Privacy Policy

Last updated: October 11, 2026

Introduction

MinutesMaster ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our meeting transcription and minutes generation service.

Information We Collect

Personal Information

We collect information that you provide directly to us, including:

  • Name and email address when you create an account
  • Payment information when you subscribe to our services
  • Profile information you choose to provide
  • Communications with us, including support requests

Meeting Data

When you use our service, we process:

  • Audio recordings of meetings you upload or record
  • Transcriptions generated from your meetings
  • Meeting metadata (date, duration, participants)
  • Any edits or annotations you make to meeting minutes

Usage Information

We automatically collect certain information about your use of our service:

  • Device information (type, operating system, browser)
  • IP address and general location
  • Usage patterns and feature interactions
  • Performance and error logs

How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process your audio files and generate transcriptions and summaries
  • Send you technical notices, updates, and support messages
  • Respond to your requests and provide customer support
  • Monitor and analyze usage patterns to improve user experience
  • Detect, prevent, and address technical issues and fraudulent activity
  • Comply with legal obligations

Data Security

We implement industry-standard security measures to protect your information:

  • All data is encrypted in transit using TLS 1.3
  • Data at rest is encrypted using AES-256 encryption
  • Access to personal data is restricted to authorized personnel only
  • Regular security audits and penetration testing
  • Secure data centers with physical security controls

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

  • Sub-processors: Specific third-party vendors who process data on our behalf to deliver the Service. Current sub-processors are listed below.
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: In connection with a merger, acquisition, or sale of assets
  • With Your Consent: When you explicitly agree to share your information

Current sub-processors

We engage the following sub-processors under written Article 28 data-processing agreements where applicable. Each accesses only the data needed to perform its specific function.

  • MeetingBaaS (SAS SPOKE, Neuilly-sur-Seine, France) — meeting-bot dispatch + recording for the Zoom, Google Meet, and Microsoft Teams integrations. Stores meeting recordings and Zoom OAuth tokens (AES-256-GCM encrypted), and uses Gladia (Gladia SAS, France) as a sub-processor for real-time transcription of bot recordings.
  • Soniox (Soniox Inc., USA) — primary speech recognition. Receives audio for transcription only; contractually not used for model training.
  • RunPod (RunPod Inc., USA) — fallback Whisper- class transcription compute. Receives audio only when Soniox is unavailable.
  • OpenRouter (OpenRouter Inc., USA) — large language model gateway used for minutes generation, translations, the in-app assistant and search embeddings. Receives transcribed text (and, for the assistant and search, your questions and search queries) and routes it to underlying model providers — including OpenAI, Anthropic, and Google — each under no-training API terms. Provider routing is logged.
  • Stripe (Stripe Payments Europe Ltd., Ireland) — payment processing for paid subscriptions and credit packs. Receives billing data; we do not store full card numbers.
  • RevenueCat (RevenueCat, Inc., USA) — manages in-app purchases made through the App Store and Google Play. Receives your MinutesMaster account ID and the store purchase records; payment details stay with Apple or Google.
  • Sentry (Functional Software, Inc., USA) — crash and error reporting for the mobile app. Receives technical diagnostics (device model, OS and app version, error traces) tagged with your account ID; never meeting audio, transcripts or minutes.

We notify customers at least 30 days in advance before onboarding any new sub-processor that materially changes data handling. To request a current copy of our sub-processor list or our DPA, email info@minutesmaster.ai.

AI agents and the assistant

AI agents (Claude, ChatGPT and other MCP apps)

You can connect MinutesMaster to AI assistants and agents such as Claude, ChatGPT, Microsoft Copilot, Cursor or automation tools through our MCP server at https://api.minutesmaster.ai/mcp. This section explains what happens when you do.

How a connection is made. You either sign in to MinutesMaster and approve the app on our consent screen (OAuth), or create a personal API key in Dashboard > AI agents. On the consent screen you choose what the app may do:

  • Read meetings (search and read transcripts, minutes, decisions and action items);
  • Organize & edit (titles, notes, speaker names, folders, tags, sharing with a team, translations, minutes templates and rewriting minutes with another template);
  • Send bots & import (send the meeting bot, import recordings from links or uploads; this spends your credits).

