GDPR-ready AI note taker

Notes your DPO will sign off on

Kasset records your meetings and conversations and turns them into notes, with a DPA under Belgian law, every sub-processor named, and nothing used to train a model.

Download Where your data lives
Learn more
Where a conversation goes

Who processes what

Recordings are stored in France. Each step that needs AI goes to a named provider, one recording at a time. An administrator can keep all of it on Mistral, in France, with EU-only mode.

Your recordings

Scaleway

Paris, France

Audio is stored in a private bucket, keyed so that no name or email appears on it.

Your notes

Scalingo

France

The app, its database and its search run here.

Transcription

ElevenLabs

United States

Receives one recording's audio at a time, and keeps the audio and transcripts it processes. Training is opted out.

Notes and suggestions

Anthropic

United States

Claude reads one transcript at a time, or a question and the passages found for it. It does not train on them.

Ask Kasset, if chosen

OpenAI

United States

GPT answers when a member picks it, and writes notes if an administrator chooses it. It does not train on them.

Search, and EU-only mode

Mistral

France

Search runs here for every workspace. With EU-only mode, all of the AI does.

Recording notice

No bot. A heads-up instead.

Kasset records from your computer, so no bot joins the call. Instead, everyone on the invitation gets an email up to 30 minutes before the meeting. Anyone who would rather not be recorded just replies, and you see it before the call.

On by default, for every calendar meeting.

What Kasset never does

Your meetings are not training data

What your team says in a meeting stays yours. It is not used to improve anyone's model, it is not sold, and it goes to no one beyond the sub-processors named in the privacy policy.

The checklist

Seven questions for any AI note taker

What a DPO will ask, and where Kasset answers it in writing.

Question
Kasset
In writing
Is there a processor agreement?
Yes, a DPA under Belgian law
Read the DPA
Where are recordings stored?
France
Where your data lives
Are sub-processors named?
Yes, each one, with its role
Privacy policy
Are transfers covered?
Yes, Standard Contractual Clauses
DPA, section 7
Are conversations used for training?
Never
Privacy policy
Are participants told?
Yes, by email, by default
Terms, section 4
Can I delete everything?
Yes, at any time
Deleting data
A few useful answers

Questions?

Is Kasset GDPR compliant? +
Kasset is built to be used lawfully under the GDPR: it acts as your processor under a Data Processing Agreement, stores recordings in France, names every sub-processor, never trains models on them, and deletes them when you ask. Compliance also depends on how you record, so you still need a lawful basis and to tell people where required.
Where does Kasset store and process recordings? +
Audio is stored with Scaleway and the application and database run on Scalingo, both in France. Transcription runs on ElevenLabs, and notes, suggestions and Ask Kasset on Anthropic's Claude, in the United States, under Standard Contractual Clauses. Search runs on Mistral, in France. Where your data lives.
Does Kasset use American AI models? +
Yes, by default: ElevenLabs for transcription, and Anthropic (Claude), or OpenAI (GPT) when a member picks it, for notes and Ask Kasset. An administrator can turn on EU-only mode to keep the workspace on Mistral, in France, for all of its AI.
Is my conversation data used to train AI? +
No. Recordings, transcripts and notes are never used to train or fine-tune any model, by Kasset or by its AI providers.
Do I need consent to record a meeting in the EU? +
You need a lawful basis under the GDPR, which is often consent or legitimate interest, and national rules on recording apply on top. In Belgium you may record a conversation you take part in, but not one you are not part of. Telling people you are recording is the safe default, and Kasset does it for calendar meetings: invitees get an email up to 30 minutes before the meeting, and can reply to you if they would rather not be recorded. This is general information, not legal advice.
How do I delete recordings? +
Delete a conversation in Kasset and it is removed, with any remaining audio. You can also have audio deleted as soon as it is processed. Close your account and everything is deleted within 30 days. How to delete your account.

Put it on kasset

Meetings, voice notes and real-world conversations, captured and ready when you need them.

Download
Sources and fine print

The facts

Checked on .

Roles

You decide what is recorded, so you are the controller of your conversations. Kasset is your processor under the Data Processing Agreement, governed by Belgian law, and acts only on your instructions. For your account data, Kasset is the controller.

Transfers outside the EU

To be transcribed and understood, recordings go to ElevenLabs, Anthropic and, when chosen, OpenAI, in the United States, unless an administrator turns on EU-only mode. They also leave the EU when you connect a tool and tell Kasset to send data to it. Standard Contractual Clauses cover these transfers, and ElevenLabs is also certified under the EU-US Data Privacy Framework. The Framework is still valid, but in July 2026 the European Data Protection Board asked the Commission to review it again.

Recording people lawfully

The GDPR does not ban recording meetings, but you need a lawful basis, usually consent or legitimate interest, and national law adds its own rules. In Belgium, recording a conversation you take part in is allowed, while intercepting one you are not part of is a crime; sharing a recording, or using it in a way that harms someone's privacy, can still be unlawful. The recording notice covers invited calendar meetings. For conversations in person, or people who join without an invitation, tell them yourself, and respect anyone who asks not to be recorded.

Retention and breaches

Audio is kept until you delete it, unless you choose a set number of days or deletion once processed. Account data is deleted within 30 days of closing the account. A breach is notified without undue delay and within 72 hours.

Sources

This page is general information, not legal advice.