Meeting Note:Privacy Policy
Privacy Policy
Last updated: 2026-09-22
This Privacy Policy describes how X-UNIV. CO., LTD. ("the Company", "We", "Us", "Our") collects, uses, and discloses information when you use Meeting Note (the "Service"), and explains your privacy rights and how the law protects you.
We built this Service around a simple idea: your recordings live on your device, and nothing leaves it unless you say so. This Policy tells you exactly what happens on the occasions when you do, and we follow a data-minimization principle throughout: we collect only what a given step actually needs, and keep it only for as long as that step needs it.
Interpretation and Definitions
Interpretation
Words with an initial capital letter have the meanings defined below, whether they appear in the singular or the plural.
Definitions
For the purposes of this Privacy Policy:
Account means a unique account created for You to access the Service.
Company (referred to as "the Company", "We", "Us" or "Our") refers to X-UNIV. CO., LTD., Sec. 2, Taiwan Blvd., Central Dist., Taichung City, Taiwan.
Country refers to: Taiwan.
Device means any device that can access the Service, such as a computer, a mobile phone, or a digital tablet.
Recording means an audio file You create or import using the Service.
Transcript means the text produced from a Recording, whether generated by the Service or pasted in by You.
Meeting Document means the written output (summary, minutes, notes) the Service generates from a Recording or Transcript.
User Content means Recordings, Transcripts, Meeting Documents, and any other material You submit to the Service, collectively.
Points or Credits means the prepaid balance You purchase to pay for cloud processing.
Personal Data is any information that relates to an identified or identifiable individual.
Service refers to Meeting Note, available as a mobile application (iOS/Android) and a website.
Service Provider means any third party that processes data on Our behalf to help Us operate the Service — see Subprocessors below.
Usage Data refers to data collected automatically, such as the duration of a session or diagnostic information generated by the Service infrastructure.
You means the individual accessing or using the Service.
The Local-First Design: What Never Leaves Your Device
Recording, playback, and file management in the Service are designed to work entirely offline, on Your Device. You do not need an account or a network connection to record a meeting, play it back, or manage your recording files. We never automatically upload a Recording. A Recording is transmitted to Our servers only when You take an explicit, affirmative action to submit it for processing (for example, tapping "Generate Meeting Document").
Because Recordings stay on Your Device until You choose otherwise, deleting the app or losing Your Device also deletes any Recording You have not exported or submitted. We strongly encourage You to export Recordings You want to keep. We do not provide cloud backup of your local Recordings, by design — backing them up automatically would defeat the purpose of this section.
The Data We Collect
Account Data
You create an account by signing in with Google (via Supabase Auth) — this is currently the only sign-in method the Service offers. We receive the email address and basic profile information Google provides through that sign-in. We also keep your Points balance and transaction history.
Referral and Engagement Data
The Service may let You invite others to use it, or otherwise track engagement between accounts (for example, to grant a bonus once someone you invited completes their first session). We do not collect any contact information about a person you invite before they create their own account — sharing an invite is something You do yourself, outside the Service.
Personalization Data (May Include Information About People Who Are Not Users)
The Service may proactively save information to improve your experience over time — for example, terminology corrections, or notes that help the Service recognize meeting participants in future sessions. If any such information identifies or describes another person, you are giving Us personal data about someone who may never use the Service themselves. Unlike your Recordings, Transcripts, and Meeting Documents, Personalization Data is not automatically deleted — we keep it until You remove it yourself. The same principle described in Recording Consent Is Your Responsibility below applies to information you provide about other people here: you are responsible for having the right to share it with Us.
Content You Submit for Cloud Processing
When You explicitly submit a Recording, a pasted Transcript, or related material for processing, We receive the audio file or text You submitted, and the Transcript and Meeting Document generated from it, for the duration described in How We Process Your Content in the Cloud.
Usage Data
We may use analytics or crash-reporting tools to help Us understand how the Service is used and to fix problems; any such tool will be named in the Subprocessors table below once it is enabled. We also keep the standard server logs needed to operate and secure the Service (for example, request timestamps and IP addresses). Regardless of which tools are active, We do not log the content of your Recordings, Transcripts, or Meeting Documents.
Payment Data
We do not receive or store your full payment card number in any case. Regardless of which payment method or processor is involved, the Service is operated solely by X-UNIV. CO., LTD.
If you purchase through Apple's or Google Play's in-app purchase, that purchase is handled entirely by Apple or Google under their own terms; We only receive confirmation of the purchase and the amount of Points to credit.
If you purchase through the web, your payment may be processed on Our behalf by a payment processor or reseller (for example, ECPay for New Taiwan Dollar purchases). If You provide a Unified Business Number (統一編號) or a mobile-barcode carrier code for a Taiwan e-invoice, We collect it for that purpose only.
How We Process Your Content in the Cloud
This section is the one we want You to actually read. When You submit a Recording or Transcript for processing:
You decide when this happens. Uploading is always a deliberate action on Your part — never something the Service does in the background or on your behalf.
The audio is chunked and transcribed, then a follow-up step may ask You clarifying questions to fill in context the audio alone doesn't carry, before the Service assembles your Meeting Document.
We use named cloud providers to do this work — see Subprocessors below, including Google Cloud Platform for temporary storage and compute, and Google's Gemini models for transcription and drafting. We are naming these providers on purpose: We are not going to tell You whether that arrangement meets your personal privacy bar — that is Your call to make, and We want You to have the facts to make it, including each provider's own terms.
We ask for your consent twice, separately. Before we ever send your audio to Gemini or Google Cloud Platform, the Service asks for your consent to that specific action — separately from, and in addition to, your consent to spend Points on the job. These are two distinct, recorded actions; we do not bundle them into a single "OK" button.
