Home page Privacy
🇪🇺 100% EU data residency · GDPR Art. 6.1(f)

Privacy, no marketing.

Most AI meeting tools are American products with US data residency, training models on your data. We built Luminote the other way around: in the EU, for the EU, with GDPR from the first commit in the code.

See for yourself — 14 days free Download DPA
Privacy by design

How Luminote processes
Your conversations.

Regardless of the chosen mode — from the first byte to the final task in the CRM, your data is encrypted, processed in the EU, and controlled by RLS at the database level. No exceptions.

01

Capture

The bot joins the call or you record locally. Audio is transmitted via an encrypted TLS 1.3 channel.

TLS 1.3
02

Transcription

Ephemeral: model runs on-device in the browser. Cloud: EU servers. Diarization, native Polish.

On-device / EU
03

Mistral extracts the meaning

Enterprise-grade EU LLM. Tasks, signals, decisions, contacts + PII anonymization before AI.

Result: preserved
04

Retention per mode

Ephemeral: audio and transcript deleted after 15 min. Cloud: AES-256 encrypted, controlled by you.

You decide
GDPR + DPA Art. 6.1(f) as basis. DPIA + DPA available for Enterprise.
AES-256 + RLS Encryption at-rest + Row-Level Security on every table. MFA for Enterprise.
100% EU residency All infrastructure, AI models, and data — exclusively in the European Union.
Audit logs + DSAR Full GDPR rights: access, rectification, erasure, portability from the UI.
Where your data lives

Every element of our stack —
in the European Union.

We do not use American providers, not even for operational metrics. Full list of sub-processors available on request.

Database

Supabase · Frankfurt

PostgreSQL with Row-Level Security on every table. AES-256 at-rest, TLS 1.3 in transit, audit logs enabled at the database level.

  • EU-West region (Frankfurt)
  • Point-in-time recovery
  • Row-Level Security + audit logs
LLM

Mistral AI · Paris

Mistral Large + Ministral 14B — French enterprise-grade LLM models. No training on your data, no sharing with third parties, fully EU compliant.

  • Pinned model snapshots (no silent changes)
  • PII anonymized before going to LLM
  • Enterprise: dedicated tenant
STT

On-device transcription

In Ephemeral mode, the transcription model runs locally in your browser — audio never leaves your device. In Cloud mode, transcription takes place on EU servers.

  • Ephemeral: 100% on-device (offline)
  • Cloud: servers exclusively in the EU
  • Polish + 10 EU languages
Your rights

Full set of GDPR rights.
From single screen.

W Settings → Privacy & Security realizujesz każde prawo zapisane w RODO — bez wysyłania maila do supportu, bez czekania, bez ticketów. Operacje są natychmiastowe i loggowane w audit logach.

  • Right of access Download everything we know about you. JSON, one click.
  • Right to rectification Edit any data of your account, contacts, deals.
  • Right to be forgotten Delete account + all data. Immediately, irreversibly.
  • Right to data portability JSON / CSV Export — everything you have in Luminote.
Settings · Privacy & Security
Download my data
JSON export · all deals, contacts, transcripts
Delete selected recordings
Get rid of specific transcripts
Delete account + all data
Irreversible. Instant.
Audit logs
Who, when, what — full activity history
FAQ

Most frequent questions
we hear from compliance departments.

Are my conversations used to train AI models?
No. Never. Mistral (LLM) models operate on a zero data retention basis, and data is anonymized (PII tokenized) before being sent to the model. In Ephemeral mode, transcription happens entirely on-device — audio never leaves your browser. This is documented in our DPA and is subject to audit.
Where is my data physically located?
Exclusively on servers in the European Union. Database — Supabase (Frankfurt). LLM — Mistral AI (Paris). Ephemeral Transcription — on-device in the browser; Cloud — EU servers. We never send data outside the EEA, not even operational metrics.
What legal basis for GDPR do you use?
Art. 6 sec. 1 lit. f GDPR — legitimate interest of the controller. Since processing in Ephemeral mode is short-term (15 min), we do not require separate consent from meeting participants. In Cloud mode, participants must be informed at the beginning of the call. Full DPIA analysis available for Enterprise customers.
Can I get a DPA + list of sub-processors?
Yes — and for Pro+ plans it's standard. Write to legal@luminote.io DPA request — we send one compliant with the EDPB model within 1 business day. The list of sub-processors is publicly available and updated 30 days before any change.
What if a client requests data deletion?
Z poziomu Settings → Privacy & Security realizujesz prawo do bycia zapomnianym — operacja jest natychmiastowa, nieodwracalna i loggowana w audit logach. DPO odpowiada na DSAR (Data Subject Access Request) w ciągu 30 dni zgodnie z RODO.
Does recording require participant consent?
In Ephemeral mode (15 min retention) and with appropriate notification to participants at the beginning of the conversation, separate consent is usually not required in B2B (Art. 6.1(f) GDPR). In Cloud mode, we recommend obtaining consent — our Meeting Bot automatically informs about recording. Full legal analysis in DPA.
How do you protect data during AI processing?
Before sending anything to the LLM model, our gateway automatically anonymizes PII — emails, phone numbers, names, and identifiers are tokenized, and after the model's response, de-anonymized on our side. Mistral models operate on a zero data retention basis and do not train on your data. Full documentation in the DPA.
What happens when I close my account?
All your data (contacts, deals, transcripts, recordings, signals) are deleted immediately and irreversibly from our database. Backups are overwritten in a 7-day cycle. After 7 days from account closure, there is no trace of your data in our infrastructure.
Any questions?

Our DPO replies
within 24 hours.

Compliance, DPIA, sub-processors, custom DPA — everything your security team needs.

legal@luminote.io legal@luminote.io

Privacy-first AI sales.
From the EU, for the EU.

Try 14 days for free. If we don't meet your security team's requirements — you cancel with one click.

Try for free Talk to DPO