1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on this website, on the Coviqo platform (web app and desktop app) and on the status page is:
Dennis Albert (private individual / sole trader)
2 Rue de Carignan, Bouneweg-Süd Luxembourg
1315 Luxembourg
Luxembourg
E-mail: [email protected]
We are established in Luxembourg. The GDPR and Luxembourg data protection law apply, in particular the Law of 1 August 2018 on the organisation of the National Data Protection Commission. The competent supervisory authority is the authority named in section 35.
2. Data protection contact
We have not appointed a data protection officer because the statutory requirements for one (Article 37 GDPR) are not met. For questions about data protection and to exercise your rights, please write to the address above or by e-mail to [email protected]. You can also use our privacy request form.
3. Overview, definitions and principles
This Privacy Policy explains which personal data we process when you visit our website or the status page, contact us or use Coviqo – in the browser, in the desktop app, as a guest, by phone or as a person who communicates with Coviqo users –, for which purposes and on which legal basis, how long we keep data and which rights you have.
The terms used have the meaning given in Article 4 GDPR. “Personal data” means any information relating to an identified or identifiable natural person, such as a name, e-mail address, IP address, voice or content you write. “Processing” means any operation performed on such data, e.g. collecting, storing, transmitting or erasing. The “controller” decides on the purposes and means of processing; a “processor” processes data on behalf of and on the instructions of the controller.
Coviqo is a platform for communication and collaboration. People and organisations create spaces in it (workspaces of companies, communities, clubs or personal spaces) that consist of rooms with chat, voice and video rooms, meetings, files, notes, tasks, events and further modules. Which features are available in a space depends on the plan and on the settings chosen by the space’s administrators. This policy describes all features; for you, only what you or the spaces you belong to actually use applies.
The following principles apply to all processing:
- We use no tracking or advertising tools, create no usage profiles for advertising and do not sell data. We measure the audience of our public website only without cookies and in aggregated form with Plausible Analytics (section 6); there is no audience measurement in the app.
- The platform is operated in data centres in the European Union. Where providers outside the EU are exceptionally involved, we say so at the relevant place and in section 32.
- All AI features (speech recognition, translation, speech output, summaries and the language model) run on servers we operate ourselves. We do not pass your content to external AI providers and do not use it to train AI models.
- Content in spaces is stored encrypted, each space with its own key; individual conversations and rooms can additionally be end-to-end encrypted (see section 10).
4. Hosting, infrastructure and backups
Coviqo runs on servers in data centres in the European Union, currently in Germany. For this we use the following hosting providers, who act on our behalf under Article 28 GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner | Hosting / Rechenzentrum | EU (Germany) |
We process all platform data on this infrastructure – the database, files, recordings, the media servers for voice and video, the telephony connection and the services for speech recognition, translation, speech output and the language model of the AI features. The legal basis is Article 6(1)(b) GDPR where the processing serves the performance of the contract with you and otherwise our legitimate interest in secure and reliable operation (Article 6(1)(f) GDPR).
Cloudflare. In front of our website, the web app and the status page we use the Cloudflare service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a reverse proxy, content delivery network, load balancer and to protect against attacks (e.g. DDoS). Requests to these addresses first pass through Cloudflare’s globally distributed servers: TLS encryption ends there, the request is checked and forwarded to our servers encrypted again. Cloudflare processes your IP address, the request metadata (e.g. time, requested address, browser identifier, approximate country of origin) and – solely for forwarding – its content including cookies. Voice and video connections (media streams and TURN) and phone calls do not pass through Cloudflare. Cloudflare acts as our processor; for the transfer to the USA see section 32. The legal basis is our legitimate interest in secure, fast operation protected against attacks (Article 6(1)(f) GDPR).
Backups. We back up the platform daily. Backups are encrypted before they are stored; backup copies at a further location are only stored encrypted and only in the EU. We keep at most seven daily, four weekly and twelve monthly backups; every backup is deleted no later than 400 days after it was created. Data that you or we delete therefore also disappears from the backups after this period at the latest. The legal basis is Article 6(1)(f) GDPR (recovery after incidents) in conjunction with Article 32 GDPR.
5. Server log files, security and operations
Each time our website is accessed and with every request to our servers, data is automatically stored in server log files: the shortened IP address (IPv4 to /24, IPv6 to /48), date and time, the requested address without parameters, the HTTP status code and the user agent sent by the browser (browser type, version, operating system). We process this data to ensure the operation and security of our systems, to analyse errors and to fend off attacks. The legal basis is Article 6(1)(f) GDPR. We delete server log files after 14 days at the latest unless longer retention is required to investigate a specific security incident; in that case we delete them once the investigation is complete.
The logs of our application contain no IP addresses, no e-mail addresses and no content; these are automatically removed or masked before writing. We keep operational logs for no more than 30 days and security-relevant operational logs (e.g. sign-in events, permission changes) for no more than 400 days.
Security events. We store security-relevant events (e.g. failed sign-ins, exceeded request limits, sign-ins from a new country, blocked devices) with the full IP address for 30 days to fend off attacks; after that the IP address is shortened, and after 180 days the events are deleted. The legal basis is Article 6(1)(f) GDPR.
Voice connection diagnostics. To fix dropped connections in voice rooms, meetings and calls, we store per connection the time and type of the event (join, leave, drop), duration, reason, the media server used, browser or app version and operating system as well as a summary of the network quality (connection type, round-trip time, packet loss) – without IP addresses and without content. We delete this data after 30 days, and immediately when you delete your account (Article 6(1)(b) and (f) GDPR).
Error logs. If an unexpected error occurs in our application (server, web app or desktop app), a technical error report (type of error, error message, code location, version) may be sent to our self-hosted error tracking. Before sending, e-mail addresses, access keys and content are removed; the reports contain no reference to your account and no IP address. They are stored exclusively on our own servers and deleted after 30 days. The legal basis is Article 6(1)(f) GDPR (stable and secure operation).
Status page. Our status page shows whether Coviqo is available. It sets no tracking cookies, uses no analytics tools and loads no third-party content. Only if you explicitly choose a language does a functional cookie (status_lang, lifetime 1 year) store that choice. The status service determines the state through regular technical checks of our own services; no user data is processed for this. In addition, a technical monitor account checks typical flows (sign-in, message, file, connection set-up) in an internal area; the test content is deleted after one day. The feeds offered (RSS, Atom, JSON) contain no personal data. The legal basis is Article 6(1)(f) GDPR (information about the availability of our service).
If we offer e-mail notifications on the status page and you subscribe, you only receive messages about incidents and maintenance after confirming a link (double opt-in). For this we store only your encrypted e-mail address, a check value to detect duplicate sign-ups, the language, the selected features and the timestamps – no IP address, no open or click tracking. We delete unconfirmed sign-ups after 48 hours and the entry immediately when you unsubscribe (link in every e-mail); after repeated delivery failures the entry is deactivated and deleted 30 days later. To send these e-mails we currently use Google’s e-mail service (Gmail; Google Ireland Limited, Dublin, Ireland), which processes the e-mail address and the content of the message; a transfer to the USA is possible (see section 32). The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing.
6. Website, audience measurement, contact and demo requests
You can send us enquiries or request a demo using our contact form. We process the type of enquiry, your name, e-mail address, company, team size, intended use and your message. We store the enquiry to handle it, reply by e-mail and send you an acknowledgement of receipt. The same applies if you e-mail us directly.
The legal basis is Article 6(1)(b) GDPR where your enquiry aims at concluding or performing a contract and otherwise our legitimate interest in answering enquiries (Article 6(1)(f) GDPR). We keep enquiries for 12 months after receipt unless a contract results from them; otherwise the periods for contract data apply. To prevent abuse we store only an encrypted check value (HMAC) instead of your IP address. We protect public forms with a self-hosted computational puzzle in the browser (ALTCHA, see section 29).
Cookieless audience measurement with Plausible Analytics
On the pages of our public website – not in the web app, the desktop app or in spaces – we use Plausible Analytics, a service of Plausible Insights OÜ, Estonia, which acts as our processor (Article 28 GDPR) and processes the data on servers in the European Union. When you open a page, your browser loads a small script from Plausible and transmits the address of the page, the referring page (referrer), the screen width, the browser identifier (user agent) and – for technical reasons – your IP address.
Plausible sets no cookies and stores no data or identifiers in your browser or elsewhere on your device. Your IP address is not stored: it is only used, together with the browser identifier, to create a check value (hash) that changes daily, and to determine the country or region; it is then discarded. The daily value only allows visits on the same day to be counted together; it becomes useless after 24 hours because the random value used to create it is deleted. No usage profiles are created, there is no recognition across websites or devices and no link to your Coviqo account. We only receive aggregated statistics (e.g. number of visits and page views, pages visited, referring sites, countries, browsers, operating systems and device types).
We use these statistics to understand which content of the website is in demand and to improve the website. The legal basis is our legitimate interest in data-minimising audience measurement (Article 6(1)(f) GDPR); you can object to this as described in section 34 or prevent the script with a content blocker in your browser. As no information is stored on your device and no information already stored there (such as cookies or identifiers) is read, we do not ask for consent under Article 4(3) of the amended Luxembourg Law of 30 May 2005 for this and do not show a cookie banner.
7. Live demo
The live demo lets you try Coviqo without registering. You use a shared, read-only demo access; no personal details are required. A demo session ends after 60 minutes at the latest. Only the technically necessary data is processed (server log files and a session cookie, see section 5 and section 24). The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in demonstrating Coviqo to interested parties and protecting the demo against abuse.
8. Registration, account and profile
When you create and use an account, we process:
- e-mail address, username and display name;
- your password exclusively as a cryptographic hash;
- voluntary profile details such as your profile picture;
- language, time zone and your settings;
- the TOTP secret (encrypted) if two-factor authentication is enabled;
- session data (shortened IP address, approximate location at country level, device or browser, the app’s random device identifier, time of sign-in) shown to you in device management; we do not store the full IP address for sessions;
- if you trust a device for two-factor sign-in (“trust this device for 30 days”): a check value of the device token, browser and operating system, shortened IP address, country and timestamps;
- the versions of the terms and the privacy policy you accepted, with timestamp, type of acceptance and an encrypted check value (HMAC) of your IP address as evidence.
We need this data to provide your account, sign you in and perform the contract (Article 6(1)(b) GDPR). We also process session data and security features to protect your account and prevent abuse (Article 6(1)(f) GDPR). Storing the accepted contract versions serves as evidence of the conclusion of the contract and of your acceptance (Article 6(1)(b), (c) and (f) GDPR).
Minimum age. Coviqo is intended for people aged 16 and over. Anyone younger may not create an account. Communities marked “18+” may only be used by adults (see section 19).
