Privacy policy

1.Who we are

MeetNotely is operated by To fill: registered company name, registered in To fill: country / free zone and registration number, at To fill: registered address ("we", "us"). For the data described here we are the controller, except where What this policy covers says we act for a workspace's organization.

Questions or requests about your data: sami@meetnotely.com.

2.What this policy covers

It covers this website, the MeetNotely app, and the public pages of share links and clips.

When a company or team uses MeetNotely through a team workspace, that organization decides what is recorded and who can see it. For the meeting content in that workspace, the organization may be the controller and we process the data on its behalf. To confirm: controller/processor split for team workspaces, and whether a data processing agreement is offered to business customers

If you use MeetNotely through a partner that offers it under its own brand, see Partners and white-label.

3.What we collect

• Account: your name, email address, password (stored only as a one-way scrypt hash), language, time zone and alert settings. If you sign in with Google: your name, email address, profile picture, and the sign-in tokens Google gives us.
• Workspaces: workspace names, who is a member and their role (owner, admin or member), and invitations (the invited email address and who sent it; invitations expire after 7 days).
• Meetings: the audio you record (your browser tab's sound and your microphone; the browser recorder doesn't record video), or a recording file you upload (audio or video, such as MP3, M4A, MP4 or MOV: we store the file as you uploaded it, including any video, and send it to our transcription providers), the meeting's title, platform, language and length; the transcript, including speaker names; the notes, chapters, decisions, action items and translations written from it; highlights you add; and a search index made of passages of the transcript and notes.
• Ask: the questions you ask about your meetings, the answers and their citations.
• Meeting bot (only if you send it to a call, or let it join from your calendar): the meeting link, when it was asked to join, its status in the call (joining, waiting room, recording, when and why it left), the call's audio (and its video only if you turn that on), and who spoke when, by the display name each person uses in the meeting. See The meeting bot.
• Zoom (only if you connect it): your Zoom user ID and email address and the access tokens Zoom gives us (encrypted), so the bot can join Zoom calls on your behalf.
• Google Calendar (only if you connect it): see Google Calendar and Google sign-in.
• Notifications: alerts shown in the app; if you turn on browser notifications, your device's push address and keys and your browser's name (user agent).
• Share links and clips: what was shared, by whom, when it expires, how many times it was viewed and when it was last viewed. We do not record who views a link.
• Contact form and waitlist: your name, email address, company, team size, topic, language and message. Joining the waitlist uses the same form, with the topic "Join the waitlist". We do not store your IP address with it.
• Live chat (only if you use it): your messages and any name, email address or files you share in the chat, handled by tawk.to (see Who processes your data).
• How this website is used: on this marketing website only, Microsoft Clarity records clicks, scrolling, the pages visited, the page text as shown, device, browser and approximate location. Clarity does not run in the app (your dashboard): nothing you do after signing in, and none of your meetings, transcripts, notes or names, is ever sent to it.
• Sign-up allowlist and admin records: during our closed testing phase only, the email addresses we have let in (for example from the waitlist), and a log of every change our administrators make to access settings: who made it (their email), what changed (such as an email added to the allowlist), the old and new value, and when.
• Usage and cost records: for each AI step, the workspace, the meeting, the provider and model, the amount of audio or text processed and its cost. These records contain no meeting content.
• Plan usage: for each meeting recorded or uploaded, the workspace, who recorded it, how it was captured, its length, the month it counts in and the plan at the time. We use it for plan limits (such as Free's monthly meetings), the fair-use line on paid plans and the usage shown in Settings → Billing. It contains no meeting content and is kept when a meeting is deleted.
• Technical data: for each signed-in session, the IP address and browser it came from; a log of the emails we sent you (address, type and subject); and the request logs our hosting providers keep.
• Payments: paid plans are paid through Stripe (see Who processes your data). You enter your card on Stripe's page; we never see or store card numbers. We keep the workspace's plan, billing period, number of seats, renewal or end date, payment status and Stripe's customer and subscription ids, and a record of each payment event Stripe sends us (its id and type, not its contents). Stripe sends receipts and invoices. To confirm: payments are in Stripe's test mode until launch; the live provider may be Paddle, which acts as the seller (merchant of record) and has its own privacy notice

4.Recording and consent

When you record in your browser, no bot joins the call, so the other people in the meeting may not know you are recording. When you send the meeting bot, it joins as a visible participant and says in the chat that it is recording. Either way, you must tell everyone in the meeting that you are recording, and get their consent where the law requires it. In many countries, including the UAE, Saudi Arabia and Qatar, recording a conversation without the consent of the people in it can be a crime.

