for individual (non-workspace) users — the provision of the service itself. Sageio Type is offered to individual users; for dictation content, Sageio is the controller and this policy applies.
2. How we use your data
We use the data we collect to (a) provide the service you requested, (b) bill you for paid plans, (c) communicate about your account, (d) improve and secure the product, and (e) comply with our legal obligations.
Meeting transcripts are processed in real time to produce translations; dictation audio is processed on demand to produce polished text or translations. We do not train machine-learning models on customer meeting content or on dictation content, and our vendors are contractually restricted from doing so.
Legal bases. We rely on the performance of our contract with you (Art. 6(1)(b) GDPR) for items (a)–(c); on our legitimate interests in improving and securing the product (Art. 6(1)(f)) for item (d); and on our legal obligations (Art. 6(1)(c)) for item (e). Where we ask for your consent — for example, for the newsletter — you may withdraw it at any time.
Special categories of data. Sageio does not seek to collect special categories of personal data (such as data about health, religion, political opinions, trade-union membership, or sexual orientation), and our service does not identify anyone by their voice: speaker labels come from the meeting interface, and we create no voiceprints or biometric templates. Because meetings can touch on anything, transcripts may incidentally contain such data. Where a business workspace is concerned, the customer is responsible under our DPA for an appropriate legal basis, including any notices to and consents from meeting participants. Where Sageio acts as controller for individual users, we ask for your explicit consent to process special categories incidentally contained in your meeting content when you first enable transcription; we use that content only to provide the service. The same applies to dictation content: because you can dictate anything, it may incidentally contain such data. We ask for your explicit consent when you first set up Sageio Type, and we use that content only to produce your text.
3. Sub-processors
We rely on the following third parties to deliver Sageio. Each receives only the minimum data necessary for its role.
- Clerk — authentication and identity.
- Deepgram — real-time speech-to-text transcription.
- OpenAI — real-time speech-to-text transcription (default engine for new workspaces), transcription of uploaded audio files, and speech-to-text for dictation in Sageio Type.
- DeepL — translation of interim transcript segments and final translation for selected target languages.
- Google (Gemini) — translation refinement of finalized transcript segments; AI-generated summaries and action items; and, for Sageio Type, speech-to-text and text refinement of dictation.
- Amazon Web Services (AWS) — cloud hosting, object storage (audio and transcript exports), and encryption key management (KMS).
- Neon — managed PostgreSQL hosting for application data and transcripts.
- Cloudflare — hosting of this marketing site, global edge delivery, and cookieless, privacy-respecting website analytics (Cloudflare Web Analytics).
- Resend — transactional, meeting-summary, and newsletter email delivery.
Separately, Lemon Squeezy (a Stripe company) handles checkout, payments, tax, and invoicing as Merchant of Record. For those purposes it determines its own means of processing and acts as an independent data controller — your purchase data is governed by its own privacy policy, not by this sub-processor list.
The canonical, always-current sub-processor list — with purpose and processing location for each — is published at sageio.net/subprocessors. The list above reflects the production processors in use today.
4. Data retention
Account data is retained while your account is active. You may request deletion of your account and associated data at any time by writing to privacy@sageio.net; we complete verified deletion requests within 30 days. Billing records are retained for up to seven years where tax law requires.
Meeting transcripts are retained until you delete them or until your account is deleted. Audio recordings are not stored; only the derived text is persisted. Deleting a meeting does not recall summary emails already delivered to their recipients.
Dictation (Sageio Type). Audio is processed in memory and is not stored on our servers. Your dictation history — the drafts and finished text — is stored only on your device, where you can clear it at any time or set how long it is kept. On our servers we retain: the usage counters described in Section 1 (with no content) for up to 12 months; your personal dictionary entries, until you delete them or your account is deleted; and, where you choose to submit a correction to a result, that correction for up to 12 months — used only to review and improve quality, and covered by the no-training commitment in Section 2. Where the app learns dictionary suggestions from your corrections, the correction pairs themselves are processed transiently and are not stored; only the resulting dictionary suggestions are kept with your dictionary.
Contact-form submissions — the name, email address, and message you provide — are automatically deleted 24 months after submission. The IP address recorded with a submission is kept for abuse prevention only and is cleared after 90 days. Newsletter data is kept while you are subscribed and removed from our mailing list when you unsubscribe. All of the above can also be deleted earlier on request to the address in Section 10.
Residual copies in routine encrypted backups and server logs are purged on a rolling schedule of no more than 30 days and are not used for any other purpose.
5. International data transfers
Sageio is operated by 好客網路股份有限公司 (Unified Business No. 29041135), an entity registered in Taiwan, and processes data in Singapore (primary database region) and Japan (Tokyo, where the Sageio Type dictation service runs; covered by a European Commission adequacy decision), and in other regions where our sub-processors operate. Where data originates from jurisdictions that restrict cross-border transfers (such as the EEA and the UK), we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum.
Business customers can put these safeguards on a contractual footing by executing our Data Processing Agreement, which incorporates the SCCs (Module Two) and the UK Addendum.
Users located in the PRC. The Service is not directed at individuals located in the PRC. If you access the Service from within the PRC on your own initiative, your personal data will be transferred to and processed in Taiwan, Singapore, and the other locations described in this Section, under this Privacy Policy and the safeguards described above. We maintain no establishment or representative in the PRC.
6. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. EU and UK residents have these rights under the GDPR; we voluntarily extend equivalent rights to all users, including California residents.
To exercise these rights, contact us using the address in Section 10. We will respond within the timeframes required by applicable law.
You may also lodge a complaint with your local data-protection supervisory authority. Users in Taiwan additionally have the rights set out in the Personal Data Protection Act. We do not make automated decisions about you that produce legal or similarly significant effects.
7. Cookies and analytics
We use essential cookies for authentication and session management. Aggregate, anonymized usage statistics are collected via a privacy-respecting analytics provider (Cloudflare Web Analytics, run by our hosting provider) that sets no cookies and stores nothing on your device; we rely on our legitimate interest in understanding site usage as the legal basis for this measurement. Visitors are counted using a hash derived from the incoming request that is not associated with your IP address and is discarded after 24 hours, so no cross-site tracking takes place and no individual profile is built. You may object to this measurement at any time (Art. 21 GDPR) by writing to privacy@sageio.net. We do not place advertising trackers on Sageio properties.
8. Children
Sageio is intended for use by businesses and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
9. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to the address on file at least 14 days before they take effect, except where a shorter notice period is required by law.
10. Contact us
Questions about this policy or our handling of your data may be sent to privacy@sageio.net, or by post to 好客網路股份有限公司 (Unified Business No. 29041135), No. 205, Hulin Street, Xinyi District, Taipei City, Taiwan (臺北市信義區虎林街205號).