Privacy statement

1. Who is responsible?

Rapportly B.V. is the controller for the data you share with Rapportly via rapportly.io and rapportly.nl. You can reach us at vragen@rapportly.io.

Do you use Rapportly for documents that contain personal data of your own clients (for example a transcript or an audio recording of a client conversation)? Then you are the controller for that data and we process it solely on your instructions, as a processor. A data processing agreement is available on request via vragen@rapportly.io.

2. Which data do we process, and what for?

Account and organisation: company name, email address, password (stored encrypted), two-factor authentication settings, your role within the team and your language preference. Purpose: making your account and team work. Legal basis: performance of the contract.

Document content: the transcripts, notes and example documents you enter, and the documents Rapportly creates from them. Purpose: generating documents in your writing style. Legal basis: performance of the contract. At registration we inform you about this and ask you to agree to this service processing.

Audio recordings: if you upload a recording of a conversation, record one in the app, or record a video meeting (in the app or with the browser extension), we process that recording to turn it into text. Such a recording contains everything that was said: the sound of people's voices and the content of the conversation, and therefore often personal data of your client. A meeting recording also captures the voices of everyone taking part in that meeting, including people who are not your client. Purpose: converting the recording into a transcript you then work with. Legal basis: performance of the contract. How we handle the recording is set out in chapter 4.

Subscription and billing data: your plan and usage, and once paid subscriptions are active your payment details via our payment provider. We do not store card or bank details ourselves. Legal basis: performance of the contract and legal (tax) obligations.

Technical data: server logs and error reports (such as IP address, time and requested page) and usage statistics we keep ourselves, without tracking cookies and without third-party analytics. Purpose: security, abuse prevention and improving the service. Legal basis: legitimate interest.

Fixed content-free signals: across offices, Rapportly combines only pre-approved counts, stages, durations, technical outcomes and non-personal configuration settings to improve the product. Names, free text, amounts, files, medical categories, source content, client content and personal data are technically filtered out and are not permitted. These two content-free components are part of the service and are enabled by default for every account; raw client content is never used or shared across organisations.

Partner attribution: if you arrive via a partner link, we remember with your consent for 90 days which partner referred you. How that works is explained in the cookie statement. Legal basis: consent.

Email to your clients: when you send a message to a client from Rapportly, we record with that message whether it was delivered and whether a link in the email was clicked, along with the time. This lets you see in the file whether your message arrived and whether your client acted on it. We deliberately do not record whether an email was opened: that measurement has become technically unreliable because some mail programs preload messages automatically, and it would therefore put a misleading picture in your file. Links in such a message run via our own domain link.mail.rapportly.io. Purpose: letting you see what happened to your message. Legal basis: performance of the contract. Please note: you remain responsible for informing your own client about this.

Style suggestions: if you provide a website address, screenshot, logo, company name or description, we process this input to suggest colours and sample layouts for your company. We retrieve the specified public website and its styling from our server; we do not send your browser cookies or log in to that website. The style maker does not send this input to an AI provider or save it as a style profile. You receive three suggestions and can create a sample file. Only when you choose to upload or save that file in the next step do the processing and retention periods for documents and style examples described above apply. A separately uploaded logo may be included in the sample file; a screenshot is used only to derive colours.

3. AI processing

Rapportly generates documents with AI models from Anthropic. Your input is only used to create your documents: not to train AI models, and not shared with other users.

To convert audio into text we use the Speechmatics Batch service through its European EU1 endpoint. Your recording is used only to produce your transcript. Speechmatics states that it does not use customer recordings to train models unless the customer expressly opts in.

Do not upload documents containing personal data you have no legal basis for; we also ask you to agree to this at registration. Tip: anonymise input where possible, the quality of the document stays the same.

4. Converting audio into text

You can upload an audio recording, record a conversation directly in the app, or record a video meeting. In all cases we send the recording to Speechmatics, which turns it into text through its European EU1 endpoint. When you record yourself, the recording stays in your own browser while you record and only leaves once you press convert. For some file types (m4a, mp4 and webm) we first convert the file on our own server into a format the speech model can handle; only then does it leave our systems.

