Privacy and security

Last updated: November 5, 2026

Privacy Policy

Mesakem is a meeting and call summarization service. This Privacy Policy explains what information we collect, how we use it, and the choices users have.

Information we collect

• Account information such as name, email address, workspace and authentication state. If you sign in with Google or Microsoft, we receive your name and email address from that account.
• If you sign in with Apple, Apple sends us an Apple user ID, an email address and, on your first sign-in only, your name. If you chose to hide your email with Apple, this is a special Apple address that forwards our emails to you. We do not get your Apple password, and we do not keep any Apple access tokens.
• Meeting information such as meeting links, titles, times, organizer/requester email, processing status, recordings, transcripts, summaries, decisions and action items.
• Calendar connection details when a user connects Google Calendar or Microsoft Outlook Calendar.
• Call-recording connector settings when a user connects a supported call-recording provider, including the sign-in details for that provider account, stored encrypted.
• Personal agent data: messages sent and received in the web chat and in Telegram, tasks and reminders, and memory items the agent keeps (see "AI processing").
• Limited payment details: a Cardcom payment token (stored encrypted), the card's last four digits and expiry, and purchase dates. For tax documents: your name and, if you provide it, an ID or company number. We never store a full card number.
• If you are billed outside Israel, you pay through Creem, our merchant of record, which collects your payment details and billing address itself. We keep the billing country you confirm, send Creem your account email address to fill in its checkout, and receive from Creem only the identifiers, plan, status and dates of your subscription and payments, without card details.
• API and integration data: API key details (never the key itself), webhook URLs and delivery logs, and access tokens for services you connect, stored encrypted.
• In the desktop app: the device name, operating system and app version.
• In the phone app: the phone type (iPhone or Android) and the app version, and, if you allow notifications, the phone's notification address (push token).
• In smart dictation in the desktop app: microphone audio while you dictate and the text made from it, neither of which is stored on our servers, and a usage record for each dictation, for usage and cost tracking and to apply your plan's monthly dictation allowance.
• Messages you send in the support chat, when you open it.
• We count anonymous page views with Vercel Web Analytics, which uses no cookies and does not identify you.
• Operational logs and audit events needed for security, support, reliability and abuse prevention.

Google Calendar data

When a user connects Google Calendar, Mesakem requests read-only access to calendar events. Mesakem uses this access for two purposes only: to detect upcoming calendar events that contain meeting links such as Zoom, Microsoft Teams, or Google Meet links, so the user's visible meeting assistant can join and generate a summary; and, when the user creates an availability link, to show the people the user shares it with which of the times the user offered are free or taken (see Availability links below).

This read-only authorization goes through our meeting-bot provider, Recall.ai, which reads your upcoming events and notifies us so the assistant can join.

Mesakem does not create, edit, or delete Google Calendar events. Mesakem does not sell Google user data. Mesakem does not use Google Calendar data for advertising.

The use and transfer of raw and derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Mesakem does not transfer Google user data to third-party AI/ML services for model training purposes.

Microsoft calendar data

When a user connects Microsoft Outlook Calendar, Mesakem requests delegated read-only calendar access to detect upcoming meetings and extract supported meeting links, and, when the user creates an availability link, to show which of the offered times are free or taken.

This read-only authorization goes through our meeting-bot provider, Recall.ai, which reads your upcoming events and notifies us so the assistant can join.

Availability links

A user can mark free times on their week and create an availability link. Anyone who has the link sees only the times the user chose, each marked as free or taken, checked against all the calendars the user connected. The page never shows event titles, attendees, locations or any other event details, and shows nothing outside the chosen times. It shows the user's name and email address, so the guest can send them an invitation.

The link closes by itself after the last time it offers, and the user can cancel it at any time. When the user asks Mesakem to email the link, we send it only to the addresses the user types, with the user's email address as the reply address.

Recordings, transcripts, and summaries

Mesakem may process meeting and call audio/video to create transcripts and summaries. Summaries are sent only to verified recipient email addresses selected by the user.

