This Privacy Policy explains how UAB Such Much AI collects, uses, discloses, retains and otherwise processes personal data as a controller in connection with Such Much Voice. It also explains what happens when we process personal data on behalf of a business, institutional or public-sector customer, including when you have been recorded by one of our customers.
Controller: UAB Such Much AI, a private limited liability company incorporated in Lithuania, company code 306405204, registered address Bukčių g. 6-38, Vilnius, LT-04127, Lithuania, VAT number LT100017966319 (“Such Much AI”, “we”, “us”, “our”). Privacy contact: info@suchmuchai.com, subject line “Privacy Request”. Data Protection Officer: Edmundas Balčikonis, info@suchmuchai.com.
We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), the Law of the Republic of Lithuania on the Legal Protection of Personal Data and the Law of the Republic of Lithuania on Electronic Communications. SIA “Such Much AI” (Latvia) and Such Much AI, Inc. (United States) are separate legal persons that do not control or access the personal data described in this Policy.
1. Scope
This Policy applies when you: visit a Such Much Voice website at suchmuch.ai or a related domain; create or use an account in the Such Much Voice application; request information, a demonstration, a proposal or a quotation; communicate with us about sales, procurement, onboarding, training, support or another business matter; subscribe to marketing communications; attend a webinar, training session or event we organize; apply for a role; or otherwise interact with us where we determine the purposes and means of processing.
This Policy does not replace the Such Much Voice Terms of Service, an applicable Order Form, the Data Processing Agreement (the “DPA”) or a customer’s own privacy notice for recordings it makes.
2. When We Act as Controller and When as Processor
2.1Controller. We are the controller for website administration, account administration and security, sales, contracting, billing, support communications, recruitment and direct marketing, as described in this Policy.
2.2Processor. When a customer uploads or captures audio or video recordings, meeting data, files or instructions in Such Much Voice (“Customer Data”), the customer is the controller and we are the processor. We process Customer Data only on the customer’s documented instructions under the DPA. We do not use Customer Data for our own purposes and do not use it to train models.
2.3If you were recorded by a customer. If your voice, image or statements appear in a recording, transcript or summary created by one of our customers (for example your employer, a company you met with, a public authority or an event organizer), that customer is responsible for the lawfulness of the recording, for informing you and for responding to your requests. Please contact that customer first. If you are not sure who the customer is, write to info@suchmuchai.com and we will refer your request to the customer and assist it as required by law and the DPA.
2.4Sole traders and individual professionals. If you use Such Much Voice on your own account in the course of your profession, you are the controller of the recordings you make and we are your processor under the DPA.
3. Personal Data We Collect
3.1Identity and business contact data: name, job title, organization, department, role, work address, work email address, telephone number and other business contact details.
3.2Account and workspace data: account identifier, workspace membership, user role and permissions, administrator actions, invitations, account status, language and transcription preferences and other configuration information.
3.3Authentication, device and network data: login events, IP address, approximate location derived from IP address, device type, operating system, browser type and version, session identifiers, single-sign-on identifiers and related access records. We do not store your password in readable form.
3.4Usage, diagnostics and security data: feature use, number and duration of recordings processed (not their content), timestamps, interaction events, performance information, error data, audit logs and security events. Diagnostic records may contain limited contextual snippets where strictly necessary to investigate an error, security event or support request, subject to access controls and minimization.
3.5Communications and support data: emails, messages, support tickets, feedback, survey responses, files you choose to send and information exchanged during demonstrations, onboarding, consulting, training and support, including recordings of such sessions where you have been informed and, where required, have agreed.
3.6Commercial, procurement and relationship data: proposals, quotations, procurement procedures, tenders, negotiations, Order Forms, subscription plans, usage entitlements, contract contacts, purchase orders and relationship history.
3.7Billing, payment and tax data: billing contacts, invoice details, bank-transfer information, payment status, company registration information, VAT identification numbers and accounting records. Card payment details are processed directly by our payment provider; we receive limited payment metadata rather than complete card details.
