# Data processing terms > The terms on which Aries AI processes personal data for its customers, including the providers it uses and where they process it. Version: 1.1 · Effective from: 2026-10-19 · Last updated: 2026-10-20T00:12:16.032904+00:00 ## Scope These terms apply where Aries AI processes personal data on behalf of a customer that uses Aries Notes. They are part of the terms of service. Where a customer has signed a separate data processing agreement with Aries AI, that agreement prevails. ## Roles The customer is the controller of the personal data in its account, and Aries AI is its processor. Aries AI is a controller in its own right only for the account and billing data it needs to run its business, as the privacy notice describes. For an individual plan, the person who holds it is the customer under these terms. ## Subject matter and duration Aries AI processes personal data to provide Aries Notes to the customer, for as long as the customer's account is open and until the data is deleted after closure, as set out below. ## Nature and purposes of the processing - Capturing meetings: storing uploaded recordings and Notetaker audio, and reading meeting details, recordings and transcripts from the meeting platforms the customer connects. - Transcribing audio, separating speakers and, where the customer enables it, suggesting who spoke by matching voiceprints. - Preparing proposed minutes, decisions and action items; translating between English and Arabic; rewriting Arabic transcripts in Modern Standard Arabic; making scheduling suggestions. - Collecting approvals, answers and electronic signatures, including from external participants. - Sending invitations, reminders and follow-ups by e-mail. - Keeping the audit trail, securing the service and providing support. ## Categories of personal data - Identity and contact data: names, work e-mail addresses, roles, committee memberships, language and time zone. - Meeting data: meeting details, invitees, attendance, agendas and attached documents. - Recordings of participants' voices and, where captured, video. - Transcripts with speakers and times, and anything participants chose to say, which may include special categories of personal data. - Minutes, decisions, action items, approvals and electronic signatures. - Where the customer enables speaker identification, voiceprints. A voiceprint is biometric data: a numerical representation of a person's voice, made from a sample of up to thirty seconds that the person provides, or that an administrator provides only with the person's explicit consent, which the customer obtains and keeps on record; the administrator confirms it when enrolling. The sample is not kept. The voiceprint is encrypted, used only to suggest who spoke among the people invited to the customer's own meetings, never compared across customers, and deleted when the person or an administrator deletes it, when the person is deactivated, or when the customer's data is deleted. - Usage and audit records. ## Categories of data subjects - The customer's staff and the other people it allows to use its account. - External participants: people outside the customer's organisation who are invited to meetings, asked questions or asked to sign. - Anyone else who speaks or is mentioned in a captured meeting. ## The customer's responsibilities The customer decides what is captured and gives its instructions through its use and configuration of the service. It is responsible for having a lawful basis for the processing, for informing participants, for obtaining consent where the law requires it, including explicit consent for voiceprints, and for the lawfulness of its instructions. ## Our obligations - Process personal data only on the customer's documented instructions, including these terms, unless the law requires otherwise. In that case we tell the customer first, unless the law forbids it. - Tell the customer if we believe an instruction breaks data protection law. - Make sure everyone authorised to access the data is bound by confidentiality. - Apply the security measures below and keep them appropriate to the risk. - Not use customer meeting content to train AI models. - Not sell the data, and not use it for our own purposes. ## Security measures - Encrypted connections to the service, the database and storage. - Encryption at rest by the cloud provider. - Application-level encryption of credentials, connection secrets, access tokens and voiceprints, with keys held in Azure Key Vault. - Passwords stored only as Argon2id hashes. - A separate database schema and a separate storage container for each customer. - Access inside each account by role and committee membership. - An append-only audit trail of consequential actions. - Account lockout after repeated failed sign-in attempts. ## Sub-processors The customer authorises Aries AI to use the sub-processors below. Each is bound by a written agreement that requires it to protect the data, and processes it to provide its service to Aries AI. We impose data protection obligations on each sub-processor equivalent to these terms and remain responsible to the customer for its performance. - **Microsoft Azure** (Microsoft): hosting of the application, database, file storage, encryption keys and logs. Location: UAE North. - **Microsoft Azure OpenAI** (Microsoft): AI language models for preparing minutes, translation and Modern Standard Arabic, and a speech-to-text model that can be used for transcription. Location: the main model is deployed in UAE North on a global deployment type, so requests may be processed in any Azure region; the speech-to-text model is deployed in Sweden Central, also on a global deployment type, so the same applies to it. - **ElevenLabs:** speech-to-text transcription of uploaded recordings, Notetaker audio and dictation. Location: outside the UAE. - **pyannoteAI:** speaker separation and voiceprint matching; receives meeting audio and voice samples. Location: outside the UAE. - **Microsoft 365** (Microsoft): delivery of e-mail notifications. The meeting platforms the customer connects, such as Microsoft Teams, are the customer's own providers. Aries AI reads from them on the customer's instructions. HyperPay processes card payments for Aries AI's own billing, through its European endpoint. It is Aries AI's provider for billing only and receives no meeting content. ## Changes to sub-processors We tell the customer's administrators by e-mail before a new sub-processor starts processing the customer's personal data, and we update this page. The customer may object on reasonable data protection grounds within 30 days of that notice. We will then work with the customer to find a solution; if none is found, the customer may end the agreement for the affected service. ## International transfers The service is hosted in the UAE, and the sub-processors above process some data outside it. Each transfer is covered by contractual safeguards with the provider — the EU standard contractual clauses or the equivalent the applicable law provides — and we tell the customer which applies on request. ## Deployment on the customer's own infrastructure On request, and under a separate written agreement, Aries Notes can be deployed on the customer's own infrastructure, on its premises or in its private cloud. The customer's personal data then stays in that environment, and the hosting, the sub-processors and any international transfers are as that agreement sets out, in place of the descriptions above. ## Assistance Taking into account the nature of the processing, we help the customer to: - answer requests from data subjects who exercise their rights, and pass on any such request we receive directly; - carry out data protection impact assessments and any prior consultation with an authority; - respond to enquiries from supervisory authorities. ## Personal data breaches We notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data. We give the information we have about what happened, the data and people likely to be affected and the measures taken, and we keep the customer updated as we learn more. ## Deletion and return Before closing its account, the customer can ask for a copy of its data, and we provide it on request in a commonly used, machine-readable form. When the account closes, we delete the customer's personal data within 90 days, unless the law requires us to keep it longer. Backup and recovery copies are gone within a further 14 days, and technical logs within 30 days. ## Audits On reasonable notice, we make available the information needed to show compliance with these terms and answer the customer's reasonable questions. Where the applicable law requires an audit beyond that, we contribute to it at a reasonable frequency and under confidentiality. ## Laws These terms are written to meet the processor requirements of the Jordanian Personal Data Protection Law No. 24 of 2023, the UAE Federal Decree-Law No. 45 of 2021, the Saudi Personal Data Protection Law, Egypt's Personal Data Protection Law No. 151 of 2020, and the EU and UK General Data Protection Regulation where they apply. ## Contact Write to **info@ariesai.ai**. ## Other policies - [Privacy](https://notes.ariesai.ai/en/legal/privacy.md) - [Terms](https://notes.ariesai.ai/en/legal/terms.md) - [Cookies](https://notes.ariesai.ai/en/legal/cookies.md) - [Acceptable use](https://notes.ariesai.ai/en/legal/acceptable-use.md)