Privacy Policy — Vertex Meet
Last updated: September 20, 2026
Summary
Vertex Meet is a meeting recording and minutes generation app designed around privacy-first principles. Your recordings, photos and finished minutes stay on your device. For AI processing, audio and text go to OpenAI: on the Free and Pro plans directly from your phone with your own key, on the Cloud plans through our server, which does not store them.
Data collection
Data kept on your device (locally)
| Data | How it’s collected | Where it’s stored |
|---|---|---|
| Audio recording (WAV) | Microphone, with your consent | Phone Documents directory |
| Transcription | Returned by OpenAI API | SwiftData SQLite database |
| Meeting minutes | Generated by OpenAI API | SwiftData |
| Meeting photos (JPEG) and their AI descriptions — Cloud Plus, optional | Camera, only when you tap the camera button during a recording | Phone Documents directory; description in SwiftData |
| Calendar events (read only) | iOS EventKit (with your consent) | Not stored in app |
| Participants, action items | Computed by the app | SwiftData |
| OpenAI API key | Your input | iOS Keychain (encrypted) |
| Settings | Your choices | UserDefaults |
Data that leaves your phone
1. OpenAI API (Free and Pro plans, with your own account)
When you use the Free or Pro plan with your own OpenAI API key: - Audio (WAV file) is sent to OpenAI Whisper API for transcription - Transcript text is sent to OpenAI GPT API for minutes generation - These calls go directly from your phone to OpenAI — no Vertex Meet server is used - OpenAI’s privacy policy: openai.com/policies/privacy-policy
2. Vertex Meet Cloud (when on the Cloud plan)
If you use the Cloud plan, we route audio and text through our backend to OpenAI. However: - We do not store your audio or text after request completion - We do not use your content for commercial purposes - We only track usage volume (minutes) for billing
2a. Meeting photos (Cloud Plus, optional)
In real-time mode you can photograph a slide, a table on the screen or a whiteboard while recording. The photo is stored only on your device next to the audio. To describe what is on it, the photo is sent once to the OpenAI vision model (directly from your phone with your own key, or through our backend on Cloud plans) and the returned text description is stored on your device. We do not store the photo on our servers, and OpenAI’s API terms state that API content is not used to train their models. You can edit or delete any photo and its description in the meeting’s Photos tab; deleting the meeting deletes its photos. Each photo counts as one minute of Cloud usage.
3. App Store Connect (Apple)
Apple tracks purchases, subscriptions, and anonymized crashes. This is Apple’s policy, not ours. See Apple’s privacy policy for details.
4. Feedback to developer
When you choose “Suggest an app improvement” and tap Send: your text, your email address (if you entered one), the app version, the iOS version and the device model are sent to our server and stored in our database (Cloudflare D1, EU) so that we can review the suggestion and reply. A hashed form of your IP address is used briefly to limit abuse and is not stored with the ticket. We use this data only to improve the app and delete it on request at appfix@vertex.ee.
Processors and where your data is processed
Vertex Meet uses a small number of service providers. None of them receives your data for their own purposes. With your own OpenAI key (Free and Pro), requests go directly from your phone to OpenAI under your own OpenAI account and settings.
| Provider | What it processes | Where | How long | Basis |
|---|---|---|---|---|
| OpenAI (OpenAI Ireland Ltd) | Audio for transcription; transcript text for the minutes; meeting photos for their description (Cloud Plus). With Sensitive meeting on, names, national ID numbers, phone numbers, email addresses and bank account numbers in the text are replaced on your device before sending. | OpenAI servers (United States) under EU standard contractual clauses | Audio sent for transcription is not retained (OpenAI documentation). Text may be kept by OpenAI for up to 30 days for abuse monitoring, then deleted. API request logging is disabled on our account. | OpenAI Data Processing Addendum |
| Cloudflare | Cloud and Cloud Plus plans: the request passes through our server on its way to OpenAI; the server does not store audio, text or photos. Our database holds usage counters, subscription status and the feedback you send us. | Cloudflare network; database in the EU (Eastern Europe region) | Content is not stored. Usage records for billing; technical audit entries 90 days. | Cloudflare Customer Data Processing Addendum |
| Apple | App Store purchases and subscriptions; iCloud sync of meetings, transcripts, minutes and tasks into your own iCloud private database (audio and photos stay on the device). | Apple, under your iCloud account | As long as you keep the data in iCloud | Apple terms and privacy policy |
| Google and Microsoft (optional calendar connection) | Calendar events are read on your device only. Titles and attendee names taken from the calendar are not sent to OpenAI or to our server. | On your device | Until you disconnect the calendar | Your consent; Google API Services User Data Policy; Microsoft terms |
Status on 20 September 2026:
- OpenAI zero data retention (no 30-day text retention): requested on 17 September 2026, pending OpenAI approval.
- Processing in the EU for EU users (OpenAI EU data residency): planned, pending.
We will update this section as soon as either status changes.
Calendar access
If you grant calendar access, Vertex Meet reads your upcoming meetings to pre-fill protocol data (title, attendees, time). Calendar data: - Stays only on your device - Is added to meetings only when you record one - Is never stored on our server
You can revoke calendar access anytime in iOS Settings.
Google user data (Google Calendar connection)
Connecting a Google account is optional. If you connect one, Vertex Meet accesses Google Calendar data through the Google Calendar API. This section describes exactly what we access, how it is used, with whom it is shared, and how it is protected.
Scopes we request and why
| OAuth scope | API call | Why it is required |
|---|---|---|
calendar.calendarlist.readonly |
GET /calendar/v3/users/me/calendarList |
To show the list of your calendars so you can choose which one Vertex Meet reads meetings from. |
calendar.events.readonly |
GET /calendar/v3/calendars/{id}/events |
To read upcoming events and pre-fill the meeting title, time and participant list of the minutes, so the user does not have to type them manually. |
openid |
— | To identify the signed-in account. |
These are the narrowest scopes that support the feature. We do not request write access, and we do not request access to calendar settings, sharing permissions (ACLs) or calendar properties. Vertex Meet can only read; it can never create, modify or delete anything in your Google Calendar.
What data we read
- Calendar list: calendar name, calendar ID, primary/selected flags
- Event: title, start and end time, location, description, organizer name and email, attendee names and email addresses
With whom we share, transfer or disclose Google user data
We do not share, sell, transfer or disclose Google user data to any third party. Specifically:
- Google Calendar data is fetched directly from Google to your device and is stored only on your device. It is never uploaded to Vertex Meet servers.
- Google Calendar data is never sent to OpenAI or to any other AI/ML provider, and is never used to train, fine-tune or improve any AI/ML model — ours or anyone else's.
- We do not sell, rent or transfer Google user data to advertisers, data brokers, analytics providers or any other party, and we do not use it for advertising or profiling.
- No Vertex Meet employee, contractor or subprocessor reads your Google Calendar data. We have no technical means to access it, because we never receive a copy.
- The only way Google Calendar data leaves your device is if you deliberately export or share a meeting protocol that contains participant names taken from the event (PDF, DOCX, e-mail, etc.). In that case it goes only to the recipient you choose.
- We would disclose data only if legally compelled by a valid order of an Estonian or EU authority — and since we hold no copy of your Google data, there is nothing for us to hand over.
How Google user data is protected
- In transit: all requests to Google APIs use HTTPS with TLS 1.2 or higher, enforced by iOS App Transport Security. Certificate validation is handled by the operating system.
- At rest: calendar-derived content stored on the device (meeting title, participants) is written to the app's SwiftData store inside the app sandbox and is encrypted at rest by iOS Data Protection (AES-256, tied to the device passcode/Secure Enclave).
- Credentials: OAuth access and refresh tokens are stored in the iOS Keychain, never in plain files, never in backups readable by other apps, and never transmitted to us. Sign-in uses the OAuth 2.0 authorization-code flow with PKCE, so no client secret is embedded in the app.
- Minimisation: we request the narrowest scopes (read-only, listed above), request events only from the calendar you select, and only for the time window shown in the app.
- Server-side: not applicable — there is no server-side copy of Google user data to protect. The Vertex Meet Cloud backend never receives Google Calendar data.
Retention and deletion
- Fetched events are held in memory for display and are not persisted; only the fields you actually attach to a meeting (title, time, participants) are saved with that meeting.
- Deleting a meeting in the app deletes that data. Deleting all meetings, or uninstalling the app, deletes all of it.
- Disconnecting the Google account in Settings deletes the stored tokens from the Keychain immediately.
- You can revoke Vertex Meet's access at any time at myaccount.google.com/permissions.
Limited Use disclosure
Vertex Meet's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve or train generalised or non-personalised AI and/or ML models.
Microsoft user data (Outlook / Microsoft 365 calendar connection)
Connecting a Microsoft account is optional and works the same way as the Google connection described above. Vertex Meet uses the Microsoft Graph API with these delegated permissions:
Calendars.Read—GET /me/calendars(so you can choose which calendar is used) andGET /me/calendarView(to read upcoming events and pre-fill the meeting title, time and attendees). Read-only: the app can never create, modify or delete anything in your calendar.User.Read— to identify the signed-in account.offline_access— to keep the connection alive without asking you to sign in repeatedly.
We read the calendar name and ID, and per event the subject, start and end time, location, a short description preview, organizer and attendees.
Sharing, protection, retention and Limited Use: identical to the Google section above. Microsoft calendar data is fetched directly from Microsoft to your device, stored only on your device, never uploaded to Vertex Meet servers, never sent to OpenAI or any other AI/ML provider, never used to train any model, and never shared, sold or transferred to any third party. It is protected in transit by TLS 1.2+ and at rest by iOS Data Protection; OAuth tokens live in the iOS Keychain and sign-in uses the authorization-code flow with PKCE. Disconnecting the account in Settings deletes the tokens immediately; you can also revoke access at myaccount.microsoft.com.
Reminders access
When you use “Add to Reminders”, action items are added to your Apple Reminders in a list named “Vertex Meet”. The addition happens on your device, without external connections.
User rights
You always have the right to:
- View all your data in the app (recordings, transcripts, minutes are all accessible in the app)
- Delete individual meetings (swipe to delete) or all at once (Home screen ⋯ menu → “Delete all”)
- Export minutes (PDF, DOCX, text file)
- Cancel subscription through the App Store
- Get support by writing to appfix@vertex.ee
Per Apple’s policy, you can delete all app data by uninstalling the app from your phone.
Children
Vertex Meet is not intended for users under 13. We do not knowingly collect data from minors. If you are a parent and believe your child has sent us feedback, please contact appfix@vertex.ee.
Changes
We may update this privacy policy from time to time. Significant changes will be announced in the app before they take effect.
Contact
- Email: appfix@vertex.ee
- App developer: OÜ Vertex Investment, Estonia
- Applicable law: Republic of Estonia and GDPR (EU)
Under GDPR you have the right to file a complaint with the Estonian Data Protection Inspectorate: aki.ee.