Poised

GDPR overview

Implementation is documented but incomplete. A dedicated GDPR notice addresses EEA and UK residents, naming four legal bases — consent, performance of a contract, legitimate interests and legal obligation — and listing rights of access, rectification, erasure, portability, restriction, objection including profiling, objection to direct marketing, withdrawal of consent and complaint to a supervisory authority. Transfers outside the EEA and UK, including between group entities, rely on the European Commission's Standard Contractual Clauses; the policy names the United States and the Cayman Islands as destinations and concedes that neither benefits from an adequacy decision. A separate CCPA notice covers California. Two gaps stand out: no EU representative is designated under Article 27, and no customer data processing agreement is published. The policy also carries contradictory dates, effective 10 October 2022 while stating it was last updated 1 May 2022.

Who owns the data?

The service is operated by Deepgram Inc., which acquired Poised. Its privacy policy makes Deepgram the controller of everything collected: registration details, calendar metadata, billing data and the audio and video recordings of the meetings you enable. Poised stores only the recording of the person using it, never the other participants, and does not keep card details. It states plainly that it never sells personal information, and repeats that position under the CCPA. You keep access, correction, deletion, portability and objection rights, exercised through privacy@poised.com, and related data is deleted once retention expires or on your request.

Reuse rights

Your own reports and insights are yours to act on, but the terms of service stop well short of letting you pass them around: reproducing, reselling, distributing or publishing the service or any report or data it generates is prohibited, as is letting a third party use a seat you paid for, or using the service to build a competing product. On the vendor side, the declared uses of your recordings are narrow but real — checking a suspected breach of the terms, answering your support requests, and improving its algorithms. Data is also shared with hosting, storage, payment and marketing providers under data protection agreements, and with analytics providers and advertisers for targeted advertising. Google Analytics runs on the site, cookies and pixel tags are used, and Do Not Track signals are ignored. No opt-out from algorithm improvement is documented.

Data retention & training

Hosting summary

Poised states that it hosts all of its software in Amazon Web Services facilities in the USA. All primary application servers sit inside Poised's own virtual private cloud, protected by restricted security groups that permit only the minimum communication required between servers. Storage uses AWS-managed DynamoDB, and cryptographic keys are maintained through AWS infrastructure. Every connection is encrypted with SSL and any HTTP attempt is redirected to HTTPS, while all customer data, including call recordings and transcripts, is encrypted at rest and in transit. The infrastructure is defined and deployed with AWS CDK and Amplify, with changes reviewed before deployment. Note that the SOC 1-3 and ISO 27001 assurances quoted on the security page are Amazon's, not certifications held by Poised. On jurisdiction, the privacy policy is explicit that data may be transferred to, stored on servers in, and accessed from the United States, and that personal information from the EEA or United Kingdom may reach the United States or the Cayman Islands, neither of which benefits from a European Commission adequacy decision.