Privacy Policy | SecureMinutes

1. Introduction

REK Apps LLC ("we", "us", "our", or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our SecureMinutes platform and services (the "Service").

We believe in strong data privacy and limit data collection to only what is necessary to provide the Service.

2. Information We Collect

2.1 Personal Information You Provide

When you create an account or use the Service, we collect:

Account Information: Name, email address, password (encrypted)
Profile Information: Organization name, preferences, settings
Payment Information: Processed by third-party payment processors (we do not store credit card numbers)
Support Communications: Messages, feedback, and support requests

2.2 Content You Upload

Audio/Video Files: Files you upload for transcription
Generated Content: Transcripts, summaries, and minutes created by the Service
File Metadata: File names, sizes, upload dates, folder structures

IMPORTANT: We do NOT use your uploaded files or transcripts to train AI models or for any purpose other than providing the Service to you.

2.3 Automatically Collected Information

Usage Data: Features used, actions taken, time spent
Device Information: Browser type, operating system, IP address
Log Data: Access times, error logs, performance metrics
Cookies: Session cookies for authentication and preferences

3. How We Use Your Information

We use your information only to:

Provide the Service

Process and transcribe your audio/video files
Generate AI summaries and minutes
Store and organize your files
Manage your account and preferences
Authenticate your access

WE DO NOT:

❌ Sell your personal information to third parties
❌ Use your content for advertising
❌ Train AI models on your data
❌ Share your content with third parties (except as required to provide the Service)

4. Third-Party Services and Data Processing

To provide the Service, we use carefully selected third-party services:

OpenAI GPT API (Smart Summaries)

What data is shared: Transcripts only (when you use smart summary features)
Purpose: Generate AI-powered meeting summaries and minutes
Privacy commitment: OpenAI does not train on customer data submitted via API

WhisperX (Transcription)

What data is shared: Audio files processed locally on our infrastructure
Purpose: Convert audio/video to text transcripts
Privacy commitment: Models run on our servers; data does not leave our control

Cloudflare R2 (File Storage)

What data is shared: Your uploaded files (encrypted at rest)
Purpose: Secure cloud storage

We carefully vet all third-party services to ensure they maintain strong privacy and security standards.

5. Data Storage and Security

5.1 Security Measures

We implement comprehensive security measures:

Encryption: Data encrypted in transit (TLS) and at rest (AES-256)
Access Controls: Role-based access restrictions; principle of least privilege
Authentication: Secure password hashing (bcrypt), JWT tokens with expiration
Infrastructure: Firewalls, intrusion detection, regular security updates
Monitoring: Automated alerts for suspicious activity
Backups: Regular encrypted backups for disaster recovery

5.2 Data Isolation

Your data is logically isolated from other users. Only you (and authorized users on your account) can access your files and transcripts.

6. Data Retention and Deletion

Active Account Data

While your account is active, we retain your files, transcripts, and account data to provide the Service.

Account Deletion

When you delete your account, we immediately and permanently delete:

All files you uploaded that are not owned by an organization
All transcripts and summaries of those files
Your profile, credentials, and account data

This deletion is immediate and irreversible.

If you belong to an organization. Recordings and transcripts that belong to an organization are retained by that organization when you leave or delete your account, and control of them passes to an organization administrator. They are the organization's records, not personal ones — a public body cannot lose its meeting minutes because a staff member closed an account. If you are the only member of your organization, nothing is retained: your account is treated as an individual one and everything is deleted.

What we keep, and why. We retain a security and audit record — including the email address associated with actions taken — for seven years. This is a tamper-evident log of authentications, permission changes, and administrative actions, kept for security investigation and records-retention obligations. It contains no file content, transcripts, or summaries. We cannot delete it on request without destroying the integrity of the record it exists to provide.

Backup Retention

Deleted data may persist in encrypted backups for up to 30 days for disaster recovery purposes only, after which it is permanently purged.

7. Your Privacy Rights

Access Your Data

You can access all your data through your account dashboard at any time.

Export Your Data

You can download your transcripts, summaries, and files at any time.

Delete Your Data

You can delete individual files, transcripts, or your entire account. Deletion is permanent.

Correct Your Data

You can update your account information and preferences through your account settings.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act including the right to know, right to delete, and right to opt-out (we do not sell personal information).

European Privacy Rights (GDPR)

If you are in the European Economic Area, you have rights under GDPR including right of access, rectification, erasure, data portability, and to object to processing.

8. Cookies and Tracking

Essential Cookies (Required)

Authentication: Keep you logged in securely
Session Management: Maintain your session state
Security: Prevent CSRF attacks and fraud

Functional Cookies (Optional)

Preferences: Remember your theme (dark/light mode), settings
Analytics: Understand how the Service is used (aggregated, anonymized)

We do not use third-party advertising cookies or tracking pixels.

9. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect information from children under 18. If we discover we have collected information from a child under 18, we will delete it immediately.

10. Data Privacy Commitment Summary

Our Core Privacy Principles:

✅ Minimal Data Collection: We collect only what's needed to provide the Service
✅ No AI Training: Your content is NEVER used to train AI models
✅ No Selling: We NEVER sell your personal information
✅ Transparent Processing: Clear disclosure of how we use your data
✅ Strong Security: Industry-standard encryption and security measures
✅ User Control: You can access, export, and delete your data anytime
✅ Immediate Deletion: Account deletion permanently removes your personal data — see Data Retention and Deletion for organization-owned content and audit records
✅ Vetted Partners: Third-party services selected for strong privacy standards

We believe your data belongs to you, and we're committed to protecting your privacy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices:

REK Apps LLC
Contact us through the support form available in your account dashboard.
Business Address: [Your Idaho Business Address]

We will respond to privacy requests within 30 days.

This Privacy Policy is effective as of the date stated above and applies to all users of the SecureMinutes Service.