Data Controller and Contact
Pending the registration of the company operating Objeqo, the Objeqo project owner acts as the data controller for the processing activities they determine. The company’s full legal identity, mailing address, and registration number will be published once the process is complete.
Any questions or requests regarding personal data may be sent to dpo@objeqo.com. The contact responsible for data protection and, where a data protection officer has been formally appointed, that officer, may be contacted at dpo@objeqo.com.
Company in the process of registration. Final legal information will be added as soon as it is assigned. The status of the formal appointment of a data protection officer will be specified, if applicable.
Scope and Allocation of Roles
This policy describes the processing carried out in connection with the website, the Objeqo SaaS application, the Chrome extension, and communications with Objeqo.
Objeqo acts as the data controller for account creation and administration, contact and support requests, security, contract management, any subscriptions, and the Service’s own operations.
When a Client imports prospect data, captures a call, records or transmits audio, has a conversation transcribed, or requests an analysis for its own business purposes, that Client generally determines the purposes and legal basis. The Client then acts as the data controller and Objeqo as the data processor, in accordance with the Terms of Use and the instructions provided in the Service.
This policy does not replace the information that the Client must provide in its own name to its prospects, employees, and call participants.
Individuals Concerned
- website visitors and people who contact Objeqo;
- Users, administrators, and representatives of Clients;
- prospects and business contacts recorded by a User;
- participants in calls captured, transcribed, or analyzed using Objeqo;
- people mentioned in an offer, note, transcript, brief, or report.
Data Processed
Account, Authentication, and Profile
- email address, technical account identifier, and authentication information managed with Supabase Auth;
- first name, last name, company, job title, sales role, primary goal, phone number, avatar, language, time zone, progress, and onboarding responses, when provided;
- account preferences, notifications, theme, and Extension settings.
Team Workspace and Administration
- workspace name and identifier, role, join date, seat capacity, and shared call volume;
- invited email address, proposed role, inviter, status, and invitation expiration date;
- collective and individual activity metrics, including the number and duration of calls, outcomes, and objections detected;
- custom sales frameworks shared with workspace members.
Offers, Prospects, and Call Preparation
- sales context provided during onboarding, including free-form text, a website or sales page address voluntarily provided, offer content, target audience, problem solved, and proposed outcome;
- public text content temporarily retrieved from the provided address to prepare an offer brief; the raw HTML page is not retained after analysis;
- additional information about offers, pricing, promises, arguments, risks, evidence, and sales frameworks;
- name, email, phone number, company, job title, lead source, readiness, notes, main problem, likely objections, and meeting context;
- call objective, brief, questions to ask, points to watch, and information selected from the history of the same prospect.
Calls, Audio, and Analyses
- call date, duration, status, outcome, platform or video conference link, and other call metadata;
- voice, microphone and tab audio when the User authorizes capture, audio recording, and capture source;
- transcription segments, speaker, timestamps, notes, conversation memories, and associated excerpts;
- objections, hesitation, buying signals, sentiment, suggested responses, reports, scores, and coaching recommendations.
Usage, Support, and Security
- messages sent through the contact form or to support, sender identity, subject, and message content;
- technical data required for the session, the Extension, audio permissions, diagnostics, security, and abuse prevention;
- with consent, browsing data on public pages, including the page visited without query parameters, visit source, configured browsing events, and technical information about the browser or device;
- for new accounts, first known page, sanitized referrer, UTM parameters, gclid or fbclid when present, date of first visit, and page that triggered registration;
- subscription, plan, and quota information, and external billing identifiers when a paid flow is enabled.
Google Calendar Data
- email address of the selected Google account and permissions granted through OAuth;
- encrypted refresh token, primary calendar identifier, and technical connection or synchronization information;
- identifier and link for Google Calendar events created by Objeqo;
- to import appointments for the next ninety days: the ID, title, time, video meeting link, and cancellation status of compatible events from the primary calendar, including those created outside Objeqo;
- technical matches between imported events and scheduled calls; imported titles and meeting links remain in call records for as long as those records are retained.
Microsoft Outlook data
- the address of the selected Microsoft account, OAuth permissions, and an encrypted refresh token;
- IDs, titles, times, meeting links, and cancellations for compatible events imported from the connected calendar for the next ninety days;
- information about scheduled calls sent to Microsoft when the User requests that their event be created, updated, or deleted.
Data Sources
Data comes directly from the User when they create an account, configure their profile, provide information about an offer or prospect, prepare a call, send a message, or authorize audio capture.
Data may also come from the Client or another authorized User, call participants, the browser and the Extension, the video conferencing services used, and processing carried out by Objeqo and its service providers based on the content provided.
