Privacy notice for the EU, EEA and UK (GDPR)

Effective 24 October 2026

1. Who the controller is

The controller is Wild Cats Media, SCO-47, Second Floor, World Street, Sector-79, Faridabad, Haryana, India – 121014, trading as AcrossView ("we", "us"). We decide why and how the personal data described in the main policy is processed. We have no office, branch or server in the EU, the EEA or the UK. Our privacy contact is Amit Goyal: use the contact form and choose "Privacy request or grievance", or write to support@acrossview.com.

This notice applies to you if you are in a member state of the European Union, in Iceland, Liechtenstein or Norway, or in the United Kingdom. For the UK, read "GDPR" as the UK GDPR, kept in UK law by the Data Protection Act 2018, and "supervisory authority" as the Information Commissioner's Office (ICO).

2. What this notice adds

The main policy is written for India's Digital Personal Data Protection Act, 2023 and is the single description of what we collect, how long we keep it, who processes it with us, what we never see, and how we secure it. It applies to you in full. This notice adds the parts the GDPR asks for that the main policy does not spell out: the legal basis for each purpose, the safeguards for processing outside the EU and UK, the full list of GDPR rights and how long we take to answer, the position on a representative and a data protection officer, and where to complain. Where the two differ, the one that gives you more protection applies.

3. Legal bases, purpose by purpose

Article 6 of the GDPR requires a legal basis for each use of personal data. The data in each row is described in detail, with its retention period, in section 3 of the main policy; this table maps those rows to the bases we rely on.

Purpose	Data	Legal basis	How long
Signing you in and running your account	Name, email, hashed password, two-step secret, plan, sign-in sessions, sign-in IP and time; the ID and email a sign-in provider (Google, Microsoft, Facebook, LinkedIn, Yahoo) gives us	Contract, Article 6(1)(b): the account you asked for	Until you delete your account or ask us to
Running meetings, support sessions, devices, teams, chat, boards, bookings, webinars, the calendar and the API	Meeting records, device registration, team membership and address books, chat messages, board contents, bookings, webinar registrations, calendar entries and connected-calendar tokens, hashed API keys and webhooks	Contract, Article 6(1)(b): the features you use	As set out per row in the main policy; mostly while your account is open, or until you delete the item
Keeping the recording or clip you made	The video file	Contract, Article 6(1)(b): you pressed Record; everyone in the meeting sees that recording is on	Recordings 7 days (free) or 30 days (paid); clips 30 days (free) or a year (paid); sooner if you delete them
Writing the AI transcript and summary of a recording	The recording's audio, sent to Google's Gemini API	Consent, Article 6(1)(a), given when you turn recording on and told that a transcript will be made. Withdraw it by deleting the recording, which deletes the transcript and summary with it	As long as the recording
Showing a clip's owner who watched and what they said	Views, how far each viewer watched, comments with the name given	Legitimate interests, Article 6(1)(f): the owner's interest in knowing the clip was received; your interest is protected because you choose the name you give, or none	As long as the clip
Running the relay, preventing abuse and investigating scams	Connection records: IP addresses, device IDs, the account or operator key that connected, when a session was requested, accepted and ended, how much data our relay carried	Legitimate interests, Article 6(1)(f): a safe service, and compliance with the law of the country we operate from, the CERT-In Directions of 28 April 2022, which require these records to be kept for 180 days. Article 6(1)(c) covers only obligations under EU or member-state law, so we do not claim it for an Indian one	180 days
Protecting accounts	Security log: sign-ins, failed sign-ins, changes to accounts and teams, with the IP address	Legitimate interests, Article 6(1)(f): security	As long as needed for security and the law
Checking that our emails arrived	Mail log: address, subject and time of each email we send you	Legitimate interests, Article 6(1)(f): answering "I did not get the email"	As long as needed for that
Learning which features help and fixing problems	A short fixed list of in-app actions with your account or a random ID; camera or microphone start errors with browser and IP	Legitimate interests, Article 6(1)(f): improving the product. No third-party analytics, no advertising use	As long as needed for that
Showing others who you are in a session or meeting	The name you type to join as a guest	Contract, Article 6(1)(b)	Not kept after the session, except where it appears in connection, webinar or chat records
Replying to you	Contact-form messages: name, email, topic, message	Legitimate interests, Article 6(1)(f): answering the question you asked us	As long as needed to deal with your message
Keeping the website up and secure	Server logs: IP address, page, time, browser	Legitimate interests, Article 6(1)(f): security	14 days
Answering lawful requests	Whatever a valid request from an authority covers, see section 6 of the main policy	Legal obligation, Article 6(1)(c), where the request is made under EU, member-state or UK law; otherwise legitimate interests, Article 6(1)(f), in complying with the law that binds us	As the request requires

Where we rely on legitimate interests, we have weighed them against your interests and rights and concluded that they do not override yours; you can object at any time (section 5). We do not process special categories of data on purpose. A recording may of course contain whatever its participants chose to say; the host is responsible for telling participants that a meeting is recorded, and the app shows everyone when it is. We send no newsletters or marketing email.

4. International transfers

Where your data goes. Everything in the table is stored on our servers in Mumbai, India, rented from Hostinger International Ltd. When you use AcrossView, your browser or the Windows app sends the data straight to those servers; nothing is first collected in the EU or UK and then moved. India has no adequacy decision from the European Commission or from the UK Secretary of State, and we do not claim one.

