EU data

GDPR at RecordX

RecordX is designed to align with the General Data Protection Regulation (Regulation (EU) 2016/679). This page describes what that means in practice: where data lives, how we honor data subject rights, our lawful basis for processing, and how to sign a Data Processing Agreement.

Data location

All recordings, transcripts, summaries, and account data are stored in the European Union - specifically AWS eu-central-1 in Frankfurt, Germany. We do not copy recordings across regions. EU/EEA data stays in the EEA for storage and primary processing.

RecordX is operated by HRD, based in Israel. Israel holds an EU adequacy decision, so operational access to EU data from Israel does not require Standard Contractual Clauses under Article 46. For any sub-processor located outside the EU/EEA that is not covered by adequacy, we rely on the appropriate Article 46 mechanism.

Your rights under GDPR

Right of access (Art. 15)

Every recording, transcript, and summary tied to your account is available for you to view and export from the app. For structured exports beyond the app, email us.

Right to rectification (Art. 16)

Update your account details from Settings. For content corrections, edit or delete the item.

Right to erasure (Art. 17)

Delete individual recordings from the app. Delete your entire account from Settings, Account, Danger Zone. All personal data is permanently deleted within 30 days.

Right to portability (Art. 20)

Export your transcripts and summaries in a machine-readable format from the app.

Right to restrict / object (Art. 18 / 21)

Contact us at security@recordx.io to restrict specific processing or object to a lawful-basis processing activity.

Right to lodge a complaint (Art. 77)

You may lodge a complaint with your local supervisory authority. In Israel, that is the Privacy Protection Authority (הרשות להגנת הפרטיות).

Lawful basis

  • Performance of contract (Art. 6(1)(b)) - for account data, audio processing, transcription, summaries, and billing.
  • Consent (Art. 6(1)(a)) - for recording third parties (obtained by the recording user before each call - see the Combined Agreement).
  • Legitimate interests (Art. 6(1)(f)) - for fraud prevention (Recital 47 recognises this as a legitimate interest), balanced against your rights.
  • Legal obligation (Art. 6(1)(c)) - for billing record retention required by tax law.

What we do not do with your data

  • We do not sell personal data.
  • We do not use your audio, transcripts, or summaries to train AI models.
  • We do not share your content with other customers.
  • We do not use ad-tracking cookies or share behavioral data with advertising networks. We use a third-party product-analytics processor for opt-in analytics and anonymized session replay (see sub-processors below).

Sub-processors

RecordX uses vendors under data processing agreements. The main ones:

  • AWS (Frankfurt) - hosting, storage, managed identity, KMS.
  • Meeting-bot provider - used only when you ask RecordX to send a bot to a Google Meet, Zoom, Microsoft Teams, or Webex call.
  • Payment processors (Creem, Google Play, PayPal) - for billing only; we do not store card numbers.
  • PostHog (EU cloud, Frankfurt, Germany) - product analytics and anonymized session replay. Receives page URLs, click / form interactions, coarse device and browser info, an anonymous device ID, and - once you sign in - your account ID and email. Input fields are masked in session replays. Recordings are retained for 30 days. DPA: posthog.com/dpa.

The full sub-processor list is available on request.

Product analytics

We use a third-party product-analytics processor (named in the sub-processors list above, along with a link to its DPA) to understand how the product is used and to record anonymized session replays for debugging. Data is hosted in the EU (Frankfurt). The processor receives: page URLs, click / form interactions, coarse device and browser info, an anonymous device ID, and - once you sign in - your account ID and email. Input fields are masked in session replays. Recordings are retained for 30 days.

Analytics and session replay only run after you click "Accept" in the cookie-consent banner shown on our marketing pages, or tap "Accept" in the in-app analytics consent screen shown on first launch of our mobile apps. If you click "Reject" - or if your browser sends "Do Not Track" (Safari) or "Global Privacy Control" (Firefox, Brave, DuckDuckGo, Chrome extensions) - the banner is auto-rejected and no analytics data is collected. You can change your choice at any time via "Manage cookies" in the footer on the web, or in Settings > Privacy > Analytics in our mobile apps.

Session replay is web-only; mobile apps send product-analytics events but no session recordings.

The processor is a GDPR-compliant subprocessor operating within the EU. A Data Processing Addendum under GDPR Article 28 is in place.

Data Processing Agreement

If you are an EU controller and need a DPA with RecordX as processor under Article 28, email legal@recordx.io with subject "DPA request". We use a standard template that references SCCs where applicable.

Data breach notification

In the event of a personal data breach as defined by Article 33, we will notify the relevant supervisory authority within 72 hours where required, and affected data subjects without undue delay when the breach is likely to result in a high risk to their rights and freedoms (Article 34).

Data Protection contact

For all data protection questions and data subject requests, email security@recordx.io. We respond within 30 days as required by Article 12.

Related reading: Security overview, Compliance overview, SOC 2, HIPAA, Privacy Policy.

Try RecordX free