Data export and account deletion. At /settings/account you can request a copy of the data stored for your account at any time as an encrypted ZIP archive (overview in PDF format with the information under Article 15 GDPR, machine-readable JSON files and your own files; Articles 15 and 20 GDPR). We send the download link by e-mail; the archive is deleted after 7 days. You can also delete your account there. As long as you still own a space, you must transfer or delete it first. After the deletion request your account is deactivated immediately, all sessions are ended, and after 14 days it is deleted permanently; until then you can cancel the deletion by signing in again. On permanent deletion we remove your account data, your personal space including files, sessions, linked sign-in providers, push addresses and notifications. Posts in other people’s spaces remain – depending on the space’s settings – under the name “Deleted user” without reference to you, or are deleted; log entries keep only a pseudonymous identifier. Data subject to statutory retention obligations (in particular invoices and contract documents) is deleted only once those obligations expire (Article 17(3)(b) GDPR, see section 33). If your account is managed by an organisation, its deletion period applies (30 days by default).
Extended profile
In addition to your display name and profile picture you can voluntarily add further profile details: pronouns, a short bio, profile banner and accent colour, job title, department, location, working hours and time zone, languages, up to five links and community details (e.g. interests, skills, favourite games, highlighted badges and roles, verified connections to sign-in providers). None of these details is required to use Coviqo; please only add details you want others to see. For each field you decide under Settings → Profile → Privacy who may see it: all signed-in people who can open your profile, only people from shared spaces, only your organisation or only you. The default is shared spaces (job title, department and teams: your organisation). Your profile page can only be reached by signed-in people, is not indexed by search engines and is never publicly accessible on the internet. We check links in your profile against known short-URL, tracking and phishing patterns; new profile and banner images are scanned for malware.
If your account is managed by an organisation (e.g. via single sign-on or SCIM), it can provide your job title and department from its directory service and lock them against changes; the details then come from the organisation, which is responsible for their accuracy. Colleagues in the same organisation can find you by job title and department unless you set the field to “Only me”.
Space identities. In each space you can set your own display name, profile picture, pronouns, short description and status. Only members of that space see these details. A space identity separates how you appear; it does not make you anonymous: your username and account identifier stay the same across the platform; in spaces of organisations, their owners and administrators can see the account name behind a space name, and we see both where this is necessary to prevent abuse or to comply with legal obligations. We store notification “worlds” and schedules to control your notifications as you wish.
Presence and status. Other people in shared spaces and your contacts see whether you are online, away or busy, as well as a status you set yourself. If you have connected a calendar, your status can automatically show “In a meeting” during an event marked as busy – the event title only if you choose so; you can switch this off under Settings → Calendar. Presence is stored only transiently.
Contacts. You can add other people as contacts, send contact requests, “nudge” someone and use read receipts in direct messages. For this we store contact pairs, requests (sender, recipient, status, timestamps – without message text) and your related settings. Declined requests block a new request for 7 days.
We process profile details, space identities, presence and contacts to provide the service (Article 6(1)(b) GDPR); checking links and images and handling reports serve to prevent abuse and protect users (Article 6(1)(f) GDPR). Our trust & safety team reviews reported profiles using a snapshot of the details the reporting person could see; it can reset inadmissible details. Your profile details are part of your data export and are deleted with your account.
10. Content in spaces, rooms and direct messages
When you use Coviqo, we process the content you and other members create: messages with replies, threads, mentions, reactions and attachments, voice and video messages, forum posts, files, notes, documents, tasks, events, decisions, polls, approval requests, support tickets (with internal notes of the ticket team), whiteboards and the associated metadata (e.g. author, time, space and room). We also process your memberships, roles and permissions to control who may see and edit which content, and we index content in encrypted form so that authorised people can search it. We scan uploaded files for malware.
The processing is necessary to provide the service (Article 6(1)(b) GDPR). Content is visible to the people who have access to the respective space or room. We store content until authorised people delete it, until a retention period set by the space expires or until the space is deleted. Deleted files, messages, notes, whiteboards and tasks remain in the bin for 30 days and are then removed permanently; deleted spaces including all content and files are also removed after 30 days. We delete message reminders you set 7 days after they were sent.
Images from other websites in messages and texts as well as external profile pictures are not loaded by your browser but by our server via our own image proxy – without your IP address, cookies or referrer – and cached for up to 24 hours; space administrators can switch external images off entirely. You edit office documents with a document server we operate ourselves; while you edit, the content is held there in a cache.
Voice and video messages
We store voice and video messages like other attachments (encrypted, same retention and deletion as the message); in addition we store the length and a rough level curve for display, from which speech cannot be reconstructed. If the space allows AI transcription, our self-hosted speech recognition creates a transcript that is stored encrypted with the message and can be searched; for video messages our language model can additionally create chapters and a short summary, labelled as AI-generated. If you have objected to the transcription of your voice (Settings → Privacy), your voice messages are not transcribed. A video message can show your image, your screen and people around you – please pay attention to what you record.
Direct messages, people search and usernames
We process direct messages (1:1 and small groups) like messages in rooms: content, attachments (including virus scanning), reactions, read status and participants. They are only visible to the participants and are stored encrypted with a separate key per conversation. You decide under Settings → Privacy who may message you (everyone, people from shared spaces, contacts or nobody), who may call you and whether others can find you by your username; blocked people cannot message you. People search shows only username, display name and profile picture, never your e-mail address. If you change your username, the old name stays reserved for you for 30 days; we log the change to prevent abuse.
Calls from direct messages run over our media servers like other calls (see section 12); they are neither recorded nor transcribed. We store only metadata (who called whom, status, start, end, duration, video yes or no) and delete it after 180 days. Direct messages are never included in AI summaries or “Ask the space”. Our trust & safety team reviews reported direct messages and only sees the reported content.
Direct messages are part of your data export. If you delete your account, your direct messages are deleted; conversations without remaining participants are removed completely. If all participants of a conversation are managed by the same organisation, that organisation is responsible for the conversation and its retention rules and policies apply. The legal basis is Article 6(1)(b) GDPR and, for blocking, reports and abuse prevention, additionally Article 6(1)(f) GDPR.
End-to-end encryption
Any participant can switch a direct-message conversation to end-to-end encryption; on plans from Business, rooms can be end-to-end encrypted as well. Messages, attachments, voice messages and calls are then encrypted and decrypted on the participants’ devices. We only store encrypted content, your public keys, the list of your devices (name, timestamps), keys wrapped for the devices and a key backup encrypted with your recovery key, which we cannot read. Notifications then contain no text; server-side search, AI features, link previews, clips, live broadcasts and the virus scan of attachments are not available. We still process metadata (participants, timestamps, group name, call metadata). So that you can search encrypted messages, the app keeps an encrypted search index on your device; it never leaves the device and is deleted when you sign out or remove the device. Encryption of a conversation only ends if all participants agree; earlier messages then remain end-to-end encrypted. We record who switched encryption on, requested to end it, agreed or declined, with the time (no content), in the audit log. Organisations can switch end-to-end encryption off for the accounts they manage. Your data export contains such content in encrypted form; if you lose all your devices and your recovery key, we cannot recover it. The legal basis is Article 6(1)(b) GDPR.
Custom invite links, space directory and public preview
Spaces on paid plans can set up their own invite link (e.g. join.coviqo.com/name). The corresponding page is public, is not indexed by search engines and shows only public details of the space (name, icon, banner, description, member count) – and only if the space allows the public preview. Communities can also list themselves in a directory that is only shown to signed-in people and whose entries we review before publishing; it contains only details of the space, no details of members. We count views, joins and join requests only as daily totals per link, without personal data. If you send a join request, the people responsible for the space see your display name and profile picture; the request is deleted with your account. The legal basis is Article 6(1)(b) GDPR and, for abuse protection and reports, Article 6(1)(f) GDPR.
Public embed of spaces (“website embed”)
The people responsible for a space can switch on a public embed (off by default) to show information from the space on their own website. The data is then made available through a public interface without signing in and without cookies and can be retrieved by anyone on the internet – including search engines and archives that may store it permanently. Only the following is published:
- public information about the space (name, description, icon, banner, number of members and of members currently online);
- messages from at most three chat rooms that the people responsible for the space have expressly released – with the display name and profile picture of their authors in this space, time and text; mentions of other people are shown as names. Only rooms that every new member can see anyway can be released; end-to-end encrypted content, thread replies and system messages are never published;
- if the people responsible switch this on, images and videos shared in these rooms; they are only delivered through short-lived signed links (valid for five minutes);
- if the people responsible switch this on, the number of people in voice rooms. Names and profile pictures of people in voice rooms only appear if the person has expressly agreed to this in their profile for this space (“Show my name in the public voice channel widget”); otherwise they appear anonymously. You can withdraw this consent at any time with effect for the future; it ends automatically when you leave the space.
Identifiers of people (user IDs, e-mail addresses, roles) are not published. Recipients are everyone who calls the interface or a website that embeds it; the people responsible for the space decide which websites may load the data in the browser – server-side retrieval is, however, possible for anyone. Responses are cached for up to 60 seconds (voice rooms 15 seconds), also in browsers and third-party caches; deleted or edited content therefore disappears from the interface with a short delay but may remain with third parties who already retrieved it. To prevent abuse we limit the number of requests per IP address; for this the IP address is processed in a counter for at most one minute and otherwise logged as described in section 5.
The legal basis for publishing space information and messages is our legitimate interest and that of the people responsible for the space in presenting their community publicly (Article 6(1)(f) GDPR); for names and profile pictures in the voice channel widget your consent (Article 6(1)(a) GDPR); for limiting requests Article 6(1)(f) GDPR. The people responsible for the space decide which rooms are published (see section 11). You may object to the publication of your messages under Article 21 GDPR; please contact the people responsible for the space or us.
Share links
If you share a file, a note or a result via a share link, the people to whom you give the link (and, where applicable, the password) can see the content until the link expires, even without an account. You are responsible for passing on the link.
11. Roles: Coviqo as controller and as processor
When companies, clubs or other organisations use Coviqo, the organisation decides on the content in its spaces and on which features are switched on there (e.g. recording, transcription, AI features, attendance reports, telephony, integrations). The organisation is the controller for this content and these features; we process the data as a processor under Article 28 GDPR solely on its instructions. Business customers conclude a data processing agreement with us for this, which they obtain in the organisation settings or on request at [email protected]. Please address questions about the processing of this content to the respective organisation first; we forward requests we receive to it.
We remain the controller for your account, sign-in, billing of our plans, the security and operation of the platform, the handling of reports (trust & safety) and for the use of Coviqo outside organisations (e.g. personal spaces, direct messages between private individuals).
