How Rithmo Handles Your Data

Rithmo, Inc. ("Rithmo," "we," "us," or "our") provides an AI-enabled meeting governance platform that helps organizations coordinate meetings, transcribe meeting activity, generate meeting outputs, analyze meeting effectiveness, and support meeting-related workflows.

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you visit our website, use our applications, participate in meetings where Rithmo is enabled, connect third-party services, or otherwise interact with Rithmo.

Rithmo is designed for organizations that want the benefits of AI-assisted meeting operations while maintaining control over sensitive meeting content, business context, and customer-facing outputs. Because our service may process meeting audio, transcripts, agenda content, calendar metadata, meeting outputs, and other sensitive business information, we use that information for defined product, security, compliance, and customer-authorized purposes.

This Privacy Policy applies to information processed through:

• the Rithmo website;
• the Rithmo web dashboard;
• the Rithmo in-meeting experience;
• integrations with meeting, calendar, transcription, AI, communication, storage, and workflow providers;
• customer support, sales, security, and administrative interactions; and
• product telemetry, logs, and analytics associated with the Rithmo service.

For business customers, Rithmo generally acts as a service provider or processor for Customer Content that we process on behalf of the customer. The customer controls how its authorized users use the service, what meetings are connected, what integrations are enabled, and what retention or administrative settings apply where supported.

If you use Rithmo through your employer or another organization, that organization may be responsible for determining how your information is processed through the service. You should contact that organization for questions about its internal use of Rithmo.

• Account Data means information used to create, manage, secure, and support a Rithmo account, such as name, email address, organization, role, authentication data, and account settings.
• Customer Content means content submitted to, captured by, generated through, or processed by Rithmo on behalf of a customer such as meeting audio, transcripts, segments, speaker labels, meeting chat or messages where enabled, agenda content, calendar metadata, uploaded documents, summaries, decisions, action items, follow-ups, analytics, AI outputs, and related artifacts.
• Meeting Data means Customer Content and metadata for a meeting, including identifiers, title, agenda, duration, participants, speaker activity, transcript data, bot status, outputs, and workflow data.
• Derived Data means information generated from Customer Content (summaries, action items, decisions, scorecards, analytics, recommendations, longitudinal customer-scoped learning records).
• Usage Data means how users and systems interact with Rithmo: logs, browser type, IP, device info, timestamps, feature usage, errors, latency, security telemetry.
• AI Provider means a third-party that supplies AI/ML, speech-to-text, TTS, embeddings, summarization, classification, or related model capabilities for Rithmo.

4.1 Account Data

We may collect Account Data when you create an account, authenticate, join a workspace, interact with support, or administer the service:

• name;
• email address;
• password or credential information where that sign-in mode is enabled;
• organization or workspace affiliation;
• role, permissions, and administrative settings;
• identifiers or profile-aligned fields from third-party services when you authorize OAuth integrations (for example calendar or meeting-platform connections), limited to what those providers disclose;
• billing or subscription contacts where applicable; and
• support communications and related metadata.

Depending on deployment, sign-in may include email/password flows, bearer or session credentials, or other mechanisms your administrator enables.

We do not intentionally store reusable raw passwords except as strong one-way cryptographic hashes where modern password authentication applies. Secrets are handled using appropriate safeguards.

4.2 Meeting Data and Customer Content

We may process Meeting Data including:

• titles, identifiers, join info, agenda, type, scheduled time, duration, recurrence, location, organizer;
• participant names, speaker labels, attendance and activity;
• meeting audio where transcription, bot, recording, or speech features are enabled;
• transcripts, segments, timestamps, speaker turns, transcription metadata;
• decisions, action items, follow-ups, summaries, recaps, scorecards, outputs;
• meeting chat or messages where enabled;
• uploaded or linked documents where document features are enabled;
• customer policy, governance, and workflow configuration; and
• Derived Data from activity.

What we process depends on enabled features, integrations, and settings.

4.3 Calendar and Integration Data

If you connect third-party services, we may process:

• OAuth codes, tokens, refresh tokens, credentials;
• calendar IDs, titles, times, attendees, organizers, locations, descriptions;
• Zoom or platform IDs, lifecycle events, bot or moderation state;
• transcript/speech/bot events from ingestion providers;
• messaging/email/workflow metadata where integrations enable it;
• sync state, integration status, errors, operational logs.

Integration data is used for the integration and related security, debugging, support, and compliance.

4.4 Usage Data, Logs, and Security Data

We collect Usage Data such as:

• IP address, browser, OS, identifiers;
• pages, features, actions;
• timestamps, request metadata, errors, performance;
• authentication and security events;
• API and model usage, token counts where available, latency, fallbacks, provider health; and
• audit logs for configuration, integrations, admin actions.

We aim to minimize unnecessarily sensitive payloads in routine logs. Troubleshooting, incidents, customer-approved support, or narrowly scoped QA may capture excerpts where needed depending on the environment and agreements.

4.5 Website and Marketing Data

We may collect contacts, demo requests, usage of our marketing site, device data, and communication preferences. We use cookies or similar technologies for essential site functions, analytics, performance, or marketing consistency with your settings where applicable.

For the current named vendors (analytics, CRM, pixels, automation), contact privacy@rithmo.ai — we can provide an updated list on request.

