Osmi:Privacy Policy
Privacy Policy
Last updated: 2026/10/19
This Privacy Policy is part of our Terms of Service. It explains what X-UNIV. CO., LTD. ("we", "us") collects when you use Osmi (the website at meeting.bookai.com and the Osmi apps for iOS and Android — together, the "Service"), what we do with it, how long we keep it, and who else receives it.
The short version
You upload a recording; Osmi turns it into a transcript and meeting notes, asking you a few questions along the way.
Your recording is deleted when the session finishes — or after one hour without activity, whichever comes first.
Your transcript and notes are deleted 48 hours after your last action on that session (24 hours if that last action was an export). Export what you want to keep.
Transcription and drafting are done by Google's Gemini API on a paid plan; under Google's terms, that data is not used to train Google's models.
We have no advertising, no analytics and no tracking tools, and we do not sell your data.
1. What we collect
1.1 Your account
You sign in with Google or Apple. We receive your email address and an account identifier from the sign-in provider. If you use Apple's "Hide My Email", we receive an Apple relay address instead of your real one. The sign-in provider may also share your name and profile photo; our sign-in service stores them with your account, but Osmi does not use them.
1.2 What you upload
Recordings. Audio or video files, up to 4 hours in total per session. Only the sound is used:
in the iOS and Android apps, the audio track is taken out of a video on your device, and only the audio is uploaded;
on the website, the whole file is uploaded, our server keeps only the audio track and deletes the original file.
Meeting materials (optional): up to 5 documents (.docx, .pptx, .pdf, .md, .txt, 10 MB each) that you attach to give context. Their text is extracted, used for that session, and not stored.
Custom templates (optional): if you upload a template, we keep its structure and filename until you replace or delete it.
1.3 What the Service produces with you
Your answers to Osmi's questions and your adjustment requests.
The transcript and the meeting notes, including any diagrams.
Your notebook. To get names and terms right next time, Osmi saves terms you corrected (what was heard → what is correct) and people you identified (a name and a short description, such as a role). This can include information about people who do not use Osmi — for example, colleagues who spoke in your meeting. See section 6.
1.4 Purchases
Your minute balance, each purchase (date, pack, amount, currency, payment channel) and each deduction or refund.
For card payments in New Taiwan dollars through ECPay: the transaction reference numbers needed for refunds and reconciliation. We do not receive or keep your card number, or any part of it.
For a Taiwan e-invoice: the details you enter (company tax ID, mobile-barcode carrier) and the name and email that go on the invoice.
1.5 Invitations
If you invite someone, we record that they signed up through your link and whether each of you received the bonus minutes. We collect nothing about a person until they create their own account.
1.6 Technical information
With each session we record the app or website version, your operating system and device model (on the website, a shortened browser identifier), and processing details such as timing, the AI model used, its token counts and cost.
To keep the service secure and prevent abuse, we log connection IP addresses, device and browser information, sign-in times, and security-related events. This information is used only to detect and respond to attacks, is kept for up to 400 days, and is then deleted automatically. It does not include the content of your meetings.
We never put the content of your recordings, transcripts, notes or answers into our logs.
2. How Osmi processes a recording
You start it. Nothing is uploaded until you choose a file and confirm. Before your first session, you agree once to three things: that minutes are deducted by recording length, that your audio and text are processed by a third-party AI provider (Google Gemini), and that your files are deleted on the schedule below. We keep a record of those agreements.
Storage while processing. Your audio is stored on Google Cloud Storage in Taiwan (region asia-east1) and sent to the Google Gemini API for transcription. Gemini also drafts the questions and the notes from the transcript, your answers and any meeting materials.
Google's terms. We use the Gemini API as a paid service. Google states that it does not use prompts or responses from paid services to improve its products, and that it may keep them for a limited time to detect abuse (Gemini API Additional Terms).
We use your content only to produce what you asked for. We do not read it, sell it, or use it to train any model.
3. How long we keep it
Recording: our copy and the copy sent to Gemini are deleted when the session finishes, when you keep only the transcript, when you cancel or remove the session, or after 1 hour without activity. This includes after a failure, so you can retry within that hour.
An upload that was interrupted and never finished: it never becomes a stored file; the incomplete upload is discarded by Google Cloud Storage.
Meeting materials: not stored; used only while that step runs.
Transcript, notes, diagrams, your answers, and the names matched to speakers: deleted 48 hours after your last action on that session, or 24 hours if your last action was an export.
Copies cached by the iOS/Android app on your device: deleted on the same schedule, and when you sign out or delete your account.
Notebook (terms and people) and custom templates: kept until you delete them on the account page, or until you delete your account.
Session record: filename, length, size, dates, status, languages, export history, device information and processing cost are kept as your history, like a receipt, until you delete your account.
Account, balance and purchase history: kept until you delete your account; see section 5 for what must be kept after that.
