Privacy Policy

1. Introduction

This Privacy Policy describes how Meevo (“we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you use the Meevo platform, including our website, applications, and related services (collectively, the “Services”).

The data controller responsible for your personal information is Meevo, contactable at privacy@mymeevo.ai. This Privacy Policy is incorporated into our Terms of Service.

2. Information We Collect

Information you provide

• Account information. When you create an account, we collect your name, email address, and authentication credentials.
• Content you submit. This includes messages, questions, and instructions you send through the Services; files, images, and documents you upload; audio and voice recordings; and links to external content (such as YouTube videos, Reddit posts, or web pages) that you ask us to process.
• SMS information. If you choose to use SMS, we collect the mobile number and country you provide, verification and consent records, messages you exchange with the assistant, and delivery information such as provider message identifiers, timestamps, status, sender, segment count, cost, and error codes. SMS is optional and is not required to use Meevo.
• Memories. The Services create and store memories based on your conversations and the content you provide. Memories are personal information about you that the AI uses to personalize its responses over time.
• Payment information. When paid features become available, payment is processed through Stripe. We do not store your full credit card number or payment credentials. Stripe collects and processes your payment information under its own privacy policy.
• Communications. If you contact us for support, provide feedback, or report an issue, we collect the content of those communications.

Information collected automatically

• Device and connection information. We collect your device type, operating system, browser type, IP address, and general location (derived from IP address).
• Usage information. We collect information about how you interact with the Services, including access times, pages viewed, features used, and session duration.
• Cookies and similar technologies. We use cookies and similar technologies as described in Section 10 of this policy.

Information from visitors without an account

• Waitlist. If you join our waitlist, we collect your email address and IP address. We use this information solely to manage access to the Services and to contact you when access becomes available. Waitlist data is not used for marketing or shared with third parties.

Information from third parties

• Authentication providers. If you sign in using a third-party provider (such as Google), we receive your name, email address, and profile information as authorized by you through that provider.
• Connected Google services (Gmail and Google Calendar). If you choose to connect your Google account, you authorize Meevo to access your Gmail and Google Calendar through Google’s APIs so the assistant can act on your behalf - searching and reading email; drafting, sending, and replying to messages; applying labels; creating, updating, moving, or reading calendar events; and creating and organizing calendars and sharing a calendar with the people you choose. Meevo never deletes a calendar. You control which of these capabilities are enabled, both on Google’s own consent screen and from the connected-apps settings within Meevo, and you can disconnect at any time. Apart from the initial setup analysis described below, we access this data to perform your requests, scheduled tasks, and email rules, and Meevo does not store the bodies of your emails. When the assistant cites an email or shows you a calendar view, the details needed to display that answer - a subject line, sender, date, short preview, or event details - are kept as part of your chat history, so the conversation still makes sense when you scroll back. When the assistant takes an action in a connected app on your behalf - drafting or sending an email, creating or editing a document or spreadsheet, moving a file, changing a calendar event, sharing a calendar - we record that action in your activity log so you can see what it did. That record names the item involved (an email subject and its recipients, a document or event title, a calendar and who it was shared with) and is kept for the life of your account. We also retain per-user derived information (such as contacts and facts about the people you correspond with) to personalize your experience. When you ask the assistant to clean up your inbox, it can archive email, mark it read, report spam, and unsubscribe you from mailing lists on your behalf. By default, archiving, reporting spam, and unsubscribing wait for you to approve the plan it shows you; marking as read, and any of these you have set to run automatically, can happen without that step. While it works, it keeps what it found about each sender (addresses, message counts, list identifiers, whether you have replied, and unsubscribe links, never subjects or message text) for 7 days, after which only the totals remain. The results, the plan, and the report of what it did stay in your chat history (including sender addresses and any unsubscribe links you need to open yourself) until you delete them, and a recurring cleanup you set up keeps the senders you approved for as long as it exists. All of it stays private to your account. By default, actions that move email to Trash, delete a calendar event, share a calendar, or remove a calendar from your list ask for your explicit, per-action approval before they are taken. You control this: each capability can be set to ask every time, run automatically, or be turned off entirely, from the connected-apps settings within Meevo.
• Connected Google Docs and Google Sheets. If you enable Docs or Sheets access, you authorize Meevo to read, edit, and create Google Docs or Google Sheets on your behalf. These capabilities are off by default, and Docs and Sheets are each enabled separately from the Apps page; you can disable either or disconnect at any time. Edits and creations are made as you and appear in the document’s Google revision history; by default, edits to an existing document ask for your explicit, per-action approval before they are made. You control this from the same connected-apps settings, including allowing edits to run automatically. When you ask us to track a specific document in your Knowledge Base, we do not store its full text - Google remains the source of truth - but we do store derived information to make it findable and useful: a summary, a searchable index of its content (for Docs), and per-user facts and entities we extract from it. We create this derived data only for documents your own Google account has verified access to, and we keep it current using access you actively exercise (opening or searching the document), not background polling. This derived-data retention is permitted for Docs and Sheets under Google’s Limited Use policy because it powers user-facing features you request; it is never used for advertising or to train AI models (see below).
• Connected Google Drive. If you connect Google Drive, you authorize Meevo to search and read the files your own Google account can open, and to save, move, rename, share, comment on, and move files to Trash on your behalf. Meevo has no way to permanently delete a file. You can narrow what the assistant may touch to folders you choose, from the connected-apps settings within Meevo or from a request the assistant makes in chat; that limit is enforced by Meevo, not by Google, and outside the chosen folders the assistant only opens a file whose link you paste yourself. Apart from the initial setup analysis described below, we read Drive content to answer your requests and run your scheduled tasks, then discard it; Meevo does not keep a copy or an index of your Drive. When you ask the assistant to add a Drive file to your Knowledge Base, that file is stored and processed like a file you uploaded, and the action is recorded in your activity log with the file’s name. By default, moving a file to Trash and sharing a file ask for your approval first; each action can be set to ask every time, run automatically, or be turned off entirely, from the connected-apps settings. Drive data is Google user data and is handled under the Limited Use policy described below.

