Privacy Policy
Effective June 18, 2026
1. Overview
This Privacy Policy describes how SpeechLP Inc. ("we," "us," or "our"), operating as EA AI, collects, uses, stores, shares, and protects your personal data when you use the EA AI service at eaai.io ("the Service"). EA AI is an AI-powered executive assistant that connects to your email, calendar, and messaging accounts to help manage your communications and schedule. This policy applies to all users of the Service regardless of location.
2. What Data We Collect
We collect and process the following categories of data:
Account Information
- •Name, email address, and profile picture from your Google or Microsoft account.
- •OAuth 2.0 tokens (access tokens, refresh tokens) for connected services, stored encrypted.
- •Account preferences and configuration settings.
Email Data
- •Email content (subject, body, headers) from Gmail and/or Outlook.
- •Email metadata: sender, recipients, timestamps, thread IDs, labels/folders.
- •Attachment metadata (file names, sizes, types). Attachment content is processed only when necessary for context.
- •Drafts created by EA AI on your behalf.
Calendar Data
- •Event details: title, description, location, start/end times, recurrence rules.
- •Attendee information: names, email addresses, RSVP status.
- •Free/busy availability information.
- •Calendar settings: timezone, working hours, notification preferences.
Messaging Data
- •LinkedIn message content and metadata from your inbox, accessed via authorized integration.
- •WhatsApp message content and metadata, accessed via authorized integration.
- •Instagram direct message content and metadata, accessed via authorized integration.
- •SMS and iMessage content relayed through the optional EA AI companion app on your Mac.
Meeting Recording Data (AI Notetaker)
- •Meeting audio and video, captured by a recording bot that joins the video meetings on your calendar when you have the notetaker enabled.
- •The transcript of the meeting, with a speaker label on each turn.
- •Notes generated from that transcript: a summary, the decisions reached, action items, and a draft recap message.
- •Meeting details: title, meeting link, platform, start and end time, organizer, recorded duration, and the email addresses of the attendees.
- •For meetings that include attendees outside your own connected addresses, publicly available background about those attendees and their companies, researched from the web before the meeting starts.
The notetaker is a feature you control. You can switch it off, limit it to meetings that have attendees outside your own addresses, have EA AI ask you each time instead of joining automatically, change the name the bot joins under, or skip a single meeting before it starts. Meeting audio and video are never stored on our infrastructure. Sections 10 and 11 describe where meeting data goes and how long it is kept.
Meeting Recordings: HIPAA Exclusion & Your Consent Responsibility
- •Meetings sit outside EA AI's HIPAA envelope. Meeting recordings, transcripts, and notes are excluded. No Business Associate Agreement covers them, and we do not handle meeting content as protected health information. Do not record meetings in which protected health information is discussed.
- •Obtaining consent is your responsibility. The bot announces itself by appearing in the participant list under a name you control, which by default is your first name followed by
's EA · eaai.io. That is a notice, not consent. Recording and notification requirements differ by jurisdiction, and some require every participant to agree before a call is recorded. Meeting those requirements for the meetings you record is up to you.
Usage Data
- •Actions approved, rejected, or modified through the EA AI interface.
- •Feature usage patterns and interaction logs.
- •Error logs and performance data for service reliability.
3. Google Account Data
When you connect your Google account, we request the following OAuth 2.0 scopes and use the data as described:
| Permission | What It Accesses | Why We Need It |
|---|---|---|
gmail.modify | Read, compose, send, and organize email | Analyze incoming mail, send approved replies, and manage inbox (mark read, apply labels) |
calendar.events | Read, create, update, and delete calendar events | View your schedule, check when you are busy so proposed meeting times never conflict, create, update, or cancel events on your behalf, and find the meetings the AI notetaker should join when you have enabled it |
4. Microsoft Account Data
When you connect your Microsoft 365 account, we request the following delegated permissions through the Microsoft Identity Platform (Microsoft Graph API):
| Permission | What It Accesses | Why We Need It |
|---|---|---|
Mail.Read | Read Outlook mail | Analyze incoming mail to generate proposals |
Mail.ReadWrite | Read & manage mail | Create drafts, organize inbox, manage folders |
Mail.Send | Send mail | Send approved replies and messages on your behalf |
Calendars.Read | Read calendar events | View events, check free/busy availability, and find the meetings the AI notetaker should join when you have enabled it |
Calendars.ReadWrite | Full calendar access | Create, update, and cancel events on your behalf |
User.Read | Basic profile | Account identification (name, email) |
offline_access | Refresh tokens | Maintain access without repeated sign-ins |
All Microsoft permissions are delegated(not application-level), meaning EA AI acts only on behalf of the signed-in user and cannot exceed the user's own access rights within their organization.