In a Team workspace, the owner or an administrator may provide a person’s business email address to invite them and assign them a role. The invitation link is tied to that address and expires after seven days.
When data about a Prospect or Contact is not collected directly from them, the Client must meet its applicable information obligations, including those concerning the source, categories of data, purposes, and applicable rights.
When Objeqo itself acts as the data controller for data received indirectly, the information is provided within the applicable regulatory deadline, no later than the first communication with the individual or, generally, within one month of obtaining the data.
Purposes and Legal Bases
Account Creation and Service Provision
Create and secure the account, manage authentication, save preferences, administer a Team workspace and its invitations, provide the requested screens and features, prepare or schedule a call, and provide the associated data. These processing activities are necessary to perform the Terms of Use or pre-contractual measures requested by the User.
Call Assistance and Artificial Intelligence
Capture authorized audio sources, transcribe conversations, maintain call memory, detect objections and signals, generate suggestions, produce a report, and prepare for the next call. For prospect and contact data, Objeqo follows the Client’s instructions, and the Client determines the applicable legal basis.
Contact, support, and contractual relationship
Respond to requests, diagnose incidents, assist the User, and manage the contractual relationship. Depending on the context, the legal basis is performance of the contract, pre-contractual measures, or Objeqo’s legitimate interest in responding to and following up with its users.
Content submitted through the support form is stored in the database, with access restricted to authorized administrators. Automatic notification and acknowledgment emails contain a request reference, without including the subject or message body. Subsequent exchanges sent directly by email follow the usual email process.
Security, abuse prevention, and defense of rights
Control access, isolate data by account, prevent prohibited uses, investigate incidents, and retain the information necessary to defend rights. These processing activities are based on Objeqo’s legitimate interest in securing the Service and, where applicable, a legal obligation.
Subscription, payment, and legal obligations
Manage a plan, quota, order, invoice, or overdue payment when a paid offering is actually enabled. These processing activities are based on performance of the contract and applicable accounting or tax obligations. The payment provider is Stripe.
Service improvement
Understand incidents and improve reliability, usability, and feature quality using proportionate technical or usage data. This processing is based on Objeqo’s legitimate interest, provided it does not override individuals’ rights and freedoms.
This improvement purpose does not include any data obtained through the Google Workspace APIs.
Objeqo does not train its own models on call content to create a shared model and does not knowingly enable the sharing of Client data to improve OpenAI models. Deepgram transcription requests are sent with mip_opt_out=true to exclude them from the model improvement program. Unless stricter contractual controls are enabled later, each provider’s published retention policies apply.
Public website analytics
Understand acquisition, pages visited, and the effectiveness of public user journeys through Google Analytics. This processing is based on visitor consent. The tag remains disabled unless consent is given, and private application routes are excluded from this measurement.
Chrome extension and limited use of data
Objeqo's use of user data by the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. This commitment covers data collected by the extension and information derived from it.
This data is used only for the advertised sales call assistance and tracking features, and for their operation, security, and reliability. It is not sold, used for targeted advertising, or used to assess creditworthiness or grant a loan.
Disclosure to third parties is limited to providers necessary for these features and other cases strictly permitted by this policy. Human review is limited to authorized cases: the User’s explicit agreement for specific data, security needs, a legal obligation, or aggregated and anonymized data used for internal operations.
Connecting and syncing Google Calendar and Microsoft Outlook
When the User voluntarily enables Google Calendar, Objeqo sends Google the information necessary to create and maintain events for scheduled calls, including the title, time, reminder, video conference link, company, offering, and stated objective. This processing is based on performance of the Service requested by the User and stops for new changes after disconnection.
Connecting also triggers the import of compatible appointments for the next ninety days, including events created outside Objeqo. Their title, time, and meeting link can be used to create or update scheduled calls. Subsequent syncs match those calls against changes and cancellations in the connected calendar. Microsoft Outlook offers the same import and sync process, with the User’s authorization.
Objeqo retains only the technical information necessary to operate and secure the integration: the encrypted refresh token, the connected account’s address, the permissions granted, the IDs and links for Objeqo events, and synchronization information. Objeqo does not retain a general copy of the User’s calendar. The refresh token is encrypted server-side and is never exposed to the browser or the Extension.
Data obtained through Google Workspace APIs is not sold or used for advertising, retargeting, commercial profiling, creditworthiness assessments, or building databases unrelated to the requested feature. OAuth tokens are not shared with analytics providers or Google Analytics. Imported information in a call record may be included in the context for preparing or analyzing that call when the User uses these features; the corresponding AI processing is described in this policy.
Data obtained through the Google Workspace APIs is not used to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.
