Lansy Privacy Policy
Last updated: November 3, 2026
This Policy replaces the Privacy Policy dated 8 June 2026.
1. Who we are and what this Policy covers
1.1 Lansy is a service that helps businesses improve the quality of service their staff provide by analysing conversations with AI. Lansy is provided by COLLABO TECH LTD, a company registered in the Dubai International Financial Centre ("DIFC") under licence number CL12226, with its registered office at Unit IH-00-01-03-OF-05, Level 3, IH-00-01CP-05, Dubai International Financial Centre, Dubai, United Arab Emirates ("Lansy", the "Company", "we", "us" or "our").
1.2 This Policy explains how personal data is processed when you visit lansy.ai, use the Lansy platform, the Lansy Desk application or demonstrations, work for a Client, or are a Customer of a Client.
1.3 We process personal data in two different roles, and your rights and the right point of contact depend on which one applies:
(a) We decide how and why (we are the controller) when we run our website, manage accounts, provide demonstrations, bill our Clients and keep our service secure. Part A of this Policy applies.
(b) A business that uses Lansy decides how and why (that Client, our "Client", is the controller and we act as its processor) when we analyse conversations between its staff and its customers, guests, patients, students or other people it serves ("Customers"). Part B of this Policy applies. In that case the Client's own notice is the primary source of information and the Client is your first point of contact. Part D sets out the data processing terms that apply between Lansy and its Clients.
2. Summary
| If you are | Who is responsible | What we process | Where to go |
|---|---|---|---|
| A visitor to our website or a business contact | Lansy | Contact details, enquiry content, technical data, cookies | Part A, privacy@lansy.ai |
| A user of a business account on the Lansy platform | Lansy for account data; the Client for the content of conversations | Account and usage data | Parts A and B |
| A user of Lansy Desk | Lansy; if you use Lansy Desk under your employer's account, your employer for the content of recordings | Account, billing and usage data; your recordings, transcripts and summaries | Part A, section 5 |
| A participant in a meeting or call recorded with Lansy Desk | The Lansy Desk user who recorded it and Lansy, as explained in section 5 | Your voice and words in the recording, the transcript and summary | Section 5; the person who recorded you first |
| An employee of a Client | Your employer (the Client) | Account data, de-identified transcripts of your conversations, service-quality scores and feedback, a voice profile only if you separately agree | Part B; your employer first |
| A Customer of a Client: a customer, guest, patient or other person served by a business that uses Lansy | That Client | Your speech while you talk to staff: processed only on a device at the premises, or, if you have signed a consent form, recorded and stored in Lansy's cloud, as described in Part B | Part B; the Client first |
PART A. WHEN LANSY IS THE CONTROLLER
3. Website visitors and business contacts
3.1 When you fill in a form, book a demonstration, write to us or meet us, we process your name, company, role, business email and phone number, and anything you choose to tell us.
3.2 When you visit lansy.ai, we automatically collect your IP address and approximate location (country or city), device and browser information, pages visited, referral source and similar information through cookies and similar technologies.
3.3 We use this data to respond to you and take steps before a contract (legitimate interests or pre-contractual steps), to run and improve the website (legitimate interests), to measure website performance (legitimate interests, and consent where cookies require it), to send marketing messages (consent where the law requires it, and you can unsubscribe at any time) and to comply with the law (legal obligation).
3.4 We use strictly necessary cookies, analytics cookies and, with your consent, marketing cookies. You can change your choices through the cookie banner or your browser settings. Details are in our Cookie Policy at https://lansy.ai/legal/cookies.
4. Account holders and authorised users
4.1 When a business opens a Lansy account, or an employee is given access to the Lansy platform or application, we process account data (name, work email, role, location, language, login identifiers), access and security logs, support communications and settings.
4.2 We use this data to provide and administer the account, authenticate users, provide support, keep the service secure and prevent misuse, notify users about changes and comply with the law. Our legal bases are the performance of our contract with the Client, our legitimate interests in running a secure service, and legal obligation.
4.3 The content that users see in the account, such as transcripts, scores and feedback, is processed on behalf of the Client under Part B.