5. How We Use Your Data
We use your data exclusively for the following purposes:
- •Generating AI proposals: Reading and analyzing your emails and messages to draft context-aware replies and action items.
- •Calendar management: Checking availability, creating events, resolving scheduling conflicts, and managing attendees.
- •Executing approved actions: Sending emails, creating/updating/deleting calendar events, and sending messages that you have reviewed and approved.
- •Meeting notes: Recording, transcribing, and summarizing the meetings you choose to record; turning what was discussed into notes and action items; and preparing a recap you can send to the other attendees.
- •Meeting preparation: Researching publicly available background on attendees from outside your own addresses before a meeting starts, so you get a written brief beforehand.
- •Personalization: Learning your communication preferences, priorities, tone, and scheduling patterns to improve suggestions over time.
- •Service improvement: Analyzing aggregate, anonymized usage patterns to improve the Service. Individual user data is never used for this purpose without anonymization.
- •Account management: Processing payments, sending service notifications, and providing customer support.
6. Legal Basis for Processing
We process your data based on the following legal grounds:
- •Consent: You explicitly consent to data processing when you connect your accounts and grant OAuth permissions. You may withdraw consent at any time by disconnecting your accounts.
- •Contract performance: Processing your data is necessary to provide the Service you have subscribed to.
- •Legitimate interest: We have a legitimate interest in improving the Service, maintaining security, and preventing fraud, balanced against your privacy rights.
- •Legal obligation: We may process data to comply with applicable laws, regulations, or legal proceedings.
7. AI & LLM Processing
EA AI uses Anthropic's Claude API to process your messages and generate proposals. Here is how your data flows through our AI pipeline:
- •Input: Relevant email/message content and calendar context is sent to Anthropic's Claude API for inference.
- •Processing: The AI generates draft replies, scheduling suggestions, and action proposals.
- •No training: Per Anthropic's commercial API data policy, data sent through the API is not used to train their models.
- •Retention by Anthropic: Anthropic may retain API inputs and outputs for up to 30 days for trust and safety purposes, after which they are automatically deleted.
- •Meeting transcripts: The transcript of a recorded meeting is sent to Claude to produce the summary, decisions, action items, and draft recap.
- •Web search for meeting preparation: Before a meeting that has attendees outside your own addresses, EA AI asks Claude to research those attendees using Anthropic's server-side web search tool. The searches happen inside that one API call, they are capped at five per meeting, and no data is sent to a separate search provider. The queries the model runs are recorded in our application logs.
- •Data minimization: We send only the minimum context necessary for the AI to generate useful proposals. Full email histories and irrelevant data are not transmitted.
8. What We Don't Do
We make the following commitments about your data:
- •We never sell your personal data to anyone, for any reason, under any circumstances.
- •We never use your data to train AI/ML models. Your data is used for inference (generating suggestions) only.
- •We never share your data with third parties for their marketing or advertising purposes.
- •We never display advertising within the Service or use your data for ad targeting.
- •We never access your data beyond what is necessary to provide the Service, except as required by law.
9. How We Store & Protect Your Data
We implement multiple layers of security to protect your data:
- •Encryption at rest: All sensitive data (including OAuth tokens, email content, and personal information) is encrypted using AES-256-GCM with encryption keys unique to your account.
- •Encryption in transit: All data transmitted between your browser, our servers, and third-party APIs is protected by TLS 1.2 or higher.
- •Per-tenant key isolation: Each account has its own encryption key, stored separately from encrypted data. A breach of one tenant's key cannot decrypt another tenant's data.
- •Database isolation: We use Neon Postgres with Row-Level Security (RLS) to ensure your data is logically isolated from other users at the database level.
- •Access controls: Internal access to production data is restricted to authorized personnel, logged, and reviewed.