Initial setup using your Google data

After you sign up and grant access, Meevo runs an initial analysis of your recent sent and received email, calendar events, and recently edited Drive files, including sharing details and the content of selected documents. It uses the Google services you authorized to learn who you work with and what you are working on, personalize your assistant, and suggest tasks. Email bodies and document text are processed without Meevo saving them as a mailbox or document archive. Derived contacts and facts stay in your private account, where you can review and edit them; setup working data is cleared when setup ends. This analysis does not add Drive files to your Knowledge Base. You can manage Google access from the Apps page or disconnect at any time.

Limited use of Google user data

Meevo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not use it to develop, improve, or train generalized artificial intelligence or machine learning models. Any processing of Google user data by third-party AI providers occurs solely to deliver the features you request, and those providers are not permitted to train on that data, under their business terms or because we have opted out; and human access is limited to the narrow cases permitted by that policy (for example, with your consent, for security, or to comply with law).

Connected Slack

If you connect Slack, you authorize Meevo to read Slack on your behalf, using your own Slack account’s access. Meevo can never reach anything Slack would not show you: every read is made with your user token, and Slack itself decides what that token may see.

When you ask the assistant something that needs Slack, or a task you scheduled runs, it may read: messages and threads in conversations your account can see, including public channels you have not joined; the list of conversations available to you, including each channel’s member-written purpose; your workspace’s member directory, including colleagues’ names, handles, and email addresses; and search results, which can include the contents of files and canvases your account can open.

Reads happen only in answer to something you asked, or to a task you scheduled. Meevo does not subscribe to message events in your channels and does not poll them. The only Slack messages pushed to us are the ones you send to the assistant in your direct message with it, which is itself the request; the other events we receive from Slack (app opened, app uninstalled, token revoked) carry no content. Nothing is copied when you connect.