A recording captures everything your tab plays and everything your microphone hears, so it includes other people's voices and anything they say. The transcript and notes then contain their names (as the speech service or you label them) and their words.

While you record, your browser keeps a copy of each part on your device until our server confirms the recording is complete, so that a crash or a lost connection doesn't lose the meeting. The copy is then removed.

If you were recorded by a MeetNotely user and want your data removed, contact the person who recorded you, or write to us at sami@meetnotely.com and we will help.

5.The meeting bot

Instead of recording in your browser, you can send MeetNotely's notetaker (a bot) to a Zoom, Google Meet, Microsoft Teams or Webex call, by pasting the link or by letting it join meetings from your connected calendar. By default it joins only calendar meetings you host or have accepted, and you can turn this off. To confirm: the bot is in testing and not offered to customers yet; remove this sentence at launch

• In the call: it joins under the name and picture of MeetNotely, posts a message in the chat saying it is recording for you, and leaves after 5 minutes alone, after 10 minutes of silence, or when you stop it. The host can refuse to let it in or remove it.
• What it records: the call's audio, mixed into one track; video only if you turn that on; and who spoke when, by display name, as the meeting platform reports it.
• Who runs it: the bot is operated for us by Recall.ai. Right after the call we copy the recording and the speaker timeline into our own storage (EU) and delete Recall's copy; if that fails, Recall deletes it automatically after 7 days. Our own transcription and AI then process it like any other meeting (How AI processes your meetings); Recall does not transcribe it.
• Zoom: Zoom only admits a bot on behalf of a signed-in Zoom user who is in the meeting. So you connect your Zoom account once; we then ask Zoom, for each meeting, for a short-lived token that lets the bot join as your notetaker, and the bot leaves when you do.

6.How AI processes your meetings

• Transcription: the audio goes to Speechmatics (EU). If it is unavailable, Google Gemini or Cloudflare Workers AI transcribes it instead. For meetings the bot recorded, each line then takes the display name of the person who was speaking, from the meeting platform.
• Notes, chapters, action items, translations and Ask: the transcript (with speaker names), the meeting title and your questions go to Google Gemini.
• Search: passages of the transcript and notes, and your search queries, are turned into numeric vectors by Cloudflare Workers AI (or Google Gemini as a backup) and stored in our database.

We do not use your recordings, transcripts, notes or questions to train AI models, and we do not sell them. AI output can be wrong or incomplete; see the terms.

Speechmatics and Cloudflare say in their terms that they do not use customer content to train their models.

Google's terms depend on the plan. On Gemini's paid service, Google does not use the content to improve its products. On the free tier, Google may use the content to improve its products, and human reviewers may read it, except for users in the European Economic Area, the UK and Switzerland. Owner decision: the app uses Gemini's free tier today. Recommended: switch to the paid tier before real customer meetings (it is also needed for Google's Limited Use rules, because calendar event titles can reach Gemini as meeting titles). Then replace this paragraph with: "We use Gemini's paid service, under which Google does not use your content to improve its products."

None of this processing makes decisions about you that have legal or similarly significant effects.

7.How we use your data, and our legal bases

• To provide the service you signed up for: recording, transcription, notes, search, Ask, sharing and workspaces (performance of our contract with you).
• To send service emails: verification, password reset and invitations (contract).
• For optional features you turn on: the meeting bot, Zoom, Google Calendar, browser notifications and alert emails (your consent, which you can withdraw at any time by turning them off).
• To answer your contact form message, and to invite you when you join the waitlist by adding your email to the sign-up allowlist (our legitimate interest in replying, or steps you asked for before a contract).
• To keep the service secure and prevent abuse, for example by rate-limiting public pages, keeping session records and logging administrators' changes (legitimate interests).
• To track our costs and, later, to bill usage (contract and legitimate interests), and to keep records the law requires (legal obligation).

We do not show ads, we do not use your data for advertising, and we do not send marketing emails. If we start a newsletter, it will be opt-in.

