In short
- Stuntpony assists a sales representative during a call and afterwards. It does not make audio recordings of calls and does not keep audio.
- Speech is transcribed within the EU. Transcripts and the output derived from them are stored in the EU. Text is processed by a language-model provider in the United States under Standard Contractual Clauses.
- Call Data is not used to train AI models by us, and the providers that process Call Data, for transcription, language models and web research, are prohibited by contract or by account setting from doing so.
- Call Data is visible to the Representative who made the call. Where the Customer turns on team summaries, a summary of each call, including short quoted client statements, is posted automatically to the channel the Customer chose. There are no manager dashboards.
- For Call Data, the company that uses Stuntpony is the controller and we act as its processor. For accounts, this website and email, we are the controller.
- This website sets no tracking cookies. Analytics, when enabled, runs without cookies and honours Do Not Track.
- You can ask to see, correct, export or delete your personal data, and object to processing based on our legitimate interests. We respond within one month.
01Scope and who we are
This policy is issued by Moscos BV, trading as Stuntpony, Haspelstraat 23, 9000 Gent, Belgium, company number 0774.733.555, VAT BE 0774.733.555 (“Stuntpony”, “we”, “us”). It applies to this website (https://stuntpony.com), to Stuntpony accounts and the web workspace, and to the Stuntpony desktop application (together, the “Service”). Questions and requests about personal data go to hi@stuntpony.com.
Three terms recur in this policy.
- The Customer is the company that subscribes to the Service, or trials it under a pilot, for its sales team.
- A Representative is an individual who uses the Service through a Customer, typically a sales representative on the Customer's team.
- Call Data is the data generated when the Service assists a call: transcripts, the output derived from them, and the information a Representative adds about a prospect.
Stuntpony acts in two capacities.
- Controller for the personal data of website visitors and account holders, and for the operation of the Service itself: sign-in, security, support, analytics and email.
- Processor for Call Data. The Customer determines the purposes and means of that processing and is its controller. We process Call Data on the Customer's documented instructions under a data processing agreement. If you use Stuntpony through your employer, your employer's privacy notice applies to Call Data alongside this policy.
02Information we collect
We collect only what the Service needs to work and to be kept secure. Providing account information is necessary to use the Service; on the waitlist, every field other than the email address is optional. When a Representative connects a service, the permissions requested are shown on the provider's consent screen.
| Category | What it includes | Source |
|---|---|---|
| Account information | Your name, email address and profile picture as provided by your Google or Microsoft sign-in; technical data about each sign-in, such as IP address and browser type; and a record of account-level actions (sign-in, connections made and removed, deletions, access granted) kept for accountability. | You, via your sign-in provider |
| Call Data | Transcripts of assisted calls; the live prompts and discovery tracking derived from them; post-call summaries and draft follow-ups; information about a prospect extracted from calls, together with the passage it came from; feedback to the Representative on their own conduct of the call, shown only to them; and notes or documents a Representative adds about a prospect. Call Data concerns the Representative and the other participants on the call. | The Representative's device during a call; the Representative |
| Connected services | Where a Representative authorises it: upcoming calendar events with their participants, messages in the team channels the Service is invited to, Google Drive documents the Representative has access to (read access is requested together with Google Calendar), searched and quoted to prepare a call brief, and the public content of the Customer's own website. | The services the Representative connects |
| Public information about prospects | Publicly available information about a prospect's company, retrieved through web search to prepare a pre-call brief. | Publicly accessible sources |
| Website information | The email address submitted to the waitlist; optionally your name, company, role, team size, LinkedIn or website, how you heard about us and, if you name a referrer, their name and email address; the name, company, website and profile submitted with a beta access request; and, when analytics is enabled, aggregate page-view statistics collected without cookies. | You |
| Desktop application | The permissions you grant (microphone, system audio, calendar) and the version information sent when the application checks for updates. The application sends no usage telemetry and no crash reports. | Your device |
03How an assisted call is processed
When a Representative starts a session, the application captures the Representative's microphone and the audio of the call playing on the device. The audio is streamed to a speech-to-text provider hosted in the EU and is discarded once transcribed; no audio file is created at any point. The resulting transcript is stored in the EU. The live prompts shown to the Representative are computed by the application on the device. During the call, the other participants' statements are sent to a language-model provider, together with the Customer's product knowledge, the current discovery status and context about the prospect (earlier calls, notes and, where connected, relevant team-channel messages), to update the discovery tracking and answer product questions. After the call, the full transcript is sent to the same provider to write a summary and a draft follow-up; the draft also uses the participants' email addresses from the calendar invitation and short quotations from earlier calls with the same prospect. To prepare a brief before a call, calendar details, relevant team-channel messages, text from Google Drive documents and web-research results are sent to the same provider. Requests are sent with response storage disabled; the language-model provider retains request data for up to 30 days for abuse monitoring and does not use it to train models.
