DstnyIQ / Legal
DstnyIQ Privacy Policy
How Capacit handles personal data in DstnyIQ and partner-branded versions of the same service - who controls what, what is processed, and where it is held.
Capacit A/S · CVR 42607797 · Overgaden Neden Vandet 9A, 1414 Copenhagen, Denmark
1.Who we are#
This policy explains how Capacit A/S (“Capacit”, “we”) handles personal data in DstnyIQ and partner-branded versions of the same service where the processing described in this policy is materially the same. Separate services may be subject to separate privacy information.
Capacit A/S, CVR 42607797, Overgaden Neden Vandet 9A, 1414 Copenhagen, Denmark. Privacy contact: info@capacit.com.
Where you buy DstnyIQ through a partner, your contract and first point of contact may be with that partner.
2.What DstnyIQ does#
DstnyIQ joins Microsoft Teams meetings as a visible participant and records the meeting. Recordings are processed automatically using AI to produce transcripts and summaries, which are delivered to the recipients the customer organisation configures.
The recorder appears in the Teams participant list the whole time it is present and can be removed from a meeting at any time by a participant with a sufficient meeting role.
3.Our role - this determines who you ask#
The customer organisation decides to record. We do not.
For meeting content, the customer organisation whose Microsoft 365 tenant is connected to the service is the data controller. Capacit is a processor and acts only on that organisation’s documented instructions under a data processing agreement.
Capacit is a controller for a narrower set: business contact and account details, onboarding, licensing, usage and billing records, support correspondence, and the security and operational logs we need to run the service.
For meeting content, Capacit acts as a processor - or, where the service is supplied through a partner, as the partner’s sub-processor - and acts only on documented instructions originating from the customer organisation under the applicable data processing agreement. Where a partner is involved, instructions and requests flow through the partner.
We do not sell personal data and do not use it for advertising. What we do and do not do with meeting content for AI purposes is in section 7.
4.If you are a meeting participant#
A participant called DstnyIQ, or a partner-branded equivalent, may have appeared in your meeting. The meeting audio is recorded, transcribed and summarised by AI, and sent to recipients chosen by the organising organisation.
If you have concerns about being recorded, contact the meeting organiser or use any meeting controls made available to you. Your rights and the organiser’s legal basis depend on the circumstances of the meeting.
The organisation that organised the meeting is responsible for it. This policy does not replace the privacy information that the organising organisation, as controller, is required to provide about its recording and use of meeting content. Ask them about purpose, legal basis, retention and your rights.
You can also write to info@capacit.com and we will pass your request to them and confirm we have done so - we cannot decide it ourselves.
5.What we process#
Meeting content (we are processor): meeting audio; transcripts and summaries generated from it; participant details such as name, email address, Microsoft Entra identifier, meeting role and join/leave times; meeting metadata such as subject, time, organiser and meeting identifiers; and records of the transparency notices sent about a meeting.
Recorded speech can contain anything participants choose to say, including special category data under Article 9 GDPR. DstnyIQ is not designed to identify or profile individuals based on special category data. Such information may nevertheless be reflected in transcripts or summaries where it forms part of the meeting content.
We do not create voiceprints. DstnyIQ does not perform voice biometrics, does not generate or store biometric identifiers, and does not identify or recognise anyone from voice characteristics - including across meetings. Speaker attribution comes from the Microsoft Teams participant identity attached to the audio stream, not from analysing the voice itself. We also do not perform emotion recognition.
We do not market to meeting participants. Email addresses obtained from a customer’s calendar or participant list are used only to send transparency notices about the meeting and to deliver the output the customer has configured. We do not use them to promote our services, and we do not add participants to mailing lists.
Customer and account data (we are controller): business contact details; tenant, onboarding and licensing records; service configuration; usage and billing records; support correspondence; and application and security logs, which can contain technical identifiers and IP addresses.
We receive controller-side account and business contact data directly from you, from your employer or organisation, from an authorised partner, and where relevant from your organisation’s Microsoft 365 tenant.
Certain administrator, account and tenant information is necessary to provision and administer the service. If it is not provided, we may be unable to activate or support the relevant account or tenant.
6.Why, and on what basis#
Where we are processor, the legal basis for meeting content is set by the customer organisation, not by us.
Where we are controller, we rely on Article 6(1)(b) where processing is necessary to perform a contract with the individual concerned. Otherwise, we rely on our legitimate interests under Article 6(1)(f) for administering and supporting our business customer relationships, user accounts and service operations, including operating, securing, troubleshooting and improving the service.
Our legitimate interest in improving the service relates to account, usage, diagnostic and operational data and does not permit us to use customer meeting content for model training or independent product development.
We also rely on legal obligations under Article 6(1)(c) for accounting and lawful requests. We do not carry out automated decision-making with legal or similarly significant effects under Article 22 GDPR.
