Privacy policy

Consee, a trade name of ConsultOS ("Consee", "we", "us") runs a workspace for business and marketing consultants. This policy explains how we collect and use personal data in three places: the public website, the team workspace where a consulting firm works, and the client portal its clients sign in to.

It is written to the standards of the EU General Data Protection Regulation (GDPR) and the UK GDPR, which also covers what most other privacy laws ask for. Consee's operator is based in Israel, so Israel's Privacy Protection Law applies to us as well.

Questions about this policy or your data: hello@consee.ai.

Whom to ask about your data depends on whose data it is:

• Data a consulting firm keeps in Consee about its own clients — client details, meetings, recordings, transcripts, summaries, tasks, files and messages. The firm is the controller and decides why and how that data is processed; Consee is its processor and handles it only on the firm's instructions, never for purposes of its own. A data processing agreement is available to every firm on request.
• Data you give us directly — when you join the waitlist, apply to the design-partner programme, request an organization, or hold a team account. For this data Consee is the controller.

If you are a client of a firm that uses Consee and have a question about the data the firm keeps about you, please ask the firm first. We will help it answer.

Visitors to the public website:

• Waitlist, organization requests and design-partner applications — the name, email address, phone number, firm and answers you enter in the form.
• Technical data — IP address, browser type and request times, kept in server logs for a limited time for security, abuse prevention and rate limiting.

Team members (firm owners, consultants, mentors):

• Sign-in is with your Google account. Google gives us the account's name, email address and profile picture — never your password.
• Your role in the organization, invitations sent and actions you take in the workspace, and the time zone you read times in.
• If the firm connects a Google Calendar: the calendar events relevant to client meetings. If it connects a Google Form as an intake questionnaire: the answers submitted to that form.

Clients in the portal:

• Name, phone number and email address, as the firm entered them or as given in the invitation.
• Sign-in with a Google account, on the same terms as above.

Content a firm manages in Consee:

• Client files, engagements, goals, tasks, notes, files and financial figures the firm enters or approves.
• Meetings — times, Google Meet links, uploaded or captured recordings, transcripts, and the summaries and analyses produced from them (section 4).
• Leads, questionnaire answers, and in-app messages and images exchanged between the firm and its clients.

Consee can transcribe a recording the firm uploads, or send a bot to a Google Meet meeting on the firm's calendar. The bot joins as a visible participant named "Consee", so everyone in the meeting can see it is being recorded, and it only enters once the meeting's host admits it.

The firm is responsible for telling meeting participants about the recording and obtaining their consent where the law requires it, before the bot joins or a recording is uploaded. We never record a meeting on our own initiative.

Recordings are kept in secure cloud storage. Transcription and speaker separation run on servers we operate — the recording is not sent to an outside transcription service. Summaries, sentiment and the client health score are produced from the transcript text with an AI language model (section 5).

The firm can delete a recording, transcript or summary at any time.

To produce summaries, suggested tasks, sentiment and extracted financial figures, we send transcript text (and, for financial extraction, the uploaded spreadsheet's text) to an outside language-model provider. The main provider is Google (Gemini API) on a paid plan, under which Google does not use the content to train its models. A fallback provider, used only when the first is unavailable, is Groq.

AI outputs are suggestions. The firm reviews and approves them before anything reaches a client, and none of them is an automated decision with legal or similarly significant effect on anyone (GDPR Art. 22).

We do not use one firm's content to train models or to improve the service for another firm.

Google sign-in, Google Calendar and Google Forms connections use OAuth and only the permissions you approve on Google's consent screen. You can revoke them at any time in your Google account settings; the connection then stops working.

Consee's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: the data is used only to provide the feature you asked for (sign-in, calendar sync, reading form answers), is not transferred to third parties except as needed to run the service, is not used for advertising, and is not read by humans except with your consent, for security, or as the law requires.

• To provide the service — signing you in, showing files and meetings, sending invitations and notifications. Basis: performance of our contract with you or your firm (Art. 6(1)(b)).
• To answer your application or request, and to tell waitlist members once when a new cohort opens — no ongoing marketing mail. Basis: steps you asked us to take before a contract (Art. 6(1)(b)) and our legitimate interest in replying (Art. 6(1)(f)).
• To keep the service secure — detecting intrusion attempts, rate limiting and logging sensitive actions. Basis: legitimate interests (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)).
• To improve the service, using aggregated usage data that does not identify anyone. Basis: legitimate interests (Art. 6(1)(f)).
• To meet legal obligations and to establish or defend legal claims. Basis: Art. 6(1)(c) and (f).

For content a firm manages in Consee, the firm determines the legal basis as controller. We do not sell personal data, share it with advertisers or show ads.

We use these sub-processors, and only to the extent needed to run the service:

• Google Cloud — servers and file storage, in the European Union (Google Cloud in Belgium; the database in Frankfurt, Germany).
• Neon — the managed database, in Frankfurt, Germany.
• Google — Google sign-in, Calendar, Forms and Meet, under the permissions you approved.
• Google AI (Gemini API) and Groq — processing transcript and document text with language models (section 5).
• Resend — sending system email (invitations, notifications, summaries).
• An error-monitoring provider, if enabled — technical error data only, never meeting content.

Beyond that we disclose data only where the law requires it, under an order of a competent authority, to protect our rights or users' safety, or as part of a transfer of the service to a successor that takes on this policy.

Inside a firm, access follows roles: the owner sees every client file, consultants and mentors see the clients assigned to them, and a client in the portal sees only what the firm marked as visible to them.

Our servers and data stores are in the European Union (Google Cloud in Belgium; the database in Frankfurt, Germany). Our operator is in Israel, which the European Commission recognises as providing adequate protection. Some sub-processors, including the AI providers, also operate from the United States; transfers there rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, with the UK addendum for UK data.

We use industry-standard measures: encrypted connections (HTTPS), a signed sign-in cookie that scripts cannot read, strict separation between organizations' data, role-based permissions, rate limits on sign-in, and logging of access to sensitive actions.

No system is completely immune. If a personal data breach occurs, we will notify the affected firms without undue delay, and the competent supervisory authority where the law requires it.

• An organization's content is kept while its account is active. When an engagement ends, the firm can export its data and ask us to delete it; we delete it within 30 days of the request, except what the law requires us to keep.
• Waitlist and design-partner details are kept until we contact you about the cohort or you ask us to remove them.
• Declined organization requests are kept for up to 12 months, to follow up and to prevent repeated requests.
• Technical server logs are kept for a short, limited period.
• Backups are overwritten in the normal backup cycle after the original is deleted.

Under the GDPR and UK GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw any consent you gave, at any time and without affecting earlier processing.

For data Consee controls, write to hello@consee.ai. We answer within one month and may ask you to confirm your identity first. For data a firm keeps about you, ask the firm; if you write to us, we will pass your request on and help the firm deal with it.

You can also complain to a data protection supervisory authority — in particular the one where you live or work, or where you believe an infringement took place.

If you live in California or another place with its own privacy law, you have the rights that law gives you; we honour them through the same address. We do not sell or share personal information for cross-context behavioural advertising.

We use only the cookies the service needs to work — mainly the sign-in cookie — and no advertising cookies or analytics tracking. Details are in the cookie policy.

Consee is for businesses and people aged 18 and over. We do not knowingly collect data about children. If you learn that a child has given us personal data, write to us and we will delete it.

We update this policy when the service changes; the date of the last update is at the top of the page. For a material change we notify registered users by email or in the app before it takes effect.

For any question about this policy or your data: hello@consee.ai.