Privacy Policy
Sounding Labs, Inc.
1. Who we are and what this policy covers
Sounding Labs, Inc. (“Sounding”, “we”, “us”) provides a nightly data feed that reads the text transcripts of sales calls from a customer's meeting platform (Zoom, Google Meet or Microsoft Teams), matches each call to an open opportunity in the customer's Salesforce organization, and writes four fields to that opportunity: the next step, the date agreed for it, any competitor named and whether a decision-maker took part, each with the sentence it was read from, for a flat monthly fee.
Registered at 50 Milk Street, 16th Floor, Boston, MA 02109, United States.
We handle personal data in two different situations, and different rules apply to each:
| Whose data | Our role | What applies | |
|---|---|---|---|
| Part A | People who visit this website, ask about the service or write to us | Controller: we decide why and how the data is used | This policy |
| Part B | People who speak on or attend the sales calls a customer's reps hold, such as the buyer's staff named in a transcript or a meeting's participant list, the people recorded as contacts in the customer's Salesforce organization, and the customer's own reps and administrators | Set out in B.1, because it depends on the data | This policy and the data processing agreement we sign with each customer |
If the data processing agreement (“DPA”) and this policy ever disagree about Part B, the DPA wins.
2. Part A: this website and our contact with you
This part covers the personal data we collect for our own purposes: running this website, answering requests, and staying in touch with people who are or might become customers.
A.1 What we collect
What you give us. When you send the form on this site, we collect what you type into it, such as your name, email address, phone number or company, and the fact that you agreed to be contacted. If you email or talk to us, we keep that correspondence and any contact details in it.
What is collected automatically. Our web server records the IP address a request came from, the browser used, the pages requested, the page you came from and the time. These logs exist to keep the site running and secure.
We don’t ask for sensitive data (the “special categories” in Article 9 GDPR) through this website, so please don’t send any through the form.
A.2 Why we use it, and what allows us to
| Why | What | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your request and working out whether the service fits | What you sent in the form, our correspondence | Art. 6(1)(b): steps you asked for before a contract |
| Looking after customers, billing and support | Contact details, correspondence | Art. 6(1)(b): carrying out a contract |
| Keeping the site running, secure and free of abuse | Server logs | Art. 6(1)(f): our legitimate interest in running a secure service |
| Contacting you about the service | Email address, company | Art. 6(1)(f): our legitimate interest in business-to-business marketing. You can object at any time |
| Meeting tax, accounting and legal duties | Billing and contract records | Art. 6(1)(c): a legal obligation |
Where we rely on legitimate interest, we have weighed that interest against your rights, and you can ask to see the assessment.
A.3 How long we keep it
- Requests from people who don’t become customers: 12 months from our last contact, then deleted.
- Customer contact and contract records: for the length of the agreement plus 6 years, to cover legal claims and accounting rules.
- Server logs: 30 days.
- A record that you objected or opted out: kept indefinitely, so we can keep respecting it.
A.4 Your rights
If you are in the EEA or the UK, you can ask to see your data, correct it, have it deleted, limit or object to how we use it, get a copy you can take elsewhere, and withdraw consent where we rely on it. Write to [email protected] and we will answer within one month.
You can also complain to a data protection authority. If you are in the EEA, that can be the authority where you live or work.
3. Part B: data inside the service
Our customers are B2B companies and their revenue operations teams. When a customer connects its meeting platform and its Salesforce organization, we read the transcripts of its reps' calls with outside participants and the Salesforce records needed to match them, and write a small set of fields back. This part explains what we read, what we keep, and where it is held.
B.1 What we handle, and in what role
For call transcripts, participant lists and Salesforce records we act as a processor: the customer decides which platforms and which reps are connected, what the competitor list contains and when data is deleted. For the accounts of the customer's administrators and the billing record we act as a controller. Inside the service we handle:
- Call transcripts. The text transcript the meeting platform produced for a call hosted or attended by a connected rep: what was said, the speaker names the platform assigned, timestamps, the meeting title and date, and a link to the recording on the platform. We do not receive audio or video.
- Participant lists. The names and email addresses of the people who joined each meeting, as the platform recorded them. A meeting whose participants all share the customer's own email domains is discarded on this list alone, and its transcript is never fetched.
- Salesforce records. Open opportunities with their owner, stage and close date; the website domain of each account; contact names, emails and titles; opportunity contact roles; the email of each connected rep; the Next Step field and Sounding's three fields with their field history; and the Call Evidence records the service created.
- Review answers and the competitor list. Each rep's answer to a held value (accepted, corrected or nothing agreed), and the list of competitors, aliases and deciding contact roles the customer maintains.
- Account and billing. The names and work emails of the customer's administrators, the company name, the rep count given at signup, and the monthly invoice record.
We do not read mailboxes, calendars, chat or the customer's notetaker. Participants come from the meeting platform's own record of the meeting, and nothing is read from a call that no connected rep hosted or attended.
We read no Salesforce object other than those listed above, and we write only to the Next Step field, Sounding's three fields and Call Evidence records. We never delete a Salesforce record.
B.2 What we do with it
Storage. Fetched transcripts, participant lists, the values we wrote and the run log are stored encrypted on cloud infrastructure in N. Virginia. Each account's data is held under its own key and is not readable from another account.
Matching and reading. Calls are matched to opportunities by rules on email domains and contact roles. Competitor mentions and next steps are read by models we serve ourselves on cloud GPU capacity we control in N. Virginia. No transcript, sentence or field is sent to an outside model provider.
