Privacy Policy

Who We Are

OmniListen is an AI-powered meeting transcription and intelligence platform developed and operated by Empowering Energy (trading as ESAP AI) (CR No. [Insert CR Number]). We help enterprise teams capture, transcribe, and extract actionable insights from Arabic and English meetings with speaker identification, role-based analysis, and automated action item generation.

Our Role: Data Processor

OmniListen operates exclusively in a B2B enterprise context. Your organization is the Data Controller— you determine who uses the platform and for what purpose. Empowering Energy (OmniListen) acts solely as a Data Processor, processing meeting data only on your organization's behalf and strictly under your documented instructions.

Important: Sensitive Personal Data

OmniListen processes voice recordings and performs speaker identification — both classified as Sensitive Personal Data under PDPL Article 23.

This means:

• Your organization must obtain explicit, informed consent from all meeting participants before any recording begins
• Participants must be clearly informed that their voice is being recorded, transcribed, and analyzed by AI
• Sensitive data is subject to stricter processing, storage, and transfer rules
• Empowering Energy will process voice and speaker data only within the scope defined in your signed DPA

What Data We Process

• Authorized User Identity Data — Names, work emails, job titles, employee IDs
• Voice and Audio Data — Audio recordings of meetings (Sensitive Personal Data)
• Transcription Data — Text transcriptions in Arabic and English
• Speaker Identification Data — AI-powered voice analysis labels (biometric-adjacent, treated as Sensitive Personal Data)
• Meeting Metadata — Title, date, time, duration, participant count, language, platform source
• Role-Based Analysis Outputs — Summaries, action items, decisions for PM/HR/Executive roles
• Technical and Security Data — IP addresses, device types, session timestamps, access logs
• Support Communications — Messages exchanged with the support team

Why We Process Your Data

We never process data for advertising, profiling, or any purpose outside the contracted scope.

How We Use AI

• All outputs are assistance tools — not final records or legal documents
• Every AI output is labeled: "AI-generated — review before using in formal decisions."
• Speaker identification accuracy is high but not infallible — human review required
• Role-based analysis is for decision-support only — does not constitute HR advice, legal opinion, or management instruction
• We do not use your meeting recordings or transcriptions to train AI models without explicit written consent
• We maintain full documentation of AI models, language capabilities, and processing logic

Participant Consent Obligation

Because OmniListen records voices of all participants — including non-registered users — your organization must:

1. Inform all participants before the recording begins
2. Obtain explicit consent, particularly for sensitive topics (HR, legal, financial)
3. Provide the ability to opt out without professional consequences
4. Maintain records of consent for each session

Data Sharing and Sub-Processors

30 days' advance notice for any sub-processor changes. Right to object included.

Data Processing and Third-Party Disclosures

To provide the features of OmniListen, we engage limited third-party service providers to act as data processors. These sub-processors are utilized solely for technical processing required to deliver the service (such as data analysis and processing).

We do not sell or share your Google user data for any purposes outside of these core functional requirements. All third-party processors are contractually bound to maintain data confidentiality and are strictly prohibited from using your data to train their own models or for any secondary purposes.

Cross-Border Data Transfers

All transfers are protected by:

• SDAIA-approved Standard Contractual Clauses (SCCs)
• Encrypted transmission and storage at all international points
• Contractual prohibition on secondary use

Your Organization’s Rights Under PDPL

• Access — Copy of all personal and sensitive data
• Correction — Fix inaccurate metadata, speaker labels, and identity data
• Deletion — Specific recordings, transcriptions, or all data
• Portability — JSON or CSV export
• Objection — Object to processing not in DPA
• Restriction — Restrict processing during dispute
• Audit — Evidence of PDPL compliance

Data Retention

30-day data export window on termination. Permanent deletion confirmed in writing.

Data Security

• AES-256 encryption at rest for all audio and transcriptions
• TLS 1.3 encryption in transit
• Audio files in isolated, access-controlled storage buckets
• Role-based access controls — only authorized personnel
• No employee access to raw audio without a logged reason
• Regular security audits and vulnerability assessments
• 72-hour SDAIA breach notification + immediate client notification

Contact and Complaints