Privacy Policy

Draft — last updated September 1, 2026. Not final legal advice.

This is a placeholder policy drafted to get a beta out quickly — it is not a substitute for review by a lawyer. It has not been reviewed for compliance with EU/UK GDPR, the ePrivacy Directive, or US state recording-consent and biometric-privacy laws (e.g. Illinois BIPA). Sections below flag where a defined policy (retention schedule, transfer safeguards, DPA agreements with OpenAI/Deepgram/Supabase) still needs to be filled in with counsel before wide release, especially to EU/UK users.

What Tape records

Tape records audio on the device you're using it on. Recording only happens when you press Record, and stops when you press Stop. Nothing joins your meetings as a bot or participant.

What we collect

Audio you record, and the transcript and notes Hai generates from it.
A voiceprint — a short mathematical fingerprint of your voice (not a recording) — if you enroll Voice ID, so Hai can recognize you across meetings. Under EU/UK GDPR this counts as biometric data used for unique identification, a special category of personal data.
Your name, email, and account details if you sign in.
Your email if you join the beta waitlist — used only to invite you, nothing else.
Basic usage data needed to run the service (error logs, rate-limit counters).

How we use it

To transcribe your meetings, generate summaries and action items, tell speakers apart, and answer your questions about past meetings via Hai. Audio may be sent to our transcription and AI providers (currently OpenAI and Deepgram, when configured) solely to produce your notes.

Legal basis for processing (EU/UK GDPR)

Contract — processing your recordings and generating notes is necessary to provide the service you signed up for.
Explicit consent — required, separately, before we create or store a voiceprint (special category biometric data under Article 9), before recording anyone else in a meeting, and before Hai starts learning facts about you under "Personalize Hai for you." Each of these is opt-in; none is enrolled automatically.
Legitimate interest — for basic security, fraud prevention, and keeping the service running (e.g. rate-limit counters, error logs).

Model training

Settings has a separate, off-by-default toggle called "Help improve Hai." It is off unless you turn it on yourself — it is never bundled into signing up or accepting this policy.

When it's off (the default), nothing about your meetings is used to improve Hai beyond serving your own account.

When it's on, two things are sent to help us improve Hai: each meeting's transcript text — what was said, attributed to an internal speaker id, which track it came from, and its timing — so we can review accuracy issues like a missed word or a merged speaker; and, if you rate a summary as helpful or not, that summary's text (overview, decisions, action items). This never includes raw audio, your voiceprint, or attendee names. You can turn it off at any time from Settings, which stops any further use going forward.

Personalizing Hai for you

Settings has a separate, off-by-default toggle called "Personalize Hai for you." It only ever affects your own account and is distinct from "Help improve Hai" above.

When it's on, after each meeting Hai may extract a couple of short facts about you — your role, a recurring project, someone you regularly work with — from that meeting's summary text only (never audio or the full transcript), and add them to a short list stored in your account. That list is used only to make your own future notes and Hai's answers to you more relevant. Settings shows you every fact on that list, lets you remove any one of them, or clear the whole thing. Turning the toggle off stops any further learning; it does not by itself erase facts already learned — use "Clear everything Hai has learned" for that.

Other people in your meetings

If you record a meeting with other people in it, you're responsible for telling them the meeting is being recorded — some places legally require every participant's consent, not just yours. Tape shows a reminder before you start recording. If any attendee is in the EU/UK, their voice becomes personal data the moment it's captured, so they need to know what happens to it (this policy) before the recording starts.

International data transfers

Our transcription and AI providers (OpenAI, Deepgram) and infrastructure (Supabase, our hosting) may process data outside the EU/UK, including in the United States. Where that happens, we rely on those providers' Standard Contractual Clauses (SCCs) or an equivalent safeguard recognized under GDPR — this needs to be confirmed against each provider's current data processing agreement before EU/UK users are onboarded at scale.

Storage, retention, and deletion

Your meetings are stored on your device by default. If you sign in, your data can sync to our servers so you can access it from other devices. You can delete any meeting, or your whole account, at any time from Settings. We don't currently have a fixed automatic retention period for account data after deletion — under GDPR's storage-limitation principle, this needs a defined retention schedule before wide release.

Your rights (EU/UK GDPR, and similar laws elsewhere)

Subject to applicable law, you can ask to: access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent (e.g. removing a voiceprint) at any time without affecting past processing. EU/UK users also have the right to lodge a complaint with their local data protection authority. Reach out using the contact below to exercise any of these.

Sharing

We don't sell your data. We share it only with the providers needed to run the service: our transcription/AI providers (OpenAI, Deepgram) to produce your notes, and our email provider (Resend) to send account emails (welcome, beta waitlist confirmation) and any meeting notes you choose to email yourself. Each only receives what it needs to do that job.

Contact

Questions about this policy, or to exercise a data-protection right: reach out to the email address you signed up with, or the app support contact listed in Settings.