Objeqo’s hosting and database providers process only the technical connection and synchronization information strictly necessary to provide and secure this feature. They are subject to contractual confidentiality and security obligations.
Objeqo's use of raw or derived user data received from Google Workspace APIs complies with and will continue to comply with Google's User Data Policy, including its Limited Use requirements.
Objeqo's use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Required data
Fields marked as required are necessary to create an account, prepare for a call, use a feature, or process a request. Without this information, Objeqo may be unable to provide the relevant feature.
Other information is optional. The Client remains responsible for limiting prospect and call data to what is relevant to its purposes.
Audio, transcription, and participant notice
Objeqo starts recording only at the User’s request and subject to the technical permissions granted to the browser or Extension. The User chooses the audio source and can stop recording.
The Client must verify that recording, transcription, and analysis are lawful in its context. Before or at the start of the call, the Client must inform each participant about the system, its purposes, recipients, retention period, and how to exercise their rights. The Client must obtain consent when required and respect any valid objection.
The technical ability to record or transcribe a call does not confirm that doing so is lawful.
Artificial intelligence and automated decisions
Text content relevant to a feature may be sent to OpenAI by Objeqo’s servers to generate a brief, detection, suggestion, or report. Audio from both participants may be sent separately to Deepgram to produce a real-time transcription. Permanent API keys are not exposed in the browser or the Extension. To open each stream, the browser receives a temporary Deepgram token with a short lifespan.
Outputs are probabilistic and may be inaccurate or incomplete. They are presented as assistance that the User must verify. Through the Service, Objeqo does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect a Prospect.
Text requests sent by Objeqo to the Responses API use the store: false parameter. Data sent to the OpenAI API is not used to train or improve models, unless Objeqo voluntarily opts in, which it does not do for Client data. Under the standard configuration, abuse monitoring logs that may contain Client content can be retained for up to thirty days for the Responses and Realtime endpoints. If Objeqo later enables Modified Abuse Monitoring or Zero Data Retention after OpenAI’s approval, the corresponding retention policy applies to eligible endpoints.
Deepgram requests use the European endpoint api.eu.deepgram.com and the mip_opt_out=true parameter. According to the provider’s documentation, data from requests excluded from the improvement program is retained only for as long as necessary to process the request. Technical and usage metadata may remain visible in Deepgram account logs in accordance with the applicable terms.
Recipients and processors
Data is accessible, strictly to the extent necessary for their duties, to authorized individuals responsible for managing the Service, Client support, security, technical operations, development, billing, and compliance. These individuals are subject to confidentiality obligations and access control rules.
In a Team workspace, the owners, administrators, and managers designated by the Client can view members’ calls, along with the associated prospects and offers, briefs, notes, transcripts, recordings, signals, and reports. Members without a management role can see only their own calls. The Client is responsible for assigning and updating these roles.
Objeqo does not sell personal data. It may disclose personal data to authorities or professional advisors when required by law or when necessary to establish, exercise, or defend legal claims.
Providers currently integrated
- Supabase: authentication, Postgres database, access rules, real-time features, and private recording storage;
- Deepgram: real-time audio transcription, speaker turn detection, and word timestamps;
- OpenAI: artificial intelligence models and structured generation;
- Vercel: hosting, execution, and delivery of the application;
- Resend: sending transactional emails, including support notifications and acknowledgments;
- Stripe: managing payments and billing information when paid features are enabled;
- Google Calendar API and Microsoft Graph (Outlook): import compatible appointments and create, update, or delete call events when the User enables the corresponding integration;
- Google Analytics: analytics for public pages only after consent.
The list of subprocessors, their roles, and links to their contractual documents is maintained in the Security and Data Protection Annex.
Transfers outside the European Economic Area
Some service providers may process data in a country outside the European Economic Area. When this is the case, Objeqo puts in place an authorized mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, supplemented, where necessary, by additional measures.
The locations actually used depend on the region selected for the Supabase project, Vercel’s global infrastructure, the Deepgram European endpoint, and the regions and settings of the OpenAI, Resend, Stripe, Google Calendar API, Microsoft Graph, and Google Analytics accounts. When data is processed outside the European Economic Area, transfers are governed, as applicable, by an adequacy decision, the European Commission’s Standard Contractual Clauses, and appropriate additional measures. A copy or description of the safeguards can be requested at dpo@objeqo.com.
Retention periods
Data is retained for a period proportionate to its purpose, then deleted or anonymized, unless a legal obligation or the need to preserve certain information to defend legal claims requires otherwise.
- Account, profile, and settings: for the duration of the account, then removed from production within a maximum of thirty days after account closure, unless there is a legal retention obligation.