You can record a video meeting in two ways: in the app via 'record meeting', or with the Rapportly browser extension for Chrome and Edge. The extension works in Google Meet, Microsoft Teams and the Zoom web client in the browser. In both cases the sound of the meeting tab is mixed with your microphone, so that both sides of the conversation end up in the recording. Recording starts only when you click the record button or extension icon; nothing is ever recorded automatically. The extension does not read or collect chat messages, participant lists or visual page content. It records only the tab audio and your microphone after you start recording and sends the recording only to Rapportly, to the same place as a recording made in the app.

While recording, the browser extension writes the audio in small parts to a local, protected queue in the browser. For each recording, this queue stores the audio and the technical data needed for recovery and upload, such as status, start time, duration, file size and file type. If you use a connected calendar, the title of the matching appointment and an internal client reference may also be stored and sent with the recording to your own Rapportly account. The extension does not retrieve participant lists or raw email addresses from your calendar. Without a calendar connection, recording continues to work without this information.

The extension temporarily stores your Rapportly sign-in session in the browser so that the recording is placed in the correct account; that session disappears when you close the browser or sign out. The extension also remembers locally the internal account ID of the most recently used Rapportly account and binds each queued recording to the account under which it was started. This prevents a recording on a shared device from being sent silently to a different account. If the account differs, the queue first asks for a deliberate choice.

After you stop recording, the extension automatically tries to upload the recording to Rapportly over an encrypted connection. If there is no valid sign-in session or the upload fails temporarily, the recording remains stored locally. The browser then schedules only a new upload attempt; this never starts a new recording. The local copy is removed only after the upload succeeds or after you deliberately remove it from the queue yourself.

What happens to the recording itself depends on the 'keep recordings' feature. If it is off, the file exists only as a temporary file on our server while it is being converted and is deleted afterwards; the recording then does not go into the database and does not appear in your document overview. If it is on, we store the recording and the literal text with the conversation (stored in the EU, with Supabase in Frankfurt), so you can listen back, download and delete them yourself at any time. For Batch processing, Speechmatics keeps a copy of the audio, transcript and job configuration. After a successful conversion, Rapportly asks Speechmatics to delete the job immediately. If that deletion does not succeed, Speechmatics automatically deletes the job within seven days under its own retention policy.

The resulting text we do keep, in exactly the same way as a transcript you type or paste yourself. The transcript appears in the text field on screen and is automatically saved as a draft, so you do not lose your work if something crashes or you close your tab. That draft disappears as soon as you start the report or clear the field. Once you start the report, the text falls under 'Document content' above.

For every conversion we record that a conversion took place, along with the file size, file type, duration, number of credits and technical data such as your IP address. The content of the recording or the transcript is not part of that record. Purpose: billing, abuse prevention and being able to trace what happened.

Important for you as an adviser: you decide whether to record a conversation and you are responsible for that decision. Tell the people you speak with that you are recording and what you use the recording for, and make sure you have a legal basis for it. The same applies to a video meeting: tell all participants before you start recording. Do not record more than you need.

We are switching on the storing of recordings step by step. If it is active for your environment, you will see a recording block with play, download and delete buttons next to the conversation. If you do not see that block, storing is off for your environment and your recording is deleted after conversion.

5. Who do we share data with?

We never sell data. We only share with suppliers needed to run Rapportly. These are all of them: Vercel (website hosting), Railway (application and API), Supabase (database and sign-in, with storage in the EU in Frankfurt), Anthropic (the AI that writes your documents), Speechmatics (converting audio into text through its European EU1 endpoint) and Resend (sending email, and recording deliveries and clicks on links in that email). These suppliers may only process the data to provide their service to us.

If we engage a new supplier that processes personal data, or replace one, we notify the firms using Rapportly in advance so they can object. The current list is available on request via vragen@rapportly.io.

If you connect your own mailbox, Rapportly uses the connection you authorise with Google (Gmail) or Microsoft (Outlook) to create drafts in that mailbox. Where sending after approval is available, you activate it separately in Rapportly and review each message’s recipient, any Bcc, subject, text and attachments. After your approval, Rapportly processes sending within the configured sending window. Google combines managing drafts and sending drafts in one permission; Microsoft requires read and write access for drafts and a separate sending permission.

Insofar as data is processed outside the European Economic Area, this happens on the basis of an adequacy decision (such as the EU-US Data Privacy Framework) or EU standard contractual clauses.