4. Who else receives your data
We use these companies to run the Service. Each receives only what its job needs.
Google Cloud
Google Cloud provides hosting and file storage in Taiwan. It receives your uploads while they are processed, and standard request logs.
Google (Gemini API)
Google's Gemini API provides transcription, questions and notes. It receives audio, transcript, your answers and meeting materials.
Supabase
Supabase provides sign-in and database services, with servers in Tokyo, Japan. It receives account data, sessions, notes until deleted, notebook and balance information.
Google / Apple
Google and Apple provide sign-in. They receive and share only what you approve on their sign-in screen.
ECPay (Taiwan)
ECPay handles card payments in TWD and Taiwan e-invoices. It receives payment details you enter on ECPay's form, your account ID, email and invoice details.
Stripe
Stripe handles card payments in USD. BookAI Inc., a company under contract with X-UNIV. CO., LTD., operates the Stripe account and collects these payments on our behalf. Stripe receives payment details you enter on Stripe's form, your email and account ID.
Apple App Store / Google Play
Apple App Store and Google Play handle in-app purchases entirely. We receive a purchase confirmation.
Resend
Resend sends emails such as "your transcript is ready", "your notes are done" and "deleting soon". It receives your email address and, attached to those emails, your notes and transcript (PDF, Word, Markdown, text) so you keep a copy before we delete ours. Those copies then live in your mailbox under your email provider's terms.
Only when you choose to send your notes somewhere:
Google Docs: sent from your browser straight to your own Google Drive; it does not pass through our servers.
Nabu (a BookAI document service, if you link your Nabu account): we send the notes, cover image, diagrams, tags and keywords you confirm.
Notion (if you connect your Notion account): we create a page in your workspace with your notes. We keep the access token Notion gives us, encrypted, until you disconnect or delete your account.
Scripts from other providers. Some pages load code from Google (sign-in), Stripe and ECPay (payment forms), and jsDelivr and d3js.org (drawing diagrams). Those providers can see your IP address and may set their own cookies under their own policies.
We do not sell your personal data, and we do not share it with advertisers.
Outside these companies, we disclose data only when the law requires it, to protect the Service against fraud or abuse, or as part of a merger or acquisition (we will tell you before your data falls under a different policy).
5. Your choices and rights
See and take your content: export notes and transcripts (PDF, Word, Markdown, text, subtitles) and your notebook (Markdown).
Delete a session: "Remove" deletes it immediately instead of waiting for the schedule above.
Delete your notebook or templates: on the account page.
Delete your account: on the account page (you type your email to confirm). This deletes your sessions, recordings, notes, notebook, templates, linked accounts and sign-in. Unused purchased minutes are not refunded. We keep:
purchase and payment records, detached from you (your account ID is replaced by a random one; email and carrier code are erased), because tax and accounting law requires them — the company tax ID on an issued e-invoice stays on that invoice;
a one-way scrambled code of your sign-in identity (no email, no name), only to stop the same account from claiming the new-account bonus twice.
Preventing repeat claims To stop the same device from claiming the free minutes for new accounts or the invitation rewards more than once, we check whether a device has already claimed them. On iPhone, this uses Apple's DeviceCheck service, and we never receive a device identifier. On Android and on the web, we use an identifier on the device or in your browser, and we store only a hash of it that cannot be reversed. If you delete your account, these records are no longer linked to it, but the note that the device has already claimed is kept, so that deleting your account and signing up again does not allow a second claim.
Questions or requests: support@bookai.com. Depending on where you live, you may have further rights (for example, access, correction or objection); write to us and we will respond as the law requires.
6. Information about other people
Meetings involve other people. Before you upload a recording, you are responsible for having the right to record and share it under the laws that apply to you — some places require everyone's consent. Names and descriptions you give Osmi (in answers, corrections or your notebook) are personal data about those people; only provide what you have the right to share.
7. Storage on your device
The website stores your settings, unsent drafts and your sign-in session in your browser's local storage. We set no cookies of our own. The apps cache your session list and recent notes on your device (see section 3).
8. Children
Osmi is for adults. You must be 18 or older (or the age of majority where you live, if higher) to use it. If you believe a minor has given us personal data, contact us and we will delete it.
9. International transfers
We are based in Taiwan, and your files are stored in Taiwan while they are processed. Your account data and database are hosted by Supabase in Tokyo, Japan. The Gemini API and Stripe may process data in other countries, including the United States.
10. Security
All connections use encryption in transit, access to our systems is restricted to the people who operate the Service, and each step receives only the data it needs. No system is perfectly secure.
11. Changes
When we change this policy we update the date at the top. For significant changes we will also tell you in the Service or by email before they take effect.
12. Contact
X-UNIV. CO., LTD., Sec. 2, Taiwan Blvd., Central Dist., Taichung City, Taiwan
Email: support@bookai.com