Once the Customer turns on team summaries, a summary of each call, including short quoted client statements, discovery status and the prompts shown, is posted automatically after the call to a team channel of the Customer's choosing. The Representative does not choose call by call.
The Service does not make audio recordings of calls, does not create voice profiles, does not recognise speakers by voice across calls, and does not report on Representatives to their managers. We do not use Call Data to train AI models, and our providers are contractually prohibited from using Call Data for their own purposes, including model training. They are listed on our subprocessors page.
04Participants who do not use Stuntpony
The other participants on an assisted call do not have an account with us, yet their words are transcribed and their email addresses may reach us through the calendar invitation. They are entitled to know this. As the Customer is the controller of Call Data, that duty rests with the Customer, and the Service is designed so that it can be met:
- The Customer requires its Representatives to inform the other participants at the start of a call that an AI assistant transcribes it for live notes, summaries and follow-up. In jurisdictions where every participant must agree before a conversation is captured (Switzerland and several US states), the Representative must obtain that agreement or not use the Service on that call.
- Where a call is already announced as recorded, for instance because the Customer or the other party uses a call-recording tool, the announcement may be combined, provided it states that an AI assistant also transcribes the call and refers to the Customer's privacy notice. An announcement that does not mention the assistant does not cover it. Where agreement is required, the Representative still asks for it on the call; consent given to another tool does not supply it. Whether a combined announcement satisfies the law in a given country or state is for the Customer to determine.
- A participant may ask the Customer, or us at hi@stuntpony.com, what has been retained and request its deletion. We assist the Customer in responding within one month.
- We retain only what the assistance requires. We do not create voice profiles and do not build profiles of participants for our own purposes.
05Purposes and legal bases
| Purpose | Legal basis | Notes |
|---|---|---|
| Processing Call Data to provide live assistance, summaries, drafts and briefs | Determined by the Customer as controller, typically its legitimate interest (GDPR art. 6(1)(f)); we process on its instructions (art. 28) | The Customer decides which connected services its Representatives may authorise |
| Creating and operating accounts for Representatives | Our legitimate interest in providing the Service to the Customer (art. 6(1)(f)); performance of a contract (art. 6(1)(b)) where you contract with us directly | |
| Securing the Service and preventing abuse | Our legitimate interest in protecting our systems and our Customers' data (art. 6(1)(f)) | Includes sign-in records, update checks and the account activity log |
| Improving the Service | Our legitimate interest in understanding how the Service is used (art. 6(1)(f)) | Aggregate, de-identified statistics only, such as how often prompts are marked useful; never transcript content and never for model training |
| Handling waitlist and beta access requests | Steps taken at your request prior to a contract (art. 6(1)(b)) | |
| Sending marketing communications | Consent (art. 6(1)(a)), given separately and withdrawable at any time | We currently send no marketing email. Service notices, including changes to this policy or to our subprocessors, are sent under the contract |
| Complying with legal obligations and handling claims | Legal obligation (art. 6(1)(c)) and legitimate interest (art. 6(1)(f)) |
Where we rely on legitimate interest, you may object at any time on grounds relating to your particular situation; see the section on your rights.
06Artificial intelligence and automated processing
The Service uses speech recognition and large language models to turn a live conversation into prompts, discovery tracking and drafts. The output is advice presented to a person. The Service makes no decision about you, a participant or anyone else that produces legal or similarly significant effects, and no processing falls within GDPR article 22.
- No model training. We do not use Call Data or any other personal data processed through the Service to train AI models, and the providers that process Call Data, for transcription, language models and web research, are prohibited by contract or by account setting from doing so.
- No emotion recognition. Output is derived from the words spoken, not from tone of voice, biometrics or facial data.
- Shown to the Representative. Output is presented to the Representative on the call. It is not used to evaluate employees. It reaches others through the team summaries the Customer turns on, which are posted automatically after each call, or where the Representative shares it.
