Last updated: 2026-10-25. This policy is a working draft written from how the product actually behaves. Have it reviewed by a lawyer before you rely on it.
ReMind turns meetings into a persistent, searchable record of decisions, commitments and open questions. This page says plainly what happens to your data. Questions: use the contact in the app footer, or the address in our security contact for security matters.
For the personal data of people who use ReMind (account holders), the operator of this ReMind instance is the controller. For the content of meetings that a customer analyses on behalf of their organisation, the customer is the controller and the operator is the processor; a data processing agreement (DPA) is available on request.
A meeting reaches us in one of these ways, and we only receive what that path carries:
We do not use your data to train models, and we do not sell it. The one caveat is the free-tier terms of the third-party model providers listed above, which we do not control.
| Data | Purpose | Retention |
|---|---|---|
| Account email, sign-in identity | Account and email delivery | Until you delete the account |
| Meetings: notes, quotes, mind map, title, date | The product | Until you delete them, or the operator's retention limit (DATA_RETENTION_DAYS) |
| Transcript and notes of a meeting (encrypted; only if "Keep transcripts and notes" is on) | Showing the exact words behind a decision or ticket | Until you delete them in Settings, or the meeting or account is deleted |
| Project memory (decisions, questions over time) | The product | Deleted with the project or account |
| Commitments, assignments, corrections | Follow-through, quality | Until deleted |
| Integration tokens (Google, Slack, Notion, GitHub, Linear) | Features you switched on | Encrypted (AES-256-GCM); removed when you disconnect or delete the account |
| API keys | Browser extension | Stored only as a hash |
| Transcript waiting for project memory (only when the AI service was at capacity) | Adding project memory a little later | Encrypted; deleted as soon as the memory is built, and in any case within 48 hours |
| Processing job records | Showing analysis progress and review | 30 days |
| Email delivery events | Prevent duplicate emails, measure delivery | 400 days |
| LLM usage records (model, token counts) | Capacity and cost | 400 days |
| Security audit log (who did what, IP address) | Security and accountability | 400 days |
Data is stored in Supabase (PostgreSQL) with row-level security so a person can only read their own rows and, in a shared workspace, what the workspace allows. Data is encrypted in transit (TLS) and at rest by the hosting providers.
Contract (providing the service you asked for), consent (integrations, recording, the weekly digest) and legitimate interests (security, preventing abuse, measuring delivery). Recording a call involves other people: tell participants and, where the law requires it, obtain their consent.
Some sub-processors are in the United States. Where personal data leaves the EEA we rely on the provider's Standard Contractual Clauses or an adequacy mechanism. The current list and locations are on the sub-processors page.
See /security. Breaches that affect personal data are notified to the authority within 72 hours and to affected people without undue delay.
We set no advertising or analytics cookies and load no third-party fonts or scripts on our own pages. The sign-in session is kept in your browser's local storage. Emails contain no tracking pixel; the button in a change email goes through a signed link that records one click event so we can tell whether the email was useful.
We will update this page and its date when behaviour changes.