Effective date: 8 October 2026
1. Application
1.1 This Privacy Notice (the "Notice") governs the processing of personal data by Bynn Intelligence Inc. ("Bynn", the "Company") in connection with ZOREAL Meet, the Company's voice, video and messaging service (the "Service"). It supplements the ZOREAL Privacy Notice and, in respect of biometric data, the Biometric Data Privacy Notice, each of which is incorporated by reference and continues to apply. In the event of conflict in respect of the Service, this Notice prevails.
1.2 The Company is the controller of personal data processed to provide, secure and operate the Service. Where the Service is used under an agreement with an organisation (the "Customer"), the Customer is the controller of the content it elects to record, transcribe or retain, and the Company processes such content on the Customer's behalf and instructions.
2. Encryption
2.1 All communications transmitted through the Service are encrypted in transit between each participant's device and the Company's media infrastructure using industry-standard transport encryption.
2.2 The host of a room may elect end-to-end encryption, in which case the cryptographic keys exist solely on the participants' devices, the Company has no technical ability to access the content of the communications, and no feature of the Service that would require such access is available for that room. The encryption mode of a room is displayed to every participant for the duration of the room.
3. Personal data processed
3.1 The Company processes the following categories of personal data in connection with the Service: (a) account and identity data, including the participant's ZOREAL account, display name and, where a presence check at the identity level has been completed, the verified name; (b) session data, including the rooms joined, the times of joining and leaving, the duration of the session, the encryption mode, the features enabled and the results of any presence or integrity measure, maintained in a tamper-evident audit record; (c) connection and device data, including network address and client version; (d) communications content, comprising audio, video, screen sharing and messages, which in rooms that are not end-to-end encrypted is processed transiently by the Company's media infrastructure for the purpose of transmission; and (e) recordings, transcripts, notes and captions, where enabled by the host in accordance with Section 5.
4. Integrity and identity assurance
4.1 To protect participants against impersonation, synthetic media and unauthorised access, and to preserve the integrity of the Service, the Company may apply automated integrity and identity-assurance measures to communications in rooms that are not end-to-end encrypted. Such measures may include the automated analysis of audio and video, the comparison of a participant against the participant's own enrolment and against records associated with previous security incidents, and the processing of biometric data for such purposes, in each case as described in the Biometric Data Privacy Notice.
4.2 Data processed under this Section is processed for security, fraud prevention and related purposes and for purposes compatible therewith, including the improvement of the Company's security measures, and is retained for a limited period in accordance with Section 7. The result of a measure may be communicated within the room and may result in the termination of a stream or a room.
4.3 A participant who does not wish such measures to apply may join, or request that the host establish, an end-to-end encrypted room.
5. Recordings, transcripts and notes
5.1 Recording, transcription, notes and captions are activated solely at the election of the host and are indicated to every participant for the duration of their operation. The host is responsible for obtaining any consent to recording required under the laws applicable to the participants.
5.2 Recordings, transcripts, notes and captions are retained on behalf of the Customer, in the storage location the Customer has designated, for the Customer's purposes, including the retrieval of and search across its meetings and the provision of context to services the Customer operates, and may be processed by the Company for the operation, security and improvement of the Service to the extent permitted by the Customer's agreement with the Company. The Customer may delete such content at any time, and deletion is permanent.
6. Connected calendar accounts
6.1 Where a user connects a Google account to the Service for scheduling, the Company accesses the user's calendar list, free and busy information and, on the calendar the user designates for bookings, calendar events, solely to display the user's availability, to prevent conflicting bookings and to create, update and remove the events of bookings made through the Service. The Company does not access the content of events on any other calendar.
6.2 The Company's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Such information, whether raw, aggregated, anonymised or derived, is not used for advertising, is not sold, is not transferred to any artificial-intelligence or machine-learning service, and is not used to develop, improve or train generalised or foundational artificial-intelligence or machine-learning models.
6.3 The user may disconnect the account at any time in the Service or in the settings of the Google account, whereupon the Company ceases to access it.
7. Retention
7.1 Personal data is retained for no longer than is necessary for the purposes for which it is processed and for such further period as is required or permitted by applicable law, including for the establishment, exercise or defence of legal claims. Communications content in rooms that are not end-to-end encrypted is not retained by the Company other than as provided in Sections 4 and 5. Session and audit data are retained for the periods necessary to maintain the integrity and accountability of the Service.
8. Disclosure
8.1 The Company may disclose personal data to its affiliates, to processors engaged under contract to provide infrastructure and services, to the Customer in respect of content processed on its behalf, to a successor in the event of a merger, acquisition or reorganisation, and where required by law or legal process. The Company does not sell personal data processed in connection with the Service and does not use it for advertising.
9. Location of processing
9.1 Communications are processed on media infrastructure operated by the Company in the European Union, currently in Germany and Finland, and on artificial-intelligence infrastructure operated by the Company in the European Union, currently in Sweden. Content retained under Section 5 is stored in the storage region designated by the Customer, which may be any region offered by the Company's cloud infrastructure provider. Transfers of personal data outside the European Economic Area are made subject to appropriate safeguards under applicable law.
10. Rights
10.1 Data subjects have the rights afforded by applicable law, including the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority, as further described in the ZOREAL Privacy Notice. Requests concerning content controlled by a Customer should be directed to that Customer. Requests to the Company may be made to privacy@bynn.com.
11. Legal bases and jurisdiction-specific provisions
11.1 European Economic Area, United Kingdom and Switzerland. The Company processes personal data on the bases of the performance of a contract (Article 6(1)(b) GDPR), its legitimate interests in the security, integrity and improvement of the Service (Article 6(1)(f)), compliance with legal obligations (Article 6(1)(c)) and, in respect of biometric data, the data subject's explicit consent (Articles 6(1)(a) and 9(2)(a)), which may be withdrawn at any time in respect of future processing.
11.2 United States. Biometric identifiers processed under Section 4 are subject to the retention, destruction and other provisions of the Biometric Data Privacy Notice, which constitutes the Company's written policy for the purposes of applicable state biometric privacy laws, and to the consent obtained upon joining a room to which such measures apply.
12. Amendments
12.1 The Company may amend this Notice. The effective date of the version in force appears above. Material amendments will be notified through the Service before taking effect.