The only file ever downloaded is one you uploaded yourself and handed to the assistant in your own direct message with it, which is then processed like any other file you upload to Meevo. A file someone else posted is never downloaded, even if it is forwarded into that direct message. When you connect, we also store your Slack user ID, display name, and the access tokens Slack issues, so that Meevo can read as you and reply in your direct message.

Where this section or Section 6 says content is not stored or is discarded, that describes Meevo’s own systems. The AI providers that process a request may keep it for a limited period under their terms, as described in Section 4.

3. How We Use Your Information

We use the information we collect to:

• Provide the Services. This includes generating AI responses, creating and maintaining memories, processing content you submit (such as transcribing videos or extracting text from web pages), generating embeddings for search and retrieval, and extracting entities and relationships to personalize your experience.
• Process your content through AI providers. To generate responses, your content is sent to third-party AI model providers. See Section 4 for details.
• Ensure safety and enforce our terms. We review content and usage patterns to detect abuse, fraud, and violations of our Terms of Service.
• Improve the Services. We analyze aggregated, de-identified usage data to understand how the Services are used and to improve their quality and performance. We do not use your personal content to train or fine-tune AI foundation models.
• Communicate with you. We send service-related communications such as account verification, security alerts, and updates about the Services.
• Process payments. When paid features become available, we use billing information to process transactions and manage subscriptions.
• Comply with legal obligations. We may process your information to comply with applicable laws, regulations, or legal proceedings.

What we do not do

• We do not use your content, memories, or stored data - including any data obtained through Google APIs such as Gmail, Google Calendar, Google Drive, Google Docs, or Google Sheets - to train or fine-tune AI foundation models.
• We do not sell your personal information.
• We do not use your personal information for advertising or marketing by third parties.
• We do not build profiles of you for the purpose of selling or sharing with advertisers.
• We do not use automated decision-making that produces legal or similarly significant effects on you.

4. How We Share Your Information

We share your information only as described below. We do not sell your personal information and do not share it for advertising purposes.

AI model providers

To generate AI responses and power features such as search, transcription, voice, and image generation, your content is processed by third-party AI providers: a model-routing gateway, and language, image, embedding, vision, and speech providers (for example, OpenAI and Anthropic). The AI providers that process your content are not permitted to train their models on it, under their business terms or because we have opted out, and we configure our integrations to opt out of training where such options are available. These providers may keep inputs and outputs for a limited period under their terms, for example for abuse monitoring. However, we cannot guarantee the internal practices of third-party providers. Where the assistant acts on content from your connected Google services, that content is processed by these providers only to the extent necessary to perform the specific action you requested, consistent with the Limited Use commitments described in Section 2.

Infrastructure and service providers

We use third-party companies to host, operate, and support the Services. Each one receives only the data it needs to do its job, and many receive nothing about you at all:

• Cloud hosting and databases. Store your account and content, handle sign-in, and run the Services, including our own media processing and page rendering services, which fetch and convert the pages and files you submit.
• AI providers. The model, embedding, image, and speech providers described above.
• Web search. Receives the search terms the assistant writes, usually just the words of the query, as with any search engine. A query can include details from your request when they are what is being searched for.
• Location and weather lookups. Receive a place name, a search phrase, or coordinates (for example, the location stored in a photo’s metadata), not who is asking. Place lookups use Google Maps Platform, which acts as a separate controller under Google’s own terms.
• Public social-profile lookups. Receive the address or handle of the public profile or post being looked up, not your account details.
• Network proxies. Receive only the address of the public video being downloaded for processing.
• Code execution. Runs code the assistant writes, with the files it is given, in an isolated environment that is shut down after each run.
• Email delivery. Receives the recipient address and content of the emails we send, such as account notices and invitations you ask us to send.
• SMS. If you enable SMS, Twilio processes your mobile number, verification request, message content, and delivery data to verify your number and transmit messages.
• Message queues and caching. Hold short-lived working data, such as job references, rate-limit counters, and replies being streamed to you, most of which expires on its own.
• Logging and monitoring. Receive technical records such as request paths, internal identifiers, and error details, used to keep the Services running.

