DRAFT under legal review: this document is not final yet and may change.
Privacy notice — Dictavo
DRAFT for legal review (version 2026-10-28-borrador). Not a final document. Items in [BRACKETS] must be
completed or confirmed before publication. The Spanish version governs in Mexico.
Last updated: October 28, 2026.
1. Who is responsible
[DEVBOX LEGAL NAME] ("DevBox"), located at [STREET, NUMBER, NEIGHBORHOOD, ZIP], Querétaro, Querétaro, Mexico, is the controller (responsable) of the personal data of people who use Dictavo ("Users") under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties published on March 20, 2025 (the "LFPDPPP").
Privacy contact: [PRIVACY EMAIL] · [PHONE] · [PERSON OR TEAM IN CHARGE OF PERSONAL DATA].
Two different roles. For the data of people who take part in a client's meetings (for example, that client's own customers), the company that subscribes to Dictavo is the controller and DevBox acts as processor (encargado): it processes that data only on the client's behalf and instructions (see the Terms of use). This notice explains both so anyone can see what happens to their data.
2. What personal data we process
| Category | Examples | Whose |
|---|---|---|
| Account data | name, display name in calls, company, email, settings | Users |
| Voice and call audio | the live audio of the meeting | Users and participants |
| Transcripts | the text of what is said, with the speaker's name or channel | Users and participants |
| Names and meeting metadata | names in the participant list, link, platform, date, time and duration | Users and participants |
| Shared-screen images (silent mode, optional) | captures of the meeting window, analyzed and not stored | Users and participants |
| Knowledge files the client uploads | service descriptions, case studies, proposals, client notes; only their text is kept, on the User's device (the original is not kept) | Client (may contain third-party data) |
| Internet search queries | the search phrase (e.g. "what does Grupo Herdez do") | Users |
| Technical data | diagnostic logs without call content, app version | Users |
Sensitive data. Dictavo does not create voiceprints or biometric templates and does not identify people by their voice: it knows who is speaking from the channel (the User's microphone or the call audio) or from the name the meeting platform shows. Dictavo is not designed to process health data, children's data or other sensitive data, and the Terms of use prohibit using it for that.
3. Why we use the data
Primary purposes (needed for the service): transcribing the meeting in real time and showing the User suggestions, answers, alerts and summaries; letting the Dictavo agent answer aloud or in the chat when the User asks; keeping the meeting history on the User's device and generating summaries, open questions and the project requirements pack; searching the internet when asked (only the query is sent); support, troubleshooting, security and legal compliance.
Secondary purposes (not needed for the service): aggregate usage and cost measurement to improve the service; product news. You can opt out at [PRIVACY EMAIL] without affecting the service.
No model training on client data. DevBox does not use the client's audio, transcripts, files or outputs to train AI models unless the client expressly opts in in writing.
4. Who we share data with (subprocessors and transfers)
| Provider | Purpose | Receives | Location |
|---|---|---|---|
| Recall.ai, Inc. | connects the agent to the meeting (Zoom, Meet, Teams) | meeting link, agent name; streams the audio live | US (us-west-2) |
| Deepgram, Inc. | speech-to-text | live call audio | US |
| Anthropic, PBC (Claude) | analysis, suggestions, answers, summaries, web search | conversation text, notes, company and client knowledge, screen images (optional), search queries | US |
| ElevenLabs, Inc. (or OpenAI / Cartesia if the client chooses) | the agent's voice | only the text the agent is about to say | US / [CONFIRM region] |
| Cloudflare, Inc. | encrypted tunnel carrying the agent's audio to the User's device | encrypted traffic in transit | global |
Recall.ai stores no audio or video. Every agent is created with Zero Data Retention (retention: null): audio only passes through live. Dictavo refuses to send an agent that would record. Recall keeps technical data only.
International transfers. These providers are in the United States. The transfers are needed to deliver the service and are made to processors acting for DevBox and the client [REVIEW applicable LFPDPPP 2025 article]. DevBox does not sell personal data or share it for advertising. Deepgram does not use our audio to improve its models: every transcription connection opts out of its Model Improvement Program (mip_opt_out=true); per Deepgram, audio from those requests is retained only as long as needed to process them. Other providers' retention: [REVIEW each contract].
5. How long we keep data
Audio and video: never stored (neither by Dictavo nor by Recall.ai). Transcripts, analysis and summaries: stored on the User's device, not on DevBox servers, and deleted automatically after 180 days (configurable; 0 keeps them). Users can delete one meeting or all of them at any time (Settings › Privacy › "Delete all my sessions"). Screen images: not stored unless the client turns it on. Account data: while the account is active and as required by law.
6. Your rights in Mexico (ARCO)
You may Access, Rectify or Cancel your data, Object to its processing, revoke consent or limit its use, by writing to [PRIVACY EMAIL] with your name and contact, proof of identity (or your representative's), the data and the right concerned. We answer within 20 business days [REVIEW 2025 deadlines]. If you took part in a meeting of a Dictavo client, that client is the controller: address your request to them; if you write to us we will forward it and help them answer. You may also go to the Secretaría Anticorrupción y Buen Gobierno, the data protection authority for private parties since the 2025 reform.
7. California and other US residents
If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, its sources, purposes and recipients; to access, delete and correct it; to opt out of its sale or sharing for cross-context behavioral advertising (DevBox does not sell or share personal information); to limit the use of sensitive personal information (DevBox does not use it to infer characteristics); and to non-discrimination for exercising these rights. You or an authorized agent can exercise them at [PRIVACY EMAIL]; we verify identity and respond within 45 days. For client meeting data DevBox acts as the client's service provider. Residents of other states with similar laws can use the same channel. [REVIEW: CCPA thresholds and Notice at Collection.]
8. Cookies
The Dictavo app runs on the User's device and uses no advertising or tracking cookies; only a local technical cookie that protects the panel.
9. Changes
We publish changes in the app and at [NOTICE URL]. For material changes the app asks for acceptance again.