Privacy Statement
1. About Speechmatics and scope of this Privacy Statement
Cantab Research Limited, trading as Speechmatics (referred to in this Privacy Statement as “Speechmatics” or “we”, “us” and “our” etc) is a company incorporated in England and Wales (Company Number: 05697423) with its registered address at 296 Cambridge Science Park, Milton Road, Cambridge, CB4 0WD, United Kingdom.
Speechmatics is registered in the UK with the Information Commissioner's Office under registration number ZA137980.
We are committed to safeguarding and preserving the privacy of our users, and value the confidence of our customers. We strive always to comply with the laws of the countries in which we do business, including, where applicable “GDPR” meaning, as the context requires, either:
UK GDPR which has the meaning given to it in Section 3(10) (as supplemented by Section 205(4)) of the Data Protection Act 2018 (as amended); or
EU GDPR meaning the General Data Protection Regulation ((EU) 2016/679).
For the purposes of GDPR, Speechmatics is a ‘Data Controller’ in respect of the Personal Data it gathers from you and other users of our Flow App (“Flow”).
The following Privacy Statement ("Privacy Statement") explains what happens to any Personal Data that you provide to us, or that we collect from you when you use Flow.
2. What is Personal Data?
Under GDPR, ‘Personal Data’ is defined as being any information relating to an identified or identifiable natural person. This means any data/information which can identify you or which can be used together with other information we are likely to have access to identify you will be your Personal Data.
We process your Personal Data when we perform (whether or not by automated means) any operation or set of operations on it. For example, we process Personal Data when we collect, record, organise, structure, store, alter, retrieve, consult, use, disclose, disseminate, restrict, erase or destruct such Personal data.
3. Personal Data that we collect
In the course of your use of Flow and our maintenance of Flow we may collect the following Personal Data:
3.1 Information you give us
We collect information about you that you give us when you register for an account on Flow, when you login to your account and when you fill out any other forms within Flow, including when you report a problem with Flow or send any other communication through Flow. You may also provide us with Personal Data if you correspond with us by phone, e-mail or otherwise.
The information you give us may include:
names, addresses, email addresses and phone numbers.
We may also collect voice recognition data from you in the form of biometric data attached to a recording of your voice (“Voice Print”). Please see section 4.4 of this Privacy Statement for information on the circumstances in which we may process your Voice Print and details of such processing.
3.2 Information we collect about you
When you use Flow, we will automatically collect the following information:
technical information, including the Internet protocol (IP) address used to connect your device to the internet, your login information, device information, time zone setting, screen resolution, operating system and usage data (inc. interaction patterns and timestamps); and
the voice recordings comprising inputs to the conversations made by you with the Flow AI agent (“Flow AV Files”).
3.3 Information we receive from other sources
We do not collect Personal Data about you from other sources.
If you log on to Flow using your app store credentials, the email address provided to us by the app store provider is given to us on a pseudonymised basis. This means that we are not provided with an email address which can identify you and/or the information required to link the email address that we are provided with to you.
4. How we use and process your Personal Data
The paragraphs below set out the lawful basis (as required by GDPR) upon which we rely in order to process your Personal Data and the purpose and scope of the processing we undertake.
4.1 To perform the contract you have entered into with us or to take steps you have asked us to take before you enter into a contract with us.
You enter into a contract with us when you download and use Flow.
We need to process the Personal Data you provide to us in order to provide the services offered through Flow to you, including by processing your Personal Data to enable you to register for an account, log in to your account and in order for us to convert the Flow AV Files into the text transcripts of the voice recordings (“Flow Transcripts”).
4.2 For our legitimate interests in providing good customer service and making our products and services (including Flow) better.
We may also process the Personal Data you provide to us when you communicate with us via any in-app form or otherwise in order to provide various supporting customer services to you (such as where you contact us with a question in connection with our other services which we might be able to provide to you).
We will also process your Personal Data in order to provide you with a more effective user experience (such as by displaying Flow in a way which is tailored for your device and usage habits). This processing means that your experience of Flow will be more tailored to you, and that your user experience on Flow may differ from someone else accessing Flow with different usage habits.
We will also process your Personal Data for the purposes of making Flow more secure, to administer Flow and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. The lawful basis we rely on in these circumstances is our legitimate interest to provide you with the best customer experience we can, and to ensure that Flow is kept secure.
4.3 With your consent for marketing purposes
We rely on your consent to contact you for marketing purposes.
If you have opted in to receive marketing communications from us, we will process your Personal Data, for example (your name, email address and postal address and telephone number) to provide you with marketing communications in line with any preferences you have told us about.
Every email we send to you for marketing purposes will also contain instructions on how to unsubscribe from receiving them. You are not under any obligation to provide us with your Personal Data for marketing purposes.
You can tell us that you no longer want your Personal Data to be processed in this way at any time by contacting us at info@speechmatics.com or, where relevant, by following the unsubscribe link shown in every marketing communication you receive from us.
4.4 Processing of Your Voice Print
We may collect, store and use your Voice Print for the purpose of providing you with the additional functionality whereby Flow will recognise and remember your voice and your name associated to your voice.