Data retention and deletion

Retention: Meeting recordings, phone-call recordings, transcripts and summaries are kept until you delete them. We do not delete content automatically after a fixed period.

Deleting items: You can delete meetings and calls directly from the dashboard. A deleted item is deleted from your account immediately and drops out of search, and it cannot be restored from the account.

Deleting your account: You can request account deletion in Settings. The account is closed immediately and calendar connections are disconnected immediately. After 30 days, everything in the account is permanently deleted automatically: meetings, recordings, transcripts, summaries, tasks, calendar connections, bots, calls, share links, availability links, sign-in details and stored files, including the recordings at our recording provider. An anonymized audit record, without the email address, is kept.

Cancelling or deleting earlier: To cancel the deletion within the 30 days, or to have the account deleted earlier, write to support@mesakem.com. After deletion, you can sign up again with the same email.

Accounts in an organization: A member of an organization must leave the organization first. The sole owner of an organization cannot request account deletion.

Billing records and tax documents are kept as required by law. Deletions are subject to legal retention obligations.

Recording consent

Laws in many jurisdictions require explicit consent from participants before recording a call or meeting. The user is responsible for obtaining, documenting, and honoring participant consent in accordance with applicable law in their organization and the participants' locations.

How we use information

• To provide meeting and call summaries.
• To detect upcoming meetings from connected calendars.
• To show free and taken times on availability links that users create.
• To turn speech into text in smart dictation.
• To send summaries to verified email recipients.
• To secure accounts, prevent abuse, and maintain audit logs.
• To improve reliability and support users.

Data sharing

We share data with service providers needed to operate Mesakem, such as hosting, database, email delivery, transcription, summarization, and storage providers. Optional marketing measurement operates only according to the consent choice described above. We do not sell personal data.

For organizations that require a Data Processing Agreement (DPA) under GDPR, one is available upon request at support@mesakem.com.

Sub-processors

We use the following service providers to operate Mesakem:

The certifications above belong to our providers. Mesakem itself does not hold a SOC 2 report or an ISO 27001 certificate.

Customers billed outside Israel buy from Creem, which resells Mesakem as the merchant of record. Creem processes the payment, issues the invoice and receipt in its name, and calculates and collects the tax that applies in your country. It handles your payment details under its own privacy policy.

AI providers and model training

Mesakem does not use meeting or call content to train AI models, and our AI and transcription providers do not use the content we send them to train their models.

For AI processing we use the business APIs of Anthropic (Claude), our primary AI provider, and of OpenAI, not their consumer chat products. Under the providers' API terms, content sent through these APIs is not used to train their models. The providers may keep requests for a limited time for security and abuse prevention, under their terms.

Our meeting transcription provider, Recall.ai, states that it does not use customer data to train models. Every request we send to Deepgram, which transcribes phone calls, uploaded recordings, phone-app recordings and smart dictation, carries Deepgram's opt-out from its model improvement program.

AI processing

• Summaries, tasks and agent answers are generated by AI models from Anthropic and OpenAI. To do this, the relevant transcript, summary or message is sent to them.
• Smart search: to let you search by meaning, we use OpenAI to create numeric representations (embeddings) of summaries, transcripts and search queries. We store only the numeric representation, in our database. A deleted meeting drops out of search immediately.
• Agent memory: the agent keeps short items it has learned from your conversations with it and from meeting summaries, so it can answer better. You can see what it remembers, delete one item or everything, and turn memory off in the dashboard. This is not AI model training.

Filtering sensitive details before summarization

Before meeting or call content is sent to our AI providers to generate a summary, it passes through a filtering layer we developed in-house and adapted for Hebrew. The layer detects and removes Israeli identity numbers (validating the check digit, so that numbers which are not valid ID numbers are not removed by mistake), along with payment card numbers, security codes, passwords and API keys.

