Trust Center · Register
Processing activities as processor
Every processing MIHOS performs for its customers, on their documented instructions.
Version 1.1 of 27 October 2026
Processor: MuuM Sàrl, Route de Champ-Colin 12, 1260 Nyon, Switzerland, privacy@mihos.ai. Controller: each customer, as named in its data processing agreement. Each customer decides which of these processing operations it uses and sets the retention periods within the limits shown.
Database note: every processing below stores its data in Switzerland, in the Zurich region, on infrastructure operated by a provider whose group is based outside Switzerland. Support access from outside Switzerland by that group is covered by Standard Contractual Clauses with the Swiss addendum.
Security: encryption in transit and at rest, access limited to the people who need it, separation of each customer's data, a log of every write into a customer's systems. The detailed list of measures is annex 3 to the data processing agreement, sent on request. Providers are named in annex 2, also sent on request.
1. Accounts and access
Purpose
Give each customer's users access to MIHOS and manage their roles.
Data subjects
Users designated by the customer: reps, managers, administrators.
Personal data
Name, email, role, team, organisation, profile photo, authentication data (sign-in links, one-time codes, Google or Microsoft sign-in).
Recipients and country
Hosting and database: Switzerland. Transactional email: Germany, Belgium, and the United States for transfers within the email provider's group.
Safeguard
Switzerland: see the database note above. Germany, Belgium: countries recognised as adequate by Switzerland. United States, within the email provider's group: Standard Contractual Clauses.
Default retention
Duration of the contract.
2. Recording and consent
Purpose
Record sales meetings started by the rep, in person or by video or phone call, and keep the rep's confirmation that every participant agreed.
Data subjects
Users; the people they meet, who are the customer's clients and prospects.
Personal data
Audio; screen and video for recordings made with the desktop app; consent record (who confirmed, time, wording, IP address, browser).
Recipients and country
Hosting and file storage: Switzerland.
Safeguard
Data at rest in Switzerland. Support access from outside Switzerland by the database provider's group: Standard Contractual Clauses with the Swiss addendum.
Default retention
Audio and video 90 days (7 to 180). Consent record as long as the meeting.
3. Transcription and speaker separation
Purpose
Turn the recording into a transcript attributed to each speaker.
Data subjects
Users; the people they meet.
Personal data
Voice and words spoken, which can include sensitive data such as health or financial situation; custom vocabulary (organisation and product terms, names of the rep and of the client).
Recipients and country
Speech-to-text provider: France. Its own sub-processors include companies in the United States.
Safeguard
France: country recognised as adequate by Switzerland. Onward processing in the United States: safeguard being confirmed in writing with the provider.
Default retention
Transcripts until the customer deletes them, or 30 days to 10 years as the customer sets. Copies at the provider: up to three weeks, until deletion after retrieval is in place.
4. Analysis, scoring and coaching
Purpose
Analyse the meeting against the customer's playbook, score it with traceable justifications, and produce coaching, meeting briefs, follow-up drafts and CRM field suggestions. Scoring evaluates work performance and is profiling within the meaning of the law; it produces no decision on its own.
Data subjects
Users; the people they meet.
Personal data
Transcript; meeting record (amounts, commitments, objections); scores and justifications; coaching notes; manager comments.
Recipients and country
Language model provider: France. Hosting: Switzerland.
Safeguard
Country recognised as adequate by Switzerland.
Default retention
As long as the meeting they relate to.
5. Speaker recognition by voice signature, not in use at present
Purpose
Attribute each passage of a meeting to the right rep. Not in use at present. If offered, it is off by default, a voice signature is created only with the explicit consent of the rep concerned, and customers are told 30 days in advance.
Data subjects
Reps who gave their explicit consent, for the voice signature. The people they meet, only through the meeting audio sent to separate the speakers.
Personal data
Voice signature (biometric data); enrolment sample.
Recipients and country
Speaker recognition provider: France.
Safeguard
Country recognised as adequate by Switzerland.
Default retention
Enrolment sample deleted right after it is sent. Signature until the rep withdraws consent.
6. AI practice sessions and onboarding assistant
Purpose
Let reps rehearse realistic situations with an AI client; guide the customer's onboarding with a voice assistant.
Data subjects
Users. Where a scenario is rebuilt from a real meeting, the people present at that meeting.
Personal data
The rep's voice and words during the session, its transcript and the AI's replies. A scenario rebuilt from a real meeting can contain elements of it, such as the client's name, the objection raised or the amounts discussed.
Recipients and country
Voice AI provider: United States. Language model provider: France. Hosting: Switzerland.
Safeguard
United States: the provider is certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognised as adequate since 15 September 2024. France: country recognised as adequate by Switzerland.
Default retention
180 days in MIHOS; a session saved as a meeting follows the meeting's retention. At the provider, the retention configured for our agents, which we are reducing.
7. Calendar, email and CRM integrations
Purpose
Prepare meetings, attach each recording to the right meeting, and write the outcome of a meeting into the CRM within the scope the customer approved.
Data subjects
Users; the customer's contacts and prospects.
Personal data
Calendar events (title, time, place, description, participants' names and emails); for messages exchanged with meeting guests or bearing the meeting's title, the sender, recipients, subject, date and preview; CRM fields approved by the administrator; access tokens, encrypted.
Recipients and country
Language model provider: France. Hosting: Switzerland. The customer's Google, Microsoft or CRM account remains its own tool, not a sub-processor of MIHOS.
Safeguard
Country recognised as adequate by Switzerland.
Default retention
Follows the meeting. Tokens until the account is disconnected.
8. Knowledge base
Purpose
Use the customer's own material, such as its playbook, offers, pricing and catalogue, as context for coaching and meeting briefs.
Data subjects
People named in the documents the customer uploads.
Personal data
Content of uploaded documents, including text read from scanned documents; can include client lists, contracts and figures per rep.
Recipients and country
Language model and text recognition provider: France. Hosting: Switzerland.
Safeguard
Country recognised as adequate by Switzerland.
Default retention
Until the customer deletes the documents, or at the end of the contract on a schedule agreed in writing.
9. Notifications
Purpose
Send sign-in links, codes, invitations, notifications and team summaries.
Data subjects
Users.
Personal data
Email address, name, content of the notification.
Recipients and country
Transactional email: Germany, Belgium, and the United States for transfers within the provider's group.
Safeguard
Germany, Belgium: countries recognised as adequate by Switzerland. United States, within the provider's group: Standard Contractual Clauses.
Default retention
Delivery log 90 days.
10. Operation, security and support
Purpose
Keep the service available and secure, fix errors and support users.
Data subjects
Users.
Personal data
IP address, browser, error reports in which text is masked, audit journal, record of support sessions opened by our staff, support emails.
Recipients and country
Error monitoring: Germany, provider based in the United States. Hosting: Switzerland. Support mailbox: Ireland, United States. Code hosting and deployment pipeline, which reaches the production database during migrations: United States.
Safeguard
Germany and Ireland: countries recognised as adequate by Switzerland. United States: adequacy where the provider is certified under the Data Privacy Framework for the data concerned, otherwise Standard Contractual Clauses.
Default retention
Server incidents 30 days. Error reports 30 to 90 days at the provider. Audit journal and technical logs for the duration of the contract, then deleted on the schedule agreed at its end.
11. End of contract
Purpose
Return and delete the customer's data.
Data subjects
Everyone whose data the customer entrusted to MIHOS.
Personal data
All the customer's data.
Recipients and country
All the providers above, for deletion.
Safeguard
As above.
Default retention
Export and deletion on a schedule agreed in writing, including at sub-processors, with written confirmation. Encrypted database backups expire after 30 days.