Privacy Policy

This Privacy Policy explains how Brieflee (“Brieflee”, “we”, “us”), operated by Xtreme IT Services, collects, uses, stores, and shares information when you use our website, web application, desktop assistant, and meeting integrations (together, the “Service”). By using the Service you agree to this Policy.

1. Information we collect

• Account information: your name, email address, organization, and authentication credentials when you create an account or sign in.
• Meeting content: audio captured during meetings you run the Service in, and the transcripts and AI-generated suggestions derived from it.
• Screen moments: a picture of part of your screen that you take during a meeting; a slide the recording keeps by itself while it shares a meeting's tab or window, and what that tab or window shows when somebody says something like “as you can see”, which you can switch off in Settings; a mark you add (a decision, a task, a question or important); your note; and the text read off each picture on our own servers. Only the meeting's owner can see them. None of it goes to an AI provider, and none of it is part of a shared report.
• Voices: when a recording's speakers are numbered rather than named by the meeting platform (usually a recording made in your browser, in the desktop app or uploaded), we keep a numerical print of each speaker's voice with the meeting, and up to ten seconds of each voice for 30 days, so you can listen and name them. If you choose to have a voice recognised, its print is kept with your account and used to name that person in your later recordings until you forget it in Settings → Voices. Only the account that made the recording can hear or use them.
• Integration data: when you connect a third-party account (e.g. Google, Microsoft, Zoom, or a CRM), the profile and data those services authorize us to access, as described below.
• Usage and device data: log data, IP address, browser/device type, and feature usage, used to operate and secure the Service.
• How you found us: when you create an account, we keep where you came from: the tags on the link you followed (such as the name of an advert's campaign), which advertising network the link was from, the name of the website that sent you, not the page, and the first page you opened on our site. We use it only to learn which adverts and sites bring people to Brieflee. It is kept with your account, only our own team sees it, and nothing in the Service depends on it. Nothing is stored in your browser for it.
• Analytics: if you accept Analytics in our cookie banner, Google Analytics records which pages you opened and which features you used, and sets its own cookies. Addresses are stripped of search terms and identifiers before they are sent, so they never carry a meeting, a client, a share link or anything you typed. Decline and it does not load; turn it off later and its cookies are deleted. See our cookie page.
• Advertising: unless you switch Advertising off in our cookie settings (in the EU, the EEA, the UK and Switzerland you are asked first, and it runs only if you accept), OpenAI's ads pixel runs on our public pages, our sign-in pages and the Brieflee One shop at briefleeone.com, so that an advert we paid for inside ChatGPT can be matched to what it led to. It is told which of those pages you open (the address without its search terms), the name of the step you reached (a sign-up, details left in the website chat, joining the Brieflee One waitlist, or a paid Brieflee One order with its amount and items), and an id for that step; we also report sign-ups, waitlist entries and paid orders from our own servers with the same id so each is counted once, together with OpenAI's click reference when you arrived from one of its adverts and the reference its pixel keeps for your browser. When you create an account with an email address and password, our server's report of it also carries a one-way hashed copy of that email address, never the address itself; an account created with Google, Microsoft or Apple sign-in is reported without it. If you arrived from a ChatGPT advert and later buy a plan with Advertising on, our server reports that purchase to OpenAI with the plan and its amount (and that hashed email address, for an account created with a password), so the advert can be credited with it. OpenAI's pixel may also read an email address or phone number typed into our sign-up and sign-in forms and send OpenAI only a one-way hash of it, for the same matching (OpenAI calls this automatic advanced matching). Under the same switch, Google's ads tag runs on our public pages and sign-in pages on brieflee.ai. It is told which of those pages you open (the address without its search terms) and, when you create an account with an email address and password, that an account was created, an id for that sign-up and a one-way hashed copy of that email address, never the address itself, which Google uses to match the sign-up to an advert you saw; an account created with Google or Microsoft sign-in is reported without it. The tag keeps Google's click reference in its own cookies. It is also used for remarketing: Google may show our adverts to people who have visited these pages, on Google and on sites that show Google's adverts. If you arrived from a Google advert, created your account with an email address and password, and later buy a plan with Advertising on, our server reports that purchase to Google with the amount and the same hashed email address, so the advert can be credited with it; a plan bought by an account created with Google or Microsoft sign-in is never reported. In the same way, for such an account only, our server tells Google once when it first connects a calendar and once when its third meeting has a report, each with an id for that event and the same hashed email address and no amount: only that it happened, never which calendar or anything in it, and nothing about the meetings themselves. As there is no page open at those moments, we keep on your account the yes you gave in the cookie banner when you created it, and any answer you give later while signed in replaces it. In the EU, the EEA, the UK and Switzerland, until you answer the cookie banner, Google's tag runs with all of its consent settings off: it sets and reads no cookie, is given no sign-up id and no email address, and what it sends Google is used only to estimate how many visits led to sign-ups. If your browser sends a Global Privacy Control signal, Google's tag is never used for remarketing and OpenAI's pixel is not told which pages you open. Neither runs inside the app or the meeting panel, and neither is ever told what is in your calendar or your meetings. Switch it off, or choose Reject all in the cookie banner, and none of it happens, in the browser or on our servers.
• Billing data: handled by our payment processor (Stripe); we do not store full card numbers.
• Brieflee One waitlist: if you ask to be told when Brieflee One is available, the email address you give us and, if you fill them in, your name, the country you would want it shipped to, how many you are interested in, and anything you write in the "what would you use it for" box. We use these only to write to you about Brieflee One. You do not need an account to join, and joining is not an order: nothing is charged and nothing is reserved.
• Brieflee One orders: when you buy from briefleeone.com, your name, email address, phone number and delivery address, what you ordered, and the order's history (payment, dispatch, tracking, returns and refunds). We use these to deliver the order and clear it through customs, to send you its updates by email (and by text message to the number you gave, where we offer that), to invoice it, and to handle returns and warranty claims. Your card is handled by Stripe; we never see its number.
• Website chat: if you start a chat with the assistant on this site, the name, email address and phone number you enter, anything you then type into it, and the page you were reading when you opened it. We use these to answer you and to follow up; the messages are answered by an AI assistant and are readable by our team.