The filter has limits. It applies only to content sent to the AI providers for summaries. It does not remove the information from the transcript or recording stored with us, or from the audio our transcription providers receive. Detection is context-based: a number written in digits after a marker such as "Israeli ID" or its Hebrew abbreviation is detected, while a bare sequence of digits, a number split by spaces or dashes, or a number spoken as words is not.

AI safety monitoring

We monitor our AI components for security and reliability. This monitoring records aggregate counters only — how many events of each type occurred in each hour. It does not retain your prompts, transcripts, summaries, or message content, and it does not store user or workspace identifiers.

Services you connect

When you connect Mesakem to another service, we send that service the data needed for the action you chose, and only after you connect it:

• Jira and Trello: the task's title, description and items (including the assignee's name), and in Jira also the fields you chose to map.
• Automation platforms (such as Zapier, n8n and Make): the data your API key and webhook allow, including summaries and transcripts.
• AI assistants through the MCP connector: the meetings, summaries, transcripts and participants of the workspace you choose.
• Call-recording providers (LINK, VoIPe): we sign in to your account with the provider using the credentials you saved, to download your call recordings.
• Share links: anyone with the link sees the summary and, if your workspace allows it, the recording. Emailing the link to participants follows the setting you chose.
• Sharing with registered users: When a Mesakem user sends a meeting's public summary to an email address that belongs to a registered, verified Mesakem account, that public summary (never the sender's private summary, edits or tasks) also appears in the recipient's account until the sender stops sharing it or deletes the meeting.

Access tokens for these services and call-provider credentials are stored encrypted. Data that has reached another service is governed by that service's terms and privacy policy. You can disconnect any connection in Settings.

API keys and webhooks

• API keys are shown once, when you create them. We store only a hash of the key, so even we cannot recover it. You can revoke a key at any time, and revoking it takes effect immediately. A password reset revokes all of your keys.
• We record key use and write actions made through the API in our audit log, without storing request contents.
• Webhooks are sent only to addresses you configure, over HTTPS and to public servers only. Each message is signed, and the signing secret is stored encrypted. Messages contain identifiers, statuses and counts, and for a scheduled meeting also the meeting title. They contain no transcript or summary text, email addresses or share links.
• Settings shows a log of recent webhook deliveries, including the beginning of your server's response.
• In an organization account, organization administrators can see details of members' API keys and webhooks (never the keys themselves) and disable them.

The exact limits and periods are listed in the developer documentation.

Desktop app and AI connector

The desktop app records meetings on your computer when you start a recording. The audio goes from your computer directly to our recording provider, Recall.ai, and we receive the transcript and recording from there. The app sends us the device name, operating system, app version and recording state. Meeting windows are detected on your computer, and the window title is not sent to us.

Smart dictation lets you speak instead of typing, in any app on your computer. It is on by default in the desktop app, and you can turn it off in the dictation settings.