5. Lansy Desk
5.1 Lansy Desk is an application for recording, transcribing and summarising meetings and calls. It is available to individuals and businesses under the Lansy Desk Terms at https://lansy.ai/desk/terms.
5.2 Your account and payments. We process your name, email address, login identifiers, language and settings, usage data and support communications to provide Lansy Desk to you under the Lansy Desk Terms (contract), to keep it secure (legitimate interests) and to comply with the law (legal obligation). Paid plans are paid through a third-party payment processor listed on our sub-processor page referred to in section 14.2, which processes payment card details under its own privacy policy. We receive only the information needed to manage your subscription, such as the plan, the payment status, the last four digits and the expiry date of the card, and the billing address, and we use it to charge for and renew subscriptions, issue invoices and refunds, prevent fraud and keep accounting records.
5.3 Your recordings. When you record or upload a meeting or call, we store the audio, transcribe it, separate the speakers and prepare summaries and other results with AI, including AI models of third-party providers described in section 10.4, so that we can provide Lansy Desk to you. Where you use Lansy Desk for yourself, we process your recordings as controller to provide the service you have asked for (contract). Where you use Lansy Desk under an account provided by your employer or another Client, that Client is the controller of the recordings and Part B applies.
5.4 Other participants. If you record other people, you must tell them before recording and obtain their consent where the law requires it. Lansy Desk prompts you to do so. If you are a participant who was recorded, you can contact the person who recorded you or us at privacy@lansy.ai; we will help, taking into account that the recording belongs to that person's account.
5.5 Retention. Audio is kept for the period shown in the app settings, and by default 30 days, and transcripts and summaries until you delete them or close your account. After you close your account, your data is deleted within 30 days, except billing records, which we keep for the period required by accounting and tax law.
5.6 We do not use your recordings, transcripts or summaries to train AI models, we do not sell them and we do not use them for advertising.
6. Security and service operation
6.1 We process technical data about the operation of the Lansy equipment and platform, such as device status, error logs and security events, to keep the service secure, detect and investigate incidents and improve reliability. Where this data relates to an identifiable person, our legal basis is our legitimate interest in running a secure and reliable service. We do not use the content of conversations for this purpose.
PART B. WHEN LANSY PROCESSES DATA FOR A CLIENT
7. Who is responsible
7.1 When a Client uses Lansy to analyse conversations, the Client decides whether, where and why Lansy is used and which setup is used. The Client is the controller of your personal data and the deployer of Lansy as an AI system. We act as its processor and the operator of the AI system, and we process your data only on its instructions.
7.2 The Client must tell you about the processing before it starts, through signs and a notice or through a consent form, depending on the setup it uses. The Client's notice tells you its identity and contact details, the purposes, the legal basis and how to exercise your rights. This Part explains how Lansy itself handles the data.
7.3 We do not use the data we process for a Client for our own purposes. We do not sell it, we do not use it for advertising and we do not use it to train AI models.
8. How the Lansy service works
8.1 The common steps. In every setup, Lansy turns the conversation into text, separates the speakers and their roles (staff member or other participant), removes names, phone numbers, card numbers, addresses and other identifiers from the text, and analyses the text against the Client's service standards to produce service-quality indicators, scores and feedback for the Client and its staff.
8.2 The setups. The Client uses one or both of the following setups. The Client's notice or consent form tells you which one applies to you.
(a) On-device processing with notice. A microphone worn by a staff member or placed at a service point is connected to a small computer on the Client's premises. The sound is held only in the computer's temporary memory for a few minutes while it is converted into text and is not saved as an audio file. Your words are analysed on that computer, and the text of your words is deleted on it once the service-quality indicators have been extracted. Signs tell you about the processing before the conversation, and you can object at any time by telling a staff member, who then switches the device off.
(b) Written consent with cloud processing. Before your conversation is recorded, you are asked to sign a consent form, on paper or electronically, for example at a clinic, a school or a business meeting. Nothing is recorded unless you sign. The sound of the conversation is captured by a microphone, by a recording device connected to a Lansy base station or by the Client's own cameras or audio system, and is sent in encrypted form to Lansy's cloud in the United Arab Emirates, where the audio recording is stored and is transcribed and analysed. The consent form tells you what is recorded, for what purposes, how long the recording is kept, who can listen to it and how to withdraw your consent. If the Client's cameras are used, Lansy receives only the sound, not the video, unless the consent form says otherwise.