Safeguards. Support sessions are end-to-end encrypted on the two devices, so their content is never readable on our servers in any country. All other connections use TLS. Passwords and API keys are kept only in hashed form. Access to our servers is limited to the people who run them, and every sign-in and change is logged. The Security page has the details. We have no servers in the EU or UK yet; a European relay and storage region are planned, and this notice will be updated when they exist.

Onward transfer to Google. The one onward transfer is the audio of a recording, sent to Google's Gemini API to write the transcript and summary. Google processes it under its data processing terms, which include the European Commission's standard contractual clauses and the UK International Data Transfer Addendum, on servers that may be outside India, including in the United States. This happens only for recordings, and only because you turned recording on. The sign-in and calendar providers you may connect (Google, Microsoft, Facebook, LinkedIn, Yahoo) and WhatsApp, if you message us there, each hold your data under their own privacy terms.

What you can do. Ask us for a copy of the information we rely on for these transfers through the contact form. If you do not want audio sent to Google, do not record, or delete a recording as soon as it is made.

5. Your rights

Under Articles 15 to 22 of the GDPR you have the right to:

Access (Article 15): a copy of the personal data we hold about you and the information in this notice as it applies to you.
Rectification (Article 16): correction of inaccurate data and completion of incomplete data. Your name and email you can change yourself in your account.
Erasure (Article 17): deletion of your data where there is no longer a reason to keep it. You can delete recordings, clips, boards, chat messages, API keys and your whole account yourself. Connection records are kept for their 180 days and the security log for as long as security requires, as explained in section 3.
Restriction (Article 18): a pause on processing while a dispute about accuracy or lawfulness is settled.
Portability (Article 20): the data you gave us or that your use produced, in a common machine-readable format, where we process it under contract or consent. We will supply it as JSON, with recordings and clips as the video files.
Objection (Article 21): to any processing we base on legitimate interests. We will stop unless we can show compelling legitimate grounds, or the processing is needed for legal claims. Because we send no marketing, there is nothing to opt out of there.
Withdrawal of consent (Article 7(3)): at any time, with effect for the future. For the AI transcript, delete the recording.
No automated decisions (Article 22): we make no decisions about you by automated means that have legal or similarly significant effects. Session time limits follow your plan, not a profile of you.

To use any of these rights, send a request through the contact form, choosing "Privacy request or grievance", or email support@acrossview.com from the address on your account. We will answer within one month. If a request is complex or you have made several, we may take up to two further months, and we will tell you within the first month if so. Requests are free; we may ask you to prove who you are before we release anything. You may act through an authorised representative.

6. EU and UK representative

Article 27 of the GDPR asks a controller outside the EU to appoint a representative in the EU, and the UK GDPR asks the same for the UK. We have not yet appointed a representative in the EU or the UK. We rely on the exception in Article 27(2)(a): our processing of EU and UK residents' data is occasional, involves no large-scale processing of special categories of data or of data about criminal convictions, and is unlikely to result in a risk to your rights and freedoms given its nature, scope and purposes. AcrossView is not promoted or advertised in the EU or UK today, and the people there who use it do so on their own initiative. We will appoint a representative, and name them here, before we promote AcrossView in the EU or the UK. Until then, write to us directly at the address in section 1.

7. Data protection officer

Article 37 requires a data protection officer for public authorities and for organisations whose core activities involve regular and systematic monitoring of people on a large scale or large-scale processing of special categories of data. None of this describes AcrossView, so we have not appointed one and are not required to. Amit Goyal, Wild Cats Media, at the address in section 1, is our privacy contact and India's Grievance Officer for the service. Reach him through the contact form or support@acrossview.com.

8. Cookies

This website sets no cookies and runs no analytics, advertising or tracking scripts, so there is nothing to consent to and no banner. The AcrossView web app sets one cookie, only when you sign in, to keep you signed in for 30 days; signing out removes it. That cookie is strictly necessary to provide the service you asked for and is exempt from consent under Article 5(3) of the ePrivacy Directive and regulation 6(4) of the UK's Privacy and Electronic Communications Regulations, so there is no banner in the app either. The web app and the Windows app also remember a few things on your own device, such as your name and recent IDs, as described in section 4 of the main policy.

9. Children

Article 8 of the GDPR says a child's own consent to an online service is valid only from age 16, and lets member states set a lower age down to 13; the UK uses 13. AcrossView is not meant for children to use on their own at any of these ages: our terms require users to be 18, or to use it with a parent or guardian present. We do not knowingly create accounts for children or ask for their consent. If you believe a child has given us personal data without a parent's involvement, tell us through the contact form and we will delete it.

10. If data is breached

If personal data is lost, stolen or accessed without authority and the breach is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it (Article 33), and tell you directly without undue delay if the risk to you is high (Article 34). Because we have no establishment in the EU there is no lead authority for us; we will notify the authority of each member state where affected people live, and the ICO for people in the UK. Session content cannot be exposed by a breach of our servers, because it is end-to-end encrypted and never stored.

11. Complaints

We would like to hear from you first: a privacy request or grievance is acknowledged within 24 hours and answered within one month. You also have the right, under Article 77, to lodge a complaint at any time with the supervisory authority of the EU or EEA country where you live, where you work, or where you believe the infringement happened. The European Data Protection Board lists them all with contact details: edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, complain to the Information Commissioner's Office at ico.org.uk. You may also go to court in your own country (Articles 79 and 82).

If we change this notice we will update the date at the top; significant changes will be announced on this website before they take effect. Other countries' notices are on Privacy notices by country.