• Microphone: the app records only while you hold the shortcut, or from the press that starts a dictation until the press that ends it. The audio goes from your computer to our server, and from there to Deepgram for transcription. Every such request carries Deepgram's opt-out from its model improvement program.
• Text processing: we send the transcribed text to an AI model from Anthropic (Claude), or from OpenAI when Claude is not available, to turn it into written text. The text comes back to the app and is inserted where your cursor is.
• Payment card numbers: before the text is sent to the AI model, our server masks card numbers in it, in every language. A card number here is 13 to 19 digits, written as digits or spoken as words, grouped like a card, starting like a card network's number and passing the check-digit test (Luhn). Such a number is replaced with "•••• 1234": only its last 4 digits remain, and that is also how it appears in the text you get. The masking applies to the text, not to the audio Deepgram receives.
• What we don't keep: we do not store the audio or the text of a dictation: not in our database, not in our server logs and not in our file storage. The audio is held in our server's memory only while it is processed. For each dictation we keep a usage record: the length of the recording, the file size, the language, the text style, the models, the cost, the device, how many card numbers were masked and the time, without the text and without the audio. We also use the usage records to apply your plan's monthly dictation allowance.
• History on your computer: the text of your last 20 dictations is kept only on your computer, encrypted with your operating system's encryption. If the computer cannot encrypt it, the history is kept only until the app closes. You can clear the history in the dictation settings, and it is also deleted when you sign out of the app. You can also turn off "Keep recent dictation history" in the settings: the stored history is then deleted at once, and new dictations are not kept.
• Keyboard: to notice when you hold the shortcut, the app listens to the keyboard and mouse clicks, only while smart dictation is on, a hold shortcut is set and no meeting is recording. It does not save or send what you type. If you choose "None" for hold to talk, the app does not listen to the keyboard at all, and the operating system tells it only when you press the start-and-stop shortcut.
• Clipboard: to insert the text, the app copies it to the clipboard and presses paste for you. It then puts back what was on the clipboard before, unless you copied something else in the meantime. When the app cannot paste for you, the text stays on the clipboard for you to paste.
• During a meeting recording dictation is not available. If a meeting recording starts while you are dictating, the dictation is cancelled and its audio is not sent.
• Permissions: on macOS the app asks for microphone permission, and for Accessibility permission to notice a held key and paste the text for you. On Windows it uses the microphone access allowed in Windows settings.

The AI connector (MCP) lets an AI assistant you choose read the meetings of the workspace you choose. Sign-in goes through WorkOS, which receives a random identifier for each connection, your Mesakem display name if you set one, and the workspace name, but not your email address.

Organization single sign-on (SSO) is available to organizations that turn it on. When you sign in with SSO, your organization's identity provider (for example Microsoft Entra, Google Workspace or Okta) verifies you, and WorkOS passes us your work email address, your name and your identifier at the identity provider. We use them to connect you to your account and your seat in the organization. An organization that requires SSO blocks password, Google or Microsoft, and email-link sign-in on its domain. If the organization also connects its employee directory, WorkOS tells us when someone is removed or deactivated there, and their seat in the organization is closed.

Phone app

The Mesakem phone app (iPhone and Android) records meetings on your phone only after you tap Record, until you finish. Recording continues with the screen locked. On Android, a persistent notification with a timer, Pause and Finish is shown while recording. You sign in to the app in your phone's browser, with the same sign-in options as the website.

• The recording: is kept in the app's private storage on the phone and is not included in the phone's backup. It uploads in parts to our file storage (Cloudflare R2) during and after the recording. Once our server confirms it has the whole recording, the file is deleted from the phone. Without a connection, the file stays on the phone until the upload finishes.
• Live transcript: while the app is open on screen, the audio goes from the phone directly to Deepgram for a live transcript, using a short-lived permission our server issues. When the screen locks or you switch to another app, the live transcript stops and the recording itself continues. Every such request carries Deepgram's opt-out from its model improvement program. The live transcript lines are saved in the meeting's Notepad.
• Transcript and summary: are made from the whole recording, the same way as a recording uploaded from the dashboard, and are kept until you delete them.
• "Summary ready" notification (iPhone): if you allow notifications, the app sends us the phone's notification address (push token), with the phone type and the app version. We use it only to tell you that the transcript and summary of a phone recording are ready. The notification shows the meeting's title, not its content, and is sent through Apple's notification service.
• The dashboard in the app: the app can show the Mesakem dashboard. It is the same dashboard, with the same data and the same account, as on the website.
• What else the app sends us: the phone type (iPhone or Android), the app version and the recording and upload status. It does not send us your phone's name. The app's sign-in credential is kept in the phone's secure storage: the Keychain on iPhone, and encrypted with an Android Keystore key on Android.
• Permissions: the microphone, to record. On Android also notifications, to show the recording notification. On iPhone also notifications, only if you allow them, to tell you a summary is ready; the camera, only when you choose to take a photo or video to upload in the dashboard; and saving to Photos, only when you choose to save a file you downloaded from the dashboard.

