Aran Labs LLC controls the data behind REC.
REC Content Studio is operated by Aran Labs LLC (United States). This notice explains what personal data we collect when you request early access, use the studio, record conversations, and pay for a subscription, and what rights you have over that data — including under the EU/UK GDPR if you are located in the EEA, UK, or Switzerland.
This notice also covers people who appear in a recording as a participant or guest, even if they never create a REC account. If you are a participant with a question about a recording, contact us using the details at the bottom of this page.
Account details, your recordings, and what it takes to bill you.
Account and application data: your email, name, an optional work link, and what you want to record, collected when you request early access or sign in.
Optional marketing data: your email address, consent timestamp and notice version, subscription status, and unsubscribe token when you separately choose to receive REC launch or product-update emails.
Email operations data: when REC sends the requested application confirmation or an account invitation, we store a provider message ID, message kind, delivery state, and send, delivery, delay, bounce, complaint, suppression, open, or click timestamps. We do not copy the provider webhook's recipient address, IP address, user agent, or clicked URL into this ledger.
Unfinished first-conversation draft: your name, context, optional source link, pasted material, and content selections may be kept in versioned browser localStorage on your device. REC treats the draft as valid for no more than 30 days, then ignores and deletes it the next time you open conversation setup; an expired local entry can remain on the device until that visit or until you clear site data. REC removes a valid draft after successful conversation creation. AI-processing and policy checkbox state is never stored in this draft.
Conversation content: source recordings, browser transcripts and timestamped transcript segments, optional word-timed precise transcripts you explicitly request, the research dossier and conversation prompts we prepare, a small ledger of live follow-up prompts shown during recording and whether you accepted, dismissed, or skipped them, and any highlight or clip records you generate. Evidence quotes and model reasoning used to prepare a live suggestion are not stored in that ledger. Recordings and transcripts capture whoever appears in the conversation, including participants without an account.
Billing data: your subscription plan and status, invoice history, and payment metadata handled through Stripe. We do not receive or store your full card number.
Usage and security logs: a limited, allow-listed set of acquisition and product events, such as public-page views, early access application milestones, completed sign-in, conversation creation, research and camera readiness, recording and upload completion, highlights, clip export or sharing, and repeat conversations. REC also stores bounded AI-operation facts — provider response ID, model, job type, token and web-search counts, estimated list-price cost, stable failure code, and queue or execution timing — so reliability and spend can be monitored. These records never include prompts, responses, form answers, names, email addresses, recording or transcript content, source material, raw error messages, or full URLs.
Attribution data: the landing path, a named page variant, the referring domain (not the referring URL), and sanitized UTM source, medium, campaign, content, and term when those labels are present. REC does not store raw IP addresses for analytics.
Optional Google measurement: if you choose “Allow measurement,” Google Analytics and Google Ads may receive the public page path and title, browser and device information, IP address, referrer, ad-click information, and an early access application conversion event. REC does not send Google your application answers, name, email address, conversation content, recording, transcript, or an enhanced-conversion customer-data payload.
AI powers research, prompts, live follow-ups, and highlight recommendations.
Current Phase 1 processing is split by operation. Anthropic's Claude performs public-web or supplied-material research and prepares the dossier. REC then uses a privately deployed model on Aran Labs-operated hardware to turn the dossier and supplied context into conversation prompts. If Claude is deliberately selected to prepare those prompts, or the explicitly configured Anthropic fallback is invoked after private inference fails, that conversation-plan material is also sent to Anthropic.
During recording, if compatible live transcription is available, REC sends bounded transcript slices and reviewed conversation-plan context to Anthropic to prepare optional live follow-up prompts. After recording, REC uses the privately deployed model to recommend highlight moments from the saved transcript. If Claude is deliberately selected for highlights, or the explicitly configured Anthropic fallback is invoked after private inference fails, the transcript and conversation-plan context needed for that highlight job are sent to Anthropic. A follow-up appears only as a suggestion that you choose whether to use it; REC never introduces it automatically.
After recording, you may separately request precise, word-timed captions. Only then does a REC-controlled self-hosted transcription worker process the private saved recording. That result is kept separate from the browser transcript, and captions are burned into a downloaded clip only when you select that render option.
If transcription is unavailable, REC continues recording with the reviewed conversation plan and skips transcript-dependent suggestions rather than inventing them. AI output can be incomplete or inaccurate — see our Terms of Service for the full disclaimer.
We rely on different legal bases depending on the data.
Contract: processing your account, conversation content, and AI-assisted research and recording features is necessary to provide the service you signed up for.
Legal obligation: we keep certain billing and tax records because the law requires it, even after you close your account.
Legitimate interests: we keep limited security and audit logs to detect abuse, send necessary application and approval service messages, monitor whether they arrive, and use privacy-minimized first-party measurement to understand whether public pages and the early access funnel work, balanced against your privacy interests. This notice is a description of the implementation, not legal advice; the chosen basis still requires jurisdiction-specific review.
Consent: REC relies on a separate, optional, unchecked opt-in for launch and occasional product-update emails. Applying does not depend on agreeing to marketing, and you can withdraw consent at any time through the unsubscribe link in a message. REC also asks separately before loading Google Analytics or Google Ads measurement. Declining measurement does not affect access to the site or studio, and you can change the choice from Cookie settings in the site footer.
You can request deletion, and we target a one-month turnaround.