8.3 What is sent to the cloud. In setup (a), only service-quality indicators derived from your part of the conversation, which do not contain your name or other identifying details, leave the device. The de-identified or pseudonymised text of the staff member's words, the indicators, and technical information about the conversation (date, start and end time, device) are sent in encrypted form to Lansy's cloud. In setup (b), the audio recording of the whole conversation, its transcript, the results of the analysis and technical information about the conversation are stored in Lansy's cloud.
8.4 De-identification is automatic. Identifiers are removed by software. It is reliable but not perfect, so please avoid sharing sensitive details, such as health information or card numbers, in a conversation that is being processed.
9. Voice and biometric data
9.1 Staff members. Lansy creates a voice profile, which is a digital representation of the characteristics of a person's voice, only for a staff member who has given separate explicit consent in the Lansy platform or in another documented form. The voice profile is used only to recognise that staff member's speech and attribute it to them. A staff member can withdraw that consent at any time; the voice profile is then deleted within 10 business days and their speech is no longer attributed to them by voice.
9.2 Customers. Lansy does not create voice profiles of Customers and does not identify them by their voice. To tell staff members' speech apart from yours, Lansy temporarily compares the characteristics of the voices in the conversation with the voice profiles of staff members who have consented. In setup (a), this happens on the device, and the characteristics of your voice are held only in its temporary memory and are not stored or sent anywhere. In setup (b), this happens in Lansy's cloud; the characteristics of your voice are used only for that comparison and are not kept as a voice profile, although the audio recording itself is stored as described in section 12.
10. Use of AI
10.1 Lansy uses automated systems for speech recognition, speaker separation, de-identification and the analysis of text against the Client's service standards. Some of these systems run on the device at the Client's premises and some in Lansy's cloud.
10.2 The purposes of the AI are set by people: the Client sets its service standards and evaluation criteria, and Lansy configures the system to assess conversations only against them. The AI cannot set new purposes on its own.
10.3 The AI produces service-quality indicators, scores, summaries and suggestions for improvement. They are used by the Client to monitor service quality, give feedback to its staff and train them. They are not used to make decisions about Customers.
10.4 The analysis of de-identified or pseudonymised text of conversations may be carried out by AI language models of third-party providers that act as our sub-processors and are listed on our sub-processor page referred to in section 14.2. These providers receive text from which names and contact details have been removed, process it only to return the analysis to us, are contractually prohibited from using it to train their models and do not keep it longer than needed to provide their service. No audio and no voice characteristics are sent to them in any setup.
10.5 A business must not make a decision about a staff member that has legal or similarly significant effects based solely on Lansy's output, and a person must review the output before it is used for such a decision. A staff member can ask the Client to have a person review any output about them and can challenge it.
10.6 Lansy is designed according to principles of purpose limitation, data minimisation, human oversight, transparency and security. Safeguards built into the system include on-device processing, automatic de-identification, short retention of sound, encryption, role-based access and logs of consents.
10.7 In setup (a), because sound is not stored and identifiers are removed, it may be impossible to find or provide data about a particular Customer after the conversation. This affects the practical exercise of rights such as access and erasure, as explained in section 13.