- Not infallible. Transcripts and prompts may contain errors. Representatives remain responsible for what they say and decide.
08International transfers
Audio does not leave the EU. Transcripts and account data are stored in the EU. Transcript text and related context are transferred to our language-model provider in the United States to update discovery tracking, answer product questions and write summaries, drafts and briefs, and search queries built from a prospect's company name, competitor names and the topic of a pre-call brief are sent to web-research providers in the United States. Website traffic passes through content-delivery providers that operate globally.
Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023. Otherwise it relies on the Commission's Standard Contractual Clauses (art. 46(2)(c)). A copy of the safeguards in place with a given provider is available on request at hi@stuntpony.com.
09Retention
| Category | Retention period |
|---|---|
| Call Data | Until the Customer or the Representative asks us to delete it, or the account is closed; deleted within 30 days of the request. |
| Audio | Not retained. Discarded as soon as it has been transcribed. |
| Connected-service data | Calendar events are fetched for seven days ahead and team-channel messages for 30 days back, and are kept until the account is closed. Disconnecting a service stops further collection but does not remove what has already been stored; you may ask us at hi@stuntpony.com to remove it. |
| Account information | For the life of the account. Sign-in sessions expire after seven days. |
| Account activity log | Three years. Records that evidence a deletion or a subprocessor notice, five years. Retained after account closure with the email address stored only as a hash. |
| Waitlist and access requests | Until the beta programme for which they were collected has ended, or earlier on request. |
| Website analytics | Aggregate statistics only; no identifier is stored on your device. |
| Contracts, invoices and correspondence | For the period required by Belgian accounting and tax law, currently seven years. |
On termination of a pilot or subscription we delete the Customer's Call Data within 30 days, or sooner on request. Backups expire on their own cycle and are never used to restore deleted Call Data.
10Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest by our hosting provider, access limited to named personnel on a need-to-know basis, signed application updates, and an application that embeds no provider secrets and, where it connects to a provider directly, uses a short-lived credential issued by our backend. The desktop application keeps its sign-in token in the macOS Keychain. Should a personal data breach affect Customer Data, we notify the Customer without undue delay and in any event within 48 hours of becoming aware of it.
11Your rights
Subject to applicable law, you have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, to restrict its processing, and to withdraw consent where processing is based on consent. To exercise these rights, write to hi@stuntpony.com. We respond within one month and may ask you to verify your identity first.
Right to object. Where we process personal data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation, and we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
Requests concerning Call Data are forwarded to the Customer as controller, and we assist in responding. On request, we delete a call together with its transcript and the output generated from it, including its summary and draft follow-up, within 30 days. Team summaries already posted to a team channel remain there under the Customer's control. Information held on a prospect's record is deleted on request or when the account is closed.
Accounts are closed on request to hi@stuntpony.com. Closing an account deletes it, together with all Call Data linked to it, within 30 days. Your waitlist entry and the record that you asked for and were given access are kept separately; we remove them as well if you ask.
You may also lodge a complaint with a supervisory authority. Our lead authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données). If you are located elsewhere in the EU, in the United Kingdom or in Switzerland, you may contact the authority in your own country.
13United Kingdom, Switzerland and United States
United Kingdom. The UK GDPR affords you the rights described above. Complaints may be addressed to the Information Commissioner's Office. Should we serve UK customers without a UK establishment, we will appoint a UK representative and name them here.
Switzerland. The Swiss Federal Act on Data Protection applies to users in Switzerland. Swiss law requires the agreement of every participant before a conversation is captured. We have not appointed a Swiss representative, as our processing in Switzerland is not large-scale; we will revisit this as it grows.
United States. We do not sell or share personal information within the meaning of California law and use no advertising trackers. Several states require the consent of all participants before a conversation is captured; Representatives must follow the disclosure procedure set by the Customer.
14Changes to this policy
The date at the top of this page indicates the current version. Where a change materially affects how personal data is processed, such as a new purpose or a new provider, we notify Customers by email at least 30 days before it takes effect where practicable, and in any event before it takes effect, and summarise the change at the top of this page. Clarifications take effect on publication.
15Contact
Moscos BV, Haspelstraat 23, 9000 Gent, Belgium, company number 0774.733.555, VAT BE 0774.733.555. Privacy enquiries and requests: hi@stuntpony.com.