- First-visit attribution: stored temporarily for a maximum of ninety days before registration, then for the duration of the account after being linked to it. Accounts created before this feature was enabled are identified as having an unavailable historical source.
- Team workspace membership and invitations: until the member leaves or is removed, the invitation is revoked or expires, or the contract ends; unaccepted invitations expire after seven days, and records of them may be retained for up to an additional thirty days for security and abuse prevention.
- Offers, prospects, briefs, calls, transcripts, notes, memories, signals, and reports: until deleted by the User or for the duration of the account or contract, then removed from production within a maximum of thirty days after the Service ends.
- Audio recordings: until the User deletes the relevant call or for the duration of the account or contract, then removed from production within a maximum of thirty days after the Service ends.
- Contact and support requests: for three years from the date the request is closed or the last substantive exchange.
- Technical data and security logs: for a maximum of twelve months, unless a longer retention period is required due to an incident, a legal obligation, or the defense of legal claims.
- Google Analytics choice: six months. Google Analytics cookies: for a maximum of thirteen months after they are created, according to Objeqo’s configuration.
- Google Calendar and Microsoft Outlook connections: for as long as the User keeps them enabled. Disconnecting revokes access when the provider allows it and is reachable, and locally deletes the encrypted token and technical matches. Events already created remain in the provider’s calendar unless the User deletes them. Call records already imported remain in Objeqo until they are deleted; their retention does not depend on the calendar connection remaining active.
- Billing data and accounting records, where applicable: for ten years from the end of the relevant fiscal year.
- Backups: deleted or overwritten within a maximum of ninety days after the production data is deleted.
- Data processed by OpenAI: up to thirty days for abuse monitoring logs under the standard configuration, unless a longer retention period is legally required; Modified Abuse Monitoring or Zero Data Retention controls reduce retention for eligible endpoints when enabled.
- Audio processed by Deepgram with the improvement program opt-out enabled: for as long as necessary to process the request, in accordance with the provider’s documentation; technical and usage metadata follow the contractual retention periods for the Deepgram account.
These retention periods are reviewed when features, legal obligations, or provider settings change.
Security and confidentiality
Current safeguards include User authentication, data isolation by owner and, in a Team workspace, membership and role checks enforced at the database level, private storage for recordings, hashed-token invitations linked to an email address, temporary replay links, and keeping AI API keys on the server.
No system can guarantee absolute security. Organizational measures, encryption in transit and at rest, backups, restoration, logging, security testing, internal access management, and incident response procedures are described in Objeqo’s Security and Data Protection Annex.
The User must protect their credentials and promptly report any suspected access to dpo@objeqo.com.
Data subject rights
Depending on the nature of the processing and the conditions set out in the regulations, each person may request access to, rectification, or erasure of their data, restriction of processing, or data portability, and may object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting prior processing.
A request may be sent to dpo@objeqo.com. Objeqo generally responds within one month. This period may be extended under the conditions set out in the regulations. Proof of identity that is strictly necessary may be requested in cases of reasonable doubt.
For prospect or participant data processed on behalf of a Client, the request should first be sent to that Client. If Objeqo receives the request directly, it forwards it to the relevant Client and assists them to the extent provided for in the Terms of Service.
The person may also lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr, without prejudice to any other remedy.
Account deletion and data export
The User can download a JSON copy of the data linked to their account from Settings, including their profile, preferences, sales context, call history, and their own team membership context. The export does not include calls or personal data belonging to other members and lists associated private files without making them publicly accessible.
Account deletion is available from Settings. Confirmation permanently deletes the account, the business data belonging to it, and associated private files. The owner of a workspace that includes other members must contact Objeqo in advance to arrange its transfer or closure. Data may be retained only when required by a legal obligation or an applicable contractual instruction.
For data processed as a processor, return or deletion at the end of the contract follows the Client’s documented instructions, subject to legal retention obligations. Data is returned within a maximum of thirty days after the Client’s request, production data is deleted within a maximum of thirty days after the Service ends, and backups are purged within a maximum of ninety days after that deletion.
Cookies and local storage
The Service uses storage that is strictly necessary for the session, security, interface preferences, and continuity of a call. Google Analytics is used on public pages only after consent. No advertising or marketing retargeting trackers are enabled as of the date of this version.
Details of the technologies, keys, purposes, and retention periods are set out in the Cookie Policy.
Policy updates
This policy may be updated to reflect changes to the Service, its providers, or the regulations. The update date is shown at the top of the page.
Users will be notified of any material changes by an appropriate means before they take effect, where required.
Effective Date and Contact
This policy took effect on August 26, 2026. Version: 1.8, updated on October 23, 2026.
Questions may be sent to dpo@objeqo.com or submitted through the Contact page.