2. How we use information

• To provide the core Service: live transcription, in-meeting suggestions, briefs, summaries, and pushing action items to your connected tools.
• To authenticate you and secure your account and organization.
• To operate, maintain, debug, and improve the Service.
• To communicate with you about your account, billing, and support.

We do not sell your personal information. Apart from the advertising measurement and Google remarketing described in section 1, which you can switch off, we do not use it for advertising, and we do not use your meeting content or Google user data to train generalized AI/ML models. Google Analytics, which runs only if you accept it, is never given meeting content of any kind.

3. Google user data

If you choose to connect your Google account, we request only the scopes needed for the features you enable:

• openid, email, profile: to identify the connected Google account and show you which account is linked.
• https://www.googleapis.com/auth/tasks: to create task lists and tasks in your Google Tasks, so Brieflee can push meeting action items to your task list at your request. This access is used to write: the only thing we read is the names of your task lists, so you can choose where action items go; we never read the contents of your tasks.
• https://www.googleapis.com/auth/calendar.readonly: to read your upcoming events, so Brieflee can show your schedule in the app and send the notetaker to the meetings you select. We store only the event subject, start and end time, the meeting join link, and the event id. An event's description is looked through for that join link and is not kept. If you press “Read from the invitation” in a meeting's agenda, we read that one event's description again to find an agenda in it, and keep only the agenda lines you then save. This access is read-only: we never create, modify or delete calendar events.

We access this data only to provide those features, only while your Google account is connected, and only in response to your actions. We store the Google OAuth tokens needed to maintain the connection in encrypted form, and you can revoke access at any time (see “Your choices and data deletion” and your Google account permissions). We do not share Google user data with third parties except subprocessors that help us operate the Service, and never for advertising or model training.

