Privacy Policy — Vertex Meet

Last updated: August 12, 2026

Summary

Vertex Meet is a meeting recording and minutes generation app designed around privacy-first principles. Your audio and data stay on your device — we don’t send anything to our servers.

Data collection

Data kept on your device (locally)

Data that leaves your phone

1. OpenAI API (Free and Pro plans, with your own account)

When you use the Free or Pro plan with your own OpenAI API key: - Audio (WAV file) is sent to OpenAI Whisper API for transcription - Transcript text is sent to OpenAI GPT API for minutes generation - These calls go directly from your phone to OpenAI — no Vertex Meet server is used - OpenAI’s privacy policy: openai.com/policies/privacy-policy

2. Vertex Meet Cloud (when on the Cloud plan)

If you use the Cloud plan, we route audio and text through our backend to OpenAI. However: - We do not store your audio or text after request completion - We do not use your content for commercial purposes - We only track usage volume (minutes) for billing

3. App Store Connect (Apple)

Apple tracks purchases, subscriptions, and anonymized crashes. This is Apple’s policy, not ours. See Apple’s privacy policy for details.

4. Feedback to developer

When you choose “Suggest an app improvement” → “Send to developer via email”: - Your text, email (if provided), app version, iOS version, and device model are sent to appfix@vertex.ee - They are only sent when you tap Send in the Mail composer - We do not use this data for any purpose other than improving the app

Calendar access

If you grant calendar access, Vertex Meet reads your upcoming meetings to pre-fill protocol data (title, attendees, time). Calendar data: - Stays only on your device - Is added to meetings only when you record one - Is never stored on our server

You can revoke calendar access anytime in iOS Settings.

Google user data (Google Calendar connection)

Connecting a Google account is optional. If you connect one, Vertex Meet accesses Google Calendar data through the Google Calendar API. This section describes exactly what we access, how it is used, with whom it is shared, and how it is protected.

Scopes we request and why

These are the narrowest scopes that support the feature. We do not request write access, and we do not request access to calendar settings, sharing permissions (ACLs) or calendar properties. Vertex Meet can only read; it can never create, modify or delete anything in your Google Calendar.

What data we read

• Calendar list: calendar name, calendar ID, primary/selected flags
• Event: title, start and end time, location, description, organizer name and email, attendee names and email addresses

With whom we share, transfer or disclose Google user data

We do not share, sell, transfer or disclose Google user data to any third party. Specifically:

• Google Calendar data is fetched directly from Google to your device and is stored only on your device. It is never uploaded to Vertex Meet servers.
• Google Calendar data is never sent to OpenAI or to any other AI/ML provider, and is never used to train, fine-tune or improve any AI/ML model — ours or anyone else's.
• We do not sell, rent or transfer Google user data to advertisers, data brokers, analytics providers or any other party, and we do not use it for advertising or profiling.
• No Vertex Meet employee, contractor or subprocessor reads your Google Calendar data. We have no technical means to access it, because we never receive a copy.
• The only way Google Calendar data leaves your device is if you deliberately export or share a meeting protocol that contains participant names taken from the event (PDF, DOCX, e-mail, etc.). In that case it goes only to the recipient you choose.
• We would disclose data only if legally compelled by a valid order of an Estonian or EU authority — and since we hold no copy of your Google data, there is nothing for us to hand over.

How Google user data is protected

• In transit: all requests to Google APIs use HTTPS with TLS 1.2 or higher, enforced by iOS App Transport Security. Certificate validation is handled by the operating system.
• At rest: calendar-derived content stored on the device (meeting title, participants) is written to the app's SwiftData store inside the app sandbox and is encrypted at rest by iOS Data Protection (AES-256, tied to the device passcode/Secure Enclave).
• Credentials: OAuth access and refresh tokens are stored in the iOS Keychain, never in plain files, never in backups readable by other apps, and never transmitted to us. Sign-in uses the OAuth 2.0 authorization-code flow with PKCE, so no client secret is embedded in the app.
• Minimisation: we request the narrowest scopes (read-only, listed above), request events only from the calendar you select, and only for the time window shown in the app.
• Server-side: not applicable — there is no server-side copy of Google user data to protect. The Vertex Meet Cloud backend never receives Google Calendar data.

Retention and deletion

• Fetched events are held in memory for display and are not persisted; only the fields you actually attach to a meeting (title, time, participants) are saved with that meeting.
• Deleting a meeting in the app deletes that data. Deleting all meetings, or uninstalling the app, deletes all of it.
• Disconnecting the Google account in Settings deletes the stored tokens from the Keychain immediately.
• You can revoke Vertex Meet's access at any time at myaccount.google.com/permissions.

Limited Use disclosure

Vertex Meet's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve or train generalised or non-personalised AI and/or ML models.

Microsoft user data (Outlook / Microsoft 365 calendar connection)

Connecting a Microsoft account is optional and works the same way as the Google connection described above. Vertex Meet uses the Microsoft Graph API with these delegated permissions:

• Calendars.Read — GET /me/calendars (so you can choose which calendar is used) and GET /me/calendarView (to read upcoming events and pre-fill the meeting title, time and attendees). Read-only: the app can never create, modify or delete anything in your calendar.
• User.Read — to identify the signed-in account.
• offline_access — to keep the connection alive without asking you to sign in repeatedly.

We read the calendar name and ID, and per event the subject, start and end time, location, a short description preview, organizer and attendees.

Sharing, protection, retention and Limited Use: identical to the Google section above. Microsoft calendar data is fetched directly from Microsoft to your device, stored only on your device, never uploaded to Vertex Meet servers, never sent to OpenAI or any other AI/ML provider, never used to train any model, and never shared, sold or transferred to any third party. It is protected in transit by TLS 1.2+ and at rest by iOS Data Protection; OAuth tokens live in the iOS Keychain and sign-in uses the authorization-code flow with PKCE. Disconnecting the account in Settings deletes the tokens immediately; you can also revoke access at myaccount.microsoft.com.

Reminders access

When you use “Add to Reminders”, action items are added to your Apple Reminders in a list named “Vertex Meet”. The addition happens on your device, without external connections.

User rights

You always have the right to:

• View all your data in the app (recordings, transcripts, minutes are all accessible in the app)
• Delete individual meetings (swipe to delete) or all at once (Home screen ⋯ menu → “Delete all”)
• Export minutes (PDF, DOCX, text file)
• Cancel subscription through the App Store
• Get support by writing to appfix@vertex.ee

Per Apple’s policy, you can delete all app data by uninstalling the app from your phone.

Children

Vertex Meet is not intended for users under 13. We do not knowingly collect data from minors. If you are a parent and believe your child has sent us feedback, please contact appfix@vertex.ee.

Changes

We may update this privacy policy from time to time. Significant changes will be announced in the app before they take effect.

Contact

• Email: appfix@vertex.ee
• App developer: OÜ Vertex Investment, Estonia
• Applicable law: Republic of Estonia and GDPR (EU)

Under GDPR you have the right to file a complaint with the Estonian Data Protection Inspectorate: aki.ee.