7.AI#
DstnyIQ uses AI models hosted in Microsoft Azure to transcribe audio and generate summaries.
AI output can be wrong. Transcripts and summaries can mis-hear words, misattribute speech, omit material and state things that were not said. Treat them as an aid, not as a record of what was said, and verify before relying on them.
Content is not used to train models. Meeting content sent for AI processing is used to return a result and is not used by us or by our providers to train or improve any model.
Microsoft’s abuse monitoring. Microsoft operates automated abuse detection on the Azure OpenAI Service. Content flagged by Microsoft’s abuse-monitoring systems may be stored and made available to authorised Microsoft personnel for human review in accordance with Microsoft’s then-current Azure service terms and privacy documentation, so that misuse of the service can be detected and prevented.
Content that is not flagged is not retained for this purpose. Because our Azure OpenAI deployments are located in the European Economic Area, any Microsoft personnel who carry out such a review are also located in the European Economic Area. This monitoring is Microsoft’s own and is limited to detecting misuse.
9.Where data is held, and transfers#
The service is hosted in Microsoft Azure in the European Union, and meeting content is stored and primarily processed in the EU. Recordings, service data and AI summarisation are currently handled in Sweden Central, and AI transcription in West Europe (Netherlands). We may change EU regions as capacity requires.
Where Microsoft’s abuse-monitoring process results in human review, flagged content may be accessed by authorised Microsoft personnel located within the EEA, as described in section 7.
Your Teams meeting itself runs in Microsoft’s infrastructure under your own agreement with Microsoft.
Where personal data is transferred outside the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses with supplementary measures, or another valid transfer mechanism. This may apply to controller-side data, such as support tooling, rather than meeting content. Request a copy of the safeguards at info@capacit.com.
10.Retention and deletion#
Meeting content is the customer’s, and the customer sets the period. Recordings, transcripts and summaries are retained for the period agreed with the customer organisation in its agreement with us, and are deleted when that period ends or when the customer instructs deletion.
Where nothing else is agreed, our default is up to 30 days from the date of the meeting - for the recording, the transcript and the summary alike. Deletion takes effect in active systems within 7 days of the retention period ending or of a customer’s instruction.
When a customer’s agreement ends, we delete or return their meeting content in accordance with the data processing agreement, unless we are legally required to keep it.
Account, licensing and configuration records are retained for the duration of the customer relationship and thereafter only for as long as necessary to close the account, comply with legal obligations, or establish, exercise or defend legal claims. Relevant contractual and customer relationship records may generally be retained for up to three years after termination.
Billing and accounting records are retained for five years from the end of the financial year to which they relate, as required by the Danish Bookkeeping Act. Operational logs and diagnostics are retained for up to 90 days.
11.Security#
We protect customer data with technical and organisational measures appropriate to the risk. These include encryption in transit and at rest, identity-based access control with access limited to personnel who need it for their role, segregation of each customer’s content, integrity verification and short-lived access links for stored recordings, and centralised logging and monitoring.
Our full technical and organisational measures are set out in the applicable data processing agreement, which customers may request from their provider. No system is perfectly secure.
Where we act as processor or sub-processor, we notify the relevant customer or partner through which the service is supplied without undue delay after becoming aware of a personal data breach and assist with applicable notification obligations. Where we act as controller, we notify the competent supervisory authority and affected individuals where the law requires it.
12.Your rights#
Depending on the circumstances and the applicable legal basis, you may have the right to access your personal data, correct it, have it erased, restrict or object to processing, obtain portability, and withdraw consent where processing relies on it.
Where to send the request depends on who controls the data. For meeting recordings, transcripts and summaries, that is the organisation that organised the meeting - send it to them. If you send it to us we will forward it via our partner where applicable, confirm we have done so, and assist as the applicable data processing agreement requires, but we cannot decide it ourselves.
For data where we are controller - your business contact details, account records, support correspondence - write to info@capacit.com. We respond without undue delay and in any event within one month. Where permitted by law, this period may be extended by up to two further months, and we will inform you of any extension within the initial one-month period. We may need to verify your identity.
Complaints. You are welcome to contact us first, and you also have the right to lodge a complaint with a supervisory authority - in Denmark, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, datatilsynet.dk - or with the authority where you live or work.
13.Changes#
We may update this policy as the service develops. The “Last updated” date changes, and where changes are material we notify customers in advance. The current version is always at https://capacit.com/dstnyiq/privacy.
14.Contact#
Capacit A/S, Overgaden Neden Vandet 9A, 1414 Copenhagen, Denmark.
Privacy and data subject requests: info@capacit.com. Inappropriate AI-generated content: info@capacit.com. Security: info@capacit.com. Support: info@capacit.com.
Both documents