The use of information received through the Rapportly browser extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Rapportly uses this data only to store the meeting recording selected by the user safely in the browser, send it to the user's own Rapportly account and convert it into text. We do not sell this data or use it for advertising, credit assessment or other unrelated purposes. Employees do not read the content unless you expressly consent for a specific support request, access is necessary for security, or the law requires it.

For the mailbox connection, we process the connected email address, granted permissions and access tokens. The token used to renew the connection is stored encrypted on the server. For a message, we store the recipient, any Bcc, subject, text, attachment references, the mail provider’s draft or message reference and processing status. We send your selected message content and attachments to your mail provider to create the draft and, after approval, send it. This client email feature does not retrieve messages from your inbox. The Sent status confirms acceptance by the mail provider; it does not prove delivery or reading.

Rapportly uses information received from Google APIs solely for the visible features you choose, in accordance with the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data or use it for advertising, credit assessment or training general AI models. Human access is limited to support you explicitly authorise, necessary security purposes or a legal obligation. The technical providers listed above process this data only to provide and secure these features.

6. How long do we keep data?

As long as your account is active, we keep your data so you can reread and reuse documents. If you delete a document or client, that content disappears from the app. If you want your account and data deleted, email vragen@rapportly.io; we then remove your data from the active systems, after which it also disappears from backups according to our backup schedule.

Audio recordings: a browser extension recording that has not yet been uploaded remains in the local queue until the upload succeeds or you remove it yourself. After a successful upload, the extension deletes the local recording. If 'keep recordings' is off in Rapportly, the server copy exists only during conversion and is deleted afterwards. If it is on, we store the recording and the accompanying text with the conversation until you delete them there, or until your account is deleted. The transcript in the text field we keep for as long as you use it, just like text you paste yourself: as an automatically saved draft until you start the report or clear the field, and after that as part of your document. If you never finish a draft, it stays until you clear it or your account is deleted; let us know if you want us to remove it sooner.

Email sent to clients and its status (delivered, clicked) are kept with the corresponding conversation in the file, for as long as your account exists or until you delete that conversation.

Data we are legally required to keep longer (such as invoices, 7 years under Dutch tax law) and the record of your registration agreements and current Rapportly service basis are kept for as long as that obligation or necessity lasts.

You can disconnect your mailbox under My account → Connections. Rapportly then deletes the stored connection credential. You can also revoke access with Google or Microsoft. Before disconnecting, check whether any approved messages are waiting in the sending queue. Disconnecting does not delete email history in Rapportly, or drafts and sent messages already held by your mail provider. The options and retention periods above apply to deleting data in Rapportly; you manage mailbox data with your mail provider.

7. How do we protect your data?

Connections are encrypted (https). Data is separated per organisation, including at database level (row level security). Two-factor authentication is available for all Rapportly accounts and is optional by default. A team administrator can make two-factor authentication mandatory for the entire team. Access to production systems is limited to those who need it.

8. Your rights

You have the right to access, rectification, erasure, restriction and portability of your data, and you can object to processing. Consent you have given (such as for partner attribution) can always be withdrawn; this does not affect the processing before that moment.

Email your request to vragen@rapportly.io; we respond within a month. If you feel we are not handling your data properly, you can file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

9. Cookies and local storage

With your permission, we send public page visits and browser data, including your IP address, to Meta to measure advertising. Meta may use cookies and link visits to your account. We do not share customer content. Your choice is valid for 90 days. You can withdraw it in cookie settings. With the same permission, we also report that your account registration is complete, without sending your name, email address or company details. What is stored in your browser (sign-in, language preference and, only with your consent, the partner code) is explained in detail in the cookie statement. If you use the browser extension, it also stores locally: your temporary sign-in session, the internal account ID of the most recently used Rapportly account, whether you have already allowed microphone access, whether a recording is running, whether you still want to see the reminder in Meet, Teams and Zoom, and the queue of recordings that still need to be uploaded. That queue contains the audio and the status, time, duration, size, file type, account binding and any appointment title or internal client reference needed for recovery and upload. A browser alarm stores no additional personal data; it only schedules a new upload attempt for an existing queue item.

10. Changes

If we make substantive changes to this statement, we increase the version number and date at the top and announce important changes in the app. Version 2.0 takes effect on 1 October 2026 and identifies Rapportly B.V. as the responsible company and vragen@rapportly.io as the contact address.