We hope (but do not warrant or guarantee) that this functionality will improve your experience of using Flow in the following ways:
The Flow AI agent will be able to refer to you by name during your conversations – making your conversations seem more personalised; and
The Flow AI agent’s ability to recognise your voice (and distinguish it from others) means that it will be able to hear you more easily if and when you use Flow in crowded places.
As your Voice Print falls within the scope of biometric data and biometric data is, for purpose of GDPR, ‘Special Category Data’.
We will only process your Voice Print where you give us consent to do so.
We obtain your consent using our Flow AI Agent who will ask you whether you would like it to remember your voice. Alternatively, including where you have previously withdrawn consent, you can tell the Flow AI Welcome Voice agent that you want it to remember your voice which will prompt it to ask you to confirm your instructions.
Your Voice Print will be processed by us for the purposes of providing you with the additional functionality (as above) only where you have responded to the Flow AI clearly in the affirmative.
As we rely on consent in order to process your Voice Print, you have the right to withdraw your consent at any time.
You can do this by:
Asking or telling the Flow AI Welcome Voice agent to delete your Voice Print. There are numerous phrases that you can use, including:
“Delete my voice”,
“Can you please delete my voice”
“Forget my voice”
“Reset my voice”.
If the Flow AI agent is not sure of your instruction/request, it may ask you to confirm. The Flow AI agent will let you know once your Voice Print has been deleted; or
Deleting your Voice Print by clicking on the button that reads “Clear Flow’s memory” which is easily accessible from Flow’s options menu app under the following option “Memory: Flow can remember information about you to personalise your experience. Your data is stored on this device.”
Where you click this button, only your Voice Print and no other Personal Data associated with your Flow account will be deleted. Other than your Voice Print as set out above, we do not knowingly process any Special Category Data.
The reason for this is that inclusion of any Special Category Data in the inputs of your conversation with the Flow AI agent would be in breach of the terms of the End-User Licence Agreement (“EULA”) and therefore such inclusion would be at your sole risk and liability.
5. Keeping your information secure and data retention
We take the trust you place in us with regards to your Personal Data seriously. To prevent unauthorized access or disclosure, to maintain data accuracy, and to ensure the appropriate use of the information, we utilise reasonable and appropriate physical, technical, and administrative procedures to safeguard your Personal Data.
We will retain your Personal Data for the longer of:
the period during which retention is necessary in order to achieve the purpose of the processing;
the period during which retention is required by us for our internal audit purposes; or
the period during which retention is required by law.
More information about our retention policy is available on request to compliance@speechmatics.com.
6. Sharing and transfer of Personal Data
6.1. Sharing of Personal Data with other Speechmatics entities
Where necessary, for the internal and/or external operations of the group of companies trading as Speechmatics, including us (“Speechmatics Group”), including in order to perform the contract that you have entered into with us and in order to achieve the purposes where processing is for our legitimate interest, we may disclose Personal Data to other companies within the Speechmatics Group, including the Speechmatics Group entity in the US.
6.2. Sharing of Personal Data with third parties in order to perform a contract
In order to perform the contract that you have entered into with us, we may need to share your Personal Data with our third-party agents, consultants and contractors, including but not limited to our cloud hosting providers.
6.3. Sharing of Personal Data with third parties for other purposes
We may also need to share your Personal Data with third parties where we are under a duty to share or disclose such Personal Data in order to comply with a legal obligation (for example, for the purposes of assessing fraud, credit and/or security risks).
6.4 Transfers of Personal Data to third parties
We will transfer your Personal Data:
In the event that we sell or buy any business or assets, in which case we will disclose your Personal Data to the prospective seller or buyer of such business or assets (at all times in accordance with data protection legislation);
If Cantab Research Limited or substantially all its assets are acquired by a third party, in which case the Personal Data will be transferred as an asset to the purchaser.
Where we transfer your Personal Data in either of the circumstances set out above, we do so for our legitimate interest in ensuring our business can be continued by a purchaser.
If you exercise your right to object to our use of your Personal Data in this way, the relevant seller or buyer of our business may not be able to provide services to you.
6.5 International Transfers of Personal Data
We may need to share, store and otherwise process your Personal Data in a location outside of the European Economic Area, United Kingdom or Switzerland in the following circumstances:
Where sharing of your Personal Data with other members of the Speechmatics Group is necessary for the internal and/or external operations of the Speechmatics Group (see above); and
to our third party providers, including cloud hosting providers located in the USA where this is necessary in order for us to perform the contract.
Where this applies:
We take all steps reasonably necessary to ensure that your Personal Data is treated securely and in accordance with this Privacy Statement; and
We will only transfer your Personal Data: (a), where UK GDPR applies, outside of the UK or (b) where EU GDPR applies, outside of the EU, where we have a lawful basis for doing so and we shall ensure that the disclosure complies with all requirements of GDPR including, where necessary, by ensuring that there are ‘Appropriate Safeguards’ in place to protect your Personal Data.
7. Use of cookies and similar technology
If you consent to the processing of your Voice Print (as set out in section 4.4), we will deploy a centroid, (a small file which acts in a similar way to a cookie), which will be used to store your Voice Print within your device and will send our servers the information it requires to enable the Flow AI agent to recognise your voice.