11. Data we process for Clients
| Staff members | Customers | |
|---|---|---|
| Data | Name, work email, role, location; de-identified or pseudonymised transcripts of their words in setup (a), and audio recordings and transcripts in setup (b); service-quality indicators, scores and feedback; conversation metadata (date, time, device); consent records; voice profile only with explicit consent | Speech held in device memory for a few minutes; text of their words until indicators are extracted (setup (a)); service-quality indicators that do not identify them (setup (a)); audio recordings of the conversation, transcripts, results of the analysis and the signed consent or a record of it (setup (b)) |
| Purpose | Assessing conversations against the Client's service standards, feedback, coaching and team reports | Assessing the service provided in the conversation, as described in the Client's notice or consent form |
| Legal basis (decided by the Client) | Usually consent; explicit consent for voice profiles | Setup (a): legitimate interests where the law allows it, or consent; setup (b): consent |
12. How long data is kept
12.1 Unless the Client's notice, consent form or contract provides otherwise:
(a) sound in setup (a) is held for a few minutes while it is transcribed and is cleared when the device is switched off;
(b) the text of a Customer's words in setup (a) is deleted on the device once the service-quality indicators have been extracted;
(c) audio recordings in setup (b) are kept for as long as the Client's contract with Lansy is in force and are deleted within 30 days after it ends;
(d) transcripts, indicators, scores, feedback and reports are kept for as long as the Client's contract with Lansy is in force and are deleted within 30 days after it ends;
(e) a staff member's data is deleted within 10 business days after they withdraw consent in the Lansy platform or the Client asks for it, and a voice profile within 10 business days after the consent to it is withdrawn;
(f) in setup (b), a Customer's audio recordings and transcripts are deleted within 10 business days after the Client informs Lansy that they have withdrawn consent; and
(g) consent records are kept for as long as the related data is processed and for any longer period the law requires, so that consent can be demonstrated.
12.2 Account data is kept for as long as the account is active and for up to 3 years afterwards to deal with claims and legal obligations. Billing records are kept for the period required by accounting and tax law. Website enquiries are kept for up to 2 years after our last contact with you.
13. Your rights in Part B
13.1 Because the Client is the controller, please send requests about your data to the Client first. We help the Client respond. If you contact us directly, we pass your request to the Client, unless you use a function we provide for that purpose, such as withdrawing your consent in the Lansy platform.
13.2 Customers: in setup (a), the text of your words is deleted shortly after the conversation and nothing that identifies you is kept, so in most cases neither the Client nor Lansy will be able to find data about you afterwards. On request, the Client will explain what data, if any, it holds and why it may be unable to identify records about you. In setup (b), the recording and transcript of your conversation are stored and linked to your consent, so you can ask the Client for access to them, a copy or their deletion, and withdraw your consent at any time.
PART C. GENERAL
14. Who we share data with
14.1 We share personal data only with: our sub-processors and other service providers, such as providers of cloud hosting, AI models, payment processing, email, customer support and website analytics; the Client for which we process data under Part B; professional advisers bound by confidentiality; a buyer or successor of our business, subject to this Policy; and regulators, courts and law enforcement authorities where the law requires it.
14.2 The current list of our sub-processors, what they do and where they process data is available at https://lansy.ai/subprocessors. We inform the Clients we work for about changes to this list through a notice in the Lansy platform once a quarter.
15. Where data is processed and international transfers
15.1 We store and process personal data in the United Arab Emirates, except where the sub-processor list states that a provider processes it in another country.
15.2 When we transfer personal data out of the DIFC, or out of another jurisdiction that restricts transfers, we do so only in accordance with the applicable data protection law, for example to a jurisdiction recognised as providing adequate protection or under standard data protection clauses adopted by the DIFC Commissioner of Data Protection.
16. Security
16.1 We protect personal data with technical and organisational measures appropriate to the risk, including on-device processing in setup (a), encrypted transfer and encrypted storage of audio recordings with logged access in setup (b), automatic de-identification, encryption of devices and of data in transit and at rest, protected device settings and remote lock and wipe, role-based access, multi-factor authentication for our personnel, access logging, separation of each Client's data, backups and an incident response procedure.
16.2 If a personal data breach affects data we process for a Client, we inform that Client without undue delay so that it can meet its obligations. If a breach affects data for which we are the controller, we notify the regulator and affected individuals where the law requires it.
17. Your rights
17.1 Depending on the law that applies, you may have the right to: be informed about the processing; access your personal data and receive a copy; have it corrected or completed; have it erased; restrict its processing; object to processing based on legitimate interests, including at any time to direct marketing; receive it in a portable format; withdraw consent at any time, without affecting processing before the withdrawal; not be subject to decisions based solely on automated processing that have legal or similarly significant effects; and ask for a person to review, and challenge, the outcome of processing by an AI system.
