What we do with your meeting data, and how we enforce it.

No hidden or silent recording. Capture starts only from an explicit action you take — there is no "record everything automatically" mode.

A persistent recording indicator is shown in the app window and the system tray for the whole time capture is active.

A link you share shows the meeting summary and action items only — never the transcript or the recording — unless you explicitly widen what it includes.

Marking a meeting "Sensitive" removes it, fail-closed, from AI memory, cross-meeting search, and the AI/MCP connector, and blocks new shares of it.

AI-inferred speaker names and client-name guesses are visibly labeled "AI guess" until you confirm them — never shown as fact.

Every account's data is isolated with Postgres Row-Level Security — one customer can never read another customer's meetings, transcripts, clients, or settings.

Deleting your account removes every row you own — meetings, transcripts, clients, forms, audit history — plus the recording files in storage, then your login itself.

Deleting a single meeting hides it immediately everywhere — dashboard, search, and AI memory — via soft-delete. Hard deletion of the underlying recording/transcript row is built and tested, but not yet switched on in production, so there is no automatic purge date for a soft-deleted meeting today.

Outbound webhook deliveries to your own systems (Zapier, Make, n8n, a generic endpoint) are HMAC-SHA256 signed once you set a webhook secret, with a timestamp that blocks replay.

Data is encrypted in transit (TLS) and at rest; Protokol's primary database and recording storage are hosted in the EU.