Wudpecker AI Meeting Assistant

Wudpecker states it collects and uses aggregated, de-identified data for product development, but the policy lacks explicit clarity on whether raw meeting transcripts or user content train the AI model. The language is vague about opt-out mechanisms and whether free vs. paid tiers differ in training usage.

“[ToS] 'Wudpecker may collect, analyze, and use any aggregated, de-indentified data and related information for the purposes of product and business development.' [Privacy] 'We use analytics and aggregated data to improve our business.'”

The ToS grants Wudpecker a non-exclusive, limited license to provide the service, and the customer retains data ownership. However, the scope permits sublicensing to subcontractors and affiliates for service delivery and improvement purposes, creating ambiguity about downstream use of content.

“[ToS] 'The Customer shall retain all rights, title, and interest in and to any data transferred or stored by the Customer in the Service.' [ToS] 'The Customer's data may be provided to Wudpecker's subcontractors for the purposes of providing the Service and for securing and improving their services.'”

Wudpecker shares data with service providers (including OpenAI for transcription summarization), affiliates, and subcontractors. While DPA-like protections are mentioned for subcontractors, the policy lacks a published sub-processor list and permits sharing with 'partners' for analytics and marketing purposes without granular controls.

“[Privacy] 'Wudpecker uses third parties to assist us... Examples include usage of OpenAI's API to summarize meeting transcript... integrations of third party services such as CRM services.' [ToS] 'The Customer's data may be provided to Wudpecker's subcontractors... Wudpecker shall reasonably ensure that such subcontractors are subject to equivalent requirements.'”

Wudpecker specifies a 'rolling year and two previous calendar years' retention policy with fees for longer retention. While this provides some clarity, the policy lacks detail on backup retention, deletion timelines after account termination, and handling of derived/aggregated data that may be retained indefinitely.

“[ToS] 'Wudpecker data retention is rolling year and two previous calendar years. For longer data retention, fees apply upon negotiation.' [ToS] 'Upon termination of the Agreement or upon the Customer's written request, Wudpecker shall either destroy or return to the Customer the personal data processed hereunder.'”

The ToS explicitly states that customers retain all rights, title, and interest in data they upload. Wudpecker claims no ownership of customer-submitted content and only retains rights to its own software and service improvements.

“[ToS] 'The Customer shall retain all rights, title, and interest in and to any data transferred or stored by the Customer in the Service.' [ToS] 'All rights, title, and interest, including all Intellectual Property Rights in and to the Service... shall belong exclusively to Wudpecker.'”

The Privacy Policy mentions that 'Wudpecker's privacy and information technology compliance program has been independently audited and certified against globally recognized standards,' but no specific certifications (SOC 2, ISO 27001, GDPR, HIPAA) are named. Data is stored on AWS EU regions, but formal compliance documentation is not provided.

“[Privacy] 'Wudpecker's privacy and information technology compliance program has been independently audited and certified against globally recognized standards.' [Privacy] 'Wudpecker stores information on AWS servers. Specifically on EU (Frankfurt) eu-central-1 and EU (Stockholm) eu-north-1 regions.'”