17.2 For processing under Part A, contact us at privacy@lansy.ai or by post at the address in section 1. We respond within one month, which may be extended where the law allows. We may ask you to confirm your identity. For processing under Part B, see section 13.
17.3 If you are not satisfied, you can complain to the authority that supervises the processing, for example the DIFC Commissioner of Data Protection, the ADGM Office of Data Protection, the UAE Data Office or the Saudi Data and Artificial Intelligence Authority, or to the data protection authority where you live or work.
18. Changes to this Policy
18.1 We update this Policy when our processing changes. Each version has a number and a date. We notify Clients and account holders of material changes by email or in the platform before they take effect.
19. Contact us
Email: privacy@lansy.ai
Post: COLLABO TECH LTD, Unit IH-00-01-03-OF-05, Level 3, IH-00-01CP-05, Dubai International Financial Centre, Dubai, United Arab Emirates
PART D. DATA PROCESSING TERMS FOR CLIENTS
This Part D sets out the Data Processing Terms that form part of the Lansy Terms of Service (the "Terms") and apply between Lansy and each Client. Capitalised terms not defined in this Part D have the meaning given in the Terms.
D1. Application
D1.1 These Data Processing Terms apply to Personal Data that Lansy processes on behalf of Client through the Service, unless the Client Agreement contains its own data processing terms. Terms such as Personal Data, Processing, Controller, Processor, Data Subject, Special Category Personal Data and Personal Data Breach have the meaning given in the DIFC Data Protection Law, DIFC Law No. 5 of 2020 ("DPL"), and the corresponding terms of any other Applicable Data Protection Law apply where that law governs the processing.
D1.2 Where Client is subject to the ADGM Data Protection Regulations 2021, Federal Decree-Law No. 45 of 2021 or another Applicable Data Protection Law, Lansy also complies with the obligations that law imposes on processors, and the parties agree in the Client Agreement any additional terms that law requires.
D2. Roles, subject matter and details
D2.1 Client is the Controller and the deployer of the Service as an AI system. Lansy is the Processor and the operator of the Service as an AI system.
D2.2 Lansy processes Personal Data to provide the Service: to generate service-quality indicators from conversations, assess Staff Members' conversations against Client's service standards, provide feedback and coaching, prepare reports, administer the Account and keep the Service secure.
D2.3 The categories of Data Subjects, the types of Personal Data, the place of processing and the retention periods for each Deployment Model are described in the Annex to this Part D and may be specified further in the Client Agreement.
D3. Instructions
D3.1 Lansy processes Personal Data only on Client's documented instructions, unless required to do so by law to which Lansy is subject, in which case Lansy informs Client before processing unless that law prohibits it. The Terms, the Client Agreement, Client's configuration of the Service and Client's service standards are Client's complete instructions.
D3.2 Lansy does not use Personal Data for its own purposes, including training AI models, and does not use the Service to identify Customers by their voice.
D3.3 Lansy informs Client without delay if it believes that an instruction breaches Applicable Data Protection Law.
D4. Confidentiality and security
D4.1 Lansy ensures that persons authorised to process Personal Data are bound by confidentiality and access it only as needed to provide the Service.
D4.2 Lansy implements and maintains appropriate technical and organisational measures, including those listed in the Annex, and keeps them appropriate to the risk.
D5. Assistance
D5.1 Taking into account the nature of the processing and the information available to it, Lansy assists Client with Data Subject requests, the withdrawal of consents, data protection impact assessments, consultations with regulators and security and breach notification obligations.
D5.2 If Lansy receives a request from a Data Subject relating to Personal Data processed for Client, Lansy forwards it to Client without undue delay and does not respond to it except on Client's instructions, unless the Data Subject uses a function of the Platform designed for that purpose, such as the withdrawal of consent by a Staff Member.
D5.3 Lansy deletes a Staff Member's Personal Data within 10 business days after the Staff Member withdraws consent in the Platform or Client so requests, and a Customer's Personal Data held in Lansy's cloud infrastructure, including audio recordings and transcripts, within the same period after Client informs Lansy that the Customer has withdrawn consent or otherwise so requests.
