Legal & Compliance
Last updated: 16 August 2026
SalesMage AB ("SalesMage", "we", "us", "our") is committed to protecting your personal data. This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have.
SalesMage is a sales collaboration platform. Users create shared "deal rooms" with their customers, and can connect a Google Calendar so that a notetaker bot joins their sales meetings, records them, and produces transcripts, summaries and insights.
SalesMage AB Nybohovsgränd 8, Stockholm, Sweden contact@salesmage.io
For personal data that we process on behalf of our business customers (for example, the personal data of participants in a customer's meetings), SalesMage acts as a data processor and the business customer is the controller. In that case the customer's own privacy notice governs, and this policy describes how we handle the data on their instructions.
1.1 Website visitors
1.2 Account and platform use
The table below covers processing for which we are the controller. Where we act as a processor, see 1.4.2.
1.3 Google account and calendar data
We use Google OAuth in two distinct places, and each requests only what it needs.
Sign-in. When you log in with Google we receive your email address and basic profile information from Google. We use it to identify your account. We do not receive or store your Google password.
Calendar connection. If you choose to connect your calendar so meetings can be recorded, we request the following Google scopes:
https://www.googleapis.com/auth/calendar.events.readonly, read-only access to your calendar events, so we can show your upcoming meetings and detect which of them have a video conference link.
https://www.googleapis.com/auth/userinfo.email, your email address, to match the calendar to your SalesMage account.
We request read-only calendar access. SalesMage cannot create, edit, or delete anything in your calendar.
The calendar authorisation is completed by our meeting-recording provider, Recall.ai (see section 2). SalesMage generates the Google consent screen link, but the resulting Google credentials are held by Recall.ai, not by SalesMage. We never see or store your Google refresh token.
From your connected calendar we receive, for each upcoming meeting, the meeting title, start and end time, the video conference URL, and an identifier. We use this only to display your meeting list and to determine whether a notetaker bot should join.
Google API Services and Limited Use
SalesMage's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs adheres to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.
Specifically:
No AI or ML training on Google user data. SalesMage does not use, transfer, or sell Google user data, whether raw, aggregated, anonymised or derived, to create, train, fine-tune, or improve any foundational or generalised machine learning or artificial intelligence model. None of the third-party AI services we use is permitted to do so either, and we enforce that contractually and through the technical routing controls described in section 3.
We are the controller of personal data that we process for our own purposes. This includes: (a) account and user data (name, work email address, job title, password credentials and login history); (b) billing and payment data; (c) website, marketing and support data, including cookies and analytics; and (d) security, audit and abuse-prevention logs.
Our legal bases for this processing are the performance of our contract with you (Art. 6(1)(b) GDPR) for data necessary to provide and administer your account, our legitimate interests (Art. 6(1)(f) GDPR) in securing, improving and marketing the Service, and our legal obligations (Art. 6(1)(c) GDPR) in respect of accounting and tax records. Where we rely on legitimate interests, you may object as described in section 6.
We are a processor, and our customer is the controller, of all personal data contained in customer content. This includes meeting recordings, audio and video, transcripts, summaries, AI-generated output derived from them, CRM data synchronised into the Service, and deal room content.
The SalesMage user who scheduled or uploaded a recording, and the organisation on whose behalf that user acts, determines the purposes and means of that processing. We process such data only on documented instructions from that customer, under the data processing terms set out in our Terms and Conditions, which meet the requirements of Art. 28 GDPR. We do not determine the purposes of that processing and do not state a separate legal basis for it; the customer is responsible for establishing a legal basis for the recording and for informing meeting participants.
If you are a meeting participant and wish to exercise your rights in relation to a recording, please contact the organisation that scheduled the meeting. If you contact us instead, we will forward your request to that organisation.
When one of our customers invites a customer or colleague to a deal room, we process that person's email address and their activity in the room on the inviting customer's instructions, as a processor.
Meetings are not visible to deal room guests by default. A recording only becomes visible to a buyer or guest if the SalesMage user explicitly shares it into the deal room.
You can unsubscribe from marketing at any time using the link in any email, or by writing to contact@salesmage.io.
We use cookies that are strictly necessary for the site and the product to work, including the cookie that keeps you signed in. We ask for your consent before setting any analytics or marketing cookies, and you can decline without losing access to the Service. Details are in our Cookie Policy. If we introduce a third-party analytics provider, we will name it in the table in section 3 and update this policy before it goes live.
SalesMage uses Recall.ai (operated by Hyperdoc Inc., 2261 Market Street #4339, San Francisco, CA 94114, USA) to connect to your Google Calendar and to record and transcribe meetings. Recall.ai acts as our sub-processor and is bound by a data processing agreement.
