Last updated: April 8, 2026
AgendaPilot never receives, stores, or saves your audio on our servers. Speech recognition is handled by your browser or device (e.g., Google's Web Speech API on Chrome). We receive only the converted text.
Meeting transcripts (text only) are stored as part of your meeting history for 90 days so you can review past meetings. You can also paste or upload transcripts from external tools. You can delete any meeting at any time.
AgendaPilot ("we", "our", or "us") is a meeting productivity application that helps you track agenda items during meetings using speech recognition. This privacy policy explains what data we collect, how we use it, and your rights.
By using AgendaPilot, you agree to the collection and use of information in accordance with this policy and our Terms of Service.
For the purposes of GDPR and other data protection laws, the data controller is:
For data protection inquiries, contact us at the email above. We will respond within 30 days.
Your browser or device (not AgendaPilot) captures and processes your audio using its built-in speech recognition (e.g., Chrome uses Google's Web Speech API). We only receive the converted text for agenda tracking. See your browser/device privacy policy for how they handle audio.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide the service | Email, agenda items, session data, transcripts | Contract performance |
| Process payments | Email (shared with Stripe) | Contract performance |
| Send login links | Contract performance | |
| AI-powered features | De-identified transcript text (Pro tier) | Consent / Contract |
| Omi wearable integration | Omi UID, webhook transcript data | Consent / Contract |
| Improve the service | Anonymized usage patterns | Legitimate interest |
We use the following third-party services to provide AgendaPilot. These are our data subprocessors:
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Stripe | Payment processing | Email, payment info | USA |
| Resend | Email delivery | Email address | USA |
| OpenRouter | AI analysis (Pro tier) | De-identified text only | USA |
| Google Web Speech API | Speech recognition (browser-side) | Audio (browser-side only) | USA |
| Replit | Application hosting and database | Account and meeting data | USA |
We use Stripe to process subscription payments. When you subscribe, Stripe receives your email address and payment information. Stripe is PCI-DSS compliant. Privacy policy: stripe.com/privacy
We use Resend to send magic link login emails. Your email address is shared with Resend for this purpose. Privacy policy: resend.com/legal/privacy-policy
AI features use multiple models via OpenRouter for meeting analysis, coaching, and Council Mode (multi-model consensus analysis). We provide HIPAA PII de-identification tools that can remove sensitive information before text is sent to AI providers. Privacy policy: openrouter.ai/privacy
Speech recognition uses your browser's built-in Web Speech API. Audio processing is handled entirely by your browser (typically Google for Chrome). AgendaPilot never receives your audio. See Google's Privacy Policy.
| Data Category | Retention Period | Purpose |
|---|---|---|
| Email address | Until account deletion | Authentication, communications |
| Display name | Until account deletion | Personalization |
| Subscription status | Until account deletion | Service access control |
| Meeting history | 90 days (auto-deleted) | Review past meetings |
| Goals, action items, memories | Until manually deleted or account deletion | Productivity tracking |
| Magic link tokens | 15 minutes | One-time authentication |
| Auth tokens | 30 days | Session authentication |
| Audio | Never stored | N/A - processed browser-side only |
| Transcript text | 90 days (with meeting history) | Review past meetings, AI analysis |
| Uploaded files | Not stored (processed in memory only) | Text extraction for transcript import |
You can manually delete any meeting from the "Meeting History" section at any time. When you delete your account, all associated data is removed immediately.
Depending on your location, you may have the following rights:
If you're a resident of California, Virginia, Colorado, Connecticut, or other states with privacy laws, you have the following rights:
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Email address, display name | Yes |
| Commercial information | Subscription history | Yes |
| Internet activity | App usage, meeting metadata | Yes |
| Geolocation | IP-based location | No |
| Biometric data | Voice recordings | No (audio is processed browser-side only, never received by AgendaPilot) |
| Sensitive personal info | Health, financial data | No |
To exercise any of these rights, email us at koalat@koalat.ai or use the "Export Data" and "Delete Account" features in the app. You may also designate an authorized agent to make requests on your behalf.
When does HIPAA de-identification apply? When you use AI analysis features, we provide PII de-identification tools that scan transcript text for sensitive information. When applied:
What we detect: Our de-identification covers 18 HIPAA Safe Harbor identifier categories including names, SSNs, dates of birth, addresses, phone numbers, emails, medical record numbers, health plan IDs, and more.
Note: While we provide tools to support HIPAA compliance for AI features, covered entities are responsible for their overall HIPAA compliance.
We implement appropriate security measures including:
AgendaPilot is not intended for users under 16 years of age. We do not knowingly collect personal information from children.
Your data may be processed in the United States where our servers and third-party providers are located.
When we transfer personal data outside the European Economic Area or United Kingdom, we rely on:
You can request a copy of the safeguards we use by contacting us at koalat@koalat.ai.
If you are in the EU/EEA and believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority (supervisory authority).
We may update this privacy policy from time to time. We will notify you of significant changes by email or through the app. The "Last updated" date at the top indicates when changes were made.
For privacy-related questions, data requests, or to exercise your rights:
We will respond to requests within 30 days.