Privacy Policy & Metadata Minimisation Notice
Last updated: November 2026 · Applicable to UK, EU/EEA, and International Users
- No meeting audio: We never join or record calls.
- No transcription: We never capture spoken or chat content.
- No content analysis: Full descriptions are not stored.
- Metadata minimisation: Only recurrence & RSVP counts are stored.
- Organiser-controlled actions: Explicit user confirmation required.
- No public employee rankings: Never ranks attendees.
- No individual productivity scoring: Audits series, not people.
- No autonomous cancellation: Never deletes events on its own.
1. Google Calendar Data Access & Encryption
During your initial audit, Unmeet requests only read-only access (https://www.googleapis.com/auth/calendar.events.readonly). OAuth access and refresh tokens are encrypted at rest on the server using AES-256-GCM and are never exposed to browser storage.
2. AI Sub-processing & Data Minimisation
Calendar Debt Scores (0–100) are computed deterministically by application logic. When OpenAI is used to format natural-language recommendations, Unmeet transmits only anonymised aggregate figures (such as cadence, duration, total invitee count, and signal scores) — never attendee email addresses or personal calendar notes.
3. Disconnecting & Deleting Your Data
You may revoke Google Calendar access and permanently delete all synchronised meeting records, audit results, and account records at any time from Dashboard → Settings.
Unmeet does not claim formal GDPR certification or third-party security audit certification. Before multi-user commercial deployment in the UK, EU/EEA, or other jurisdictions, organisations and counsel must review: (a) Data Controller vs. Data Processor roles and Data Processing Agreements (DPAs), (b) Lawful basis for processing calendar metadata (e.g. Legitimate Interests Assessment vs. Consent), (c) Employee transparency notices and workplace data protection / works council requirements, and (d) Custom data retention schedules.