Privacy Policy - Meetfy AI

1. Controller

The controller responsible for data processing is: Appload Solutions S.L., Calle Bethencourt Alfonso 33, 7º, 38002 Santa Cruz de Tenerife (S/C Tenerife), España, CIF B76813195.

For all questions about data protection and to exercise your rights, you can contact us at any time at contact@meetfy.ai.

2. Overview

We only process personal data to the extent necessary to provide our website, your account and the app, to protect them against misuse and to fulfil legal obligations. We do not sell your data.

Depending on the purpose, we rely on the following legal bases: performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR), your consent (Art. 6 (1) (a) GDPR), legal obligations (Art. 6 (1) (c) GDPR) and our legitimate interests (Art. 6 (1) (f) GDPR). We name the legal basis for each processing operation in the following sections.

3. Visiting our website

Server log files: when you visit our website, our server automatically records technical data such as your IP address, date and time of access, the page requested, the referring page, the HTTP status code and your browser and operating system (user agent). We use this data to deliver the website, to ensure its stability and security and to analyse errors. Legal basis: Art. 6 (1) (f) GDPR. The log files are deleted as soon as they are no longer required for these purposes, unless they are needed to investigate a specific security incident.

Session cookie: we use a single technically necessary session cookie. It stores, among other things, your selected language and a security token that protects our forms against forged requests (CSRF) and excessive use. The cookie is deleted when you close your browser. Because it is strictly necessary for the operation of the website, no consent is required (Art. 22 (2) LSSI-CE) and we do not show a cookie banner.

Local storage: if you switch between the light and dark theme, your choice is saved in the local storage of your browser ("meetfy-theme"). This information stays on your device and is not transmitted to us.

Product Hunt badge: our footer shows a badge of the platform Product Hunt. The image is loaded directly from the servers of Product Hunt (USA), which means that your IP address and technical browser information are transmitted to Product Hunt. We use the badge to present our product on this platform. Legal basis: Art. 6 (1) (f) GDPR. For more information, please refer to the privacy policy of Product Hunt.

4. Help center

When you read an article in our help center or rate whether an article was helpful, we store the article, the date, your rating and, if you enter one, the reason for a negative rating. Instead of your IP address we only store a SHA-256 hash value that is calculated from your IP address and your browser identification (user agent). We use this data to create visitor and rating statistics, to improve our articles and to prevent multiple ratings. Legal basis: Art. 6 (1) (f) GDPR.

5. Protection against misuse

To protect our forms (registration, email confirmation, password recovery) against automated attacks and misuse, we limit the number of requests. For this purpose we store a SHA-256 hash value calculated from the requested action and your IP address, together with a counter and the start of the time window. Your IP address itself is not stored. In addition, the number of your requests is counted in your session. The entries are deleted automatically after the time window has expired (usually after one hour).

Legal basis is our legitimate interest in the security of our services and in protecting our users (Art. 6 (1) (f) GDPR).

6. Beta registration

If you register for our beta program, we process your name and the email address you use for the Google Play Store. We use this data to grant you access to the beta test via Google Play and to contact you about the beta. For this purpose your email address is entered in the list of testers in the Google Play Console. After your registration we receive an internal notification email.

Legal basis: Art. 6 (1) (b) GDPR. We store the data for the duration of the beta program or until you ask us to delete it.

7. Account registration

When you create an account, we process your first name, your email address, your password, your language and your choice regarding the newsletter, as well as internal account identifiers.

We use this data to create and manage your account and to provide the service. Legal basis: Art. 6 (1) (b) GDPR. We store the data for as long as your account exists. After the account has been deleted, the data is deleted unless statutory retention obligations apply.

8. Email confirmation, password recovery and security notifications

After registration we send you an email with a confirmation link to make sure that the email address belongs to you (double opt-in). The link contains a random token that is valid for 24 hours. If you request a new password, we send you a link that is valid for 60 minutes. To protect your mailbox, we send these emails to the same address at most once every 15 minutes.

After your password has been changed, we inform you by email so that you can react quickly if it was not you.

Legal basis: Art. 6 (1) (b) GDPR and our legitimate interest in the security of your account (Art. 6 (1) (f) GDPR). The token is deleted as soon as it has been used or replaced by a new one.

9. Email deliverability (bounce and complaint lists)

If an email to your address cannot be delivered permanently (hard bounce), repeatedly cannot be delivered temporarily (soft bounce) or if you mark one of our emails as spam (complaint), we store your email address, the reason and the time on a blocking list. Before each email is sent, we check this list and do not send any further emails to blocked addresses.

This protects your mailbox from unwanted emails and ensures the deliverability of our emails. Legal basis: Art. 6 (1) (f) GDPR. We store the entries for as long as necessary to prevent further sending to the address concerned. If you want to receive emails from us again, just contact us.

10. Newsletter

If you tick the newsletter box during registration, we will send you news about Meetfy.ai by email. Your consent only becomes effective once you have confirmed your email address.

Legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future, for example via the link in every newsletter or by sending an email to contact@meetfy.ai. The lawfulness of the processing carried out until the withdrawal remains unaffected.

11. Consent records

To be able to prove that you have accepted our terms and conditions, taken note of this privacy policy and, if applicable, consented to the newsletter, we record: your user ID, the type of consent, the action (accepted, acknowledged, revoked), the version of the document, the language, the source (e.g. web registration), the time, your browser identification (user agent) and a SHA-256 hash value calculated from your IP address and user agent.

Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR (obligation to prove consent) and our legitimate interest in defending against legal claims (Art. 6 (1) (f) GDPR). We keep these records even after your account has been deleted, for as long as claims can be asserted against us (statutory limitation periods).