- •Token security: OAuth tokens are encrypted before storage and decrypted only at the moment of use. Tokens are never logged or exposed in plaintext.
10. Data Sharing & Third-Party Processors
We share your data only with the following categories of service providers, strictly as necessary to operate the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Anthropic | AI inference (Claude API), including the server-side web search used for meeting preparation | Email/message content for generating proposals; meeting transcripts for generating notes; the email addresses and domains of outside meeting attendees for pre-meeting research |
| Vercel | Application hosting | Application logs, request metadata |
| Neon | Database hosting | Encrypted user data |
| Stripe | Payment processing | Billing email, payment method (we never see full card numbers) |
| Gmail & Calendar APIs | OAuth tokens; data flows directly between you and Google | |
| Microsoft | Outlook & Calendar APIs (Graph) | OAuth tokens; data flows directly between you and Microsoft |
| Unipile | LinkedIn, WhatsApp & Instagram messaging; Gmail & Google Calendar for Google accounts connected through the recommended option in Connections | OAuth tokens for connected accounts; message, email, and calendar content synced for processing. Google accounts connected this way grant access to Unipile rather than to our own Google app, so your Gmail and Calendar data passes through Unipile. Google accounts connected with the direct-connect option do not involve Unipile at all. |
| Recall.ai | Meeting recording and transcription for the AI notetaker | The meeting link and the display name the bot joins under, plus the meeting audio and video captured while the bot is in the call, from which Recall.ai produces the transcript. Your email, calendar events, contacts, and attendee email addresses are not sent. Recall.ai deletes the recording 7 days after the meeting; see Section 11. |
| Resend | Transactional email delivery | Recipient email address and message content for system notifications (e.g., admin consent requests, briefing emails) |
Sharing Meeting Notes with Attendees
- •After a recorded meeting, EA AI prepares a recap message to the other attendees. It goes out from your own connected mailbox rather than from us, and by default it waits on your approval. You can change that setting so recaps send automatically.
- •The recap links to a notes page on eaai.io at an unguessable address. Before anyone signs in, that page shows only the meeting title and your name as the host.
- •To read the notes, a person must sign in and the verified email address on their account must be in the meeting's attendee list, or you must have granted that address access from the meeting's share panel. You can revoke access at any time, and a revoked address is blocked even if it is on the attendee list.
- •Someone with access can read the meeting title, your name as the host, how long the meeting ran, the summary, the decisions, and the action items. The full transcript is shown only if you turn on the setting that includes it. They cannot see the recording, the pre-meeting research, or anything else in your account.
- •We record the email address a recap was shared with, and when that person first and last opened the notes page, so you can see who has read them.
We may also disclose your data if required to do so by law, court order, or governmental request, or to protect the rights, property, or safety of SpeechLP Inc., our users, or the public.
11. Data Retention
- •Active accounts: Your data is retained for as long as your account is active and as necessary to provide the Service.
- •Meeting audio and video: Never stored on our infrastructure. The recording provider holds the media for 7 days after the meeting and then deletes it, and we set that 7-day limit explicitly on every recording we create. While it lasts, EA AI makes the recording available only to you, through your own dashboard; attendees who open the shared notes page are not given it.
- •Meeting transcripts, notes, and action items: Stored in our database, encrypted with your account key, and kept for as long as your account is active. They are not deleted when the recording expires, so your notes remain after the video is gone. Deleting your account deletes them under the rule below.
- •Account closure: Upon account closure, all associated data (encrypted content, OAuth tokens, preferences, usage history) will be permanently deleted within 30 days.
- •OAuth token revocation: When you disconnect an account or close your account, the associated OAuth tokens are revoked immediately and deleted.
- •Backup retention: Encrypted database backups may persist for up to 7 additional days after deletion for disaster recovery purposes, after which they are permanently purged.
- •Legal holds: We may retain data beyond the standard retention period if required by law or ongoing legal proceedings.
12. Your Rights
Regardless of your location, you have the following rights:
- •Access: Request a copy of the personal data we hold about you.
- •Export: Export your data at any time in a machine-readable format (JSON).
- •Rectification: Request correction of inaccurate personal data.
- •Deletion: Delete your account and all associated data.