3.8Marketing and preference data: newsletter subscriptions, consent records, campaign interactions, event registrations, communication preferences, unsubscribe requests and suppression records.
3.9Cookie and similar-technology data: as described in Section 20 of this Policy.
3.10Recruitment data: contact details, CV, work history, education, qualifications, portfolio information, interview notes, references and other information you provide in connection with a role.
3.11Customer Data: recordings, transcripts, summaries and related content submitted by or for a customer may contain personal data about you and others. We process that information as a processor under the DPA, not as a controller.
4. How We Obtain Personal Data
We obtain personal data directly from you (forms, registration, contracts, communications, meetings, events, support requests); from your organization or a workspace administrator who creates an account or assigns access for you; automatically from your browser, device or use of the websites and Services; from payment, communications, CRM, analytics and event-management providers; from referrals, business partners and event organizers; and from public sources such as company websites, public procurement records and professional profiles, where collection and use are lawful and proportionate. Where Article 14 GDPR applies, we provide the required information within the applicable period unless an exception applies.
5. Why We Process Personal Data, Legal Bases and Retention
We process personal data only where a lawful basis applies. The table sets out our principal purposes, the legal bases under Article 6(1) GDPR and usual retention periods. A longer period may apply where necessary to comply with law, investigate security incidents, establish or defend legal claims, enforce an agreement or comply with a legal hold.
| Purpose | Main data | Legal basis | Usual retention |
|---|---|---|---|
| Providing websites and accounts, authentication, workspace administration, delivering requested features | Identity, account, authentication, usage data | Contract (Art. 6(1)(b)); legitimate interest in operating reliable B2B services (Art. 6(1)(f)) | Lifetime of the account, then up to 12 months after closure or prolonged inactivity |
| Sales, demonstrations, proposals, procurement, contracting, customer-relationship management | Identity, commercial and relationship data | Pre-contractual steps and contract (Art. 6(1)(b)); legitimate interest in managing professional relationships (Art. 6(1)(f)) | Duration of the relationship, then up to 24 months after the last meaningful interaction; contract records for the limitation period |
| Billing, payments, accounting and taxation | Billing, payment and tax data | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Up to 10 years under Lithuanian accounting and tax law |
| Support, onboarding, consulting and training | Communications and support data | Contract (Art. 6(1)(b)); legitimate interest in effective support (Art. 6(1)(f)) | Up to 24 months after the request or engagement is closed |
| Security, fraud prevention and incident response | Authentication, device, usage and security data | Legitimate interest in securing the Services (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) | Routine logs up to 180 days; longer for an active investigation, dispute or legal hold |
| Analytics, performance measurement and service improvement | Usage, cookie and diagnostics data | Consent for non-essential cookies (Art. 6(1)(a)); legitimate interest for minimized operational measurement (Art. 6(1)(f)) | Per tool configuration and consent settings, as stated in Section 20 |
| Service communications (account, security, billing, maintenance, feature changes) | Identity and account data | Contract (Art. 6(1)(b)); legitimate interest in keeping users informed (Art. 6(1)(f)) | As long as needed to deliver and evidence the communication |
| Marketing, newsletters, webinars and events | Marketing and preference data | Consent (Art. 6(1)(a)); limited B2B communications on the basis of legitimate interest where permitted by the Law on Electronic Communications (Art. 6(1)(f)) | Until consent is withdrawn or you unsubscribe; event records up to 24 months; a minimal suppression record thereafter |
| Legal compliance, corporate administration, claims and transactions | All categories as relevant | Legal obligation (Art. 6(1)(c)); legitimate interest in administering the business and defending claims (Art. 6(1)(f)) | Statutory period and applicable limitation period |
| Recruitment | Recruitment data | Pre-contractual steps (Art. 6(1)(b)); legitimate interest in recruiting (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)); consent for talent pools (Art. 6(1)(a)) | Up to 6 months after the process ends; longer with consent |
6. Legitimate Interests
Where we rely on legitimate interests, those interests include operating, securing and improving B2B/B2G websites and Services; managing professional, customer, supplier and public-sector relationships; preventing fraud, misuse and security incidents; maintaining business, procurement and support records; protecting legal rights and resolving disputes; and conducting limited, proportionate business development permitted by law. We weigh these interests against your rights and reasonable expectations and apply safeguards such as access limitation, minimization, retention controls and your right to object. You may request information about a relevant balancing assessment by contacting us.