Google user data and AI processing. Brieflee uses three third-party services to do its AI work: RunPod, whose GPU servers in the EU, Canada and the United States run our own speech-to-text;Modal (the same speech-to-text on its servers in the European Economic Area and the United States, used only when RunPod has no server free); and DeepSeekfor the language model that writes live suggestions and post-meeting summaries. Google user data is not sent to any of them.RunPod and Modal receive only meeting audio. DeepSeek receives only the meeting transcript and the notes and summaries generated from it. Data obtained from the Google Workspace APIs (your Google Calendar events and your Google Tasks) stays inside Brieflee: it is used to show your schedule, to send the notetaker to the meetings you choose, and to write the action items you ask us to write, and it is never included in a prompt to any AI provider. Calendar event subjects in particular are excluded from everything we send to a model: they are held in a separate database column from the meeting name the AI is given, so the separation is structural rather than a filter. Agenda lines read from an invitation are stored marked as calendar data and are left out of everything we send to a model too, which is why a report shows each of them as “Not checked”. Your Google profile is treated the same way: if you signed in with Google, the display name we received from Google is never sent to DeepSeek. Where a suggested reply is signed with your name, that name comes from the meeting roster our notetaker sees in the call, or from a name you typed into your Brieflee profile yourself.

We do not use, transfer, or sell any information received from Google APIs (raw, aggregated, anonymized, or derived) to develop, improve, or train generalized or foundational AI/ML models, whether our own or a third party's.

Brieflee’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3a. Zoom user data

If you connect your Zoom account (Settings → Integrations → Zoom) or open Brieflee inside a Zoom meeting, we request only these Zoom scopes:

• user:read:user: your Zoom user id, name, email address and account id, so we know which Zoom account is linked to your Brieflee account.
• user:read:token (and user:read:zak, which Zoom adds with it): to ask Zoom, at the moment you send the notetaker to a meeting you are in, for the one-meeting token that lets the notetaker join on your behalf. Zoom honours that token only while you are in the meeting.
• zoomapp:inmeeting: so the Brieflee panel inside the Zoom client can read which meeting it is open in and show that meeting’s notes.

What we keep. Your Zoom user id, account id and email address, and the Zoom OAuth access and refresh tokens, stored encrypted at rest. When the notetaker is in a Zoom meeting, the meeting’s audio, the transcript made from it, the participants’ display names as Zoom shows them, and the notes and summaries generated from the transcript are handled exactly like any other meeting content in this Policy: audio is deleted after transcription (section 5), and transcripts and summaries are kept until you delete them, the meeting or your account. We do not read your Zoom contacts, chat, cloud recordings, calendar or account settings.

Who else receives it. Zoom meeting audio is transcribed by our own speech-to-text on RunPod or Modal servers, and the transcript is sent to DeepSeek to write suggestions and summaries, as described in sections 3, 4 and 9. Your Zoom profile and Zoom tokens are never sent to any AI provider. We do not sell Zoom user data, use it for advertising, or use it to train AI/ML models.

Removing access. Disconnect Zoom in Settings → Integrations, or remove the Brieflee app from your Zoom account (in the Zoom App Marketplace, Manage → Added Apps → Remove). When Zoom tells us the app was removed, we delete your stored Zoom tokens and Zoom account identifiers at once and the notetaker can no longer join on your behalf. Meetings already captured stay in your Brieflee account until you delete them or the account; to have them deleted, delete them in the app or email privacy@brieflee.ai.

4. How we share information

We share information only with: (a) subprocessors that operate the Service under contract: our cloud hosting providers, our payment processor (Stripe), our transactional email provider (Resend),RunPod (GPU servers in the EU, Canada and the United States running our own speech-to-text, meeting audio only), Modal (the same speech-to-text on servers in the European Economic Area and the United States, used only when RunPod has no server free, meeting audio only), andDeepSeek (the language model behind suggestions and summaries: meeting transcripts, generated notes, and the messages you send to the assistant on this website); (b) the third-party tools you connect and direct us to send data to (e.g. your CRM or task list); (c) the courier carrying a Brieflee One order (DHL or FedEx), which receives the name, delivery address, phone number and contents it needs to deliver the parcel and clear customs; (d) OpenAI and Google, for the advertising measurement and Google remarketing described in section 1, unless you switch Advertising off; and (e) authorities where required by law. Our meeting notetaker runs on infrastructure we host and operate ourselves. We do not sell personal information, and we do not use your meeting content to train models. The current list, with what each one can reach and where it sits, is kept at brieflee.ai/subprocessors.