Writing back. Values are written to the customer's Salesforce organization through the connected app the customer's administrator authorized. Revoking that app stops every write at once.
Model training. If an account owner has opted in, the labeled pairs that account contributes (a transcript span of at most seven turns, the field name and the final value, never a whole transcript) are used to fine-tune the models all customers use. Fine-tuning runs on the same cloud GPU capacity we control in N. Virginia. An account that has not opted in contributes nothing.
Staff access. Our staff open a customer's transcripts or pairs only to resolve a support request the customer raised, only for the calls named in it, and each such access is recorded in the account's run log.
B.3 AI models: where they run and what they learn from
Where models run. Two models run inside the service. A competitor-mention classifier, an open-weight encoder we fine-tuned, reads the turns around each mention of a name on your competitor list and decides whether the buyer is using or weighing that vendor. A next-step model, an open-weight language model of the 8B class that we prompt, reads the end of each call and proposes the next step, who owns it and the date phrase it was tied to. Both are served on cloud GPU capacity we control in N. Virginia, beside the transcripts, which are stored on cloud infrastructure in N. Virginia. Matching calls to opportunities, turning date phrases into dates and deciding whether a decision-maker was present are rules, not models. No transcript, sentence or field is sent by us to a third-party hosted model API, and no third-party model provider is a sub-processor of the service.
Training. We do not train models on your transcripts or your Salesforce data. The one exception is the labeled-pair corpus: when a rep accepts, corrects or rejects a held value, or edits a field the service wrote, we store the span of transcript the value was read from (at most seven turns), the field name and the final value, and nothing else from the call. Those pairs belong to your account, tune your competitor aliases and your per-field thresholds, and are not shared between customers. No shared model is trained on them unless your account owner opts in; the opt-in is off by default and can be withdrawn for future training. The next-step model in service today is prompted and trained on no customer data; the competitor classifier is fine-tuned on sentences we wrote or licensed. Contributed pairs are the training set for the fine-tuned next-step model planned for March 2027, trained on the same cloud GPU capacity we control in N. Virginia. Retrieval over an opportunity's earlier calls, planned for September 2027, will read only your own account's calls.
Where a person decides. The models propose; your reps and your revenue operations team decide. A value read below 0.85 confidence is not written to the opportunity: it is held, with the quoted sentence, in a Salesforce list view assigned to the opportunity owner, who accepts it, corrects it or marks that nothing was agreed, and revenue operations sees the same list across the team. A held value nobody answers lapses when the next call on that opportunity is read. A value at or above the threshold is written with the sentence it came from so that it can be checked, and a rep's later edit is kept and read back as a correction. No output of the service is an automated decision with legal or similarly significant effect on any individual: the service records what was said on a sales call and takes no decision about the people who said it.
B.4 Where the data is kept
All data inside the service is stored and processed on cloud infrastructure in N. Virginia, in the United States. Model inference runs on cloud GPU capacity we control in N. Virginia, and so does any fine-tuning on pairs an account has opted in to contribute. We keep no copy outside the United States and offer no other location.
A customer's calls may include people outside the United States. Their words are processed in the United States, and the customer, as the party that recorded the call, is responsible for the notice and the legal basis that processing requires.
The suppliers that handle data in the service are named on our subprocessor list, which comes with the data processing agreement and which we send to anyone who asks: write to [email protected].
B.5 How long we keep it, and what deleting can’t remove
A fetched transcript is deleted seven days after the nightly run that read it. When a later run needs the call again, for example after a change to the competitor list, the transcript is fetched from the meeting platform again rather than kept.
The values we wrote, with their quoted sentences and confidences, and the run log are kept for 13 months, so that any field in the customer's organization can be traced to the call and the run that wrote it. Labeled pairs are kept for the life of the account. The invoice record is kept for as long as US tax law requires.
When an account is closed, the customer can download its pairs and run log as CSV for 30 days. After that everything in the account is deleted, and backups roll off within a further 35 days. Fields and Call Evidence records already written stay in the customer's Salesforce organization, which we do not touch on closing.
B.6 Requests from people whose data is in the service
The customer is the controller of its calls and its Salesforce data. If a person who spoke on a call asks us about their data, we pass the request to the customer within five business days and do not answer it ourselves. A customer can find every Call Evidence record that quotes a contact from inside Salesforce, and can instruct us to delete the pairs and transcripts concerning a named person, which we do within 30 days.
For everyone
4. Moving data between countries
Sounding Labs, Inc. is a company in the United States. When personal data from the EEA or the UK reaches us, for example because someone there writes to us or a customer there uses the service, it is protected by the European Commission’s Standard Contractual Clauses, a transfer impact assessment and the extra technical measures described in our security documentation. You can ask us for a copy of the clauses.
EU representative (Article 27 GDPR). Write to [email protected] with “EU representative” in the subject line and we will send you our representative’s details.
5. Security
We protect data in line with the risk. That includes encryption in transit and at rest, access limited to the people and systems that need it, each customer’s data kept separate from every other’s, and a log of every access to production systems.
If a personal data breach affects you, we tell you without undue delay, and at the latest within 36 hours of finding out, with the information you need to meet your own reporting duties.
6. Children
The service is sold to businesses and is not meant for children. We don’t knowingly collect personal data from anyone under 16.
7. Changes to this policy
We may update this policy. If a change matters, we email customers at least 30 days before it takes effect. The version number and date at the top of this page change every time.
8. Contact
Privacy questions and anything else: [email protected]
By post: Sounding Labs, Inc., 50 Milk Street, 16th Floor, Boston, MA 02109, United States