In communities run by private individuals, the person administering the space sets the rules and features of the space; we provide the platform and process the data to perform our contract with the members. People who start recordings, clips or live broadcasts in a space, or who export content or send it to third parties, are themselves responsible for that action.
Organisations can export their space completely at any time. If our support staff access an organisation’s data in the course of a support request or to fix a fault, this is logged and shown to the organisation in its space’s audit log.
12. Voice and video communication
Voice rooms, meetings, webinars, calls, screen shares and intercom channels use WebRTC. The media streams are relayed via self-hosted media servers (LiveKit) on our own infrastructure and transmitted encrypted with DTLS-SRTP. We process your audio and video signals, your screen content (when sharing), technical connection data such as IP address and connection quality and the information who joined a room, meeting or call and when. Audio and video content is not stored unless a recording is started. Coviqo only gets access to camera, microphone and screen with your permission in the browser or operating system. We store your selected devices and settings locally on your device. The legal basis is Article 6(1)(b) GDPR.
Camera effects and presentation mode. Background blur, virtual backgrounds and light correction are computed exclusively on your device; only the finished image is sent to the media server. Your browser loads the required library and detection model (MediaPipe) from our own servers when you first switch them on; no third parties are involved. Background images you upload, and background images provided by space administrators, are stored – after a virus scan – under an address that cannot be guessed in our storage in the EU until you or the administrators delete them or the account or space is deleted. In presentation mode the app places your camera image over your own screen share; for this it switches your camera on even if you had switched it off in the call, and your image is then visible to everyone as part of the share, including in recordings and live broadcasts.
Drawing on shared screens. Drawings on a screen share are only exchanged between the participants’ devices and are not stored. If a participant saves a snapshot (image of the share with the drawing) or shares it in the call’s chat, it is stored like a chat attachment; it can show content of the shared screen.
Remote control of screen shares. On plans from Business, a person in a call can ask to control a screen you share with the desktop app (Windows). Only once you choose “Allow” in a dialog of your operating system are this person’s mouse and keyboard inputs sent to your desktop app over the encrypted call connection and carried out there; we do not store these inputs. You can end the control at any time; it ends automatically after 2 minutes without input and after 60 minutes at the latest. We log start and end (who controlled whose screen in which call, timestamps, duration, reason for ending) without content in the audit log (Article 6(1)(f) GDPR – security and accountability).
Intercom and listen-in. Intercom channels let you speak short announcements into other rooms. On plans from Business, a room’s administrators can also allow “listen-in” (off by default): authorised people can then hear a room’s audio without joining it. Everyone in the room sees who is listening in and hears a tone when it starts; guests, meetings and direct messages are excluded, and no recording can be made while someone is listening in. Only audio is transmitted and nothing is stored; we log start and end in the audit log.
Map rooms. In rooms with a map we process your position on the map while you are connected to it, to show it to everyone who may see the room – including people who are not in the call – and to mix the sound by distance. We store only the latest position and delete it when you leave, after 12 hours at the latest; we do not create movement logs. Map rooms are not end-to-end encrypted.
Room devices. Organisations can connect conference room devices (e.g. a screen with a camera in a meeting room) to Coviqo. The device joins meetings with camera and microphone; everyone in the physical room can then be seen and heard in the meeting. For the device we store name, location, seats, time zone, the time of the last connection, the shortened IP address, platform and technical status data (e.g. number and names of connected cameras and microphones). The device shows the room’s daily schedule with meeting titles and the names of the organisers. The organisation is responsible for informing people present about the device.
Voice regions. By default, calls run over our media servers in the EU. To reduce latency in calls with participants far outside Europe, we can use additional media servers (“voice nodes”), also operated by us, in other regions, for example the USA. A call only runs over such a voice node if we have set up that region and either the organisation or the organiser explicitly chooses it or – with automatic selection – the first person to join connects from a country assigned to that region and the organisation has allowed voice regions outside the EU (off by default). For automatic selection we use the country of origin of the request only transiently. The voice node only relays the audio and video streams of the ongoing call in real time and processes the connection data needed for this (e.g. IP addresses); it does not store call content. Accounts, chat, files, recordings, transcripts and the database remain in the EU; if a recording is made in such a region, it is buffered on the voice node only during recording and then stored in our storage in the EU. For the related transfer, section 32 applies.
13. Recordings, transcripts, translation and live broadcasts
Recordings
Meetings and calls in rooms can be recorded if the plan provides for it and the person has the permission to do so. When a recording starts, a sound plays and all microphones except that of the person who started it are muted – including those of phone participants. Your voice is only recorded once you switch your microphone back on yourself (in the app, or on the phone with *6); you can switch it off again at any time. Anyone joining during a recording sees a notice first and joins muted. Throughout the recording, the apps show all participants visibly that recording is in progress. As evidence we log which people were present when a recording or transcription started or joined during it and thus received the notice; we delete this evidence after three years.
Whoever starts a recording or organises the meeting remains responsible for ensuring that the recording is lawful and must – where necessary – inform the participants in advance and obtain their consent. The app’s notices do not replace this information. We store recordings encrypted. They can be accessed by the people who have the corresponding permission in the respective space or meeting. Recordings are kept depending on the plan (Community Pro 30 days, Business 365 days, Enterprise as agreed) and then deleted automatically; organisations and space owners can set shorter periods or delete recordings earlier at any time.
Transcription, captions and translation
Meetings can be transcribed and captioned live. Transcription uses self-hosted speech recognition (Whisper); translations use a self-hosted translation service (LibreTranslate) or our language model – in each case exclusively on our own infrastructure. Whoever creates a space decides whether meetings there are automatically transcribed and summarised. You can object in your settings to the transcription of your voice in general; your contributions are then not transcribed. Phone participants hear an announcement when a transcription is running, starts or ends. We store transcripts encrypted and delete them after 90 days by default unless the space’s administrators have chosen a different period.
Summaries, task and decision suggestions
From a meeting’s transcript, notes and chat, our self-hosted language model can create summaries, decisions, task and follow-up suggestions. Suggestions are drafts that are only published after a person has reviewed and confirmed them. Summaries can be translated automatically into each reader’s language; the translation is stored encrypted with the summary and deleted with it. Summaries remain stored as content of the respective meeting or room until they are deleted. All AI results are generated automatically, are labelled as AI-generated and may contain errors.
Voice commands (“wake words”) and markers
If the feature is switched on in the space, authorised people can create tasks, markers or decisions in a meeting with a wake word (e.g. “Coviqo, note a task …”). Commands are recognised exclusively from the transcript that is running anyway; there is no additional listening, and the feature does not work without a running transcription. We store the recognised text, the speaker, the point in the meeting and the result (e.g. a task with assignee and due date); undone commands are deleted. There are no voice commands in end-to-end encrypted rooms.
Meeting report (PDF) and summary by e-mail
Organisers can create a meeting report as a PDF and choose which sections it contains (e.g. participants with join and leave times, share of speaking time, transcript, chat, markers, follow-ups). They can also send a summary of the meeting by e-mail to selected participants, including external guests. We use the e-mail addresses only for sending; the log stores only the number of recipients. With the export or e-mail the content leaves Coviqo; the person who creates or sends the report is responsible for passing it on.
Interpretation
In meetings with interpretation channels, interpreters speak on their own language tracks; listeners choose their language. These tracks are only recorded if the meeting’s hosts explicitly switch this on (then as separate audio files next to the recording, with the same access and deletion rules). If a participant chooses “Listen translated”, the texts of the spoken contributions that are generated for captions anyway are machine-translated on our servers and read out with a neutral computer voice. Voices are not imitated; the computer voice is labelled as machine-generated. People who have objected to transcription are not translated.
Live broadcasts
Authorised people can stream meetings, webinars and stages live to a platform of their choice (e.g. YouTube, Twitch or their own server). This is a publication: picture and sound of everybody who can be seen or heard in the call go to that platform and can be watched there by the public or the audience chosen there, under that platform’s terms. Before the start a countdown with a notice appears, and all microphones except that of the person starting are muted; during the broadcast everybody sees a “LIVE” notice, and anybody joining a streamed or announced call is informed beforehand. Anybody who does not want to be seen or heard can keep camera and microphone off or leave the call. Whoever starts the broadcast, or the operator of the space, is responsible for it and for the required legal basis or the participants’ consent; the destination platform is itself responsible for its processing and may be established outside the EU. We only forward the stream and do not store it. We store the stream key encrypted and details of the broadcast (destination server, period, person who started it) in the space’s log.
Legal bases
The legal basis for providing these features is, towards the person using them, Article 6(1)(b) GDPR. Where other participants are affected, the legal basis depends on the decision of the organisation or organiser, in particular consent (Article 6(1)(a) GDPR) – for example by switching one’s microphone back on after the recording notice – or their legitimate interest (Article 6(1)(f) GDPR). In spaces of organisations we act as a processor in this respect (see section 11). We store the evidence of notices given to meet our accountability obligations (Article 6(1)(c) and (f) GDPR).
14. Further AI features
In addition to the meeting features, Coviqo offers further AI features. They use the same self-hosted language model on our servers; nothing is transferred to external AI providers. The features only see content the respective person may read anyway; end-to-end encrypted rooms and direct messages are always excluded. The results are labelled as AI-generated and may contain errors.
- Ask the space. You can ask a space’s assistant a question. It searches the content you may read (e.g. messages, forum posts, transcripts of voice and video messages, file names, tasks, notes, decisions, meeting transcripts and summaries) and gives the language model up to eight short excerpts with type, room, title, author and date. The answer names its sources, including their authors. We keep the conversation with the assistant for at most one hour; only if you choose “Save as note” is the answer stored as a note. A space’s administrators can switch the feature off; guests cannot use it.
- “What did I miss?” The overview summarises for you what happened in your spaces since your last visit (e.g. decisions, mentions, tasks, missed meetings, much-discussed topics) and can create a short AI paragraph about it. Direct messages are never included. We cache the result for at most 30 minutes and dismissed entries for 60 days.
- Short summaries and whiteboard. On request the language model summarises a thread, a video message or selected sticky notes of a whiteboard or groups them by topic. The result is only stored after your confirmation or stored encrypted with the message.
- Translations on request. You can have messages translated on request; the translation is cached encrypted.
AI processing log and privacy cockpit. So that you can see which AI feature processed content that comes from or concerns you and when, we log, without content, the feature, subject, space, day, count and the accounts concerned. You see these entries under Settings → Privacy cockpit and in your data export; we delete them after 180 days, and your identifier immediately when you delete your account. Via the cockpit you can also ask the creator and the space’s administrators to delete a clip, recording or transcript in which you appear; they learn your display name. We store the request (subject, time, status) until your account is deleted.
