Data Handling Practices

Our Principles

Everything we build starts with these core principles:

• Data minimization — We only collect data necessary to provide the service. We don't harvest data for advertising or sell it to third parties.
• Purpose limitation — Data collected for one purpose isn't repurposed without explicit consent. Your sales conversations power your insights, not a training dataset for other customers.
• Transparency — You can see exactly what data we have about you at any time. No hidden data stores or undisclosed processing.
• User control — You own your data. You can export it, delete it, or restrict how it's processed at any time.

What Data We Collect

Cue collects the following categories of data:

Account Data

• Email address and name
• Company name and team information
• Authentication credentials (encrypted)
• Billing information (processed by Stripe)

Connected Service Data

• Calendar events (titles, attendees, times)
• CRM records (accounts, contacts, opportunities)
• Email metadata (subject lines, timestamps — not email content)

Conversation Data

• Meeting audio (temporarily processed, not stored by default)
• Transcriptions and summaries
• AI-generated insights and signals
• User notes and annotations

How We Process Data

Your data is processed to provide the following capabilities:

• Pre-call intelligence — We aggregate CRM data, calendar information, and past interactions to build meeting briefings.
• Real-time analysis — Conversation audio is processed through our AI to identify topics, sentiment, and actionable signals.
• Post-call automation — Transcriptions are summarized and structured data is synced back to your CRM.
• Performance analytics — Aggregated, anonymized metrics help you understand team performance.

All processing happens within our secure infrastructure. We do not send your data to external AI providers for model training.

Where Data Is Stored

All data is stored in secure, SOC 2 certified data centers:

• US customers — Data stored in AWS us-east-1 (Virginia) by default
• EU customers — Data stored in AWS eu-west-1 (Ireland) by default
• Enterprise — Custom data residency available upon request

Data at rest is encrypted using AES-256. Data in transit is protected by TLS 1.3. See Encryption Model for technical details.

Who Can Access Your Data

Access to your data is strictly controlled:

• Your team — Based on roles and permissions you configure
• Cue support — Only with your explicit permission, and only to troubleshoot specific issues
• Cue engineering — No access to customer data in production. Development and testing use synthetic data only.

All access is logged and auditable. Enterprise customers can request access logs at any time.

Third-Party Sharing

We share data with third parties only in the following circumstances:

• Service providers — Infrastructure providers (AWS), payment processors (Stripe), and essential service providers who are contractually bound to protect your data
• Your integrations — Data synced to your CRM or other connected tools as you configure
• Legal requirements — Only when required by law, and we will notify you unless legally prohibited from doing so

We never sell your data. We never share it for advertising purposes. Your sales conversations are your competitive advantage — we respect that completely.