What Recall.ai does for us:
Holds the Google Calendar authorisation. When you connect your calendar, the Google consent flow completes at Recall.ai. Recall.ai stores the Google credentials and keeps your calendar in sync.
Reads your upcoming calendar events and passes us the title, times, and video conference link for each one.
Sends a bot into the meeting. For meetings marked for recording, Recall.ai's bot joins the call as a visible participant named "Salesmage Notetaker" and captures audio and video. Supported platforms are Zoom, Google Meet, Microsoft Teams, Cisco Webex and GoToMeeting.
Produces a transcript of the recording, with speaker attribution and timestamps.
Notifies us when a recording and transcript are ready, so we can retrieve them.
Where processing happens. We use Recall.ai's EU infrastructure (eu-central-1) for calendar sync, recording and transcription, so meeting media is processed within the EU. Recall.ai's provider, Hyperdoc Inc., is established in the United States and its personnel may access data from there for support and operations. That access is a transfer to a third country and is covered by the EU Standard Contractual Clauses, see section 3.
What we retrieve and store ourselves. As soon as a recording and transcript are ready, we download them to our own AWS S3 storage in the eu-north-1 (Stockholm) region. Once stored with us, the recording video and transcript live in our EU infrastructure and are served to you from there.
What we do not send to Recall.ai.
We do not send Recall.ai your deal room documents, comments, or any other platform content. The only data we send is what is needed to identify you and schedule a recording: your account email address, which Recall.ai uses as your identifier, and, when you schedule a bot for a meeting link yourself, that meeting URL together with an internal numeric user identifier.
Disconnecting. You can disconnect your calendar at any time from the Calendar page in the app. When you do, we instruct Recall.ai to delete your calendar user record, which revokes their access to your Google Calendar, and we discard our cached Recall.ai session token for you. Recordings already stored with SalesMage are not deleted by disconnecting an integration. To have them deleted, follow the procedure in section 6 (Your rights); for how long we keep them if you take no action, see section 4 (Retention). You can also revoke SalesMage's and Recall.ai's access directly from your Google Account permissions page at https://myaccount.google.com/permissions.
We do not sell personal data. We share it only with service providers who process it on our behalf under a data processing agreement, and with authorities where the law requires it.
Some of our providers are established outside the EU/EEA, principally in the United States. Where personal data is transferred outside the EU/EEA, we rely on:
You can obtain a copy of the safeguards in place by writing to contact@salesmage.io.
Meeting transcripts and deal room content are sent to large language models in order to generate summaries, chapters, action items and answers in the deal room assistant. We use OpenRouter as a gateway to reach those models rather than contracting with each model host directly.
Which models we call. We call a fixed, named set of models: openai/gpt-oss-120b for meeting summaries, chapters, action items and deal room context, and openai/gpt-4o-mini for the deal room assistant's streaming replies. No model is chosen dynamically at runtime, and requests are routed only to inference endpoints on an allowlist we maintain.
What we do to prevent training and retention.
data_collection: "deny") and has provider fallback disabled, so a request cannot be served by, or silently fail over to, an endpoint that collects submitted data.Google data and AI. Meeting transcripts are produced from the audio of the call itself, not from any Google API. The only Google Calendar data that can appear in a model prompt is the meeting's title and start time, included so a summary can be labelled correctly. No Google user data, raw or derived, is used to train or improve any AI or ML model. See section 1.3.
Automated output. Model output is generated automatically. It can be inaccurate or incomplete and should not be treated as a verbatim record of a meeting. It does not produce legal effects concerning you, and we do not use it for automated decision-making within the meaning of Art. 22 GDPR.
We apply technical and organisational measures appropriate to the risk, including:
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours and, where the risk is high, notify you directly.
Where we act as a processor, we will notify the affected customer without undue delay after becoming aware of a personal data breach affecting their data, and will assist them in meeting their own notification obligations. The customer, as controller, is responsible for any notification to a supervisory authority or to data subjects.
Under the GDPR you have the right to:
To exercise any of these, email contact@salesmage.io. We respond within one month.
If your data was uploaded to SalesMage by one of our business customers, for example if you attended a meeting recorded by one of our users, we will forward your request to that customer, who is the controller of that data.
The Service is not directed at anyone under 18, and we do not knowingly collect personal data from children.
We may update this policy. When we do, we will revise the "Last Updated" date above, and for material changes affecting how we use your data we will notify you by email or in the product before the change takes effect.
SalesMage AB
Company registration number (organisationsnummer): 559530-1192Registered office: Stockholm, Nybohovsgränd 8, Sweden
Email: contact@salesmage.io