The legal basis for the AI features is Article 6(1)(b) GDPR (providing the features chosen by you or the organisation); in spaces of organisations we process the content on their behalf. The processing log and the forwarding of deletion requests serve transparency and the protection of your rights (Article 6(1)(c) and (f) GDPR).
15. Clips
If a room’s administrators allow clips, participants can save the last 15 to 60 seconds of a call as a clip and share it in the room, keep it private or download it. A clip contains the voices and possibly the image or screen of the people who could be heard or seen during that time. For this, the last seconds are only held in the memory of the device of the person who can save a clip; nothing is stored until they create a clip.
In rooms with clips everybody sees the notice “Clips active” before and during the call, and an explanation the first time. You can exclude at any time – for your whole account or for a room – that your voice, image and screen are captured in other people’s clips; the exclusion takes effect immediately. If your setting is not known, nothing is captured; phone participants and bots are never captured. The exclusion is enforced by the Coviqo app of the recording person; a modified app could bypass it – which would breach our terms of use. Clips are only transcribed if no audible person has objected to transcription.
We store the clip (encrypted), the recording person, the room, the time and the accounts of the people who can be heard or seen. Shared clips are visible to the room’s members and are kept and deleted like chat attachments. Downloaded clips leave Coviqo; the person who downloads them is responsible for their further use. Anyone who creates or shares a clip must respect the rights of the people captured. You can request the deletion of a clip in which you appear via the privacy cockpit (see section 14) or report the clip.
The legal basis towards the recording person is Article 6(1)(b) GDPR. Towards the people captured, we base providing the feature on the legitimate interest of the room’s administrators and the participants in capturing special moments, and we protect their interests with the visible notice and the right to object at any time (Article 6(1)(f) and Article 21 GDPR).
16. Participation, attendance and meeting statistics
Attendance per occurrence. For every meeting we store who first joined when, when the person last left and how long they took part; for phone participants only the last three digits of the phone number. Organisers see this in the participant list and in the meeting report, and you see in the “What did I miss?” overview which meetings you missed. The data is deleted with the meeting and is part of your data export.
Attendance reports and webinar registrations. On plans from Business, organisers can view attendance reports (who took part for how long, with role) and export them as CSV; participants are informed of this before joining. For webinars we store registrations with name, e-mail address, answers to the organisers’ questions, status and timestamps. We delete both after 365 days by default.
Meeting statistics. Organisers can switch on speaking-time statistics for a meeting. Before anything is counted, all participants see the notice “Speaking time is counted for the statistics”; anyone who objects is not counted for that occurrence, and seconds already counted are deleted. Per person only the total number of seconds is stored – no audio, no times of individual contributions. The organisers see the values; others only if they are shared. The data is deleted with the meeting. A personal overview of your weekly meeting time is calculated only for you and not stored.
The legal basis is Article 6(1)(b) GDPR (organising and holding the meeting) and, where organisers use reports and statistics, their legitimate interest (Article 6(1)(f) GDPR), to which you can object at any time. In spaces of organisations we process this data as a processor. If such features are used in an employment relationship, the organisation is responsible for complying with the applicable employment and co-determination rules; the data must not be used to monitor the performance or behaviour of individual employees where this is not permitted under those rules.
17. Telephony
Organisations can connect Coviqo to the telephone network: via phone numbers we provide through a telephony provider, or via the organisation’s own provider (SIP trunk). What happens to an incoming call is set by the organisation in a call flow (e.g. opening hours, voice menu, queue, ringing people or ring groups, mailbox, voice room). Authorised people can – where enabled – also call external numbers and add people by phone to a meeting or to a call from direct messages. The voice connection runs via the provider and our own media server; phone calls are not end-to-end encrypted. Phone calls are only recorded if the organisation has switched on call recording (see below); for phone participants in meetings, section 13 applies. Features that place calls into the public telephone network or record or automatically answer calls (external calls, forwarding to mobile and external numbers, callback, call recording, AI receptionist) are switched off by default; they are only available if we enable them and the organisation switches them on or uses them in a call flow. Emergency calls are not possible via Coviqo.
Telephony provider. Where we provide the phone numbers, we currently use Twilio (Twilio Ireland Limited, Dublin, Ireland; parent company Twilio Inc., USA) as the provider for the connection to the telephone network. As a telecommunications provider it processes the numbers of the parties, connection data and – in real time – the voice; a transfer to the USA is possible (see section 32). If the organisation uses its own provider, a separate contract exists between the organisation and that provider.
Meeting dial-in. If you dial into a meeting by phone, you hear an announcement and enter the meeting PIN. Your phone number is hidden from Coviqo on dial-in; other participants only see “Phone … 123” (the last three digits). A technical identifier is derived from the number. If a recording or transcription is running in the meeting, you hear a notice after the PIN; when a recording starts you are muted and switch your microphone back on yourself with *6. To protect against PIN guessing we store failed attempts briefly and temporarily block repeated failures. A PIN dialled via a phone number of an organisation only leads to meetings of that organisation.
The organisation’s call records. For each call we store direction, type, timestamps, duration, billed minutes, the organisation’s phone number used, the person who answered or dialled, the outcome and the other party’s number only in shortened form (e.g. “+49 30 •••••678”) with country and an encrypted check value. This serves billing, protection against abuse and costs (e.g. blocked premium and emergency numbers, quotas) and accountability. We delete this data after 180 days.
Personal call history, favourites and missed calls. When a call rings for you, you see the caller’s number. In your personal call history we store the other party’s full number encrypted so that you can call back; only you see the history, you can delete entries at any time, and we delete them automatically after 180 days. For a missed call to a ring group, every member gets an entry. We store favourites (at most 12) encrypted until you remove them. Notifications about missed calls and new voicemails – including push notifications – contain the caller’s number.
Ringback, announcements and mailbox. Callers hear a ringback tone until the call is answered; if nobody answers, they hear an announcement. If the called person or ring group has switched on the mailbox, callers then always hear the notice that their message will be recorded after the tone (and – if the organisation allows it – automatically converted into text). Anyone who hangs up before the tone leaves nothing. If you speak after the tone, we store your message, your full phone number, the number called, time and duration encrypted for the called person or all members of the ring group; the transcript is created by our self-hosted speech recognition and labelled as AI-generated. Messages are deleted automatically after 90 days, earlier if the recipients delete them. A personal greeting a person records is played to callers of their number and deleted when the number is assigned to another person or the account is deleted.
Calls from meetings. If you are called from a meeting that is being transcribed, you hear “This call is being transcribed.” after answering, before you are connected; you can still hang up then. No calls can be placed from a meeting while it is being recorded.
Call flows, queues and phone system. We process the caller’s input (e.g. menu keys pressed or digits entered) only during the call. With the call record we store the path taken (building blocks and outcomes, without content), waiting, hold and ringing times, transfers and average values of the connection quality between our server and the device of the person in the call (round-trip time, jitter, packet loss); digits that the call flow shows to the person answering are stored encrypted. We delete these details with the call record after 180 days. Block lists and caller lists (e.g. “VIP”) of the organisation contain phone numbers only in shortened form and as an encrypted check value. The organisation’s reports show aggregated figures (e.g. calls, waiting times, service level) per number, menu, queue and day. We store your personal settings (call forwarding, busy on busy, extension, queue sign-in) until you change them or your account is deleted; numbers that may still ring through during “Do not disturb” are stored encrypted and only you see them. A call flow can send details of the call to a service chosen by the organisation (in plans from Business and only to addresses it has approved); the full phone number is only sent if the organisation explicitly selects it in the building block. The organisation is responsible for this transfer.
Phone book, caller context, notes and outcomes. The organisation can keep a phone book (name and number stored encrypted, possibly linked to a member) until it deletes entries. When a call rings, the people it rings for see the name from the phone book, details from the call flow (e.g. a tag or entered digits) and, on request, the last calls of this number to the organisation (date, answered by, duration, outcome) as well as open tickets and missed calls of this number that they may see. The people involved in a call and the organisation’s administrators can store an outcome and a note for it (the note encrypted, editable until 7 days after the call); both are deleted with the call record after 180 days and remain until then even if the author’s account is deleted.
Missed calls for the team, tickets from calls and callback. Missed calls and mailbox messages to numbers of the organisation can appear in a shared list visible to the organisation’s administrators and the people of the number concerned – with the full phone number (stored encrypted), number and time of calls, assignment and status; we delete entries 180 days after the last call. If the organisation has set this up, a missed call or a mailbox message creates a ticket in a room of the organisation. The ticket may contain the full phone number, the mailbox message as an audio file and its AI-generated transcript; it is only visible to the room’s ticket team and is subject to the retention and deletion rules for tickets in that room – also beyond the 90 days of the mailbox. If a queue offers a callback and you choose it by pressing a key, we store your number encrypted in order to call you back as soon as someone is free; we try this for at most 24 hours and delete the entry 180 days after the request.
Queue status and wallboard. People who answer calls from queues have a status (ready, break with an optional reason, after-call work). This status and whether they are currently ringing, on a call, busy or offline are visible to the organisation’s administrators, supervisors it designates and the people of the same queue on a live overview (wallboard) with name and profile picture, together with the queues’ figures for the day. We only store the current status; changes between break and ready are logged with the break reason in the organisation’s audit log.
Forwarding to mobile and external numbers. Where enabled, you can store your own mobile number under “My mobile”; calls then ring there in parallel or as forwarding, and a meeting can call you there (“Call me”). We store the number encrypted and only you see it in full; it is part of your data export and is deleted with your account. Calls can also be forwarded to colleagues’ mobile numbers or to external numbers. The target number is called via the telephony provider for this; each such connection gets its own call record with the number in shortened form (180 days). A number of the organisation is shown as the caller, never the caller’s number. If the organisation has switched on “Confirm acceptance on mobiles and external numbers” (default), the person called hears an announcement with the organisation’s name and answers by pressing 1; this way no mobile mailbox takes the call.
Call recording and transcription. In plans from Pro, organisations can allow phone calls to be recorded (switched off by default). A recording is only possible after the parties have been informed: either the caller hears a notice before the conversation or is asked for consent (“… If you agree, please press 1. Otherwise the call will not be recorded.”), or the person in the call starts the recording and everybody in the call hears “This call is now being recorded.” (and likewise when it ends). A caller who declined is never recorded; the organisation can decide that calls are only recorded with consent. The audio of all parties is recorded; the recording ends with the call or on a transfer. We store the recording encrypted together with the shortened number, line, how it was started, consent status, the person who started it and the accounts involved. If the organisation has switched this on and its AI settings allow transcription, our self-hosted speech recognition creates a transcript that is stored encrypted and labelled as AI-generated. The organisation’s administrators and – if the organisation sets it up this way – the people involved in the call can listen to it; start, end, playback and deletion are logged in the organisation’s audit log. Recordings and transcripts are deleted automatically after the period set by the organisation (1 to 365 days, 30 days by default). The organisation is responsible for whether a recording is lawful and whether a notice is sufficient or consent is required.