12. Using the Meetfy.ai app

When you use the app, we process the content you create, in particular:

Live coaching: the audio of your conversation is streamed live to the AI coach in order to generate tips in real time.
Recordings: the audio of the meetings you record.
Captures: the photos you take of whiteboards, slides or documents.
Meeting preparation: your notes on participants, goals, topics, checklists and expected objections.
Summaries: the recaps generated after a coaching session, including tips received and your notes.
Transcriptions: the text generated from your recordings (speech-to-text).
Analyses: the results of image analyses and meeting analyses.
Usage data: e.g. credits used for live coaching, image analysis, meeting analysis and transcription, and your credit balance.

12.1 AI service providers and data of third parties

To generate tips, analyses and summaries, we use AI service providers that process the data exclusively on our behalf and according to our instructions as processors (Art. 28 GDPR). They are contractually bound to confidentiality and to appropriate technical and organisational measures.

Legal basis for processing your content is the performance of the contract (Art. 6 (1) (b) GDPR). Your content is stored in your account until you delete it or your account is deleted.

Conversations, recordings and photos may contain personal data of other people (e.g. conversation participants). We process this data on the basis of the legitimate interest in providing the service you have requested (Art. 6 (1) (f) GDPR). You are obliged to inform these people and, where required by law, to obtain their consent before recording or coaching (see our Terms and Conditions).

13. Purchases of credits

Purchases in the app: if you buy credits in the app, the payment is processed by Apple (App Store) or Google (Google Play) as independent controllers; we do not receive your payment details. We only receive the information required to process the purchase, such as the product purchased, the time and a transaction ID. The privacy policies of Apple and Google apply to the processing by the stores.

Purchases in the dashboard: if you buy credits in the dashboard at account.meetfy.ai, the payment is processed by the payment service provider Stripe Payments Europe, Ltd., Ireland ("Stripe"). Stripe processes the payment data you enter (e.g. card or other payment method details, name, email address and billing address) in order to carry out the payment and to prevent fraud. We do not receive your full card details; we receive transaction data such as the product purchased, the amount, the time, a transaction ID and the payment status. The privacy policy of Stripe applies to the processing by Stripe. Stripe may transfer data to Stripe, Inc. in the USA; such transfers are based on the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission (see section 16.1).

Legal basis: Art. 6 (1) (b) GDPR (performance of the purchase contract) and, for retaining accounting records, Art. 6 (1) (c) GDPR. Data relevant for tax and commercial law is kept for the statutory retention periods.

14. Email delivery service providers

We use specialised service providers to send emails (e.g. confirmation and password emails). They process your email address, your first name and the content of the email exclusively on our behalf as processors (Art. 28 GDPR) and may receive delivery information (e.g. bounces and complaints). Legal basis: Art. 6 (1) (b) and (f) GDPR.

15. Hosting

Our website, our databases and our backend are operated in data centres in Madrid and Frankfurt am Main. The hosting provider processes data exclusively on our behalf as a processor (Art. 28 GDPR). Legal basis: Art. 6 (1) (b) and (f) GDPR.

16. Recipients and transfers to third countries

We only pass on your data if this is necessary for the purposes described above, in particular to the following categories of recipients:

hosting providers, email delivery service providers and AI service providers as processors;
Apple and Google for purchases and the beta test;
the payment service provider Stripe for purchases in the dashboard (see section 13);
Product Hunt when the badge is loaded (see section 3);
public authorities, courts and advisors bound to professional secrecy, if we are legally obliged to do so or it is necessary to assert or defend legal claims.

16.1 Transfers to third countries

Some service providers may be located outside the European Economic Area or may access data from there. In this case, the transfer only takes place if the European Commission has issued an adequacy decision for the country concerned (for example the EU-US Data Privacy Framework for certified US companies) or if appropriate safeguards exist, in particular the standard contractual clauses of the European Commission (Art. 46 (2) (c) GDPR). You can request a copy of these safeguards from us at contact@meetfy.ai.

17. Storage period

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. The specific periods are stated in the respective sections. In summary:

account data and app content: for as long as your account exists;
confirmation tokens: 24 hours, password recovery tokens: 60 minutes, or until used;
rate-limiting entries: until the time window has expired (usually one hour);
blocking list entries: for as long as necessary to prevent further sending;
consent records: until the statutory limitation periods have expired;
accounting records (purchases in the app and in the dashboard): for the statutory retention periods under commercial and tax law.

18. Your rights

You have the following rights regarding your personal data:

right of access (Art. 15 GDPR);
right to rectification (Art. 16 GDPR);
right to erasure (Art. 17 GDPR);
right to restriction of processing (Art. 18 GDPR);
right to data portability (Art. 20 GDPR);
right to object to processing based on legitimate interests (Art. 21 GDPR);
right to withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR).

18.1 Exercising your rights and complaints

To exercise your rights, simply write to us at contact@meetfy.ai. You can request the deletion of your data here: Request data deletion.

You also have the right to lodge a complaint with a data protection supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can also contact the supervisory authority in the country of your habitual residence.

19. Security

We use appropriate technical and organisational measures to protect your data, in particular TLS encryption for all connections to our website, the hashing of IP addresses for statistics and protection against misuse, and restrictive access rights.

20. Minors

Our service is aimed exclusively at persons aged 18 and over. We do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data, please contact us at contact@meetfy.ai so that we can delete the data.

21. Changes to this privacy policy

We adapt this privacy policy when our services or the legal situation change. The current version is always available on our website. We will inform you of significant changes by email or in the app.