5.1 Provide and Operate the Service

• accounts and authentication;
• integrations and meetings;
• audio, transcripts, agendas, metadata;
• outputs and dashboard/in-meeting experience;
• governance workflows and support.

5.2 AI-Enabled Features

We use Customer Content and Derived Data for transcription, summaries, facilitation, extraction, recommendations, document intelligence, embeddings, TTS, and related features — sometimes through external providers under contracts and controls designed to protect Customer Content.

5.3 Security and Abuse Prevention

Fraud and abuse detection, auth verification, workspace protection, reliability monitoring, and terms enforcement.

5.4 Improve and Develop

Usage Data, feedback, support, configuration, aggregates. We do not use Customer Content to train general-purpose models except where expressly covered in posted terms or a separate written program with controls.

5.5 Communicate

Administrative notices, updates, alerts, billing, announcements related to Rithmo.

5.6 Legal and Contractual

Compliance, agreements, lawful requests, rights and safety.

Rithmo may use external AI, speech, bot, and infrastructure providers. Principles:

6.1 Purpose Limitation

Customer Content goes to providers to deliver, secure, support, or improve enabled features per contract and lawful instructions unless otherwise authorized.

6.2 Training Posture

We do not rely on identifiable Customer Content to train general-purpose models in ordinary operations. Vendor APIs, enterprise settings, and written agreements are selected to narrow provider reuse; validate your stack with counsel.

6.3 Minimization

We aim to send only what the task reasonably requires.

6.4 Scrubbing

Where feasible we minimize/redact/pseudonymize before external inference. Controls vary by feature, routing, prompting maturity, and deployment.

6.5 Identifiers

We aim to avoid unnecessary correlation IDs in free text; structured offline tasks may still bundle JSON fields with context when needed for fidelity, audit, or reliability.

6.6 Tenant Isolation

One customer's meeting content is not used to produce another customer's outputs; context is scoped to the relevant tenant and meeting surfaces.

6.7 Vendor Retention

We use contractual and technical arrangements to narrow reuse; vendor-specific configurations (such as API no-retention or reduced retention offerings) depend on commercially available programs.

6.8 Telemetry

We record operational telemetry for model traffic — for example vendor, task type classification, model identifier, timestamps, latency, tokens when vendors return them, request/correlation IDs, and meeting identifiers in structured logs — for reliability, metering, governance, not line-by-line content review. Richer categorical metadata may evolve over time.

• sell Customer Content;
• treat undisclosed vendor model training on Customer Content as acceptable — we align deployments and contracts to minimize unintended reuse;
• cross-customer leakage of outputs;
• blanket disclosure to every subprocessor — only actors needed for activated features participate;
• silent application of deferred learning outputs where product design expects guardrails;
• knowingly disclose Customer Content outside this Policy, lawful service delivery, authorization, or legal compulsion.

• Customer and authorized users according to RBAC and org settings.
• Providers and subprocessors under contracts — for meetings, bots, speech, AI, calendar, infra, DB, queues, mail, observability, support, advisers.
• Integrations enabled by customers.
• Legal, safety, compliance when reasonably necessary.
• Business transfers subject to confidentiality and safeguards.

Enterprise subprocessor schedules or DPAs may exist separately — contact legal@rithmo.ai.

We retain data as needed to operate the service, meet legal/regulatory obligations, resolve disputes, enforce contracts, secure systems, and honor customer-controlled settings. Raw meeting artifacts may live for shorter periods than Derived outputs used for continuity. Credentials exist while integrations run. Logs roll per operational schedule. Deleted data may persist briefly in backups until overwritten unless law/contract mandates earlier handling.

Depending on plan and configuration, admins may tune recording/transcription/bots/analysis, scopes, retention defaults, integrations, AI usage, sensitivity policies, access levels. Administrators align with their internal policies.

Measures may include:

• encryption in transit and at rest where supported;
• application-layer encryption for selected credentials/content;
• access controls, auth, token handling;
• structured logging within the bounds described in Sections 4.4 and 6.8;
• secure SDLC, monitoring, incident response.

No system is perfectly secure — protect credentials.

Processing may occur in the United States and other countries where we or subprocessors operate. Laws may differ from your home jurisdiction. Where required we use appropriate safeguards — contractual clauses, DPAs, SCCs, or other lawful mechanisms. Regional hosting or data residency may be available under enterprise agreements; ask your account contact or legal@rithmo.ai.

Depending on location you may access, correct, delete, object/restrict, port, withdraw consent where applicable, or complain to regulators. Organizational users — we may coordinate with your admin.

Contact privacy@rithmo.ai. We may verify identity before responding.

Your employer/host may decide whether Rithmo runs, what is captured, retention, integrations, outputs, audiences. Employees should contact that organization first.

Rithmo targets business audiences and is not directed to children under 13 (United States COPPA framing) nor to knowingly collect children's data outside lawful, customer-directed enterprise contexts where the customer bears compliance duties. Parents or guardians who believe information was submitted in error should contact privacy@rithmo.ai.

We may update this policy; we will revise the Last updated date. Material changes may get additional notice in-product, by email, or via administrators. Continued use after effectiveness applies the revision subject to law and contracts.

• Rithmo, Inc.Postal address: available upon written request via privacy@rithmo.ai until a public mailing address is published here.
• Privacy: privacy@rithmo.ai
• Legal / DPAs: legal@rithmo.ai
• Security: security@rithmo.ai