AI receptionist. In plans from Business, a call flow can use an AI receptionist if we have enabled the feature and the organisation’s AI settings allow it. The caller always first hears “You are speaking with an AI assistant.” After that our self-hosted speech recognition converts the caller’s spoken answers into text, and our self-hosted language model replies, recognises the request and routes the call according to the organisation’s settings or, on request, takes a message. The conversation is limited to a few turns and at most five minutes; if the AI cannot help, the call is handed over to a person. We keep the conversation only during the call (at most 30 minutes) and do not store it permanently; a summary of the request and a message taken can – if the call flow provides for it – be passed into a ticket or a message to the organisation. In the organisation’s AI processing log we store, without content and without the phone number, the number of turns, the duration, the model used and the outcome (180 days). No data is sent to external AI providers.
Listening in, whispering and barging in. In plans from Business, the administrators of an organisation can allow (switched off by default) supervisors they designate to listen in on the organisation’s ongoing phone calls, to whisper to the person in the call so that only that person hears it, or to barge into the call. To switch this on, the administrators must confirm that the employment and data protection requirements are met (e.g. informing employees in advance, co-determination of employee representatives where applicable, informing callers, limitation to training and quality). The person in the call always sees that someone is listening in, whispering or has barged in; this indicator cannot be switched off. The organisation can also set callers to hear the notice “Please note: calls may be listened to for training purposes.” at the start. Nothing is recorded or transcribed when listening in; start, mode, end and duration (with the person in the call and the shortened number) are logged in the organisation’s audit log. The organisation is responsible for lawfulness.
Ringing on your phone and softphone. In plans from Pro, a call can also reach you by push notification on your smartphone or with the browser closed, with “Answer” and “Decline”. The notification contains the caller’s full number and the line, is valid at most until the end of the ringing phase and is closed as soon as the call no longer rings for you. You can switch this off under Settings → Notifications (“Phone ringing”) (see section 25). If you connect a headset via the device permission of your browser or the desktop app, the app only evaluates its telephony buttons on your device; device, ringtone and headset settings stay locally on your device.
Opening hours from calendars. The organisation can link opening hours to a Coviqo calendar or to the address of an external calendar (ICS); every entry in it closes the line. For this our server regularly retrieves the external calendar and stores the titles and times of the entries, which only the organisation’s administrators see; we store the calendar address encrypted. Entries may contain personal data – the organisation should use a dedicated calendar without such data.
The organisation using telephony is the controller for the call data of its users and of external callers; we process it on its behalf (Article 28 GDPR). The legal basis is Article 6(1)(b) GDPR towards the organisation’s users and otherwise the organisation’s legitimate interest in being reachable by phone and our and its interest in billing and protection against abuse (Article 6(1)(f) GDPR). A mailbox message is recorded after the caller has been informed of the recording and has decided to speak after the tone. For call recordings, listening in and the AI receptionist the legal basis depends on the organisation’s decision – in particular the caller’s consent (Article 6(1)(a) GDPR) where the caller is asked to consent to the recording, or the organisation’s legitimate interest (Article 6(1)(f) GDPR); the organisation is responsible for complying with the rules that apply to it (including employment and telecommunications law). Call data, call history, your personal mailbox messages, your telephony settings (including your mobile number and the “Do not disturb” exceptions) and details of recordings of calls you took part in are part of your data export.
18. Guests and external people
Meeting guests. If you join a meeting via a guest link, we create a temporary guest account for you. We process the display name you enter, technical connection data and your contributions in the meeting (e.g. audio, video, chat messages). If the meeting is protected by a lobby or an access code, we also process whether you were admitted. The guest account is deleted automatically no earlier than 24 hours after the meeting ends; we then remove your details, sessions and notifications. Contributions you shared in the meeting (e.g. chat messages or content of a recording) may remain in the organisers’ space. For recording, transcription and live broadcasts, section 13 also applies to you.
External guests in spaces. Organisations can invite external people (e.g. project partners) as guests into individual rooms of their space. Guests need an account with a confirmed e-mail address and only see the rooms explicitly shared with them; guest membership can expire on a date or at the end of the project and is then suspended, but not deleted immediately for accountability. Members of the inviting organisation see your display name, profile picture and the profile details visible to them; the administrators also see in an overview your company or e-mail domain, who invited you, since when and until when you have access. If your own account belongs to an organisation, that organisation can decide what you may upload or share in other organisations’ spaces.
Invited people without an account. If users invite people by e-mail to a space, meeting or webinar, we process the e-mail address and possibly the name to send the invitation and to match the person after registration.
The legal basis is Article 6(1)(b) GDPR or, if you are invited on behalf of an organisation, its legitimate interest in collaboration (Article 6(1)(f) GDPR); in that case we process the data on the organisation’s behalf.
19. Community features, player search and age
Community features. Communities can ask questions on joining (e.g. about interests), obtain agreement to their rules and offer join codes for rooms, custom emojis, stickers and soundboard sounds. We store your answers and the time you agreed to the rules until you leave, are removed or delete your account; the administrators only see totals.
Player search. In player search you can offer sessions or apply for a slot. Session entries (game, mode, rank, language, region, platform, microphone requirement, slots, start time, name of the community, 18+ flag and your space identity as host) are visible to all signed-in people on the platform while the session runs. If you apply, the host sees your account name and profile picture. You may be given guest access to the community for the session, which ends after 6 hours. Open requests expire after 30 minutes; we delete decided requests after 7 days.
18+ communities. Communities can mark themselves “18+”. To see such communities in player search or to join them, you must explicitly switch this on and confirm that you are an adult. We store this confirmation with the time in your account; no further age verification takes place. The community sets the flag itself; it is responsible for its content matching the flag.
Raid protection. To protect spaces against waves of joins, message floods from new accounts and abuse of invite links, we briefly (at most 30 minutes) evaluate account identifier, invite link, account age, a check value of the message text and the number of mentions. In raid mode, joins can be paused and messages from new members held for review; held messages are kept for at most 7 days, and decided ones are deleted without text after 30 days. The legal basis is Article 6(1)(f) GDPR (protection of the community and the platform).
For the other community features the legal basis is Article 6(1)(b) GDPR; we also store the adult confirmation to control access to 18+ communities and to be able to demonstrate this (Article 6(1)(c) and (f) GDPR).
20. Reports, moderation and trust & safety
You can report content, profiles, spaces, invite links, player-search entries and bots via the report function in the app or by e-mail. A space’s moderators handle reports about their space; our trust & safety team reviews reports of illegal content or breaches of our terms of use. We process the report (reason, your details, possibly your name and e-mail address), the reported content or a snapshot of it, the reported person, our decision and its reasons and the further communication. The reported person does not learn who reported them unless this is indispensable for handling the report or required by law. If we take action (e.g. removing content or suspending an account), we inform the person concerned of the reasons.
The legal basis is Article 6(1)(c) GDPR in conjunction with Regulation (EU) 2022/2065 (Digital Services Act) and Article 6(1)(f) GDPR (protection of users and the platform). We keep records of reports handled by a space’s moderators or by our trust & safety team outside a legal procedure for 3 years after closure. We answer requests from authorities only where we are legally obliged to do so, and document them. For notices of illegal content under the Digital Services Act and the resulting legal cases, the following also applies:
Notices of illegal content (Article 16 Digital Services Act)
If you report content to us via the notice form at /report-content, in the app or by e-mail, we process your name, your e-mail address, your explanation, the location you give, the selected category, the time of the notice and your statement that you submit it in good faith. We do not store your IP address in plain text, only as a cryptographic hash, to limit misuse and duplicate notices. Name, e-mail address and explanation are stored encrypted. The purpose is handling the notice, confirming receipt and informing you of our decision; the legal basis is Article 6(1)(c) GDPR in conjunction with Article 16 Digital Services Act. Without an account you can voluntarily confirm your e-mail address via a link in the confirmation of receipt. Notices of child sexual abuse material can be submitted without name and e-mail address. Only our trust & safety team has access. The person concerned does not learn your identity; we disclose it to authorities only on an authority’s order. We delete your name, your e-mail address and the related hashes 365 days after the decision or the closure of the case; the remaining information becomes part of the case file (see below).
Reported and affected persons
When we review reported content or take a measure, we process the content and the related metadata: the account of the person responsible with its account data, timestamps, the space and room, the context (a few messages before and after), earlier reports and stored session and log data including IP addresses, to the extent and in the form in which they are still retained under section 33. The purposes are review, blocking, preservation of evidence, the statement of reasons under Article 17 Digital Services Act, handling complaints and complying with authority orders. The legal bases are Article 6(1)(c) GDPR in conjunction with the Digital Services Act, Regulation (EU) 2021/784 (terrorist content online) and Regulation (EU) 2023/1543 (electronic evidence), and Article 6(1)(f) GDPR (preservation of evidence, establishment, exercise and defence of legal claims, protection of third parties). We process data relating to criminal offences or suspected offences only where permitted under Article 10 GDPR in conjunction with the regulations mentioned and Luxembourg law. If a measure concerns a space of an organisation, we inform its owner of the measure in their space without transmitting the content itself – except for child sexual abuse material, terrorist content or while the statement of reasons is withheld.
Preservation of evidence (quarantine)
When we block manifestly illegal content, we preserve it together with the metadata mentioned and related files, encrypted with a separate key per case and kept apart from the space’s data. Only authorised staff have access, stating a reason; every access is logged. Child sexual abuse material cannot be viewed even by staff; we delete the originals after preservation, and the preserved copy is released only as an encrypted package to authorities. The preserved copy is deleted automatically after 90 days unless an authority’s preservation or production order (initially 60 days under Regulation (EU) 2023/1543, extendable) or another legal reason (legal hold) requires longer retention; we then delete it once that reason ceases to apply. The legal basis is Article 6(1)(c) and (f) GDPR.
Case files
For each legal case we keep a case file with its history, decisions, statements of reasons, complaints, authority orders and reports to authorities. We keep it for 5 years after the case is closed so that we can prove decisions, handle complaints and legal disputes and answer requests from authorities (Article 6(1)(c) and (f) GDPR). After the 365 days mentioned above, it no longer contains the identity of notifiers.
