Trust
What happens to your meetings, who else handles your data, and what we can put in writing for your security review.
Your meetings are not used to train AI models
Every AI request we make tells our AI router, OpenRouter, to use only providers that neither store requests nor train on them. If no such provider can serve a request, it fails rather than going to one that would. This applies to transcription, minutes, chat, translation and Refine.
Audio recaps are voiced by Google Cloud Text-to-Speech, which receives only the recap script, under Google Cloud's data terms.
Subprocessors
The companies that process data on our behalf, and what each one receives.
Supabase
Database, sign-in, file storage, server functions
Receives: Your account, meetings, transcripts, minutes and uploaded recordings
OpenRouter, routing to Google Gemini models
Transcription, minutes, chat, translation, Refine
Receives: The recording or text being processed, for the length of the request
Google Cloud Text-to-Speech
Voicing AI audio recaps
Receives: The recap script generated from your minutes
Brevo
Account and product email
Receives: Your email address and name
DoDo Payments
Card payments on web and desktop
Receives: Billing details you enter at checkout
RevenueCat, Apple and Google Play
In-app purchases on mobile
Receives: Purchase records and an app user ID
PostHog
Product analytics
Receives: Usage events, never recordings or transcripts
Sentry
Error reports
Receives: Technical error details and device information
Vercel
Website hosting, web analytics, speed insights
Receives: Page requests and performance data
Google Analytics 4 and Microsoft Clarity
Website analytics and session replay, only with cookie consent
Receives: Website usage
Cloudflare R2
Desktop installer and update downloads
Receives: Download requests
ipwho.is
Country lookup for admin security views
Receives: IP addresses of sign-ins
Google and Apple
Sign in with Google or Apple, if you use it
Receives: Your name and email from that account
| Vendor | Purpose | Data it receives |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Your account, meetings, transcripts, minutes and uploaded recordings |
| OpenRouter, routing to Google Gemini models | Transcription, minutes, chat, translation, Refine | The recording or text being processed, for the length of the request |
| Google Cloud Text-to-Speech | Voicing AI audio recaps | The recap script generated from your minutes |
| Brevo | Account and product email | Your email address and name |
| DoDo Payments | Card payments on web and desktop | Billing details you enter at checkout |
| RevenueCat, Apple and Google Play | In-app purchases on mobile | Purchase records and an app user ID |
| PostHog | Product analytics | Usage events, never recordings or transcripts |
| Sentry | Error reports | Technical error details and device information |
| Vercel | Website hosting, web analytics, speed insights | Page requests and performance data |
| Google Analytics 4 and Microsoft Clarity | Website analytics and session replay, only with cookie consent | Website usage |
| Cloudflare R2 | Desktop installer and update downloads | Download requests |
| ipwho.is | Country lookup for admin security views | IP addresses of sign-ins |
| Google and Apple | Sign in with Google or Apple, if you use it | Your name and email from that account |
Retention
How long recordings, transcripts and minutes are kept, and what you can change, is set out on our privacy page and in the Privacy Policy.
Security basics
- Encrypted in transit with TLS 1.2 or later, and at rest with AES-256.
- Row-level security in the database: each record is reachable only by its owner's account.
- Support and admin access is logged.
- No bot joins your calls, and we never ask for access to your calendar, email or contacts.
Data processing agreement
If your organisation needs a DPA, contact us and we'll send one for review.
Request a DPA