We use service providers under their business terms, which limit how they may use your data. A list of our current sub-processors is available upon request by contacting us at privacy@mymeevo.ai.

Content loaded in your browser

Some features load content directly from third parties in your browser: site icons shown next to links and sources, embedded video players, maps, and code libraries and fonts used by apps the assistant builds for you. Those parties receive your IP address, browser information, and what the page requests (such as the site whose icon is shown or the video being played), under their own privacy policies.

Legal obligations

We may disclose your information when required by law, legal process, or government request, or when we believe in good faith that disclosure is necessary to prevent fraud, address security issues, or prevent imminent harm to any person.

Business transfers

If Meevo is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

With your consent

We may share your information for other purposes with your explicit consent.

We do not sell or share mobile numbers, SMS opt-in data, or SMS consent with third parties for their own advertising or marketing.

5. Your Rights and Controls

You have control over your data. The following rights are available to you regardless of where you are located. We will not discriminate against you for exercising any of these rights.

Access

You can view, search, and browse all data the Services store on your behalf, including memories, documents, and conversation history, directly through the Services.

Correction

You can edit your memories and account information at any time. Due to the nature of AI-generated content, it may not always be possible to correct specific outputs, but you can edit or delete the memories that influence future responses.

Deletion

You can delete individual memories, documents, and conversations at any time. When you delete content:

• Your personal data associated with that content is deleted from Meevo promptly, and in any case within 30 days.
• Content derived from publicly available sources (such as YouTube videos or web pages) that you linked to may be retained in de-identified form, as the underlying content is publicly available and not unique to your account.
• Content you uploaded that is not derived from a public source will be fully deleted from Meevo.

Exclusion

For documents and other ingested sources, you can exclude specific items from being used by the AI without deleting the underlying data.

Data portability

You have the right to receive a copy of your personal data in a portable format. If self-serve export is not yet available, you may request an export by contacting us at support@mymeevo.ai.

Account deletion

You can delete your entire account at any time from Settings. Deletion takes effect immediately: you are signed out, your assistant stops acting for you (no scheduled tasks, email triggers, or messages on any channel), and anyone you shared content with loses access to it at once. Your account is then held for 30 days, during which you can restore it by signing back in and choosing Restore. Your data is intact during that hold, and you can request an export from support@mymeevo.ai until the permanent deletion begins. After 30 days, your personal data, including memories, conversations, preferences, connected apps, and uploaded content, is permanently deleted from Meevo, except for the records described below. If you would rather not wait, you can ask us at the same address to erase your account immediately; an immediate erasure cannot be undone.

When your account is deleted:

• Connected apps. We revoke the access you granted to connected apps (such as Google, Slack, and Notion) at the provider as soon as you request deletion, wherever the provider supports revocation, and we delete the stored credentials at permanent deletion. If a provider could not be reached, we tell you which grants to remove yourself. Restoring your account does not reconnect them; you reconnect each app yourself. Share invitations you sent that were never accepted are cancelled and do not come back if you restore.
• Usage records. We keep records of the assistant’s usage and its cost for accounting, tied only to a random internal identifier. They contain no content and no contact details, and we keep a record that the account was deleted and when.
• Other people. Knowledge other users built from content you shared with them, or from their own conversations with you, stays theirs, as do your name and contact details in their own contact records. Those records stop showing you as a Meevo user.
• SMS records. Records of your SMS consent and any opt-outs are retained as required by law.
• Backups. Our database backups keep a copy of deleted data for up to 7 days. If we ever restore from a backup, we follow a procedure to re-apply deletions before the service resumes.
• Diagnostic traces. Technical traces of assistant activity, which may include prompt and response content, expire within 30 days.
• Service providers. Copies that service providers received while processing your requests (for example, AI, transcription, search, and email delivery providers) are not reached by account deletion and are kept only for the period their terms allow.

