Privacy
Last updated: 4 November 2026
This notice explains what personal data mtlr processes, why, who sees it and what rights you have. We keep it short and plain on purpose.
1. Who we are
mtlr is operated by Pixel Art, Marko Popović s.p., Slovenia (“we”, “us”).
- Address: Agrokombinatska cesta 6C, 1000 Ljubljana
- Company registration number: 9549056000
- Tax number: 33355673
- Contact person: Marko Popović, [email protected]
- Website: mtlr.si. Application: app.mtlr.si.
2. What mtlr does
An AI participant joins an online meeting (Microsoft Teams, Zoom, Google Meet or Webex), or a browser microphone captures a room. Speech is transcribed and translated live, and each viewer reads it in the language they choose. Viewers open a link. An organisation can restrict a meeting to invited e-mail addresses, verified with a one-time code sent by e-mail.
Transcripts, translations and speaker names are stored per organisation and can be exported as TXT, SRT or JSON. Organisations have admin and member roles and invite colleagues by e-mail. Optionally, an organisation can enable AI meeting summaries and tasks.
3. Our role: controller or processor
It depends on the data:
- Meeting content (transcripts, translations, speaker names, participant data from the meeting): the customer organisation that runs the meeting is the controller and we are its processor. A data processing agreement (DPA) is available on request.
- Website visitors, account data, contact-form enquiries and billing: we are the controller.
If you took part in a meeting and want to exercise your rights, contact the organisation that ran it first. We will help them as their processor.
4. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: name, surname, e-mail, job title, role in the organisation | Creating and running your account, access control, invitations | Contract (Art. 6(1)(b)) |
| Meeting data: audio streamed in real time (not stored as a recording), transcripts, translations, speaker names, participant names and e-mails received from the meeting platform | Live transcription and translation, storing and exporting transcripts for the organisation | Controller’s basis (usually legitimate interest or contract of the customer); we act on its instructions |
| Usage and cost data: meeting duration, audio minutes per language | Operating the service, cost allocation and billing | Contract; legitimate interest (Art. 6(1)(f)) |
| Technical logs: IP address, time, errors. They do not contain meeting content. | Security, abuse prevention, troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Contact form: e-mail, name, company, message | Replying to your enquiry and following up on your interest in mtlr | Legitimate interest or your request (Art. 6(1)(f), (b)) |
| Viewer access codes: e-mail address and a one-time code | Letting invited viewers into a restricted meeting | Controller’s basis; contract |
We do not make decisions about you based solely on automated processing, and we do not build advertising profiles.
5. Audio and recordings
Audio is streamed in real time to the services that turn it into text and translation. We do not store audio recordings. What remains after the meeting is text: transcript, translations and speaker names, kept in your organisation’s account.
6. Who receives data
We share data only with service providers (sub-processors) that we need to run mtlr, under contracts that bind them to protect it. By category:
- Server infrastructure provider in the EU (Finland): hosts the application and database.
- Meeting-participation infrastructure provider (EU, Frankfurt): joins the meeting as a participant and streams audio in real time. It does not store recordings for us.
- Speech recognition and translation provider: turns audio into text and translations. It currently processes in the USA under EU Standard Contractual Clauses. We plan to move to EU processing.
- E-mail delivery provider (EU): sends invitations and one-time codes.
- CDN and DNS provider (global network): delivers the website and protects it against attacks.
- AI model provider (EU regions): only if your organisation enables AI summaries and tasks.
We name the specific providers to customers in the DPA or on request. Within a meeting, content is visible to the people who have the viewer link (or are invited, if the meeting is restricted) and to members of the organisation, according to their role.
We do not sell personal data, and we do not use it to train AI models. Our providers are not allowed to use it for their own purposes either.
7. Transfers outside the EU
Some processing happens outside the EU/EEA, for example speech recognition in the USA and a global CDN. We transfer data only with appropriate safeguards, mainly the European Commission’s Standard Contractual Clauses (SCCs) and, where needed, additional technical measures such as encryption in transit. You can ask us for a copy of the safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Meeting data (transcripts, translations, speaker names) | Until the organisation deletes it. A configurable retention policy is planned. |
| Account data | While the account exists, then only as long as the law requires (for example accounting rules). |
| Contact-form enquiries | Up to 2 years |
| Technical logs | About 30 days |
| Viewer access codes | 10 minutes |
9. How we protect data
- The application runs in the browser. Everything travels over encrypted TLS connections, including real-time WebSockets.
- Servers are in the EU.
- Access is controlled per organisation and by role (admin, member).
- Restricted meetings need an invited e-mail address and a one-time code.
- Logs contain no meeting content.
- Multi-factor authentication is planned.
No system is perfectly secure. If a breach affects your data, we will notify the affected customers and the authorities as the law requires.
11. Your rights
Under the GDPR you have the right to:
- access your data and get a copy,
- have inaccurate data corrected,
- have data erased,
- restrict processing,
- receive your data in a portable format,
- object to processing based on legitimate interest,
- withdraw consent at any time, where processing is based on consent.
Write to [email protected]. We reply within one month. For meeting content, we may forward your request to the organisation that ran the meeting, because it decides about that data.
You can also complain to the supervisory authority: Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia), ip-rs.si.
12. Children
mtlr is a business tool. It is not intended for children under 16 and we do not knowingly collect their data.
13. Changes to this notice
We may update this notice when the service or the law changes. The date at the top shows the latest version. We will notify account holders of material changes.
14. Contact
Pixel Art, Marko Popović s.p., Agrokombinatska cesta 6C, 1000 Ljubljana, Slovenia. E-mail: [email protected].
This page is provided for transparency. If you have questions, write to [email protected].