7. AI-Specific Privacy Commitments
7.1No model training without opt-in. We do not use recordings, transcripts, summaries or other Customer Data to train or fine-tune speech, language or other models for other customers or for general model improvement unless the customer expressly opts in through a specific written agreement. We do not use controller-side personal data to train models unless it has first been rendered anonymous.
7.2EU hosting. Customer Data is stored and processed in Microsoft Azure regions in the European Union; limited remote support access by Microsoft is described in Part B of the Legal Notice and Trust Information page. Speech recognition and language-model processing take place in those regions. We do not send Customer Data to external foundation-model APIs outside that environment. The regions and subprocessors are listed in Part B of the Legal Notice and Trust Information page at suchmuch.ai/legal.
7.3No biometric identification or emotion recognition. We do not create voiceprints, do not identify people by their voice across recordings and do not infer emotions from voice or content.
7.4No solely automated decisions. We do not use controller-side personal data to make solely automated decisions that produce legal or similarly significant effects. The Services generate assistive output for customers, who are responsible for human review and for any transparency or automated-decision requirements that apply to their use.
7.5Transparency. Our AI Transparency Notice, in Part C of the Legal Notice and Trust Information page at suchmuch.ai/legal, describes how the Services use AI, how AI-generated content is marked and the known limitations of transcripts and summaries.
8. Retention of Customer Data
Customers control how long recordings, transcripts and summaries are kept and can delete them at any time. Unless a customer configures a shorter period or an Order Form provides otherwise, Customer Data is retained until deleted by the customer or until the account ends, after which the customer has at least 30 days to export its data; we then delete Customer Data from active systems and from backups through ordinary backup rotation within 90 days. Some customers may agree in writing to a process-only configuration in which recordings are processed transiently and not stored beyond what immediate processing and security logging require.
9. Cookies and Similar Technologies
Our use of cookies and similar technologies, the tools we use, their purposes and durations and how to accept, reject or change your choices are described in Section 20 of this Policy.
10. Recipients
We disclose personal data only where necessary for an identified purpose and subject to appropriate safeguards. Recipients may include: our authorized personnel and contractors on a need-to-know basis; Microsoft Ireland Operations Limited (Microsoft Azure) for cloud infrastructure and AI services in the European Union; our payment provider Stripe Payments Europe Ltd (Ireland) and relevant banks; our customer-relationship and email providers (Attio Ltd, United Kingdom; Resend Inc., United States, with processing in the European Union); analytics, performance and monitoring providers identified in Section 20, subject to consent where required; event, webinar and scheduling providers where you register or book a meeting; legal, accounting, tax, audit, insurance and other professional advisers bound by confidentiality; competent public authorities, courts and regulators where disclosure is required or legally permitted; and prospective or actual investors, purchasers, successors or transaction advisers in connection with a financing, restructuring, merger or sale, subject to confidentiality and data-protection safeguards. We do not sell personal data. The providers listed here receive controller-side data; the subprocessors authorized for Customer Data are those listed in Part B of the Legal Notice and Trust Information page at suchmuch.ai/legal.
11. International Transfers
Customer Data is stored and processed in the European Union. Controller-side data (for example contact details in a CRM or support tool) may be processed by a provider located outside the European Economic Area. Where the GDPR restricts such a transfer, we rely on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified US recipients), the European Commission’s Standard Contractual Clauses with supplementary measures where needed, or, exceptionally, a derogation under Article 49 GDPR where its conditions are met. You may request information about the relevant safeguard and, where legally available, a copy of it by contacting info@suchmuchai.com.