- •Restriction: Request that we restrict processing of your data in certain circumstances.
- •Objection: Object to processing of your data based on legitimate interest.
- •Portability: Receive your data in a structured, commonly used, machine-readable format.
- •Withdraw consent: Withdraw your consent at any time by disconnecting your accounts or closing your account.
- •Revoke OAuth: Revoke access to Google, Microsoft, or LinkedIn at any time through EA AI settings or directly through those platforms.
To exercise any of these rights, contact us at shail@eaai.io. We will respond within 30 days of receiving your request.
13. Google API Services Limited Use Disclosure
EA AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- •We only use Google user data to provide and improve the user-facing features of EA AI that are prominent in the application's user interface.
- •We do not transfer Google user data to third parties unless: (a) it is necessary to provide or improve user-facing features prominent in the requesting application's interface; (b) it is necessary to comply with applicable law; (c) it is necessary for security purposes (e.g., investigating abuse); or (d) the user provides affirmative consent.
- •We do not use or transfer Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
- •We do not allow humans to read Google user data unless: (a) we have obtained the user's affirmative consent; (b) it is necessary for security purposes (e.g., investigating a security incident); (c) it is necessary to comply with applicable law; or (d) our use is limited to internal operations and the data has been aggregated and anonymized.
14. Microsoft Data Handling
EA AI complies with the Microsoft APIs Terms of Use and the following principles for Microsoft 365 data:
- •We use only delegated permissions (not application permissions), ensuring EA AI cannot exceed your own access rights.
- •We request only the minimum permissions necessary to deliver the Service.
- •We do not use Microsoft data for any purpose other than providing the EA AI service to you.
- •We do not cache or store Microsoft data longer than necessary for the stated purpose.
- •Microsoft organization administrators may revoke EA AI's access for their entire tenant at any time through the Azure AD admin portal.
- •We fully support Microsoft's admin consent workflow for organizations that require IT administrator approval before granting third-party app access.
15. International Data Transfers
EA AI is operated by SpeechLP Inc. from Canada. Your data may be processed and stored in Canada and the United States (where our infrastructure providers operate). For users in the European Economic Area (EEA), United Kingdom, or other regions with data transfer restrictions, we ensure appropriate safeguards are in place, including reliance on Standard Contractual Clauses (SCCs) and our processors' adequacy determinations. Canada has received an adequacy decision from the European Commission, meaning transfers to Canada are permitted under GDPR.
16. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- •Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
- •Right to delete: You may request deletion of your personal information, subject to certain exceptions.
- •Right to correct: You may request correction of inaccurate personal information.
- •Right to opt-out of sale/sharing: We do not sell or share your personal information, so this right is automatically satisfied.
- •Non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
We do not sell personal information. We do not use or disclose sensitive personal information for purposes other than providing the Service.
17. European Privacy Rights (GDPR)
If you are in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):
- •All rights listed in Section 12 above, plus the right to lodge a complaint with your local data protection authority (supervisory authority).
- •The right to restrict processing while we verify your rectification or objection request.
- •The right not to be subject to automated decision-making with legal or significant effects. EA AI's proposals are suggestions only and do not constitute automated decision-making under GDPR Article 22, as all actions require human approval.
Our data controller is SpeechLP Inc. For GDPR inquiries, contact shail@eaai.io.
18. Canadian Privacy Rights (PIPEDA)
As a Canadian organization, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA:
- •We collect personal information only for identified purposes and with your knowledge and consent.
- •We limit collection to what is necessary for the identified purposes.
- •We retain personal information only as long as necessary to fulfill the purposes for which it was collected.
- •You may challenge the accuracy and completeness of your personal information and request amendments.
- •You may file a complaint with the Office of the Privacy Commissioner of Canada if you believe we have not complied with PIPEDA.
19. Children's Privacy
EA AI is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at shail@eaai.io.
21. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes at least 30 days in advance via the email address associated with your account. The "Effective" date at the top of this page will be updated. We encourage you to review this policy periodically. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
22. Contact & Data Protection
For privacy questions, data access requests, or to exercise any of your data rights, contact us:
We will acknowledge your request within 5 business days and provide a substantive response within 30 days. If we require additional time, we will notify you of the reason and expected timeline.