Disclosure to authorities
We disclose personal data from notices and cases to authorities only on a legal basis – in particular to the Police grand-ducale, the BEE SECURE Stopline, the public prosecutor (Parquet), Europol and authorities that have issued an order to us. This applies to suspected criminal offences involving a threat to the life or safety of persons (Article 18 Digital Services Act), to child sexual abuse material and to authority orders. The data is transmitted as an encrypted package; it does not contain the identity of notifiers unless an authority orders this.
Restriction of access and information
Your rights under section 34, in particular the right of access and the right to be informed of a measure, may be restricted to the extent and for as long as fulfilling them would jeopardise the prevention, investigation, detection or prosecution of criminal offences or an authority requests this (Article 23 GDPR in conjunction with Luxembourg law). In that case we provide the information or statement of reasons as soon as the reason ceases to apply.
21. Watch together, music and third-party content
Some features show content from other providers. Your browser only loads this content after you have explicitly confirmed it in the respective window; before that, no connection to the provider is made. On confirmation your browser transmits to the provider in particular your IP address, browser information and the address of the content; the provider may use cookies or similar technologies and is itself responsible for this processing. If you choose “Remember on this device”, we store your decision per provider in your browser’s local storage; you can withdraw it in the player menu. The legal basis for loading is your consent (Article 6(1)(a) GDPR and Article 4(3) of the amended Luxembourg Law of 30 May 2005), which you can withdraw at any time with effect for the future.
- Watch together. In voice rooms and meetings, participants can watch videos together: videos from the space (streamed encrypted like other files) or from YouTube (Google Ireland Limited, Dublin, Ireland; player from youtube-nocookie.com) or Vimeo (Vimeo.com, Inc., New York, USA; with “Do Not Track”). Our server fetches the title and thumbnail from the provider without transmitting any of your data. We store the session state (source, title, who started it, playback position) for at most 12 hours, and start and end in the space’s log.
- Music in voice rooms. If music is included in the plan and allowed for your role, participants of a voice room can play a shared queue: audio files from the space and tracks from YouTube, Vimeo or SoundCloud (SoundCloud Global Limited & Co. KG, Berlin, Germany; via its embedded player). Anyone who wants to listen switches this on themselves; for YouTube, Vimeo and SoundCloud the confirmation described above additionally applies. Our server fetches the title and thumbnail from the provider without transmitting any of your data. We store the queue with the name of the person who added a track, skip votes and the playback position for at most 12 hours, and start and end in the space’s log. There is no music in end-to-end encrypted rooms. We store music files like other files in the space; whoever uploads or plays them must hold the necessary rights.
- Embedded content in rooms. Cards in room overviews can show embedded videos; they are only loaded after a click, and a preview is loaded by our image proxy.
- Web pages in rooms. Rooms can embed external web pages (e.g. dashboards or wikis) chosen by the room’s administrators. Your browser or the desktop app only loads such a page when you open it in the room; there is no separate confirmation as for the other third-party content. The operator of the page then receives your IP address and browser data like with any website visit, may set cookies and is itself responsible for this processing. In the desktop app, sign-ins to such pages are kept per space, separately from your Coviqo sign-in. Our server fetches the icon of a page without any data about you.
Providers established in the USA or with a parent company there may transfer data to the USA (see section 32). For details, please see the providers’ privacy notices.
22. Calendar, integrations and automations
Calendar sync. You can connect your Microsoft 365 (Microsoft Ireland Operations Limited) or Google Calendar (Google Ireland Limited) calendar to Coviqo. The connection is established exclusively at your initiative via the OAuth authorisation procedure; you decide with the provider which access you allow. We then process the event data required for synchronisation (e.g. title, time, attendees) and store the access tokens granted encrypted. You can revoke the connection at any time in Coviqo’s settings or with the provider; we then delete the access tokens.
Google user data. When you sign in with Google, Coviqo receives your name, e-mail address, profile picture and a unique identifier of your Google account (scopes openid, email, profile) and uses them exclusively to create your account, sign you in and show your name and picture in Coviqo. If you connect Google Calendar or Google Drive, Coviqo reads and writes only the events or files required for the respective feature. We store this data on the servers described in section 4 (encrypted in transit, access tokens stored encrypted) and only as long as the connection or your account exists; you can delete it at any time by disconnecting Google or deleting your account. We do not sell Google user data, do not use it for advertising, do not share it with third parties (except the processors we need for operation) and do not use it to develop, improve or train generalised AI or machine learning models. People at Coviqo only have access to it with your consent, for security reasons or because of legal obligations. Coviqo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Integrations. Spaces can connect services of other providers, in particular GitHub (GitHub, Inc., USA), Jira (Atlassian Pty Ltd, Australia, or Atlassian US, Inc.), Notion (Notion Labs, Inc., USA), Google Drive (Google Ireland Limited) and Microsoft OneDrive (Microsoft Ireland Operations Limited). Coviqo shows linked issues, pages or files in the room; for this, titles, descriptions, comments and the names and profile pictures of the accounts involved are fetched from the provider and cached for at most 60 seconds; your browser loads profile pictures directly from the provider. You make changes at the provider with your own account, which you link via OAuth at your initiative; we store the access token encrypted, for GitHub also your username and account ID. If a space connects Jira, Coviqo shows changes in linked projects as messages in the room, with the display names of the Atlassian accounts involved; for this we store the Atlassian account ID and regularly (at least every seven days) check it against Atlassian’s personal data reporting API so that names of closed accounts are removed and changed names are updated. If you take over an issue as a task, we store title, link and description like any other task. You can disconnect integrations at any time under Settings → Integrations; we then delete the token. Organisations can block integrations by policy.
Automations, bots and webhooks. A space’s administrators can create rules that act automatically on certain events (e.g. a join, a message with a keyword, an event, a task) and set up bots and approval workflows. For keyword rules the message text is checked. The run log keeps the last 100 runs per rule with identifiers only. If the administrators set up a webhook, we send event data (identifiers of space, room, person or message, type of event) signed to the address they choose; when forwarding the audit log (SIEM) this also includes the IP address and browser identifier of the acting person. The space’s administrators decide on recipient and location and are responsible for this transfer.
Bots by developers. Besides bots we operate ourselves in Coviqo (e.g. for approvals or RSS feeds, where the RSS bot only fetches the feed address), developers can offer their own bots that run on their own infrastructure; some of them are listed in a bot directory whose entries we review. If a space’s administrators add such a bot, it receives the data they explicitly allow in the permission dialog – by default commands and members’ names and roles, and with separate approval also message content, files, notes, tasks, tickets, presence, voice-room audio or transcripts, in decrypted form. The dialog names the bot’s operator, server location and privacy notice. The developer is itself responsible for its processing. If a bot listens in a voice room, everybody sees “Bot is listening”; there are no listening bots in meetings and direct messages.
The legal basis is Article 6(1)(b) GDPR or – for third parties’ data in linked services and for automations – the legitimate interest in collaboration in the space (Article 6(1)(f) GDPR); in spaces of organisations we act on their behalf. The providers named are themselves responsible for their own processing; a transfer to the USA or other third countries is possible (see section 32).
Signing in to other websites with Coviqo (“Sign in with Coviqo”)
Third-party websites and apps can offer you to sign in with your Coviqo account. Data is only transmitted after you have expressly agreed on a Coviqo page; that page shows the app, its operator and the data transmitted. As a rule the app receives an identifier that is valid only for it and – if requested – your profile (display name, username, profile picture, language) and your e-mail address.
If the people responsible for a space have expressly linked the app to their space, the app can additionally request your membership in these spaces: whether you are a member (or guest), your display name there, your roles and teams, whether you are currently timed out, when you joined, and your Coviqo user ID, which is the same for every app – the app can use it to recognise you uniquely, also across these spaces. The consent page names the spaces concerned. The app reads this information fresh on every request until you remove its access in Settings → Connected services or the people responsible for the space remove the link. If another space is linked, we ask you again. The recipient is the operator of the app, who is responsible for its own further processing. The legal basis is your consent (Article 6(1)(a) GDPR) or the performance of the service you requested (Article 6(1)(b) GDPR). The apps you connected and the spaces you shared are included in your data export.
23. Matrix bridge
A space’s administrators can connect a chat room to a room in the open Matrix network. To do so they enter a Matrix server of their choice (homeserver) and their own bot account and confirm that the room’s messages will be transferred to this server; all members see a notice about the connection in the room. Organisations can block such connections for their managed accounts.
Transferred to the Matrix server are: message text, the display name of your space identity, attachments up to 20 MB, edits, reactions, replies and deletions. Not transferred are your e-mail address, username, profile picture, presence, system messages and end-to-end encrypted content. From the Matrix server, messages can reach further servers within the Matrix network, including outside the EU; their operators are themselves responsible for their processing. If you delete a message in Coviqo, we also send a deletion to Matrix; however, we cannot guarantee that copies already transferred will be removed there – not even after your account has been deleted.
We store messages from people in the Matrix network like other messages of the room, together with their Matrix identifier, display name and profile picture address. The space’s administrators are responsible for the connection; we carry out the transfer on their behalf. The legal basis is Article 6(1)(b) GDPR or the space’s legitimate interest in communicating with the Matrix network (Article 6(1)(f) GDPR).
25. Push notifications
On request, Coviqo notifies you by push about new messages, mentions, calls, missed calls or upcoming events, even when the app is not open. In the browser a service worker is registered for this; push notifications are only activated after you have explicitly allowed them in your browser or operating system. We then store the push address generated by your device (endpoint and keys). Delivery is encrypted via the push service of your browser or operating system vendor (e.g. Google, Mozilla, Apple), which processes the push address and the time for this and may be established in the USA. For incoming phone calls the notification is only valid until the end of the ringing phase and is closed as soon as the call no longer rings for you (see section 17). The visible text of a notification (e.g. the sender’s name or – for calls – the phone number) is shown on your device; for end-to-end encrypted conversations notifications contain no message text.
The legal basis is your consent (Article 6(1)(a) GDPR, Article 4(3) of the amended Luxembourg Law of 30 May 2005). You can withdraw consent at any time with effect for the future by disabling push notifications in Coviqo’s settings or in your browser or operating system; we then delete the push address. We delete in-app notifications after 90 days.
26. E-mails
We send e-mails that are required to use Coviqo or that you have requested, in particular to confirm your e-mail address, reset your password, security notices, invitations to spaces, meetings and webinars, event reminders, notifications according to your settings, meeting summaries that other users send you and confirmations of contact requests, orders, terminations and withdrawals. We process your e-mail address, your name and the content of the message. For sending we use an e-mail service listed in section 31. In the sending log we store the recipient only masked and as a check value and delete the entries after 90 days.