Early access applications and their transactional-email delivery records carry a 180-day retention date. REC accepts an unfinished first-conversation draft from versioned browser localStorage for no more than 30 days, deletes an expired or unreadable entry on the next setup visit, and removes a valid draft after successful conversation creation. The browser can retain an expired local entry until that visit or until you clear site data. Anonymous acquisition events expire after 3 months. Application-linked and authenticated funnel events, privacy-minimized attribution records, AI usage facts, and AI job observations expire after 13 months. Security and audit logs normally expire after 365 days. Nightly database jobs enforce those analytics and logging retention dates.
If you opt in to launch or product-update emails, REC keeps your email and consent record while you remain subscribed. After you unsubscribe, REC keeps the address and opt-out status as a suppression record so it is not added back to marketing by mistake, unless a valid deletion request requires a different result.
Conversation content — context, dossier, prompts, recording, browser and optional precise transcript segments, and highlight records — does not yet expire automatically, so request deletion when you no longer need it.
You can request access, export, or erasure of your data through your account or by emailing us; requests are logged and we target responding within one month, consistent with GDPR's data-subject request timeline. Erasure requests move your account into a deletion-pending state immediately, then a reviewed process cancels your subscription, removes stored recordings and transcripts, deletes your Stripe customer record, and removes your authentication identity, subject to any records we must keep for legal or tax obligations.
You can also generate an authenticated export of your account data, including linked analytics events, AI usage and job observations, and temporary signed links to your recordings, from your account settings.
A small set of processors run the service with us.
Supabase: our database, authentication, and file storage provider, hosting recordings and structured conversation data behind owner-scoped access rules.
Stripe: handles subscription billing and payment processing. Stripe receives your payment details directly; we receive subscription status and invoice metadata.
Anthropic: performs dossier research and live follow-up generation. Anthropic also processes dossier, supplied context, and transcript material when Claude is deliberately configured to prepare conversation prompts or highlights, or when REC invokes the explicitly configured fallback after private inference fails.
Aran Labs-operated AI infrastructure: during Phase 1, privately deployed models on operator-controlled hardware in Portugal prepare conversation prompts and highlight recommendations and, only when requested, transcribe a saved recording for precise captions. Users connect to REC normally and do not install or download a model.
Railway: hosts the application infrastructure that runs REC.
Resend: sends application, account invitation, and password recovery email, and reports delivery, bounce, complaint, suppression, open, and click events. If you separately opt in to launch or product-update email, Resend also stores your address as a Contact in REC's consented marketing Segment and records the matching Topic preference. REC stores only the content-minimal transactional delivery facts described above.
Google: only after you allow measurement, Google Analytics measures public-site use and Google Ads measures whether an advertisement led to an early access application. Advertising personalisation and remarketing signals are disabled in REC's implementation. Google may process measurement data in the United States and other countries under its own terms and data-transfer safeguards.
We do not sell your personal data, and we do not use your content to train AI models. Each processor is contractually limited to processing data on our instructions for the purposes described here.
Data may be processed outside your home country.
Aran Labs LLC is based in the United States, and the Phase 1 private-inference worker runs on operator-controlled hardware in Portugal. Our processors may operate in the United States and other countries. If you are located in the EEA, UK, or Switzerland, your data may therefore be transferred between those locations and the countries where our processors operate. We rely on Standard Contractual Clauses and equivalent safeguards where required, and we review processor and infrastructure locations as part of our security practices.
You can access, correct, move, restrict, or delete your data.
Depending on your location, you have the right to access the personal data we hold about you, correct inaccurate data, request erasure, receive a portable copy of your data, object to or restrict certain processing, and withdraw consent where processing is based on consent. You will not be charged for exercising these rights except where the law allows a reasonable fee for excessive requests.
Every launch or product-update email must include a clear unsubscribe route. Withdrawing from marketing does not affect your application, account, or necessary service messages.
To exercise any of these rights, contact us at the email below or use the export and deletion request options in your account. We may need to verify your identity before acting on a request.
First-party measurement stays cookieless; Google measurement is your choice.
We use strictly necessary cookies to maintain your authenticated session and keep the studio working — for example, Supabase authentication cookies. First-party funnel measurement does not set or read an analytics cookie, local-storage identifier, fingerprint, or cross-site identifier. Anonymous page events are not joined into a visitor profile.
First-touch attribution is held only in page memory during normal in-app navigation and is stored only if you submit an early access application; conversion-touch attribution is stored with that application. A reload can reset first touch, which is an intentional privacy tradeoff.
Google measurement is off by default. If you choose “Allow measurement,” REC loads Google's tag with Consent Mode v2, allows analytics and advertising-measurement storage, and keeps advertising personalisation denied. Google may then set measurement cookies such as _ga or _gcl. Your choice, the notice version, and the time of the choice are kept in a first-party consent cookie for up to six months. If you decline or later withdraw consent through Cookie settings, REC sends denied consent signals, removes Google measurement cookies it can access on this domain, and stops sending new Google measurement events.
The requested application confirmation and approval sign-in email may use a small tracking image and tracked links supplied by Resend. REC uses those signals to monitor delivery and whether the linked product guidance is useful. Open measurements can be affected by mailbox privacy features and are treated as directional rather than exact. These are necessary service messages and are separate from optional launch or product-update email.
You can read more about how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. Browser settings may also let you delete existing cookies at any time.
We'll post updates here as the product and its data use evolve.
We may update this privacy notice as REC changes. Material changes will be posted here with a new effective date, and where practical we will notify account holders directly.