Privacy policy

1. Who is responsible

The data controller is Merme LLC (“Merme”, “we”). For anything in this policy, write to support@merme.ai.

2. What we collect

Account data

Your name, email address and preferred language, the ID of the Google or Microsoft account you sign in with, and your workspace and your role in it. Merme does not store your profile picture.

Calendar data

Only if a Host or Admin connects a Google or Outlook calendar (Viewers' calendars are never read): upcoming events on that calendar that contain a Google Meet, Zoom or Microsoft Teams link (the title, start and end time, the link, the organizer's email, and each invitee's name, email address and response to the invitation), plus an encrypted token that lets Merme keep reading the calendar. Events without a meeting link, and all-day events, are not stored.

GitHub and Jira connections

Only if your workspace uses external action item management and you connect GitHub or Jira: your account ID and username there (in Jira, your display name), and OAuth tokens, stored encrypted and used only to create the action items you choose to send. When you send one, Merme passes the item's title and text, its due date and assignee, the meeting's title and date, the note's link and your name to the GitHub or Jira account you connected; from then on that copy is governed by GitHub's or Atlassian's terms. If you disconnect in Settings, or delete your account, the tokens are erased.

Meeting content

The audio of meetings the Merme bot joins (the whole meeting and each participant's own audio track), participants' display names, who spoke when, and screenshots of the call that our bot vendor takes about once a minute, all captured by our bot vendor and kept only briefly (see “Where your data lives”); and the structured notes produced from them: summary, agenda, key topics, decisions, action items, open questions and short quotes, with the names of the people who spoke. A full transcript exists only while the notes are being prepared and is not stored. We do not use voices for biometric identification: Merme creates no voiceprints and does not recognise people by their voice. Speaker names come from the meeting platform.

Contact-form leads

The name, company, email address, topic and message you leave on our contact page, the time you gave consent and, to prevent abuse, your browser's user agent and a one-way hash of your IP address. We use them to reply to you and, if you join a waitlist, to tell you when that product launches. We send marketing email only with your consent; every such email has an unsubscribe link, and we stop within 7 working days of your request.

Billing

The hour packages your workspace buys (package, price and date), its hours balance (hours added and the time each meeting used), and the billing details you send us when you buy. We never see or store card numbers or payment tokens.

Technical data

Server logs with IP addresses and user agents, kept for security and debugging.

3. Google user data

Merme uses Sign in with Google and the Google Calendar API. Signing in asks Google only for your basic profile (openid, email, profile). The read-only Google Calendar events scope (calendar.events.readonly), which shows Merme your calendar events and nothing else, is requested separately, only when a Host or Admin connects their calendar; Viewers are never asked, and their calendars are never read. Merme uses it to find upcoming meetings with a Google Meet, Zoom or Microsoft Teams link on your primary calendar and to join them at the right time; you can stop Merme joining any meeting on your behalf. Outlook works the same way: Microsoft sign-in asks only for openid, email and profile, and connecting an Outlook calendar adds Microsoft Graph's read-only Calendars.Read permission, plus offline_access so Merme can keep syncing while you're away. To find the link, Merme reads each event's title, times, organizer, invitees and conferencing details and scans its location and description; it stores only what is listed under “Calendar data” above and never stores event descriptions. We never write to your calendar, never read events without a meeting link beyond what is needed to skip them, and never access your email, contacts or files. To withdraw Outlook access completely, disconnect the calendar in Settings and also remove Merme from your Microsoft account's app permissions.

Data from Google is used only to provide Merme's features: the meeting link goes to the bot that joins (Merme's own bot or, on Google Meet and Microsoft Teams when Merme's own bot can't join, our bot vendor, MeetStream.ai); the meeting title and the invitees' names and email addresses go to our own speech and summarization service so the notes carry the right title and speaker names (before any text reaches Google's Gemini models, they are removed or replaced with codes); and the invitee list sets who can open the notes by default and who is emailed, through our email provider (Resend), when they are ready. It is never used for advertising, never sold, never used to train AI models, and is read by a person only with your explicit consent for support, where it is necessary for security purposes (for example, investigating a bug or abuse), or where the law requires it. You can revoke access at any time: disconnect the calendar in Settings → Calendars, or remove Merme on your Google Account permissions page (see the Help page).

4. Why we use it, and on what basis

Contract

To provide the service you signed up for: signing you in, syncing your calendar, having the bot join your meetings, producing, storing and sharing notes, sending the emails the service needs, and billing.