The legal basis is Article 6(1)(b) GDPR; for invitations and meeting summaries by other users additionally their and our legitimate interest in collaboration (Article 6(1)(f) GDPR). We do not send marketing e-mails without your consent. You can unsubscribe from notification e-mails in your settings.
27. Payment processing
Coviqo plans. We process payments for paid plans via Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter your payment details (e.g. card number or account details) directly with Stripe; they are processed exclusively by Stripe. We receive and store a customer identifier, the selected plan, the number of seats, the billing period, the status of payments and invoices, the details required for invoicing (name or company, billing address and, where applicable, VAT identification number) and whether you order as a consumer or as a business.
The legal basis is Article 6(1)(b) GDPR and, for retaining invoices and accounting records, Article 6(1)(c) GDPR in conjunction with Article 16 of the Luxembourg Commercial Code (Code de commerce) and the Luxembourg VAT Law. Stripe is partly itself responsible for payment processing, e.g. for fraud prevention and to comply with regulatory obligations. A transfer to Stripe, Inc. in the USA may take place (see section 32). We keep documents we must retain separately in an encrypted accounting archive (see section 33); we can make accounting records available to our tax adviser and the tax authorities where necessary.
Paid memberships and tickets (only where offered). If we enable this feature, communities can sell paid memberships or tickets for events via Coviqo. The seller and your contracting party is then the respective community, not Coviqo; we only receive a platform fee. When you buy, you are redirected to Stripe; Stripe processes the payment on the community’s behalf. We store the tier or ticket type, amount, currency, status, timestamps, where applicable your confirmations (e.g. immediate start) and the identifiers at Stripe – no card or account details – to grant and withdraw the access you bought (e.g. a role, a room or an event). For a selling community’s payout account we transmit its e-mail address, country and the space link to Stripe; Stripe carries out the identity verification. We store the community’s acceptance of the seller terms (version, time, person) as evidence. The legal basis is Article 6(1)(b), (c) and (f) GDPR.
28. Desktop app
The desktop app (Windows, macOS, Linux) is a frame that loads Coviqo’s web app; the same data is therefore processed as when using it in the browser. The desktop app shows notifications via your operating system’s notification feature. It contains no analytics or tracking features; error reports are handled as described in section 5.
Updates. The desktop app regularly checks with our own server whether a new version is available and downloads it from there. We process the connection data named in section 5 as well as the app’s platform and version. The app only installs updates signed with our code-signing certificate.
Global shortcuts. Shortcuts (e.g. push-to-talk or mute) can also work while another program is in the foreground. For this the app uses the operating system’s shortcut feature and – only if you explicitly confirm this in a dialog – a keyboard monitor of the operating system that compares key presses on the device with the shortcuts you have set. Keyboard input is neither stored nor sent to us; the app only reacts to the keys you have defined.
Game activity and game overlay. If you switch on game activity under Settings → Privacy (off by default), the desktop app compares the names of running programs every 15 seconds with a list of known games and your own entries – without window titles or screen content. The list of programs never leaves your computer; only the name of the detected game is transmitted, which your contacts and people in shared spaces see in your presence while you are online. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by switching it off. If you switch on the game overlay (Windows), a small window over your games shows who is speaking in the call, your mute state, intercom, incoming calls and – if you wish – short notifications. The details come from the application that is open anyway and stay on your computer; the overlay does not appear in screen shares or recordings.
Streamer mode. In streamer mode the app hides personal details such as your e-mail address, invite links and notification content. If you choose “Automatic”, the desktop app checks the names of running programs every 15 seconds for known streaming and recording software; the check happens on your computer only. Only your setting is stored in your account.
Game clips and recordings (Windows). If you switch game clips on (off by default), the desktop app checks once per second whether a game is running in the foreground (based on window type, size and program name – without window titles or content) and, while it does, keeps the last seconds of the game’s picture and sound – optionally with your microphone, but never the voices of others from Coviqo calls – in memory. Only when you press the key is a video file saved on your computer. A recording without a game captures the screen of the active window and the computer’s sound without Coviqo’s sound. Clips and recordings only leave your computer if you share them in a room or a direct message; the rules for files then apply. Organisations can block the feature for their managed accounts; the desktop app enforces the block. Anyone who records other people (e.g. in a game) must respect their rights.
Phone and headset. The desktop app shows incoming phone calls as an operating-system notification with the phone number and the buttons “Answer” and “Decline”. The app only uses headset buttons (USB/DECT) of devices you explicitly select; it stores the selection (vendor, product and serial number of the device) locally on your computer until you disconnect the device.
For the other features of the desktop app the legal basis is Article 6(1)(b) GDPR and, for updates and their signature check, additionally Article 6(1)(f) GDPR (security of the software).
29. Data security and security incidents
We take appropriate technical and organisational measures under Article 32 GDPR to protect your data. These include in particular:
- encryption of all connections with TLS and of media transmission with DTLS-SRTP;
- encryption of stored content (messages, files, recordings, transcripts and more) with a separate key per space; end-to-end encryption on request; optionally customer-managed keys for Enterprise customers;
- storage of passwords exclusively as a hash; two-factor authentication (TOTP);
- role-based permissions in spaces and rooms;
- tamper-evident audit logs for security-relevant actions;
- shortening or pseudonymisation of IP addresses and application logs without IP addresses;
- virus scanning of uploaded files;
- logging of every support access to customer data, visible in the space’s audit log;
- device and session management with which you can view and end sessions;
- daily encrypted backups and regular restore tests.
Bot protection. We protect public forms (e.g. registration, forgotten password, contact, termination, privacy requests, guest join) with a self-hosted proof-of-work check (ALTCHA): your browser solves a small computational puzzle in the background that our server issues and verifies. No cookies are set, no usage profiles are created and no data is transferred to third parties. The legal basis is our legitimate interest in protection against abuse and spam (Article 6(1)(f) GDPR).
Security incidents. If, despite these measures, a personal data breach occurs, we document it, notify the competent supervisory authority within 72 hours where required and inform you without undue delay if it is likely to result in a high risk to your rights and freedoms (Articles 33 and 34 GDPR). If an incident concerns data we process on behalf of an organisation, we inform that organisation without undue delay. You can report security vulnerabilities to us via the channels named in our security.txt; we keep the details of such reports for 3 years after closure.
30. Legal bases at a glance
- Article 6(1)(a) GDPR (consent): push notifications; loading third-party content (YouTube, Vimeo, SoundCloud); game activity in the desktop app; status page e-mail notifications; where applicable recordings, transcriptions and live broadcasts where organisers obtain consent; names and profile pictures in the public voice channel widget, sharing your linked Discord account with the bots of a space, sharing your membership with apps when you sign in with Coviqo; recording of phone calls after the caller’s consent, where the organisation sets it up this way.
- Article 6(1)(b) GDPR (contract and pre-contractual measures): account, sign-in (including via third parties), profile, content and direct messages, voice and video communication, recordings, transcription and AI features for the person using them, guest access, community features, e-mails, payment processing, calendar and integrations, desktop app including game clips, telephony features towards the organisation’s users, contract-related enquiries.
- Article 6(1)(c) GDPR (legal obligation): retention of invoices and accounting records, evidence of notices and consents, handling of privacy requests and of notices under the Digital Services Act (including measures, statements of reasons and reports to authorities), compliance with authority orders under the Digital Services Act, Regulation (EU) 2021/784 and Regulation (EU) 2023/1543, documentation of data breaches, information to authorities where we are legally obliged to provide it.
- Article 6(1)(f) GDPR (legitimate interests): server log files, security and abuse prevention, raid protection, Cloudflare, backups, voice connection diagnostics, error tracking, status page, cookieless audience measurement of the website (Plausible Analytics), live demo, general enquiries, profile badges, clips towards the people captured, meeting statistics and attendance reports, telephony towards external callers (including call flows, phone book, missed calls, callback, listening in and the AI receptionist, where the organisation relies on it), integrations and automations, evidence of accepted contract versions, preservation of evidence and case files in legal cases, the voluntary internal complaint procedure, the public embed of spaces and limiting requests to the public interface.
Where we act as a processor for organisations, the respective organisation determines the legal basis.
31. Recipients and processors
We only pass on personal data if this is necessary to perform the contract, you have consented, there is a legal obligation or we or the recipient have a legitimate interest in doing so. Within Coviqo, your content is visible to the members of the respective spaces and rooms according to their permissions.
In addition to the hosting providers named in section 4, we use the following service providers as processors, bound by contract under Article 28 GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Stripe Payments Europe, Ltd. | Payment processing / Zahlungsabwicklung | EU / USA (EU standard contractual clauses) |
| Coviqo | Transactional e-mail / Versand von System-E-Mails | EU |
| Cloudflare, Inc. | CDN, DDoS protection / CDN und DDoS-Schutz | Global (EU standard contractual clauses) |
Further recipients only receive data where the respective feature is used:
- Cloudflare (reverse proxy and protection against attacks, section 4);
- Plausible Insights OÜ, Estonia, as processor for the cookieless audience measurement of the website, processing in the EU (section 6);
- third-party sign-in providers and organisations’ identity services (section 9);
- Twilio or the organisation’s telephony provider and, for forwarding and external calls, the lines called; destinations of call flows chosen by organisations (section 17);
- Stripe (section 27);
- calendar and integration providers as well as webhook and log destinations chosen by spaces (section 22);
- developers of bots added by a space (section 22);
- operators of a space’s bots with which you share your linked Discord account (section 9);
- operators of apps you sign in to with Coviqo, including your membership in linked spaces (section 22);
- the public, where a space switches on the public embed (section 10);
- the Matrix server chosen by a space (section 23);
- the platform chosen by hosts for live broadcasts (section 13);
- YouTube, Vimeo and SoundCloud after your confirmation (section 21);
- operators of web pages you open in a room (section 21);
- push services of browser and operating system vendors (section 25).
In addition, we transfer data to authorities, courts or other public bodies where we are legally obliged to do so (for notices and legal cases see section 20), and to advisers bound by professional secrecy (e.g. tax advisers, lawyers). Should we transfer the operation of Coviqo to a company founded by us, the data will pass to that company; we will inform you beforehand.
32. Transfers to third countries
The platform itself is operated in the EU. A transfer to countries outside the European Economic Area can only take place in the following cases, in particular to the USA:
- via Cloudflare (section 4);
- via a voice node outside the EU, where set up and used (section 12);
- via Twilio for calls over phone numbers we provide (section 17);
- via Stripe (section 27);
- when signing in via third parties, calendar sync and integrations (section 9, section 22);
- via push services (section 25) and via e-mail services where they process outside the EU (section 5, section 26);
- after your confirmation when loading third-party content (section 21).
Such transfers take place on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Article 45 GDPR) where the recipient is certified under it, and otherwise on the basis of the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR). You can obtain a copy of the standard contractual clauses on request at [email protected].