12. Security and Breach Handling
We maintain technical and organizational measures appropriate to the nature and risk of processing, including encryption in transit and at rest, individual accounts and multi-factor authentication, role-based and least-privilege access, logical separation of customer workspaces, security logging and monitoring, vulnerability and patch management, backup and recovery, and confidentiality and data-protection obligations for personnel and providers. No system can be guaranteed completely secure. You are responsible for protecting your credentials and reporting suspected unauthorized access.
Where we become aware of a personal-data breach for which we are the controller, we will notify the State Data Protection Inspectorate within 72 hours where Article 33 GDPR requires it and notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms. Where we act as processor, we notify the customer without undue delay in accordance with the DPA.
13. Your Rights
Subject to the conditions and exceptions in applicable law, you have the right to: access your personal data and obtain a copy; correct inaccurate or incomplete data; request erasure; request restriction of processing; receive data you provided in a structured, commonly used and machine-readable format and transmit it to another controller; object to processing based on legitimate interests, including to direct marketing at any time; withdraw consent at any time without affecting prior lawful processing; receive information about safeguards for international transfers; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where permitted by law.
To exercise a right relating to processing for which we are the controller, contact info@suchmuchai.com and describe the relevant interaction, account or agreement. We may request information reasonably necessary to verify your identity and locate the relevant records. We respond without undue delay and within one month; that period may be extended by up to two further months where permitted because of the complexity or number of requests. Requests are handled free of charge unless they are manifestly unfounded or excessive. If your personal data is contained in a customer’s recordings, transcripts or summaries, please contact that customer first; we will assist the customer as required by law and the DPA.
14. Marketing Choices
You may unsubscribe from promotional email by using the link in the message or by contacting info@suchmuchai.com. We will continue to send non-promotional communications concerning an active account, contract, billing, security, support or material service changes. If you object to direct marketing we stop using your data for that purpose and keep a minimal suppression record so that we do not contact you again contrary to your request.
15. Children
The websites and user accounts are intended for adult representatives of businesses, institutions and public authorities and are not directed to persons under 18. We do not knowingly invite a child to create an account or provide personal data directly to us. Recordings made by customers may lawfully include minors (for example in education settings); in that case the customer is responsible for the lawful basis, transparency and other controller obligations and we process the data under the DPA.
16. Third-Party Websites and Social Media
Our websites and communications may link to third-party websites, platforms or services whose privacy practices are governed by their own notices. When you interact with a Such Much Voice page on a social-media platform, we may receive profile and interaction information from that platform, which also processes information under its own privacy terms and may act as an independent or joint controller for certain activities.
17. Complaints and Supervisory Authority
Please contact us first at info@suchmuchai.com so that we can investigate and try to resolve your concern. You also have the right to lodge a complaint with the supervisory authority in the EEA country of your habitual residence, place of work or the alleged infringement. Our lead supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, vdai.lrv.lt.
18. Changes to This Policy
We may update this Policy to reflect changes to the Services, recipients, technology, law or processing practices. The current version states its effective date. Where a change materially affects your rights or the way we use personal data, we will give appropriate notice through the websites, the Services or email before the change takes effect, unless a shorter period is required for security, legal compliance or urgent service needs.
19. Contact
UAB Such Much AI, company code 306405204, Bukčių g. 6-38, Vilnius, LT-04127, Lithuania, VAT number LT100017966319. Email: info@suchmuchai.com, subject line “Privacy Request”.
20. Cookies and Similar Technologies
This Section explains how we use cookies and similar technologies on the Such Much Voice websites at suchmuch.ai and related domains and in the Such Much Voice application. It forms part of this Privacy Policy.
