Privacy notice

Who we are

Aries Notes is a meeting governance product. It captures meetings, writes the minutes, records the decisions taken and follows up the commitments made. It is operated by Aries AI ("we", "us"), whose registered office is in Amman, Jordan. Aries AI also has offices in New Cairo, Riyadh, Dubai and Washington.

This notice explains how we handle personal data in Aries Notes, on its website and when you contact us. It applies to the people who use Aries Notes, to the people who take part in meetings captured with it, and to the people who contact us.

Our role

• Business accounts. The organisation that holds the account decides what is captured and why. It is the controller of its meeting data and of its people's data. Aries AI is its processor and handles that data only on its instructions, under our data processing terms.
• Individual plans. You are responsible for the meetings you capture, and Aries AI processes their content for you under the data processing terms. Aries AI is the controller of your own account data.
• Our own records. Aries AI is the controller of the account and billing data it needs to run its business, and of the data of people who contact us or ask for a demonstration.

If your data is in a business account, that organisation's own privacy notice also applies, and the organisation is your first point of contact.

The personal data we handle

• Account data: name, work e-mail address, role, committee memberships, language and time zone.
• Meeting data: meeting details, invitees and attendance, the agenda, and the papers and documents attached to the meeting.
• Transcripts: what was said, with who said it and when. Where a committee chooses it, also a rewrite of an Arabic transcript in Modern Standard Arabic.
• Recordings: meeting audio and video, as described in the next section.
• Meeting outcomes: minutes, decisions, action items with their owners and due dates and times, approvals, and electronic signatures.
• Voiceprints, only where an organisation uses speaker identification. They have their own section below.
• External participants: people outside the organisation who are invited to a meeting, asked a question or asked to sign. We hold their name and e-mail address and what they do through the personal links we e-mail them. They have no account.
• Billing data: plan, invoices and payments: for each payment, its amount, its outcome and the reference the payment provider gives it. Card details are entered only in HyperPay's own payment form. They never reach Aries Notes and are not stored by us, and nothing is saved for later payments: every payment is one you start yourself.
• Usage and audit records: who did what in an account and when, and how much of the plan's allowances has been used.
• Technical logs: records of requests to the service, kept to run it and keep it secure.
• Enquiries: what you send us when you ask for a demonstration or write to us.

Meeting content is whatever people choose to say, so it can contain any kind of personal data, including sensitive data. The organisation decides what is captured. We receive data about external participants and people mentioned in a meeting from the organisation that holds the account, not from them.

Recordings and how they reach us

• Uploaded recordings are stored in the organisation's own storage.
• The Aries Notes Notetaker joins a meeting when the organisation uses it. It appears in the meeting as "AriesNotes" and, where the meeting chat allows it, posts a notice there that it is transcribing. The audio it captures is stored in the organisation's own storage.
• Microsoft Teams recordings are not copied. We keep a reference and play the recording from Microsoft when someone opens it. We do store the transcript text that Teams produces.
• Dictation is sent for transcription into text.

Recordings are kept until the meeting they belong to is deleted. There is no automatic deletion schedule.

Capturing a meeting is the organisation's decision, and so is telling the people in it. Where the law requires every participant's consent, obtaining it is the organisation's responsibility. The product supports that obligation; it does not replace it.

Speaker identification and voiceprints

Speaker identification is optional. An organisation can switch it on so that its transcripts suggest who was speaking. It relies on voiceprints, which are biometric data, and we treat them as sensitive data.

• What a voiceprint is. A numerical representation of a person's voice, made from a voice sample of up to thirty seconds.
• Consent. A person enrols their own voiceprint by giving explicit consent. An administrator of their organisation may enrol it on their behalf only with the person's explicit consent, which the organisation obtains and keeps on record; the administrator confirms it when enrolling.
• What we keep. Only the voiceprint, encrypted. The sample is sent to our speaker-identification provider to make the voiceprint and is not kept by us.
• What it is used for. Only to suggest who spoke in that organisation's own meetings, among the people invited to the meeting. It is never compared across organisations. A suggestion is shown as a suggestion, and any name can be corrected by an authorised person.
• How long it is kept. Until the person or an administrator deletes it, the person is deactivated, or the organisation's data is deleted, whichever comes first.
• Withdrawing consent. The person can delete their voiceprint at any time, and an administrator can delete it for them. Deleting it does not undo what was done before.

To separate the speakers in a recording, meeting audio is also sent to the same provider.

How we use personal data, and why

• To provide the service under our agreement with you or your organisation: to capture and transcribe meetings, prepare proposed minutes, decisions and action items, collect approvals and signatures, send reminders and follow-ups, and show each person what they are allowed to see.
• To send the e-mails the service depends on: invitations, reminders, requests to sign, invoices and account notices. They are sent from no-reply@ariesai.ai.
• To bill for plans and keep the records that tax law requires.
• To keep the service secure and working, to prevent misuse and to keep the audit trail. This is our legitimate interest in running a safe service.
• To answer enquiries and arrange the demonstrations you ask for.
• To suggest speakers by voice, only with the explicit consent described above.
• To meet legal obligations and respond to lawful requests from authorities.

For data in a business account, the organisation decides its own legal basis for capturing its meetings, and we act on its instructions.

We do not sell personal data and we do not use it for advertising. We do not use customer meeting content to train AI models.