Transfers that users or spaces trigger themselves – for example live broadcasts to a platform of their choice, connections to a Matrix server, bots by developers, webhooks (including from call flows) to destinations outside the EU or opening web pages in rooms – are not initiated by us and are not our responsibility; the person or organisation triggering them is responsible.
33. Retention periods
We store personal data only as long as necessary for the respective purpose or as long as statutory retention obligations exist. Organisations can set shorter or – within the permitted limits – different periods for their spaces. Unless set otherwise, the following applies:
- Account data: until the account is deleted (after the deletion request another 14 days in which you can cancel the deletion by signing in); thereafter only where statutory retention obligations exist.
- Sessions and device history: up to 30 days after expiry or sign-out; IP addresses only shortened. Trusted devices: 30 days.
- Security events: 180 days; full IP addresses only for 30 days, shortened thereafter.
- Website audience measurement (Plausible): IP addresses are not stored; the daily check value can no longer be recreated after 24 hours because the random value has then been deleted. We keep the aggregated statistics as long as we need them to evaluate the website.
- Space audit logs: depending on the plan (Free 90 days, Community Pro 1 year, Business 2 years, Enterprise 7 years); platform operation logs 3 years; full IP addresses only for 30 days.
- Server log files: at most 14 days; application operational logs (without IP addresses) 30 days, security-relevant operational logs 400 days; error reports 30 days; voice connection diagnostics 30 days.
- Messages and other content: until deleted by authorised people, by a retention period set by the space or until the space is deleted. Deleted content and spaces: permanent removal after 30 days.
- Public embed and permissions you grant: permissions (name in the public voice channel widget, Discord account for bots, membership for apps when you sign in with Coviqo) until withdrawn or until the membership ends; caches of the public interface 15–60 seconds; signed file links 5 minutes; IP counter for limiting requests 1 minute; granting and withdrawal of permissions in the space’s audit log for the period applicable to it (section 10, section 9, section 22).
- Recordings: Community Pro 30 days, Business 365 days, Enterprise as agreed, or shorter if set.
- Meeting transcripts: 90 days by default; AI summaries and their translations until the summary is deleted.
- Evidence of recording and transcription notices: 3 years.
- Attendance per occurrence and meeting statistics: with the meeting; attendance reports and webinar registrations: 365 days.
- Clips, voice and video messages: like chat attachments.
- AI processing log: 180 days; conversation with “Ask the space” 1 hour; deletion requests until your account is deleted.
- Calls: metadata of calls from direct messages, telephony call records and personal call history 180 days (including the path through the call flow, call notes and outcomes); favourites until removed; mailbox messages 90 days, calls passed into tickets under the rules for tickets; phone call recordings and their transcripts for the period set by the organisation (1–365 days, 30 days by default); shared list of missed calls 180 days after the last call; callback requests 180 days; phone book, mobile number, block and caller lists until deleted; AI receptionist: conversation at most 30 minutes, processing log 180 days.
- Discord import: import record until your account is deleted; mapping of the Discord identifiers as long as the space exists.
- Player search: entries while the session runs; decided requests 7 days; guest access 6 hours.
- Reports and moderation: 3 years after closure; messages held by raid protection at most 7 days.
- Notices of illegal content and legal cases (Digital Services Act): name and e-mail address of notifiers 365 days after the decision or the closure of the case; preservation of evidence (quarantine) 90 days, longer only on an authority’s order or under a legal hold; case files 5 years after the case is closed (section 20).
- Guest accounts: deleted automatically no earlier than 24 hours after the meeting.
- In-app notifications: 90 days; e-mail sending log: 90 days.
- Data exports: 7 days, after which the encrypted archive is deleted.
- Privacy requests and evidence of acceptance: closed requests 3 years, unconfirmed requests 7 days; evidence of accepted legal texts until 3 years after the account is deleted.
- Contact and demo requests: 12 months after receipt unless a contract results.
- Invoices and accounting records: 10 years (Article 16 of the Luxembourg Commercial Code (Code de commerce) and the Luxembourg VAT Law). These include invoices, credit notes, refunds, payments, contract conclusions and changes as well as notices of termination and withdrawal with their confirmations. We keep them separately from other data in an encrypted accounting archive that contains only these documents (no messages, content or usage data). The period begins at the end of the calendar year in which the document was created. If you delete your account, these documents remain until the period expires (Article 6(1)(c) and Article 17(3)(b) GDPR) – pseudonymised where possible: invoices keep the billing details as they appear on the invoice, notices of termination the name of the person who gave notice; your e-mail address is replaced by a pseudonym in them.
- Backups: at most 12 monthly backups, every backup deleted no later than 400 days after it was created (section 4).
34. Your rights
Under the GDPR you have the following rights:
- access to the data stored about you (Article 15 GDPR);
- rectification of inaccurate data (Article 16 GDPR);
- erasure of your data (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- data portability (Article 20 GDPR);
- objection to processing (Article 21 GDPR, see below);
- withdrawal of consent given, with effect for the future (Article 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected.
You can view, change or delete many details directly in your settings; there you can also request a complete data export, delete your account (/settings/account), object to the transcription of your voice and to being captured in clips, and check in the privacy cockpit which AI features processed your data. Without an account or for any other request, please use our privacy request form or write informally to [email protected]. We answer requests within one month; in complex cases the period can be extended by up to two further months, of which we will inform you (Article 12(3) GDPR). To protect your data, we may ask you to prove your identity. If your request concerns content we process on behalf of an organisation, we forward it to that organisation. For restrictions during ongoing investigations, see section 20.
Right to object under Article 21 GDPR
Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where your data is processed for direct marketing purposes, you may object at any time without giving reasons.
Please send your objection to [email protected]. For individual features (e.g. transcription of your voice, clips, meeting statistics, profile badges) you can object directly in the app.
35. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR (Article 77 GDPR). The authority competent for us is: Luxemburg. You can also contact the supervisory authority in the place of your habitual residence, your place of work or the place of the alleged infringement.
36. No automated decision-making
We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The AI features only create transcripts, translations, summaries, answers and suggestions; people decide how to use them. The AI receptionist on the phone routes calls according to the recognised request or hands them over to a person; it makes no decisions with legal effect. Automatic protection mechanisms such as raid protection or request limits pause actions temporarily; people decide on permanent measures such as suspending an account.
37. Obligation to provide data
Providing personal data is neither required by law nor by contract. However, without the data marked as mandatory during registration we cannot create an account, and without the technically required connection data Coviqo cannot be used. Voluntary details such as a profile picture or further profile fields are not required. For paid plans we need the details required for payment and invoicing.
38. Changes to this Privacy Policy
We update this Privacy Policy when our processing, our service providers or the legal situation change. The current version with version number and date is always available at /legal/privacy. We inform registered users of material changes in advance by e-mail or in the app. If a new processing requires your consent, we will ask for it separately.
9. Signing in with third-party providers
Optionally, you can register and sign in via one of the following providers. This processing only takes place if you explicitly choose the corresponding button:
You are redirected to the provider’s page and sign in there. We then receive your name, your e-mail address and a unique identifier of your account with that provider (with Google also your profile picture). We use this data to create your account or to match the sign-in to your existing account. The legal basis is Article 6(1)(b) GDPR. The provider is itself responsible for its processing; its privacy policy applies. A transfer to the USA may take place (see section 32). You can revoke Coviqo’s access at any time in the account settings of the respective provider.
Steam and Epic Games. These providers do not share an e-mail address. From Steam we receive your SteamID after Steam has confirmed the sign-in; we then load your public profile name, profile picture and profile link via the Steam Web API. From Epic Games we receive your Epic account ID and display name. We do not receive or store passwords, access tokens, friend lists, games or purchases. On the first registration this way we ask for your e-mail address and send a confirmation code; your account is only created after you enter the code. An address that already belongs to a Coviqo account is never linked automatically. Your Steam profile name and picture are updated on every sign-in via Steam.
Profile badge and “Now playing”. A linked Steam or Epic Games account is shown by default as a badge (name; for Steam also profile picture and a link to your public Steam profile) on your profile and in the member lists of your spaces – only to people who can see your profile there anyway. You can switch the badge off per provider under Settings → Security → Linked accounts; removing the link deletes the stored provider data. The legal basis is Article 6(1)(f) GDPR (showing your gaming identity to your communities; you can object at any time by switching the badge off). If you switch on “Now playing” for Steam, we ask the Steam Web API which game you are currently playing when your profile is opened; the result is cached in memory for a few minutes only.
Single sign-on of organisations. If your organisation has set up sign-in via its own identity service (SAML or OpenID Connect, possibly with user provisioning via SCIM), we receive your identifier, name, e-mail address and possibly groups, job title and department from that service. Your organisation is responsible for this transfer; we process the data on its behalf (see section 11).
Importing a Discord server. If you explicitly choose “Import from Discord”, you sign in with Discord and allow us to retrieve your Discord name, your identifier and the list of your servers with your permissions on them; we use this to check whether you may manage the server. Your Discord access is revoked immediately afterwards and the server list is kept for at most 60 minutes. You then add our import bot to a server; it only reads the server’s structure (name, icon, banner, categories, channels and their descriptions, roles with their permissions, channel permissions for roles and custom emojis) – no messages, no member lists, no role assignments and no details about individual people. From this we create a new space on your behalf or add to a space you manage; the bot then leaves the server and the structure that was read is deleted. We keep an import record (server identifier and name, chosen options including your confirmation that you may use imported emojis, number of imported items, space, time), which is deleted with your account, and, as long as the space exists, the mapping of the Discord identifiers of channels, categories, roles and emojis to the created items so that a repeated import does not create duplicates. The legal basis is Article 6(1)(b) GDPR; a transfer to the USA may take place (see section 32).
Sharing your linked Discord account with the bots of a space. If you linked a Discord account to your Coviqo account, we store, in addition to the Discord identifier, your Discord username, display name and the address of your profile picture, and update them every time you sign in with Discord. In individual spaces you can allow bots of this space that the people responsible for the space granted the data access “Linked accounts” to see your Discord identifier and Discord username – for example to take over roles from a Discord server. This is off by default, applies only to that space and only while you are a member; you can withdraw it at any time in your profile for this space or in Settings → Security → Linked accounts. If you unlink Discord, all of these permissions end. Recipients are the operators of the bots concerned (third parties responsible for their own further processing). Your e-mail address and credentials are never shared. The legal basis is your consent (Article 6(1)(a) GDPR); withdrawal does not affect the lawfulness of processing before the withdrawal. We record granting and withdrawal in the space’s audit log (Article 6(1)(c), Article 7(1) GDPR).