Your consent

Connecting a calendar, GitHub or Jira account; storing a contact-form lead; and any support access to your content. Where the law requires meeting participants' consent to recording, the Host or Admin who brings the bot is responsible for obtaining it (see “Meeting participants”).

Legitimate interest

Recording and transcribing the other participants of a meeting that a Host or Admin brought Merme to (the bot is visible in the participant list and, where chat is on, posts a notice in the meeting chat); using a calendar event's invitee list to set who can open its notes, to tell invitees when the notes are ready and to help name the speakers; securing the service, preventing abuse, and improving reliability using aggregate, non-content metrics.

Legal obligation

Keeping invoices and the accounting and tax records of payments for as long as Georgian law requires.

5. Where your data lives

Our servers and database run in the European Union (Frankfurt). Data is encrypted in transit (TLS) and at rest. Meeting audio, the participant list and the screenshots our bot vendor takes during the call are kept in our own storage in the European Union (Cloudflare R2) and deleted automatically within 48 hours of upload. Our speech service fetches the audio to our server in the EU, sends it to Google for transcription (see below) and deletes its copy as soon as the notes are delivered; after that we keep only the text of the notes. We keep a recording longer only with the written consent of the customer whose meeting it is (for example, to investigate a problem with its notes or to evaluate our speech service), and only for the agreed period.

Some of the providers listed below are based in the United States or may process data outside Georgia and the European Union, including in the United States, which the State Audit Office of Georgia has not listed as a country with appropriate personal data protection safeguards; data processed there may be less protected than under Georgian or EU law. They are MeetStream (the meeting bot, which handles a meeting's audio, participants' names and screenshots of the call); Google (sign-in and Calendar, and the Gemini models that transcribe meetings and write notes: we use Google's global endpoint, so a request may be processed in any country where Google Cloud operates); Microsoft (sign-in and the Outlook calendar); Vercel (web hosting: app.merme.ai's traffic passes through its network); and Resend (its records of the emails we send, such as the recipient and subject; the emails themselves are sent from the EU). We send each provider only what its service needs, always encrypted in transit. Before any text is sent to Gemini, people's names and email addresses are replaced with codes and the meeting title is left out; the audio is sent as recorded.

6. Who processes data for us

We use the following service providers (processors) to run Merme; each receives only the data its job needs:

Google

Sign-in, Calendar API, and our own company email (Google Workspace)

Microsoft

Sign-in, Outlook calendar via Microsoft Graph

MeetStream.ai

The meeting bot. MeetStream Corp. is a United States company; it joins meetings, captures their audio (the whole meeting and each participant's track), participants' names, who spoke when and periodic screenshots of the call, writes the files to our storage in the EU, and may keep its own copy for up to 24 hours.

Google Cloud (Gemini)

Transcription and notes: we process the meeting audio, and text in which names are replaced by codes, with Google's Gemini models. Requests go to Google's global endpoint and may be processed in any country where Google Cloud operates. Google does not use this data to train its models and does not keep it after processing, except requests its automated safety systems flag, which it may keep for up to 90 days.

Fly.io

Application hosting, EU (Frankfurt): our servers and our own speech and summarization service

Neon

Database, EU

Vercel

Web hosting on its global network, which also carries app.merme.ai's traffic to our servers, and anonymous, cookieless visit counts on merme.ai and meet.merme.ai. Vercel Inc. is based in the United States.

Cloudflare

DNS; storage of the meeting bot's files (audio, participant list and screenshots of the call) in the EU (R2), deleted automatically within 48 hours of upload

Resend

Transactional email, sent from the EU (Ireland); Resend keeps its records of each email, such as the recipient and subject, in the United States

Bank of Georgia

Payments by card, Google Pay or Apple Pay on its own payment page, once online payment launches

Grafana Labs

Server log storage (Grafana Cloud), EU (Germany), kept for 14 days

We do not sell personal data. Apart from the providers above, it reaches other people only in these cases, or where the law requires it: everyone on a meeting's calendar invite can open its notes; a note shared from Merme reaches the people, or the holders of the link, it is shared with; the “Notes ready” email tells invitees that the notes exist (the meeting's title and details, never the notes' content); and an action item a member sends to GitHub or Jira goes to the account that member connected (see “What we collect”).

7. Not used for training

We never use your meeting content, notes or calendar data to train AI models, and the AI service that transcribes and summarizes your meetings (Google Cloud) is contractually barred from training on them.

8. How long we keep it

Account data

While your account exists.