8.Google Calendar and Google sign-in

Google sign-in gives us your name, email address and profile picture, and lets you log in without a password.

Google Calendar is optional. When you connect it, we ask Google for read-only access to your events (`calendar.events.readonly`) and your email address. We store, for upcoming events: the title, start and end time, the meeting link and platform, the organizer's email address, whether you are the organizer, your reply, and the number of attendees (not their names or addresses). We read an event's location and description only to find the meeting link; we do not store them. We use this to show your upcoming meetings, alert you before they start and pre-fill a recording's title.

Calendar access tokens are encrypted at rest (AES-256-GCM). When you disconnect, we revoke our access at Google and delete the connection and its events. You can also remove access in your Google Account settings.

Limited Use. MeetNotely's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and people do not read it unless you ask us to, it is needed for security, or the law requires it.

If you start a recording from a calendar event, the event's title becomes the meeting's title and is processed as part of that meeting (How AI processes your meetings).

9.Notifications

• In the app: alerts before a calendar meeting starts and when notes are ready.
• Browser notifications (Web Push): only if you turn them on for a device. The message is encrypted so that only your browser can read it; it travels through your browser maker's push service (Who processes your data). You can turn it off per device in Settings.
• Email: meeting alerts and "notes ready" by email are off unless you turn them on. Emails are sent through Resend from the EU, and we don't track whether you open them or click their links.

10.Share links and clips

Any member of a workspace can create a link to a meeting, or a clip of part of it. Anyone who has the link can open it without signing in. The page shows only what the person who made the link chose (notes, transcript and/or recording) and the speaker names in them; it never shows the workspace, the owner or other meetings.

Links can expire after 7 or 30 days, or never. Any member can revoke a link at any time, and it stops working immediately; a clip's audio file is deleted when its link is revoked. Shared pages tell search engines not to index them. We count views, and to slow down abuse we keep a keyed hash of the viewer's IP address for a few minutes (never the address itself).

11.Who processes your data

We use these service providers (sub-processors). Each processes data only to provide its service to us.

We also share data: with the other members of your workspace (as the workspace allows); with the partner whose brand you use MeetNotely through, if any (Partners and white-label); when the law requires it or to protect people's rights and safety; and with a buyer if MeetNotely is sold or merged, under this policy. We never sell personal data.

Links to other sites (for example our booking page for demos, or LinkedIn) are governed by those sites' own policies.

12.Where your data is processed

Our database is in the EU (Frankfurt, Germany) and transcription runs in the EU. AI notes and Ask run on Google's infrastructure, mainly in the United States. Recordings and clips are stored in the EU (Cloudflare R2, EU jurisdiction), and our emails are sent from the EU (Resend, Ireland). Meetings recorded by the bot pass through Recall.ai in the United States while the call is on, until we copy them to the EU and delete Recall's copy. To confirm: the United States unless Recall moves our account to its EU region (Frankfurt), then this sentence says EU The app and website run on global networks, so a request is handled near where you are.

So your data may leave your country, including the UAE, Saudi Arabia, Qatar or the EU. We rely on our providers' data processing agreements and, where required, recognised safeguards such as the EU Standard Contractual Clauses, and on the transfer rules of the GCC data protection laws. To confirm: DPAs signed with each sub-processor; transfer mechanism for KSA (SDAIA transfer regulations) and UAE PDPL cross-border rules

13.How long we keep data

• Account and workspace data: while your account exists.
• Meetings (recordings, transcripts, notes, search index): until they are deleted. The person who recorded or added a meeting, and the owners and admins of its workspace, can delete it in the app: its recording file, transcript, notes, action items, highlights, search index, Ask conversations about it and share links are removed at once, and its share links stop working. Records of what processing it cost stay, without the link to the meeting. Deleting your account yourself is not available yet: write to sami@meetnotely.com and we will delete it within To confirm: 30 days, including your recording files.
• Ask conversations: until you delete them (you can, in the app).
• Calendar data: until you disconnect Google Calendar.
• Meeting bot: Recall's copy of the recording is deleted as soon as ours is saved (at the latest after 7 days). A video the bot recorded is deleted after 90 days; the audio, transcript and notes stay with the meeting. The bot's status history stays with the meeting. Zoom connection: until you disconnect it, or remove our app in Zoom.
• Share links: until revoked or expired. Rate-limit hashes: about 5 minutes.
• Contact form and waitlist messages: To confirm: e.g. 24 months after the last contact. Web3Forms keeps its copy for 30 days.
• Sign-up allowlist and admin change log: the allowlist exists only for the closed testing phase: an email is deleted when an administrator removes it, and the whole list is deleted when the testing phase ends. The admin change log is deleted automatically after 45 days.
• Session records, email log and notifications: To confirm: retention period; there is no automatic clean-up yet.
• Usage and cost records, plan usage and billing records: as long as needed for billing, tax and accounting law; Stripe keeps payment records under its own legal duties. To confirm: period
• Backups: To confirm: backup schedule and how long backups are kept.

