Privacy Policy

1. Who is responsible

GR is the controller of the personal data of Fishcamp accounts and of this website. Questions and requests about personal data go to privacy@fishcamp.space, the channel of our data protection officer (in Brazil, the encarregado).

Content that a team puts in a workspace (messages, files and transcripts) is managed by the organization that runs that workspace, which decides how it is used. GR processes that content on the organization’s behalf, following the workspace’s settings. Some requests about a workspace’s content may need the workspace owner’s action, and we will help route them.

2. What we collect

• Account: your email address and name, and your Google profile photo when you sign in with Google. One-time sign-in codes are stored only as hashes and expire after 10 minutes.
• Workspace content: messages, direct messages, mentions, files, channel settings and the timeline events (for example, who joined an audio room or shared a screen).
• Calls: voice, camera and screen travel in real time between participants and are not recorded.
• Transcription: only when it is turned on in the channel. Each person’s audio is turned into text as it happens and then discarded; the text of the transcript, with the speaker’s name, is kept.
• Guests: the name a guest types to join a room and their participation in it (and their speech, in the transcript, when transcription is on).
• AI agents and integrations: the data your workspace chooses to send to them, such as messages, events or transcripts.
• Technical data: IP address, browser and device information and server logs, used to run, protect and troubleshoot the service.

3. Why we use it and on which legal basis

• To provide Fishcamp (accounts, workspaces, messages, calls, transcripts and integrations): performance of a contract (LGPD, article 7, V; GDPR, article 6(1)(b)).
• To send transactional emails, such as sign-in codes and invites: performance of a contract.
• To keep Fishcamp secure, prevent abuse and fraud and fix problems: our legitimate interest (LGPD, article 7, IX; GDPR, article 6(1)(f)).
• To meet legal obligations, such as keeping access records for six months as required by the Brazilian Internet Civil Framework (Law 12,965/2014): legal obligation (LGPD, article 7, II; GDPR, article 6(1)(c)).

Transcription only happens when a workspace turns it on for a channel. The organization running the workspace decides whether to use it and is responsible for its legal basis and for informing the people in the room.

When an audio room closes, an AI chooses where its transcript goes. That decision is about the content of a conversation, not about you, has no legal effect on anyone and can always be changed by a person in the channel. We don’t use your data for advertising, we don’t sell it and we don’t build profiles to market to you.

4. Who processes data with us

We share personal data only with the services below, and only what each one needs:

• Contabo (Germany): the servers that host Fishcamp, its database, its files and its media server, in data centers in Germany and France.
• ElevenLabs: turns each person’s audio into text when transcription is on. It receives short audio segments and returns text.
• Google: sign-in with Google, only if you choose it. We receive your name, email address and profile photo.
• Dcision (a GR product): reads a transcript when the audio room closes to decide where it goes.
• HubMail (a GR product): sends transactional emails, such as sign-in codes and invites.
• Integrations your workspace connects, such as OpenSync (a GR product) or the webhooks of AI agents: they receive only what the workspace sends to them.

Calls run on LiveKit media servers that we host ourselves, so no other company receives your audio or video during a call. We may also disclose data when required by law or by a competent authority.

5. Where data is stored and international transfers

Fishcamp is hosted in the European Union (Germany and France). For people in Brazil, this is an international transfer of personal data. Transcription by ElevenLabs may also process audio outside Brazil and the European Economic Area.

We make these transfers on the grounds allowed by the LGPD (article 33) and by the GDPR (Chapter V), and we choose providers that protect personal data at a level compatible with these laws.

6. How long we keep data

• Account data: while your account exists. When it is closed, we delete or anonymize it, except what the law requires us to keep.
• Workspace content (messages, files and transcripts): until it is deleted by the people and admins of the workspace, or until the workspace is deleted.
• Audio: not kept. It is discarded as soon as it has been turned into text.
• Sign-in codes: expire after 10 minutes.
• Access records: six months, as required by Law 12,965/2014.
• Backups: kept for a limited period for disaster recovery and then deleted.

7. Your rights

Under the LGPD (article 18) you can ask us to confirm whether we process your data; to access it; to correct incomplete, inaccurate or outdated data; to anonymize, block or delete data that is unnecessary, excessive or processed unlawfully; to port it to another provider; to delete data processed with your consent; to know with whom we share it; to know when you can refuse consent and what follows; and to withdraw consent. You can also object to processing and ask for a review of decisions made only by automated means (article 20).

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time.

To exercise any of these rights, write to privacy@fishcamp.space. We may ask you to confirm your identity and will answer within the deadlines set by law. You can also complain to the Brazilian National Data Protection Authority (ANPD) or, in the European Union, to your local data protection authority.

8. Security

• Everything travels over HTTPS, and calls are encrypted between browsers and our media servers.
• Every request is checked against its workspace, and the isolation between workspaces is tested on every route.
• API keys, webhook URLs and invite links are stored as hashes; secrets from other services are encrypted with AES-256-GCM.
• Outgoing webhooks are guarded against requests to internal networks (SSRF).
• Audio is never stored.

If a security incident may put you at relevant risk, we will tell you and the authorities as the law requires. To report a vulnerability, write to security@fishcamp.space.

9. Cookies

Fishcamp uses only the cookies it needs to work: the session cookie that keeps you signed in, the short-lived cookies that protect the sign-in itself and a cookie that remembers the language you chose (fc_locale). We don’t use analytics, advertising or third-party tracking cookies, and our public pages load no trackers.

You can block cookies in your browser, but then you won’t be able to sign in.

10. Children

Fishcamp is a work tool and is not intended for people under 18. We don’t knowingly collect their data; if you believe this has happened, write to privacy@fishcamp.space and we will delete it.

11. Changes to this policy

We will update this policy when the product, our providers or the law change. The version in force is always on this page, with its effective date, and we will tell you about important changes in advance, by email or in Fishcamp.

12. Contact

• Privacy and data protection officer: privacy@fishcamp.space
• Security: security@fishcamp.space
• General questions: hello@fishcamp.space
• Mail: GR Negócios Digitais, Av. Luiz Boiteux Piazza, 1302, Sala 13 — Sapiens Park, Florianópolis/SC, 88056-682, Brasil