What an agent can see. A connected app sees only what your account can see: your own meetings and the meetings shared with your team workspaces, and only within the permissions you approved. Depending on your request, the data returned to the app can include: meeting titles, dates, durations and languages; participant and speaker names and roles; transcripts; minutes (summary, topics, decisions, action items with owners, next meeting); your private meeting notes; folder, tag and team names; the email address of the teammate who owns a shared meeting; your account email, plan and credit balance; your minutes templates and their settings; and time-limited links (a recording playback link valid for 2 hours, a download link valid for 15 minutes that works for anyone who has it, and a single-use upload link valid for 1 hour).

What happens to data in the AI app. When a tool returns meeting content, the AI app you use (for example Anthropic's Claude or OpenAI's ChatGPT) receives it and processes it under its own terms and privacy policy. MinutesMaster doesn't control how that provider stores or uses it. Connect only apps you trust with your meetings.

What we store about connections.

  • Connected apps (OAuth): the app's name, its client identifier and website, the permissions you granted, when you connected and when the app last used the connection. Access and refresh tokens are stored only as one-way hashes. Access tokens expire after one hour and refresh tokens after 60 days, renewed while you use the app. Registrations of apps that never completed a connection are deleted after 7 days.
  • API keys: the name you gave the key, its first characters (to recognize it in the list), a one-way hash of the key, its permissions, creation and last-use time and an optional expiry date. The full key is shown once, when you create it.
  • Activity log: for each tool call, resource read or prompt, we record your account, the app's name and identifier, whether it used OAuth or an API key, the tool, resource or prompt name, success or failure, a short error message if it failed, the duration and the time. We don't log what the app sent to a tool (your questions, search terms or other arguments) or what the tool returned. We use this log to show you recent agent activity, to enforce rate limits and to investigate abuse. It is deleted after 180 days.

Actions an agent takes for you. If you allowed "Send bots & import", an agent can send the MinutesMaster bot to a meeting or import a recording on your behalf. These work exactly like doing it yourself in the app: the same credits, processing and sub-processors described above.

Disconnecting. In Dashboard > AI agents you can disconnect any app or revoke any API key; access stops at once. You can also remove MinutesMaster in the AI app itself. Changing your password revokes all API keys and connected apps. Deleting your account deletes all connections, keys and log entries.

Ask MinutesMaster (in-app assistant) and search

Assistant. When you ask the assistant a question in the app, or an agent uses the ask_meetings tool, we send your question and the relevant excerpts of your meetings to our AI model provider (through OpenRouter, listed among our sub-processors) to write the answer. The question and the answer, with links to the cited moments, are saved in your assistant history so you can return to them. You can delete a conversation at any time. Questions are limited per day.

Search. To find meetings by meaning, meeting text (transcripts and minutes) and your search queries are turned into numerical representations (embeddings) by an embedding model accessed through OpenRouter. The embeddings are stored with your meeting and deleted when you delete the meeting or your account.

Neither the assistant nor search uses your content to train AI models.

Data Retention

We retain your personal information and meeting data for as long as your account is active or as needed to provide you services. You can delete your meetings and account at any time by emailing info@minutesmaster.ai. Deletions are processed within 5 business days, except where we are required to retain specific data for legal purposes.

AI-agent activity logs are deleted after 180 days; assistant conversations are kept until you delete them or your account.

Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal information
  • Correction: Request correction of inaccurate information
  • Deletion: Request deletion of your personal information
  • Portability: Request transfer of your data to another service
  • Opt-out: Opt out of marketing communications

To exercise these rights, please contact us at info@minutesmaster.ai

International Data Transfers

Several of our sub-processors (Soniox, RunPod, OpenRouter, RevenueCat, Sentry) are based in the United States. We rely on the following safeguards for cross-border transfers of personal data from the EEA / UK / Switzerland to the United States:

  • Standard Contractual Clauses (EU Commission Implementing Decision 2021/914) where the sub-processor does not participate in the EU–US Data Privacy Framework.
  • EU–US Data Privacy Framework certification where the sub-processor participates.
  • Technical measures including TLS 1.2+ in transit and AES-256 at rest.

Stripe processing for EU customers is handled by Stripe Payments Europe Ltd. (Ireland). MeetingBaaS processing is handled within the European Union. To request our Transfer Impact Assessment or Standard Contractual Clauses, email info@minutesmaster.ai.

Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

  • Email: info@minutesmaster.ai
  • Mail: Jan Horák, IČO 06599648, Pod Rozhlednou 2970/11, 787 01 Šumperk, Czech Republic
Back to Home