How Actualcast handles data on your behalf.
This is a plain-language template of the terms that govern Actualcast processing personal data for your organisation. It is a starting point, not a signed contract. A countersigned version is available when billing opens; ask and we will send it.
Last updated 1 August 2026
Roles
For the personal data in your meetings and your CRM, you are the controller and Actualcast is the processor. We process that data only to provide the product and only on your instructions, which are the settings you choose and the facts your team approves. We do not sell it, and we do not use it to train models.
What we process, and why
To do its job Actualcast processes meeting audio and transcripts, the deal and contact records it reads from your CRM, and the account details of the people in your organisation. Each is processed for a single purpose: to draft deal facts with their evidence, to write the ones a rep confirms back to your CRM, and to run your account.
Subprocessors
We use a small set of vendors to run the product, each under its own data protection terms: the meeting recording and transcription provider, the model provider that reads a transcript to draft facts, our cloud hosting and database, error tracking, and email delivery. We will keep this list current and give notice before adding a subprocessor that changes where your data is handled.
Security
Access to your CRM is held as encrypted tokens, decrypted only at the point a confirmed write is sent, and never written to a log. Transcript content never appears in our logs. Every write to your CRM is recorded in an audit trail with who confirmed it and when. The security page describes what we do and does not claim a certification the company does not hold.
Retention and deletion
Audio is kept for a retention window you set, 180 days by default, then deleted. You can ask us to delete the recordings and transcripts for an organisation at any time, and we will carry it out and confirm when it is done. When you leave, your data is deleted on request rather than kept.
International transfers
Where data is processed outside the region it was collected in, that transfer is covered by the standard contractual clauses in the terms of our vendors. The signed agreement names the mechanism that applies to your organisation.
Getting the signed version
To countersign this as a contract, or to ask which subprocessors apply to your account, write to hello@actualcast.com.