Privacy Policy

01.Recording and consent

In the extension and in the web app, X-Scribe records only after you explicitly press Start. While it is recording it shows a recording indicator the whole time: a red REC badge on the extension icon and on the page.

Recording stops when you press Stop, close the tab, leave the call, or stop sharing the tab.

You are responsible for telling the other meeting participants that the meeting is being recorded, and for getting any consent that the laws that apply to you require. This applies equally to calls the notetaker joins through auto-join.

02.What we collect

Before you press Start. On the meeting sites listed below, the extension only checks whether you are in a call. No audio, page content, participant names or browsing data leaves your browser. If you are signed in, the extension fetches your own meeting list from X-Scribe to know whether notes are already being taken for that call.

While the extension records. The meeting tab's audio and your microphone audio are uploaded to X-Scribe in short pieces. From the meeting page it also sends participant names and the times the page shows each person speaking. It looks at live captions only to see who is talking; the caption text itself is not sent or stored.

While the web app records. In Chrome or Edge you can share the meeting tab with its sound, plus your microphone. In other browsers only your microphone is recorded.

From that, and from using your account, we hold:

• Recordings: the audio of the meetings you record.
• Transcripts, notes and cues: what our AI processing produces from the audio.
• Speaker names and voice samples: participant names, speaker labels, and short voice samples of a few seconds per speaker so the same person keeps the same label.
• Meeting details you add: the title, meeting link, time, context and meeting type, and any reference documents you upload to a meeting.
• Interview details: for an interview, the candidate's name and email address, the role, the interviewers' email addresses, the resume you upload, and the prepared and follow-up questions and the assessment the AI writes. You decide what to enter and are responsible for having the right to share it with us. We never email the candidate.
• Search index: to let you ask questions across your meetings, we keep a search index made from your transcripts and notes.
• Translations: when notes are translated, the translated copy is kept with the meeting so it does not have to be made again.
• Share links: the links you create and what each one shows (see "Share links" below), and a record of who opened them.
• Account details: your name, email address, your workspace, your password (stored hashed), and your Google account ID if you sign in with Google.
• Billing details: your plan and payment history; for invoices, the payer's name, billing email addresses, billing address and GST number where given; for offline payments, the proof files you upload and the UTR or payment reference; coupon codes you redeem. If you ask for a company workspace, the company name, contact name and phone, country and team size you give us.
• Usage: the date and recorded minutes of each meeting, so plan allowances can be counted.
• Request logs: described in "How long we keep it" below.

03.Chrome extension permissions

The X-Scribe Chrome extension asks for these permissions, each for one purpose:

• tabCapture: Records the audio of the meeting tab, only after you press Start.
• offscreen: A hidden extension page does the actual recording and uploading, because Chrome's background worker cannot record audio.
• storage: Keeps your sign-in key, your settings and the state of a recording in progress, on your own device.
• activeTab: Lets you start recording the tab you are looking at when you click the X-Scribe icon.
• alarms: A timer that asks for suggested questions every few minutes during a live recording.
• scripting: When a recording starts, adds a small script to the meeting tab that reads participant names and who the meeting page shows as speaking.
• Site access to meet.google.com, zoom.us, teams.microsoft.com, teams.live.com and webex.com: To notice when you are in a call so the extension can offer to take notes, and (only while recording) to read participant names and who is speaking.
• Access to the X-Scribe server: Requested separately when you sign in, so the extension can talk to X-Scribe.
• Microphone: Asked once through a X-Scribe page. The extension stops the microphone again immediately after you allow it, and only uses it while recording.

04.How we use it

We use your data only to run the service for you:

• Transcribing your meetings, writing notes, suggesting questions, translating notes and answering questions you ask about your meetings.
• Booking the notetaker into the calls you or your calendar rules choose.
• Counting recorded minutes against your plan and billing you.
• Sending email: sign-in and confirmation codes and password resets; account notices (such as a partner app connecting to your account); notetaker booking, change and cancellation notices with a calendar invitation (not for calls booked by calendar auto-join, which are already on your calendar); for interviews, the prepared questions, follow-up questions and the interview summary to the person who booked it and the interviewers they named; invoices, payment reminders and payment confirmations; and notices when a plan or a free plan from a coupon is about to end or has ended.
• Keeping the service secure and answering support requests.

X-Scribe does not use your recordings, transcripts or notes to train AI models, and does not sell your data.

05.What we send to Google Gemini

X-Scribe uses Google's Gemini API to transcribe the meeting, write notes, suggest questions, translate notes and answer questions you ask about your meetings. For those purposes only, it sends:

• recorded meeting audio (short pieces during a live recording, or the whole recording at the end);
• short voice samples of a few seconds per speaker, so the same person keeps the same label;
• transcript text;
• participant names and speaker labels;
• any context or meeting type you entered for the meeting, and the text of reference documents you upload to it;
• for interviews, the role, the resume and the interview details you entered, to prepare questions and write the assessment;
• notes you ask to have translated;
• questions you ask, with the parts of your transcripts and notes that answer them, and the text used to build your search index.

Translation of notes is done by Gemini. A viewer of a share link may instead use their own browser's translation, which happens on their device under their browser's terms, not ours.

X-Scribe does not send your browsing history, your other tabs or other websites' content to Gemini.

When a whole recording is uploaded to Gemini's file service, X-Scribe deletes that upload as soon as the transcription is done (Google would otherwise delete it after 48 hours).

X-Scribe uses Google's paid Gemini API, under whose terms Google does not use the content to train its models. A workspace can choose to use its own Gemini API key; Google's terms for that key then apply.

06.Your Google account and Google Calendar

You can sign in with Google, and you can choose to connect your Google Calendar so the X-Scribe notetaker can join your meetings. Both are optional.