D6. Sub-processors
D6.1 Client gives Lansy general authorisation to engage sub-processors. The current list of sub-processors, their services and the countries where they process Personal Data is published at https://lansy.ai/subprocessors or set out in the Client Agreement.
D6.2 Lansy informs Client of any addition or replacement of sub-processors through a notice in the Platform once per calendar quarter, covering the changes made or planned since the previous notice, and keeps the list referred to in clause D6.1 up to date. Client may object on reasonable data protection grounds within 30 days after the notice. If the parties cannot resolve the objection, Client may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
D6.3 Lansy imposes on each sub-processor data protection obligations no less protective than this Part D and remains liable to Client for each sub-processor's performance.
D6.4 Lansy ensures that providers of AI models used as sub-processors are contractually prohibited from using Personal Data to train their models and from retaining it longer than needed to provide their service to Lansy.
D7. Location and transfers
D7.1 Lansy stores and processes Personal Data in the United Arab Emirates, except where the sub-processor list or the Client Agreement states that a sub-processor processes it in another country.
D7.2 Where processing involves a transfer of Personal Data out of the DIFC or out of another jurisdiction whose law restricts transfers, Lansy makes the transfer only in accordance with Applicable Data Protection Law, including, for transfers out of the DIFC to a jurisdiction that is not recognised as adequate, under the standard data protection clauses adopted by the DIFC Commissioner of Data Protection, which are incorporated into this Part D by reference.
D8. Personal Data Breach
D8.1 Lansy notifies Client without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed for Client, and provides the information Client needs to meet its obligations.
D9. Deletion and return
D9.1 When the Service ends, Lansy deletes Personal Data within 30 days, unless Client asks for an export before the end of the Service or law requires Lansy to keep it, and wipes returned Equipment.
D10. Audit
D10.1 Lansy makes available the information needed to demonstrate compliance with this Part D and allows audits by Client or an independent auditor bound by confidentiality, on 30 days' notice, no more than once a year, unless a regulator requires it or a Personal Data Breach has occurred.
Annex to Part D. Processing by Deployment Model
| On-device processing with notice (clause 5.2(a) of the Terms) | Written consent with cloud processing (clause 5.2(b) of the Terms) | |
|---|---|---|
| Data Subjects | Staff Members; Customers | Staff Members; Customers and other participants who gave written consent |
| Audio Sources | Equipment | Equipment; third-party recording devices connected through a Lansy base station; Client Systems; uploads |
| Customer data | Speech in device memory for a few minutes; text on the device until indicators are extracted; de-identified indicators | Audio recordings; transcripts of the whole conversation; Output relating to the conversation; consent records; conversation metadata |
| Staff Member data | Account data; de-identified or pseudonymised statements; indicators, scores and feedback; metadata; Voice Profiles of those who gave explicit consent | Account data; audio recordings and transcripts; indicators, scores and feedback; metadata; Voice Profiles of those who gave explicit consent |
| Where processed | Customer data on the Equipment only; Staff Member data on the Equipment and in Lansy's cloud | Lansy's cloud, after encrypted transfer from the Audio Source |
| Lawful basis (decided by Client) | Typically legitimate interests where the law allows it; consent where required | Consent; explicit consent where special categories of Personal Data are processed |
| Retention | Sound: minutes; Customer text: until indicators are extracted; Staff Member data: term of the Client Agreement plus 30 days | Audio recordings: term of the Client Agreement plus 30 days; transcripts and Output: term of the Client Agreement plus 30 days; consent records: for as long as the related data is processed and as required by law |
Security measures. No audio files in the on-device model; sound held only in device memory and cleared on shutdown. In the cloud model, audio transferred in encrypted form from the Audio Source, stored encrypted, accessible only to the roles that Client authorises, with access to and playback of recordings logged. Device encryption, protected settings, remote lock and wipe, activity indicators on the Equipment. Automatic removal of identifiers from text before it leaves the Equipment or is sent to AI models. Encryption in transit and at rest. Role-based access, multi-factor authentication for Lansy personnel and access logging. Logs of consents and withdrawals. Voice Profiles encrypted and accessible only to the system. Isolation of each Client's data. Backups, vulnerability management and incident response. Confidentiality obligations and data protection training for Lansy personnel.