As the use of the centroid in this way is ‘strictly necessary’ for us to provide you with this additional functionality where you have consented us using your Voice Print, we are not required to obtain your separate consent to the use of the centroid itself.
The centroid will be stored in your device until you withdraw your consent to the processing of your Voice Print in accordance with section 4.4.
Save for the above we do not use cookies or similar files/data storage mechanism.
8. Your rights under data protection laws
You may exercise any rights you have under applicable data protection laws. Where GDPR applies, this means that you may exercise the following rights:
8.1 Right of Access
You have the right to receive confirmation as to whether your Personal Data is being processed by us, as well as various other information relating to our use of your Personal Data. You also have the right to access your Personal Data which we are processing. You can exercise the right in a variety of ways, and the easiest way for you do to this is likely to be contacting us at the email address detailed at the bottom of this Privacy Statement. Please note that the Flow AV Files and Flow Transcripts are only processed by us for the purposes of transcribing your voice inputs, collecting any consent required under this Privacy Statement and enabling Flow to produce a response during the applicable session and are not retained by us thereafter.
8.2 Right to Rectification
You have the right to require us to rectify any inaccurate Personal Data we hold about you. You also have the right to have incomplete Personal Data we hold about you completed, by providing a supplementary statement to us.
8.3 Right to Restriction
You have the right to restrict our processing of your Personal Data where:
The accuracy of the Personal Data is being contested by you;
The processing by us of your Personal Data is unlawful, but you do not want the relevant Personal Data erased;
We no longer need to process your Personal Data for the agreed purposes, but you want to preserve your personal data for the establishment, exercise or defence of legal claims; or
We are processing your Personal Data for our legitimate interests (for example to improve Flow or on the sale of our business (as set out above)) and you:
Object to our processing as set out above; and
Want processing of the relevant Personal Data to be restricted until it can be determined whether our legitimate interest overrides your legitimate interest.
Where any exercise by you of your right to restriction determines that our processing of particular Personal Data is to be restricted, we will then only process the relevant Personal Data in accordance with your consent and, in addition, for storage purposes and for the purpose of legal claims.
8.4 Right to Data Portability
You have the right to receive your Personal Data in a structured, standard machine-readable format and the right to transmit such Personal Data to another controller.
8.5 Right to Data Erasure
You have the right to require we erase your Personal Data which we are processing where one of the following grounds applies:
The processing is no longer necessary in relation to the purposes for which your Personal Data were collected or otherwise processed;
Our processing of your Personal Data is based on your consent, you have subsequently withdrawn your consent and there is no other legal ground we can use to process your Personal Data;
You object to the processing in as set out in this Privacy Statement and we have no overriding legitimate interest for our processing;
The Personal Data has been unlawfully processed; and
The erasure is required for compliance with a law to which we are subject.
Please see section 4.4 which explains how this right may be exercised in respect of your Voice Print.
8.6 Right to object
You have the right to object to us processing your Personal Data where we are processing your Personal Data:
Based on our legitimate interests to improve Flow, or on the sale of our business (as set out above). If you ask us to stop processing your Personal Data for these reasons, we will stop processing your Personal Data unless we can demonstrate compelling grounds as to why the processing should continue in accordance with data protection laws; and
For direct marking purposes. If you ask us to stop processing your Personal Data on this basis, we will stop.
8.7 Right to withdraw consent
Where we rely on consent in order to process your Personal Data (i.e. processing of your Personal Data for marketing purposes and in respect of your any processing of your Voice Print), you have the right to withdraw such consent at any time.
Please see section 4.4 which explains how this right may be exercised in respect of Voice Prints.
8.8 Right to complain to the regulator
You also have the right to lodge a complaint with:
Where UK GDPR applies: the Information Commissioner's Office, who are the supervisory authority for data protection issues in England and Wales; or
Where EU GDPR applies: the applicable supervisory authority.
9. Children's privacy
Flow is not intended for children under the age of 13 and this is reflected in our EULA.
We do not knowingly solicit or collect Personal Data from children under the age of 13. If we learn that any Personal Data has been collected inadvertently from a child under 13, we will delete such Personal Data as soon as possible. If you believe that we might have collected information from a child under 13, please contact us at compliance@speechmatics.com.
10. Third party links
On occasion we include links to third party applications, websites, products or services on Flow for your convenience and information. Where we provide a link, it does not mean that we endorse, make representations or approve that site's policy towards visitor privacy. You should review their privacy statement/notice before sending them any Personal Data.
11. Changes to our Privacy Statement
Any changes we may make to our Privacy Statement in the future will be posted on our website.
Please check back frequently to see any updates or changes to our Privacy Statement.
We will notify you of any material changes to this Privacy Statement by way of a pop-up which you will see when you first launch the latest version of Flow after having downloaded it from the app store.
12. Contacting us
Please do not hesitate to Contact Us at compliance@speechmatics.com if you wish to exercise any of the rights above or regarding any other matter that relates to this Privacy Statement.
This Privacy Statement was last updated on 18th December 2024.