If we terminate your account for reasons other than your breach of our Terms (e.g., discontinuation of the Services), we will give you 30 days to request an export before your data is deleted. If your account is terminated by us for violation of our Terms of Service, your data will be deleted without an export window. We may retain data as required by law or as necessary for ongoing legal proceedings.

SMS controls

You can disconnect SMS in settings or reply STOP to unsubscribe. Disconnecting or opting out stops Meevo from authorizing new SMS attempts, although a message already accepted by a carrier may still arrive. You can continue using Meevo without SMS. Replying START can remove a provider keyword block for a still-linked, consented number, but does not restore messages queued before the opt-out.

Objection and restriction

If you believe we are processing your data in a way that is not consistent with this Privacy Policy, you may contact us at privacy@mymeevo.ai to object or request that we restrict processing of your data.

Complaints

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with a data protection authority in your jurisdiction. For example, users in the EU/EEA may contact their local supervisory authority, users in the UK may contact the Information Commissioner’s Office (ICO), and users in Australia may contact the Office of the Australian Information Commissioner (OAIC).

To exercise any of these rights, you can use the controls available within the Services or contact us at privacy@mymeevo.ai. We will respond to requests within 30 days, or within the timeframe required by applicable law.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Services. Specific retention periods:

• Account information. Retained while your account is active and, after you request deletion, for the 30-day restorable hold described in Section 5, then deleted except for the pseudonymised usage records and legal records listed there. An immediate erasure, or a termination for breach of our Terms, skips the hold.
• Conversations. Retained until you delete them or delete your account.
• Memories. Retained until you edit, delete, or exclude them, or delete your account.
• Activity log. The record of actions the assistant took on your behalf, including in connected apps. Retained until you delete your account. Because it exists so you can audit what was done for you, individual entries cannot be edited or removed.
• Documents and sources. Your personal association with content is retained until you delete it or delete your account. De-identified data from publicly available sources may be retained indefinitely.
• Uploaded files. Retained until you delete them or delete your account, then fully deleted from Meevo on the timeline described in Section 5.
• Slack content. Messages, threads, search results, and channel listings read from a connected Slack are held by Meevo only for as long as it takes to answer the request that retrieved them, and are then discarded. We do not build a copy or a searchable index of your workspace. What persists is private to your account: facts and memories the assistant works out from what it read; its own written summary of what it found, in your chat history, which may quote a short phrase where the exact wording is the answer; what you send the assistant in your Slack direct message with it, kept as your own chat history and knowledge base; and the Slack identifiers and tokens issued when you connect. Links open the original message in Slack, under Slack’s own permissions and retention, and we store no message text behind them. Disconnecting Slack ends Slack for you in that workspace and revokes your token at Slack; your direct-message history stays until you delete it or delete your account. Nothing from Slack is used to train or fine-tune AI models, and the AI providers named in Section 4 process it under terms that prohibit training on it.
• SMS data. Your SMS conversation is retained like other conversation history until you delete it or your account. Separate transport copies of inbound message bodies are deleted seven days after receipt, and frozen outbound bodies are deleted seven days after their first terminal submission outcome. We retain limited receipt, cost, deduplication, consent, and current suppression evidence as needed to operate the service, resolve disputes, meet provider requirements, and comply with law. Our outbound requests instruct Twilio to discard message bodies, and account-level message body redaction is required before SMS is activated. Twilio may still access unredacted messaging data in production systems for up to 24 hours and retain limited-access copies for compliance purposes under its own policies.
• Usage and device data. Usage records are kept for accounting while your account exists and, after deletion, only in the pseudonymised form described in Section 5. Server logs, which can include your IP address and device information, are kept for a short period set by our hosting providers.

We may retain information for longer periods when required by law, to resolve disputes, or to enforce our agreements.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using TLS and at rest via our infrastructure providers
• Per-user data isolation at the database level, ensuring each user can only access their own data
• Authentication and access controls for all accounts
• Rate limiting to prevent abuse
• Secure integration protocols with external services, including cryptographic verification of incoming requests
• Secrets and credentials stored securely and never in source code

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify you without unreasonable delay and notify any applicable regulatory authorities in accordance with applicable law.