• Sign in with Google reads your name, email address and Google account ID (the openid, email and profile scopes). We use them only to create and sign in to your account.
• Google Calendar (only if you connect it) reads the events of your primary calendar for the next 24 hours, read-only (the calendar.events.readonly scope). From each event it reads the start and end time and time zone, the title, the meeting link (from the event's video call details, location or description), the organiser's email address, your own reply to the invitation, whether the event repeats, and the guests' email addresses, which are used only to tell whether someone from outside your email domain is invited and are not stored. We use this only to book the notetaker into the calls your auto-join rule chooses, and to follow a call that moves or is cancelled. Google also notifies us when your calendar changes, so a new call is booked quickly. With this read-only access, X-Scribe never creates, changes or deletes anything in your calendar.
• Adding the notetaker as a guest (optional, only if you press "Add the notetaker as a guest"). Google then asks you to let X-Scribe edit your events (the calendar.events scope). X-Scribe uses it for one thing only: to add the notetaker's own Google account as a guest to the calls it books for you, so the notetaker can join without waiting to be admitted. It adds no other guest, changes nothing else in the event, and asks Google not to email the other guests about it. When such a booking is taken back, X-Scribe removes the notetaker from that event's guest list. Without this option the notetaker is never added to your events.
• For the calls it books, we keep the event's title, time, meeting link, organiser's email address, event ID and whether it repeats, as part of the booked meeting. We also keep the Google access to your calendar (a refresh token) encrypted in our database, your auto-join rule and the calls you skipped. We do not keep a copy of your calendar.
• We do not sell Google user data, do not use it for advertising, do not use it to train AI models, and do not share it with anyone except to run the service as described on this page.

To disconnect, open Account settings and disconnect Google Calendar: X-Scribe revokes its access with Google, deletes the stored token at once, and takes back the bookings the notetaker has not started yet. You can also remove X-Scribe at any time from your Google account (myaccount.google.com, Security, Third-party apps). Deleting your X-Scribe account removes all of this too.

X-Scribe's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

07.Share links

The owner of a finished meeting can create a link to it. Anyone who has the link can open it without signing in, and sees only the parts the owner chose: the notes, the transcript, the recording, or a mix. Search engines are asked not to index these pages.

• For an interview, the interview details, the assessment, the transcript and the recording are never on the open link. They are shown only to the owner and to people signed in with an email address the owner listed.
• The owner can set a link to stop working after 7, 15 or 30 days, and can turn a link off at any time. A link also stops working when the meeting is deleted.
• The owner can see who opened the link: a signed-in viewer's name and email address, and a viewer who is not signed in as a random name.

Whoever has the link can copy or pass on what it shows. The owner decides who gets the link and is responsible for sharing it only with people who should see the meeting.

08.Connected apps

A partner product (such as Xipp) can book the X-Scribe notetaker for you. It may create a X-Scribe account for your email address, or ask to connect to your existing account; we email you either way, and in some cases you approve the connection first. A connected partner can book the notetaker for you and read the meetings it booked, never your other meetings. You can disconnect it at any time in the web app; the account and its meetings stay yours.

09.Other services that process your data

• Amazon S3: where configured, recordings, resumes, documents and payment proofs are stored privately in Amazon S3. Otherwise they are stored privately on our own server.
• Stripe and Razorpay: card payments go through Stripe for customers outside India and Razorpay in India. Your card details go to them; X-Scribe never stores card details.
• Offline payments: you can also pay an invoice by bank transfer or UPI. You upload a proof of payment and the UTR or payment reference, which our staff check before the plan starts. Your bank or UPI app processes the payment itself.
• Our email provider: sends the emails described in "How we use it".

10.Storage and security

Transcripts, notes, cues, speaker names and voice samples are stored in our database. Recordings are stored privately: in Amazon S3, with encryption at rest and short-lived signed links, where S3 is configured; otherwise on our own server.

• All traffic uses HTTPS.
• Every request needs a signed-in session or a key, and a key only reaches its own workspace.
• Passwords and sign-in codes are stored hashed. Sign-in codes are single use and expire after 10 minutes.
• Repeated failed sign-ins are rate limited.

11.How long we keep it

• Recordings (the audio) are deleted automatically 30 days after the meeting by default. A plan, or platform staff for a workspace, can set a different period, including keeping recordings.
• Transcripts, notes, cues, speaker names, voice samples, translations, resumes and documents are kept until you delete the meeting or your account.
• A share link works until the owner turns it off, its chosen expiry passes, or the meeting is deleted.
• Invoices, payment records and payment proofs are kept as billing records, also after an account is deleted, for as long as tax and accounting rules require.
• Request logs (path, status code, IP address and account) are kept for 90 days, for security and support. Passwords, keys and codes are removed from them.

12.Deleting your data

Deleting a meeting in the web app permanently removes its transcript, notes, cues, speaker names, voice samples, resume, documents, share link and recording straight away, from our database and from storage, and removes it from your search index. This includes audio that was still uploading or being processed at the moment you deleted it. Only a minimal record (the date and the recorded minutes) is kept so the month's usage stays correct.

Deleting your account (in Account settings) stops any card subscription from renewing, cancels open invoices, disconnects your Google Calendar, and removes the account and every meeting you recorded on your own, with their recordings. Meetings recorded inside a company workspace belong to that workspace and stay with it. In a company workspace, deleting your account may need the workspace admin's approval first.

13.Your choices

You can ask to access or delete your data at any time by writing to info@xipp.ai. In the app you can:

14.Contact

For questions about your data or help with the product, email info@xipp.ai. If this policy changes, we will update the date at the top of this page.