When we delete data, it may stay in backups until they expire.

14.Security

• All traffic is encrypted in transit (HTTPS).
• Our database and storage providers encrypt data at rest; Google Calendar tokens are encrypted again by us (AES-256-GCM).
• Passwords are stored only as scrypt hashes.
• Every request is checked on our server against your workspace, so one workspace can't read another's data.
• Share links use long random tokens that we store only as hashes, and recordings are served through signed links that expire.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires. MeetNotely does not hold security certifications (such as SOC 2 or ISO 27001) today.

15.Your rights

Depending on where you live, you can ask us to: tell you what data we hold and give you a copy; correct it; delete it; give it to you in a portable format; restrict or object to some processing; and withdraw consent you gave. You can change your name, language, time zone and notification settings in the app, delete meetings you recorded (or any meeting in a workspace you own or administer), delete Ask conversations, disconnect Google Calendar and revoke share links yourself.

For anything else, write to sami@meetnotely.com. We will reply within To confirm: 30 days and may need to confirm your identity. If your request is about meetings in a team workspace, we may refer it to that workspace's organization. You can also complain to your data protection authority (Data protection laws).

16.Data protection laws

We aim to meet the data protection laws of the places we serve. In general terms:

• United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Free zones such as the DIFC and ADGM have their own data protection laws. To confirm: which UAE regime applies to our company
• Saudi Arabia: the Personal Data Protection Law and its regulations, overseen by the Saudi Data & AI Authority (SDAIA).
• Qatar: Law No. 13 of 2016 on the Protection of Personal Data Privacy.
• European Union and United Kingdom: the GDPR and the UK GDPR. To confirm: whether an EU/UK representative is needed

These laws give you the rights in Your rights. Where a law gives you more rights than this policy describes, that law applies.

17.Cookies and similar technologies

• This website uses no ads. Two outside services run on it: Microsoft Clarity, which records how visitors use the pages (clicks, scrolling, the page as you saw it) and sets cookies such as `_clck` and `_clsk` on our site (up to a year) plus Microsoft's own cookies (such as `MUID`) on clarity.ms and bing.com, and the tawk.to live chat, which sets its own cookies and browser storage to keep your chat session. Both are listed in Who processes your data. Our own fonts are served from our site; the chat window loads its fonts from Google Fonts.
• In the app (your dashboard, after you sign in), only the tawk.to live chat runs, so you can reach us. Microsoft Clarity does not run in the app at all: no analytics, heatmaps or session recordings there, and none of its cookies are set.
• The app also uses a sign-in session cookie (it keeps you signed in for up to 7 days of inactivity), a cookie that remembers when you chose not to stay signed in, and two cookies that remember the layout of the app (sidebar and side panel, kept for a year).
• While you record, the app uses your browser's storage (IndexedDB) for the temporary copy described in Recording and consent.

The sign-in, layout and recording storage are needed for the service to work. Clarity (analytics, on this website only) and the chat cookies are not strictly needed. To confirm: whether visitors from the EU, UK and other places that require it must be asked for consent before Clarity and the chat load, and if so add a consent banner We will update this section before adding any other analytics or advertising cookies.

18.Children

MeetNotely is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, write to us and we will delete it.

19.Partners and white-label

Some companies offer MeetNotely under their own name and brand. If you use it that way, that partner's privacy notice also applies and the partner may be the controller of your data, with us processing it for them. Ask the partner first about your data; we will help them answer. To confirm: partner agreement and roles

20.Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell signed-in users by email or in the app before it takes effect.

21.Contact

To fill: registered company name, To fill: registered address. Email: sami@meetnotely.com.