5. Data retention and deletion

Raw meeting audio is transcribed and then deleted server-side promptly after transcription; audio waiting to be transcribed is held encrypted in the meantime and deleted once the transcript is written, at the latest within 24 hours. Transcripts, suggestions, summaries, screen moments and account data are retained while your account is active and until you delete them or your account. Voice samples kept so you can name a recording's speakers are deleted after 30 days; a meeting's voice prints go with the meeting, and a saved voice is kept until you forget it or delete your account. That is not how transcripts and summaries are handled for a workspace that keeps them in its own storage; see section 6, which describes what we delete and what we keep in that case. Brieflee One waitlist entries are kept until the device is available and we have written to you, or until you ask us to remove you, whichever comes first; there is no automatic expiry on them, and you can ask us to delete yours at any time by writing to privacy@brieflee.ai. You may request deletion of your data at any time by emailing privacy@brieflee.ai; we will delete it within a reasonable period except where retention is required by law.

Website chat is kept to a fixed window rather than your account's lifetime, because the person who used it does not have an account. If you start a chat with the assistant on this site, the details you enter and the messages you send are deleted automatically 365 days after your last message, and you can ask us to delete them sooner at any time by emailing privacy@brieflee.ai.

Tasks you hand to someone else are also kept to a fixed window. When you email a follow-up item to another person, or share it with them on WhatsApp, we keep their name, their email address or WhatsApp number, the notes either of you wrote and their answers, so they can open the task and answer it. The email names you, and a reply to it goes to your own email address. A WhatsApp message goes from your own phone: we send nothing on WhatsApp and receive nothing from it. Their details are deleted automatically within 180 days after their link ends (when you turn it off, hand the task to someone else, or it runs out); the task itself stays in your account.

6. Customer-managed storage

A workspace can point Brieflee at storage it owns (for example an S3-compatible bucket, Azure Blob Storage, Google Cloud Storage, or an SFTP server) in Settings → Storage. Meeting recordings are then written to that storage instead of ours. Screen moments and voice prints are not; they stay with us. No voice samples are kept for those meetings.

How a recording gets there depends on what recorded it, not on which provider was chosen. A recording made on a phone, for an in-person meeting, is handed a short-lived signed link and uploaded straight to the workspace’s storage; it does not pass through us. A recording made by the notetaker in a Teams, Google Meet or Zoom call is streamed through our servers to that storage in chunks: it is held only in memory in transit and is never written to a disk of ours, but it does pass through our infrastructure. A workspace chooses what happens when its storage cannot be reached: we hold the recording and keep retrying for a period it sets, and if that period runs out we either keep the recording or delete it, according to the workspace’s setting.

Transcripts and AI summaries can also be written to that storage. This is a separate setting in Settings → Storage, off by default, that a workspace owner or admin turns on deliberately. With it on, when a meeting ends the transcript and the summaries generated from it are written to the workspace’s storage next to the recording, and any exports of that meeting are written beside the transcript; all of it is read back to confirm it landed and then deleted from our database. From that point the workspace’s storage holds the only copy of that text. Opening the meeting in Brieflee, following a share link, or asking a question that reaches back into it reads the text from that storage each time; if the storage cannot be reached, those views show an error rather than an older copy, because there is no older copy.

Three limits apply, and we would rather state them than have them discovered. First, a read that reaches back into a moved meeting is buffered on our servers for about a minute by default, so a page of follow-up questions does not fetch the same document repeatedly; a workspace can lengthen this to five minutes or, by declining to allow us any copy of its data, switch the buffer off. Second, what remains in our database is the metadata a listing needs (the meeting’s title, its timestamps and counts) together with the follow-up items and findings Brieflee produced during the call, which are its own notes about the meeting rather than the words spoken in it (a follow-up item may name the person it was assigned to). Minutes a workspace sends for confirmation, and formal minutes it drafts, also stay in our database, so the people they are sent to can read them. So does a follow-up item someone emails to another person or shares with them on WhatsApp, with that person’s name and email address or number, any note sent with it and their answer, so they can open and answer it; no line of the transcript is sent with it. A title given before storage was connected stays as it was. Third, if a workspace deletes one of these objects from its own storage, that transcript is gone: we hold no copy to restore it from.

Live meetings do not depend on any of this: audio, transcription and in-meeting suggestions run on Brieflee and do not wait on a workspace’s storage. If a workspace disconnects its storage, the recordings already written to it stay there, but Brieflee can no longer read them, and reconnecting the same storage does not restore that access.

A workspace can keep a deleted meeting’s files in its own storage. This is a separate setting in Settings → Storage, off by default, that a workspace owner or admin turns on where the company’s own policy requires it to keep its records. With it on, when anyone in the workspace deletes a meeting, or their account, the meeting is still deleted from Brieflee as section 7 describes, but the files already written to the workspace’s storage (the recording and, where the workspace stores them, the transcript and summaries) stay there. From then on they are the workspace’s own records, kept or deleted under its policy; Brieflee keeps no copy and no longer uses them. Storage a person has connected for their own meetings, where the workspace allows it, is not covered: files there are deleted as usual. Anyone in the workspace can see on the Storage page in Settings whether this is on, and a question about a copy the workspace keeps is for its administrator.

7. Your rights and your choices

Where the UK GDPR or Regulation (EU) 2016/679 applies to you, you have the right to access your personal data, to have it rectified if it is wrong, to have it erased, to restrict or object to how we process it, and to receive it in a portable form. You can also withdraw consent where we rely on it, without affecting processing already carried out.

• Delete your account yourself in Settings → Account. This erases the account, its meetings, transcripts, summaries, recordings, screen moments and saved voices, including media held on our own disk. It is immediate and cannot be undone. If your workspace keeps deleted meetings in its own storage (section 6), the files already there stay with the workspace.
• Delete a single meeting from its report or from Meetings; the recording, its screen moments and its voices go with it. If your workspace keeps deleted meetings in its own storage (section 6), the meeting’s files there stay with the workspace.
• Forget a saved voice in Settings → Voices; nobody is recognised by it again.
• Disconnect an integration at any time in Settings → Integrations; this revokes our stored tokens for that provider.
• Revoke Google access directly at myaccount.google.com/permissions.
• Remove Brieflee from Zoom in the Zoom App Marketplace (Manage → Added Apps); we delete your stored Zoom tokens and identifiers when Zoom tells us (section 3a).
• Switch off advertising measurement and remarketing with Cookie settings at the foot of our pages (or Reject all in the cookie banner). Our tags stop, their cookies are deleted, and our server stops reporting to OpenAI and Google for you. A Global Privacy Control signal from your browser is treated as an opt-out of remarketing, and OpenAI's pixel is then not told which pages you open. You can also choose which adverts Google shows you at adssettings.google.com.
• Exercise any other right by emailing privacy@brieflee.ai. We answer within one month and do not charge for a reasonable request.

If we get it wrong you can complain to your data protection supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk), and in the EEA the authority for the country where you live or work. We would rather you told us first, but that is your right and not conditional on asking us.

7a. Why we are allowed to process your data

For account holders, our legal basis is performance of the contract between us (you asked for a meeting assistant and this is what running it requires) and, for security measures, product improvement and keeping our records, our legitimate interests in operating a safe and functioning service. Where we rely on legitimate interests we have weighed them against your rights, and you can object as set out above.

For meeting participants who are not our customers, the controller is the customer whose workspace recorded the call; we process that data as their processor on their instructions, under the Data Processing Agreement. Responsibility for having a lawful basis to record a conversation, and for telling participants, sits with the customer running the meeting.

8. Security

We protect data with encryption in transit (TLS), encrypted storage of third-party OAuth tokens, access controls, and tenant isolation. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard measures.

9. International transfers

We process data outside the European Economic Area and the UK. Those transfers are made under the European Commission's Standard Contractual Clauses with supplementary measures, not on the basis of your consent, which is not an appropriate safeguard for processing you cannot avoid while using the Service.

One transfer deserves naming here rather than in a schedule: meeting transcripts are sent to DeepSeek, in China, to produce summaries and suggestions, and China has no adequacy decision. Messages you type into the chat assistant on this website go to the same provider, for the same reason. The full list of recipients and locations is at brieflee.ai/subprocessors, and the transfer mechanism is set out in section 9 of the Data Processing Agreement.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, by additional notice.

12. Contact us

Questions about this Policy or your data: privacy@brieflee.ai.