Calendar events

Events without a meeting link are never stored. Each event with a meeting link is kept as a meeting record (title, time, link, organizer and invitee list) for as long as the workspace exists, including meetings the bot did not join, because who can open a meeting's notes depends on it; it is deleted with the workspace. Disconnecting a calendar stops syncing but does not remove meetings already synced.

Notes

While the workspace exists; notes are deleted together with their workspace. A single note can't yet be deleted in the app: one of its owners or a workspace Admin can ask us at support@merme.ai, and we will delete it.

Meeting audio and screenshots

The audio, participant list and screenshots our bot vendor writes to our storage are deleted automatically within 48 hours of upload; MeetStream may keep its own copy for up to 24 hours, and our speech service deletes its working copy as soon as the notes are delivered.

Contact-form leads

Up to 12 months after you contact us, or sooner if you ask us to delete them.

Server logs

Up to 14 days.

You can delete your account yourself in Settings, or ask us at support@merme.ai. If you are the billing owner of a workspace you share with others, first hand that role to another Admin. Deletion takes effect immediately and cannot be undone: your profile, email address, connected calendars and apps, and sign-in sessions are erased at once, and any workspace where you are the only member is deleted with all its meetings and notes and any hours left. In a workspace you share with others, the meetings and notes stay with the workspace for your colleagues, and the notes you owned show “Deleted user” as their owner; your name and email address may remain in its records, such as a note's list of speakers, a meeting's invitee list or its invitation history. Remaining copies in backups and logs are deleted within 30 days. We keep only what the law requires us to keep, such as the accounting and tax records of payments.

9. Your rights and how to exercise them

Under the Law of Georgia on Personal Data Protection and, where it applies to you, the EU General Data Protection Regulation (GDPR), you have the right to: be told whether and how we process your data, see it and get a copy; have it corrected, updated or completed; have its processing stopped and the data deleted or destroyed; have it blocked (for example, while you contest its accuracy or while your request to delete it is being considered); receive the data you gave us in a structured, commonly used, machine-readable format (a note's owners and the workspace's Admins can download it as Markdown; we send anything else on request); object to processing based on our legitimate interest; and withdraw your consent at any time, as easily as you gave it. Merme makes no decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

To exercise any of these rights, email support@merme.ai, from your account address if you have one, so we can confirm it is you. It is free of charge. We respond within 10 working days, as the Law of Georgia requires, and decide on a request to block data within 3 working days; in exceptional cases we may extend the deadline for giving you information about your data, or a copy of it, once by up to 10 working days, and will tell you why. If you believe your rights have been breached, you can complain to the State Audit Office of Georgia, which supervises personal data protection, or go to court; where the GDPR applies, you can also complain to your local data-protection supervisory authority in the European Union.

10. Meeting participants

When the Merme bot joins a meeting, it appears in the participant list as “Merme Meet - bot” and, if the meeting's chat is on, posts a short notice in the meeting chat once it is let in, saying that Merme is recording the meeting and preparing a summary, with a link to our help page; people who join later may not see that message. The bot joins on behalf of the workspace's Hosts and Admins who are invited to the meeting and have joining switched on for it (it is on by default); any one of them can bring it, even if other Merme users in the same meeting chose not to. Each of them remains responsible for telling participants that the meeting is recorded and, where the law requires, for obtaining their consent. If you don't want to be recorded, ask them to remove the bot.

Everyone on the meeting's calendar invite can read its notes by signing in to Merme with the invited email address. Invitees who are members of the workspace, or whose address is on its company email domain, are emailed by default when the notes are ready; outside participants are emailed only if someone who manages the note sends it to them. Anyone without a Merme account can unsubscribe from these emails with one click, and we keep unsubscribed addresses only so that we don't write to them again. You don't need a Merme account to use the rights listed under “Your rights”: write to support@merme.ai with the meeting's date and title, and within the same deadlines and free of charge we will tell you what we hold about you, remove your name from the meeting's notes, or delete or block your data, working with the workspace that owns the notes where needed.

11. Cookies

Merme uses only the cookies the service needs to work: a session cookie that keeps you signed in to app.merme.ai (the session ends when you sign out or after 14 days without activity), a security cookie that protects your actions and forms against cross-site request forgery, and a cookie that remembers the language you chose. A few interface choices, such as which onboarding tips you have already seen, are kept in your browser's own storage. We use no advertising, analytics or cross-site tracking cookies; the visit counts on merme.ai and meet.merme.ai are cookieless.

12. Changes

We update this policy when the service changes and show the date of the current version at the top. Material changes are announced in the app or by email at least 14 days before they take effect.