Data location and international transfers

Rather than make one sweeping statement, we set out where each component runs:

• Database (accounts, meeting details, transcripts, summaries and agent memory) — Neon, Frankfurt, Germany (eu-central-1).
• Application and API servers — Vercel, Frankfurt, with a global edge network that delivers pages to your browser.
• Background processing servers — Render, Frankfurt.
• Meeting bot and meeting transcription — Recall.ai's European Union region (eu-central-1). According to Recall, transcription in this region is processed in the EU (Dublin, Ireland); the provider's primary processing operations are in the United States.
• Recording files — Cloudflare R2, encrypted. Storage is not restricted to a single jurisdiction, so its physical location is not guaranteed to be the European Union.
• AI processing (summaries, agent answers, search and smart dictation) — Anthropic and OpenAI, in the United States.
• Phone-call, uploaded-recording, phone-app recording (including the live transcript) and smart-dictation transcription — Deepgram, via its global endpoint.
• Notifications to the phone app on iPhone — Apple Push Notification service.
• Email delivery — Resend, which stores data in the United States.

Israel is recognized by the European Union as providing an adequate level of protection for personal data, so transfers between Israel and the EU need no additional mechanism. For transfers to the United States we rely on our providers' data processing agreements, which include Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as applicable.

Security

We implement the following measures, and describe them specifically so that they can be examined:

• Encryption in transit: All communication uses HTTPS, and the site requires HTTPS in every browser (HSTS). The database connection fully verifies the server certificate and hostname.
• Protection against embedding: Other sites cannot display Mesakem inside a frame.
• Encryption of secrets: Calendar tokens, call-provider credentials, tokens for connected services, webhook signing secrets and the Cardcom payment token are stored with authenticated AES-256-GCM encryption.
• API keys: Stored only as a hash and shown once.
• Passwords: Stored as scrypt hashes with a unique random salt, and compared in constant time.
• Workspace separation: Every request re-checks active workspace membership. Suspending a member takes effect on their next request.
• Rate limiting: Sign-in attempts are rate-limited per account and per IP address.
• Inbound request authentication: Incoming calls from providers (webhooks) are verified by signature or shared secret before their contents are processed.
• Outgoing webhooks: Signed, and sent only to public servers over HTTPS.
• Access to recordings: Recordings are stored encrypted in Cloudflare R2, in a private bucket. Access is possible only through a short-lived signed link, issued after a server-side authorization check.
• Read-only calendar access: We request only calendar.events.readonly from Google and only Calendars.Read from Microsoft.
• Verified recipients only: Summary delivery is restricted to addresses verified in your workspace.
• Data minimization: The temporary audio file is deleted from our processing server after the transcript and summary have been produced.
• Audit logs: Actions on user data are recorded — who performed them, on which record and with what outcome, including blocked and failed attempts.
• Access controls: Staff access to data is limited to what is required, under confidentiality obligations.

Do not share passwords, API keys or other secrets via chat, email or any unencrypted channel.

User choices

• Users can disconnect calendar connections from the dashboard.
• Users can choose verified summary recipient email addresses.
• Users can stop product-update emails with the link in each such email or in Settings, while essential account emails, such as meeting summaries and security, continue.
• Users can request deletion or support by contacting us.

Your rights

If you are located in the European Union, Israel, or other jurisdictions with similar privacy laws, you have the following rights:

• Access: Receive a copy of the data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data.
• Data portability: Receive your data in a structured, machine-readable format.
• Objection: Object to certain processing of your data.
• Withdraw consent: Withdraw consent at any time.

To exercise your rights, contact support@mesakem.com.

Contact

For privacy questions or deletion requests, contact: support@mesakem.com

Mesakem and the domain mesakem.com are operated by Januar Technologies Ltd (JANUAR TECHNOLOGIES LTD), company number 516721248, registered in Israel at HaLivne 5, Rishon LeZion 7555609, Israel. Contact: admin@mesakem.com · support@mesakem.com. Published as required under the Israeli Protection of Privacy Law 5741-1981.