8. Children’s Privacy

The Services are not directed to anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal data from a user under 18, we will promptly delete that data and terminate the account. If you believe a child under 18 has provided us with personal information, please contact us at privacy@mymeevo.ai.

9. International Data Transfers

The Services are operated from and data is processed in the United States. If you are accessing the Services from outside the United States, your information will be transferred to, stored, and processed in the United States and potentially other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

Where required by applicable law, we rely on appropriate transfer mechanisms to ensure adequate protection for your data, including Standard Contractual Clauses approved by the European Commission (and equivalent clauses for the UK and Switzerland) or other legally valid mechanisms. You may request a copy of the relevant transfer safeguards by contacting us at privacy@mymeevo.ai.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Services.

Essential cookies

These are necessary for the Services to function, including authentication, session management, and security. You cannot opt out of essential cookies.

Analytics

We may use privacy-focused, cookieless analytics tools to understand how the Services are used and to improve them. When analytics are in use, they collect information about usage patterns in aggregated form without setting cookies or tracking individual users across third-party websites.

Maps and other third-party content

Maps in the Services are provided by Google Maps. The map is loaded from Google in your browser, which sends Google your IP address and map usage data under Google’s Privacy Policy. Other content your browser loads from third parties is described in Section 4.

Managing cookies

You can manage cookies through your browser settings. Disabling cookies may affect the functionality of the Services.

We do not use advertising or marketing cookies. We do not use tracking technologies to build profiles for advertising purposes. We honor Global Privacy Control (GPC) signals. Because we do not sell or share personal information for advertising or cross-context behavioral profiling, a GPC signal does not change how we process your data - we already do not engage in the practices GPC opts out of. We do not currently respond to the older Do Not Track (DNT) browser signal, as there is no industry consensus on how to interpret it.

11. Legal Bases for Processing

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following bases:

Where we rely on legitimate interest, we have assessed that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interest at any time by contacting us at privacy@mymeevo.ai.

12. Regional Supplements

The following additional disclosures apply depending on your location. These supplements are in addition to, and do not replace, the rest of this Privacy Policy.

European Economic Area and United Kingdom

If you are located in the EEA or UK, the following applies:

• The legal bases for our processing of your personal data are described in Section 11.
• You have the rights described in Section 5, including access, correction, deletion, portability, objection, and restriction.
• International data transfers are conducted using Standard Contractual Clauses or other valid mechanisms as described in Section 9.
• You have the right to lodge a complaint with your local data protection supervisory authority.
• For privacy inquiries, contact us at privacy@mymeevo.ai.

Australia

If you are located in Australia, the following applies:

• We handle your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), to the extent applicable.
• Your personal information will be disclosed to recipients located overseas, primarily in the United States, where our infrastructure and AI providers are located.
• You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you are not satisfied with our handling of your personal information.

California, United States

If you are a California resident, the following applies under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Categories of personal information collected: identifiers (name, email, IP address), internet or electronic network activity (usage data, device info), audio/visual information (voice recordings, uploaded media), and inferences drawn from the above (memories, AI-generated content).
• We do not “sell” or “share” your personal information as those terms are defined under the CCPA/CPRA.
• We do not use sensitive personal information for purposes other than providing the Services.
• You have the right to know what personal information we collect, request deletion, request correction, and opt out of the sale or sharing of personal information (though we do not sell or share it).
• We will not discriminate against you for exercising any of your privacy rights.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days’ notice via email or through the Services. If a change materially affects how we process your personal data, we will seek your explicit consent where required by applicable law. For non-material changes, the updated policy takes effect when posted. The “Last updated” date at the top of this page indicates when the policy was last revised.

Your continued use of the Services after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

14. Contact

If you have questions about this Privacy Policy, want to exercise your data rights, or have a privacy concern, contact us: