Version 2 · Published November 6, 2026

CivilTalk Privacy Policy

Effective Date: February 25, 2026 Last Updated: November 6, 2026

CivilTalk LLC ("CivilTalk," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the CivilTalk platform and Clarion CI service at app.civiltalk.com (the "Service").

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 Information Generated by the Service

2. How We Use Your Information

We use the information we collect to:

• Provide the Service — Process your uploads, generate transcriptions, produce AI analysis reports, and deliver results to you
• Manage your account — Authenticate your identity, maintain your profile, and manage your subscription
• Process payments — Handle subscription billing through our payment processor
• Enforce usage quotas — Track analyses used within your billing period
• Improve the Service — Monitor performance, troubleshoot issues, and enhance the quality of AI analysis
• Communicate with you — Send account-related notifications, respond to inquiries, and provide customer support
• Ensure security — Detect and prevent unauthorized access, fraud, and abuse
• Comply with legal obligations — Respond to lawful requests and enforce our Terms of Use

We do not use your User Content (audio, video, transcriptions, or analysis reports) for:

• Training AI models
• Advertising or marketing purposes
• Sale to third parties
• Any purpose other than providing the Service to you

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

3.1 Third-Party Service Providers

We engage trusted, industry-leading third-party service providers to help operate the platform. Each provider is carefully vetted and receives only the minimum data necessary to perform its specific function. Our providers fall into the following categories:

All third-party providers are contractually obligated to protect your data and are selected based on their security certifications, compliance standards, and data protection practices. For specific inquiries about our service providers, please contact us using the information in Section 12.

3.2 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

3.4 With Your Consent

We may share your information in other circumstances with your explicit consent.

4. Data Storage and Retention

4.1 Where We Store Data

Your data is stored using secure, enterprise-grade cloud infrastructure hosted in the United States. We use industry-leading providers for database storage, media file hosting, and authentication services, all of which maintain rigorous security certifications and compliance standards.

4.2 How Long We Retain Data

We retain your data for as long as your account is active and as needed to provide the Service:

4.3 Data Deletion

You may delete individual reports through the Service, which will remove the associated media, transcription, and analysis data. To request full account deletion, please contact us at the address listed in Section 12.

5. Data Security

CivilTalk maintains a secure technology stack and robust security practices to protect your information. Our security measures include:

• Encryption in transit — All data transmitted between your browser and our servers is protected using industry-standard HTTPS/TLS encryption
• Encryption at rest — Data stored on our infrastructure is encrypted using modern encryption standards
• Secure authentication — We employ enterprise-grade identity and access management with secure token-based authentication
• Account isolation — User data is strictly isolated by account; you can only access your own reports and analysis
• Vetted providers — All third-party service providers are selected based on their security certifications, compliance standards (including SOC 2, PCI DSS where applicable), and data protection practices
• Audit logging — All administrative access to user data is logged and monitored
• Secure development practices — We follow industry best practices for secure software development and regularly review our security posture

While we take extensive precautions to safeguard your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to continuously improving our security measures to protect your information.

6. Your Privacy Rights

6.1 All Users

Regardless of your location, you have the right to:

• Access your personal information through your account dashboard
• Update your account information at any time
• Delete individual reports and their associated data
• Cancel your subscription and close your account
• Request a copy of or deletion of your personal data by contacting us

6.2 California Residents — Your CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and its amendments (CPRA) provide you with the following additional rights:

Right to Know. You have the right to request that we disclose:

• The categories of personal information we have collected about you
• The specific pieces of personal information we have collected about you
• The categories of sources from which your personal information was collected
• The business or commercial purposes for collecting your personal information
• The categories of third parties with whom we share your personal information

Right to Delete. You have the right to request that we delete your personal information, subject to certain exceptions permitted by law.

Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.

Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, or provide you with a different level of quality for exercising your rights.

No Sale or Sharing of Personal Information. We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising purposes, as those terms are defined under the CCPA/CPRA.

How to Exercise Your Rights. To submit a request, please contact us using the information in Section 12. We will verify your identity before processing your request. We will respond to verifiable consumer requests within 45 days. If we require additional time, we will notify you of the extension and the reason.

Authorized Agents. You may designate an authorized agent to make a request on your behalf. We may require proof of authorization and may still verify your identity directly.

6.3 Categories of Personal Information Collected (CCPA Disclosure)

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

Note on Sensitive Information in Uploads: Because you upload audio and video recordings of conversations, the content of those recordings may contain sensitive personal information about you or other conversation participants. You are responsible for obtaining appropriate consent from all participants before uploading. CivilTalk processes this content solely to provide the Service and does not use it for any other purpose.

7. Cookies and Local Storage

7.1 What We Use

The Service uses browser local storage (not cookies) to maintain your authentication session. Specifically:

• Authentication tokens (secure session credentials and expiration data) are stored in your browser's local storage to keep you logged in

7.2 What We Do Not Use

• We do not use third-party tracking cookies
• We do not use advertising or analytics cookies
• We do not use third-party analytics or tracking technologies
• We do not engage in cross-site tracking or behavioral advertising

7.3 Third-Party Cookies

Our payment processor and authentication service may set their own cookies during payment flows and login processes. These are governed by their respective privacy policies.

8. Public Reports

If you choose to make a report public using the Service's sharing feature, the report content (including analysis results and transcript data) will be accessible to anyone with the public link. You are solely responsible for ensuring that all conversation participants have consented before sharing any report publicly. You may revoke public access to a report at any time.

9. Connected Calendars (Google and Microsoft)

You can choose to connect a Google Calendar or Microsoft Outlook calendar to the Service. This section explains what happens to your calendar data when you do. Connecting a calendar is optional.

9.1 What We Access

When you connect a calendar, we access:

• Calendar events from the connected calendar: event titles, start and end times, meeting links, the organizer, and attendees (names and email addresses)
• The email address of the calendar account you connect

We request read-only access to your calendar events, plus your account email address. We do not create, change, or delete events in your calendar.

9.2 How We Use Calendar Data

We use calendar data only to let you choose which meetings Clarion CI joins and records, and to get Clarion CI to those meetings. We show you your upcoming meetings so you can choose. For meetings you choose, we use the meeting link and start time to send Clarion CI to the meeting, and we use later calendar updates to keep it on schedule if the meeting is moved or to cancel it if the meeting is cancelled.

If another CivilTalk user invited to the same meeting has already added Clarion CI to it, we show you their name so you know the meeting is already being recorded. Likewise, if you add Clarion CI to a meeting, other CivilTalk users invited to that meeting may see your name.

We do not use calendar data for advertising, we do not use it to build profiles of you or your contacts, we do not use it to train AI models, and we do not sell it.

9.3 Who We Share Calendar Data With

We use Recall.ai as our service provider for calendar connections. Recall.ai holds the connection to your Google or Microsoft account, including the access credentials, and reads your calendar events on our behalf. When you connect, CivilTalk passes the access credentials from Google or Microsoft directly to Recall.ai and does not store them.

We do not share calendar data with anyone else, except as described in Sections 3.2 (Legal Requirements) and 3.3 (Business Transfers).

9.4 What We Keep

• Upcoming events: We do not store your upcoming calendar events. We fetch them from Recall.ai when you view your meetings. To keep the page fast, results may be reused for up to 30 seconds from temporary server memory; they are never written to our database. Recall.ai keeps a synced copy of your calendar events while your calendar is connected, so it can provide them to us.
• Meetings you choose to record: For each meeting you choose, we keep its title, meeting link, start time, and calendar event identifiers with that meeting's report. This data is deleted when you delete the report.
• Your connection: While your calendar is connected, we keep the email address of the connected calendar account, the calendar provider (Google or Microsoft), and the dates you connected and last synced. When you disconnect, or revoke our access from your Google or Microsoft account, we delete the email address. We keep the provider, the connection and disconnection dates, and a log of calendar activity (for example, when you connected or disconnected and which meetings you added). That log records the domain of your calendar email address but not the full address, and keeps identifiers of the meetings you added even after you delete their reports. We keep this remaining information for as long as you have a CivilTalk account and delete it when your account is deleted.

9.5 Disconnecting and Revoking Access

You can disconnect your calendar at any time from your Account page by selecting Disconnect. When you disconnect:

• Recall.ai deletes the access credentials for your Google or Microsoft account, so neither Recall.ai nor CivilTalk can read your calendar anymore
• We delete the email address of the connected calendar account from our records
• We stop showing your calendar events, and Clarion CI will no longer be scheduled from that calendar
• Recall.ai deletes its copies of your calendar events within 90 days
• Reports of meetings you already recorded are not deleted; you can delete them separately

If you instead revoke our access from your Google or Microsoft account, we are notified and carry out the same steps.

You can also revoke the Service's access at any time from your Google or Microsoft account:

• Google: myaccount.google.com/permissions
• Microsoft (personal account): account.microsoft.com/privacy
• Microsoft (work or school account): myapps.microsoft.com

To have your remaining calendar connection history deleted before your account is closed, contact us using the information in Section 12.

9.6 Google User Data

CivilTalk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9.7 Microsoft User Data

Calendar data received from Microsoft is accessed, used, shared, and kept exactly as described in Sections 9.1 through 9.5: we use it only to let you choose which meetings Clarion CI joins and records and to get Clarion CI to those meetings (including when they are moved or cancelled), we share it only with Recall.ai as our service provider, we keep it only as described in Section 9.4, and we do not use it for advertising, profiling, AI model training, or sale.

10. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe we may have collected information from a person under 18, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Provide notice through the Service or via the email address associated with your account

Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to submit a data request, please contact us:

CivilTalk LLC Email: [email protected] Website: https://www.civiltalk.com

For CCPA-related requests, please include "CCPA Request" in your subject line and provide sufficient information for us to verify your identity.

By using CivilTalk, you acknowledge that you have read, understood, and agree to this Privacy Policy.