20.1 What Cookies and Similar Technologies Are
Cookies are small text files placed on your device by a website. Similar technologies include local storage, session storage, pixels, scripts and software development kits that store or read information on your device. We refer to all of them as “cookies” in this Policy.
20.2 Legal Framework
Under the Law of the Republic of Lithuania on Electronic Communications, which implements Article 5(3) of Directive 2002/58/EC, we may store information on your device or access information already stored there only with your consent, unless the cookie is strictly necessary to provide a service you have requested. Where cookies process personal data, the GDPR also applies. Consent must be freely given, specific, informed and unambiguous; it is obtained through the cookie banner and can be withdrawn at any time. We follow the cookie guidance of the State Data Protection Inspectorate of the Republic of Lithuania.
20.3 Categories We Use
3.1Strictly necessary. These cookies support authentication, session management, security (including protection against cross-site request forgery), load balancing, storage of your cookie choices and core application functions such as keeping you signed in and uploading recordings. They are used without consent because the Services cannot be provided securely without them. You can block them in your browser, but parts of the Services will then not work.
3.2Functional. These cookies remember choices you make, such as language, interface preferences or a collapsed panel, so that you do not have to set them again. Where they are not strictly necessary, they are used only with your consent.
3.3Analytics and performance. These cookies help us understand how the websites and application are used, which pages and features are popular, where errors occur and how performance can be improved. They are used only with your consent. Information is aggregated where possible.
3.4Error monitoring. We use an error-monitoring tool to detect and diagnose technical faults. It operates without consent only to the extent strictly necessary to keep the Services secure and operational, such as detecting failed uploads or security errors; any performance tracing, session-replay or behavioural component is activated only with your consent.
3.5Advertising. We do not use advertising or retargeting cookies or pixels (for example Meta Pixel, LinkedIn Insight Tag or Google Ads tags). If that changes, we will update this Policy and ask for your consent where required.
20.4 Cookies Used
The table lists the cookies and similar technologies in use at the Effective Date.
| Name or tool | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| Session and authentication token | Such Much AI | Strictly necessary | Keeps you signed in to the application | Session or up to 30 days |
| Cookie-consent record | Such Much AI | Strictly necessary | Stores your cookie choices | 12 months |
| Language and interface preferences | Such Much AI | Functional | Remembers language and display settings | 12 months |
| PostHog | PostHog Inc. (EU cloud) | Analytics | Product-usage analytics in the application | Up to 12 months |
The cookie banner or cookie-settings panel may provide more specific and current information about individual cookies, providers, purposes and durations. If that information conflicts with this table, the cookie-settings panel governs for the relevant cookie.
20.5 Your Choices
5.1Cookie banner. When you first visit the websites, the banner lets you accept all non-essential cookies, reject all non-essential cookies or choose by category. Rejecting is as easy as accepting, and non-essential cookies are not set until you have made a choice.
5.2Changing or withdrawing consent. You can change your choices or withdraw consent at any time through the “Cookie settings” link in the website footer or in the application settings. Withdrawal does not affect the lawfulness of processing that took place before withdrawal. We ask for your choices again after 12 months or when we add a new category of cookies.
5.3Browser controls. Most browsers let you block or delete cookies and clear local storage. Blocking strictly necessary cookies may prevent you from signing in or using parts of the Services.
5.4Opt-out tools. Where an analytics provider offers its own opt-out, it is linked from the cookie-settings panel.
20.6 Third-Party Content
Pages that embed third-party content, such as videos or scheduling widgets, may set third-party cookies when you interact with that content. These are loaded only after you consent to the relevant category or click to activate the content.
20.7 Changes to This Section
We may update this Section to reflect changes in the cookies we use, their providers or applicable law. The current version states its effective date, and material changes are announced through the cookie banner.
20.8 Contact
Questions about cookies may be sent to info@suchmuchai.com with the subject line “Cookies”. Your data-protection rights and how to complain to the State Data Protection Inspectorate are described in Sections 13 and 17 of this Policy.