Privacy policy

Version 1.0 · Drafted 29 August 2026 · Not in force until published

This describes how Souldi Labs SL handles personal data in Tulius. It covers both the data we control ourselves and the data we process for a customer.

Who we are

The distinction that matters most

Tulius handles two different kinds of data, and we hold a different role for each.

What is said on a call — the controller is our customer

The organisation that deploys Tulius decides which calls it is used on and for what purpose. They are the controller of everything said on those calls; we process it on their instruction and nothing else. If you were a participant on a call and want to know why it was recorded, or want to object, the organisation running the call is who to ask — their own privacy notice covers it, and we cannot answer for them.

Account data — the controller is us

When somebody signs in to Tulius we receive their name and work email address from Google. We are the controller of that, and it is used only to identify who approved what.

Google user data

Signing in to Tulius is done with a Google account, and Google gives us the name and work email address on it. That is the whole of what we receive from Google today: we do not read anybody's mail, calendar or files.

Where a customer connects it, Tulius sends an approved follow-up email as the person who approved it, using the narrowest Gmail permission that can send — one that can send a message and cannot read, search or alter a mailbox. It is asked for when that feature is switched on, never before, and a person has approved the message before anything is sent.

Tulius's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data, use it for advertising, or allow anybody to read it, except as those requirements permit.

What we process on a customer's instruction

The text of a call, the names and email addresses of the people on it, and the proposals and approvals that follow from it.

We do not retain audio. Where Tulius captures a call itself, the audio is transcribed as it happens and discarded. Only the text is stored, and no recording of anyone's voice is kept in a customer deployment.

How long it is kept

A transcript is held for a retention period agreed with the customer, after which the words are discarded. The record of what people decided about the call — the proposals and the approvals — outlives the transcript, because that record is what the customer uses the product for. Once the words are gone, nothing new can be grounded in that call.

Deletion on request is separate and immediate: a customer can have a call and everything derived from it removed at any time, without waiting for a retention period to come due.

Where it is processed

Tulius runs in Frankfurt. Each customer has a deployment of their own with its own database, so one customer's calls are never held alongside another's.

Who else is involved

Your rights

You can ask for access to your data, its correction or its erasure, and you can object to processing. For anything on a call, the organisation that ran the call is the controller and the right place to ask — we will pass on any request that reaches us and tell you where it went. For account data, write to us directly at joan@souldi.io.

You also have the right to complain to a supervisory authority in the country where you live or work.

Cookies

This site sets no cookies, loads nothing from another domain, and runs no analytics. The application at app.tulius.app sets one cookie, which keeps you signed in and does nothing else.

Changes

This page carries a version and an effective date. If it changes materially we will tell customers rather than relying on you noticing.