AI and automated processing

Aries Notes uses AI to transcribe recordings and dictation; to prepare proposed minutes, decisions and action items; to propose which committee a meeting belongs to; to translate between English and Arabic; to rewrite Arabic transcripts in Modern Standard Arabic where a committee asks for it; to make suggestions in the scheduling assistant; and, where speaker identification is on, to suggest who was speaking.

Everything the AI produces is a proposal for people to review. A person confirms every commitment before it binds anybody. No decision with legal or similarly significant effects on a person is made solely by automated means.

Who processes it for us

We share personal data only with the providers that help us run Aries Notes, under written agreements, and only as much as each one needs. They process it to provide their service to us under those agreements.

• Microsoft Azure: hosting of the application, database, file storage, encryption keys and logs, and the AI language and speech-to-text models.
• ElevenLabs: speech-to-text transcription of uploaded recordings, Notetaker audio and dictation.
• pyannoteAI: separating the speakers in meeting audio, and making and matching voiceprints.
• Microsoft 365: delivery of the e-mails we send.
• HyperPay: card payments.

When an organisation connects a meeting platform, such as Microsoft Teams, we read meeting details, recordings and transcripts from it on the organisation's instructions.

We may also disclose personal data where the law requires it, or to protect people's rights and safety. If Aries AI's business is reorganised or transferred, the data may pass to the successor under the same commitments.

Where your data is stored

Aries Notes runs on Microsoft Azure in the UAE North region. The database, file storage, applications, encryption keys and logs are all there. Each organisation has its own database schema and its own storage container.

Some processing happens outside the UAE:

• Transcription by ElevenLabs is processed outside the UAE.
• AI language models run on Microsoft Azure OpenAI. Our main model is deployed in UAE North on a global deployment type, so Microsoft may process a request in any of its regions. A speech-to-text model that can be used for transcription is deployed in Sweden Central, also on a global deployment type, so the same applies to it.
• Speaker separation and voiceprints are processed by pyannoteAI outside the UAE.
• E-mail delivery runs on Microsoft 365.
• Card payments are processed by HyperPay through its European endpoint.

Where personal data leaves the country it was collected in, each transfer is covered by contractual safeguards with the provider — the EU standard contractual clauses or the equivalent the applicable law provides — and we tell you which applies on request.

This describes our cloud service, which is how Aries Notes is provided by default. On request, and under a separate written agreement, Aries Notes can instead be deployed on an organisation's own infrastructure, on its premises or in its private cloud. The organisation's data then stays in that environment, and where it is hosted and which providers process it are as that agreement sets out.

How long we keep it

• While an account is open, its data is kept until the organisation deletes it. Meetings that form the official record — approved minutes, decisions, commitments and signatures — cannot be deleted by users, so the record stays complete.
• Recordings are kept until the meeting they belong to is deleted.
• Voiceprints are kept as described in their own section.
• When an account is closed, every sign-in ends at once. We delete the account's data within 90 days of closure, unless the law requires us to keep it longer. Backup and recovery copies are gone within a further 14 days.
• Technical logs are kept for 30 days.
• Invoices and billing records are kept for as long as tax law requires.

Before an account is closed, the organisation can ask us for a copy of its data, and we provide it on request in a commonly used, machine-readable form.

Security

• Connections to the service, the database and storage are encrypted.
• Data is encrypted at rest by our cloud provider.
• Passwords are stored only as Argon2id hashes.
• Credentials, connection secrets, access tokens and voiceprints are also encrypted by the application, with keys held in Azure Key Vault.
• Access inside an account follows each person's role and committee memberships.
• Every consequential action is written to an audit trail that cannot be edited.
• An account is locked after repeated failed sign-in attempts.

If we become aware of a personal data breach affecting your data, we tell the affected organisation without undue delay and in any case within 48 hours of becoming aware, and we notify authorities and the people affected where the law requires.

Your rights

Depending on the law that applies to you, you have the right to:

• access the personal data held about you and receive a copy;
• have inaccurate data corrected;
• have data deleted;
• restrict how it is used;
• object to its use, including use based on legitimate interests;
• receive the data you provided in a portable form;
• withdraw your consent at any time, for example by deleting your voiceprint;
• complain to the data protection authority where you live or work.

If your data is in a business account, send your request to that organisation: it decides what is held about you, and we help it answer. If you write to us instead, we pass your request on to the organisation. For data we hold as controller, write to us directly. We may ask you to confirm who you are, and we answer within the time the applicable law allows.

The laws this notice follows

Aries Notes is built to support its customers' obligations under the data protection laws of the places it is used in, including:

• the Jordanian Personal Data Protection Law No. 24 of 2023;
• the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data;
• the Saudi Personal Data Protection Law;
• the Egyptian Personal Data Protection Law No. 151 of 2020;
• the EU and UK General Data Protection Regulation, where they apply.

Where these laws differ, the law that applies to you decides your rights.

Children

Aries Notes is for organisations and adults. It is not directed to anyone under 18, and we do not knowingly collect their personal data.

Changes to this notice

We update this notice when the product or the law changes. The version and the date it applies from are shown at the top of this page. If a change is material, we tell account administrators by e-mail at least 30 days before it takes effect.

Contact us

We have not appointed a statutory data protection officer; privacy questions and requests go to info@ariesai.ai. We answer in English or Arabic, in the language you write in.