We do not keep a separate record of your conversation with the AI processor. Any interim conversational exchange used to produce your Meeting Document exists only for the duration of your active processing job. Our operational logs record only status and technical metadata about that job (for example, processing stage, timing, token counts) — never its content.
We prioritize deleting your Recording and Meeting Document over keeping them. Once your job ends — whether it completes, fails, or is cancelled — We delete the uploaded audio first, actively and immediately, rather than relying on it to expire on its own. What is left afterward is limited to log and transaction metadata; see Retention for exactly how long each part of your content stays before it is deleted.
Google's own terms govern further use by the AI model. Our use of the Gemini API is a billed, "Paid Service" under Google's terms, and under those terms Google states that it does not use the prompts or files you submit on Paid Services to improve or train its models (see the Gemini API Terms of Service). Google may still retain data briefly under those same terms for safety purposes — for example, to detect abuse of its Prohibited Use Policy. On Our side, We do not use your Content for any purpose beyond producing the output you asked for.
The Subprocessors We Use
Subprocessor
Purpose
What it receives
Google Cloud Platform
Temporary storage and compute for processing jobs
The uploaded audio file, transiently
Google (Gemini API)
Audio transcription, contextual interview, document drafting
The uploaded audio and derived Transcript, transiently
Supabase
Account, authentication, and Points ledger
Account data, Points balance
Apple / Google Play
In-app purchase processing
Payment details (handled entirely by Apple/Google)
ECPay and other payment processors
Payment processing on Our behalf
Payment and, where applicable, Taiwan e-invoicing details
This list may grow as We add features — for example, a productivity-tool integration such as Notion, if We add the ability to export a Meeting Document there, or an analytics/crash-reporting tool as described under Usage Data. We keep this table current.
If You choose to save an exported document directly to a service like Google Docs, that transfer goes straight from your browser to your own account on that service — it does not pass through Our servers, and this table does not cover it.
How We Use Your Personal Data
We use Personal Data to:
Provide and maintain the Service, including your Account and Points balance
Process the cloud transcription and document-generation jobs You request
Contact You about your Account, purchases, or changes to this Policy
Comply with legal obligations, such as tax and payment record-keeping
Investigate and prevent fraud or abuse of the Service
Sharing Your Personal Data
We share Personal Data only:
With the Subprocessors listed above, to the extent necessary to run the Service
For legal reasons, if required by law or a valid request from a public authority
In a business transfer, if the Company is involved in a merger, acquisition, or asset sale — We will notify You before your data becomes subject to a different privacy policy
With your consent, for any other purpose
We do not sell your Personal Data.
Retention
Recordings you have not submitted never reach Us — see The Local-First Design.
We prioritize deleting your content over keeping it. Once your processing job ends — whether it completes, fails, or is cancelled — We delete the uploaded audio first, actively and immediately, rather than waiting for it to expire on its own.
Your Transcript and Meeting Document remain available to You for a limited window after your last activity on that job (currently 48 hours) so You can view and export them; their content is then permanently deleted. Please export anything You want to keep within that window.
What remains after that is limited to technical log and transaction metadata — for example, the filename, duration, cost, and timestamps of a processing job, kept indefinitely as your transaction history, similar to a receipt — never the substance of your Recording, Transcript, or Meeting Document.
Personalization Data (see above) is retained until You delete it yourself; it is not subject to the automatic deletion described above.
Account data, Points transaction history, and payment/invoice records are retained for as long as your Account is active, and afterward as required to comply with Our legal, accounting, and tax obligations.
International Data Transfers
The Company is based in Taiwan. Our Subprocessors operate global infrastructure, which means your data — including audio you submit for processing — may be transferred to, and processed in, countries other than the one you are in, including the United States. We require our Subprocessors to handle your data securely and in a manner consistent with this Policy.
Your Rights
You can delete your Account and the Personal Data associated with it at any time from Account settings, or by contacting us. Because We do not retain a cloud copy of your Recordings once processing is complete, deleting your Account does not by itself delete any local Recording still on your Device — please export anything you want to keep before deleting the app.
Security
We use commercially reasonable technical and organizational measures to protect your Personal Data. Access by Our own personnel is limited to what is necessary to provide support, investigate abuse, and maintain the Service. No method of transmission over the internet or electronic storage is 100% secure, and We cannot guarantee absolute security.
Recording Consent Is Your Responsibility
Laws about recording a conversation — including whether every participant must consent, and whether that consent must be given before recording starts — vary by country and, within some countries, by state or context (e.g., a workplace meeting versus a personal call). The Service does not verify, and cannot guarantee, that recording a particular meeting is lawful in your jurisdiction. You are solely responsible for determining whether you need the consent of other participants before recording, and for obtaining it. The Service gives you the tools to record and transcribe; it does not give you legal permission to do so.
Children's Privacy
The Service is not directed to children, and We do not knowingly collect Personal Data from anyone under the age of 13. If You believe a child has provided Us with Personal Data, please contact Us and We will delete it.
Links to Other Websites
The Service may link to third-party websites not operated by Us, including the terms of the Subprocessors named above. We are not responsible for the content or privacy practices of any third-party site.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify You of material changes by posting the updated Policy on this page and updating the "Last updated" date, and, where required, by email or an in-app notice before the change takes effect.
Contact Us
If you have any questions about this Privacy Policy, you can contact us:
By email: support@bookai.com
X-UNIV. CO., LTD., Sec. 2, Taiwan Blvd., Central Dist., Taichung City, Taiwan
