Privacy Policy

We collect the following categories of information:

• Account information: Your name, email address, firm name, and password (stored as a secure hash).
• Meeting transcripts and notes: Text content you upload manually, or that is automatically retrieved when you connect a supported meeting platform — Google Meet (via real-time push notifications from the Google Workspace Events API, with transcripts processed automatically when the meeting ends), Zoom (via recording webhook), Microsoft Teams (via Microsoft Graph webhook), or Webex (via meeting transcript webhook). The full text content of these files is read and sent to our AI provider to generate summaries.
• Connected meeting platform account data: If you connect Google, Zoom, Microsoft, or Webex, we store OAuth access and refresh tokens to retrieve transcripts on your behalf. For Google, we use the Workspace Events API to receive push notifications when a meeting ends, then process the transcript automatically. If you configure cloud storage output, we also write branded PDF and DOCX files to the Google Drive folder you designate. For Zoom, Microsoft Teams, and Webex, we receive a webhook notification when a transcript becomes available and retrieve only that specific transcript — we do not browse your broader account or recordings. If you configure OneDrive as a cloud storage output destination, we write branded PDF and DOCX files to the OneDrive folder you designate.
• Calendar data (optional): If you separately connect your Google Calendar or Microsoft Calendar in Integrations, we read the start time and meeting link of your upcoming events so we can automatically schedule an AI notetaker for meetings on a platform you've opted into. This is a distinct, optional connection from the meeting-platform connections above — see Section 5.
• Payment information: Billing is handled entirely by Stripe. We do not store credit card numbers or payment details on our servers.
• Usage data: Summary count, account activity, and session information for security and product improvement purposes.

• To generate AI-powered executive summaries from your meeting transcripts and notes.
• To automatically detect and process new meeting transcripts from your connected platforms (Google Meet via Workspace Events API push notifications, Zoom, Microsoft Teams, and Webex).
• To upload branded PDF and DOCX summary files to your designated Google Drive or OneDrive folder, if you have configured cloud storage output in Integrations.
• To deliver summaries and notifications via email, including DOCX and PDF attachments.
• To process payments and manage your subscription.
• To authenticate your account and maintain security.
• To improve and maintain the platform.

When you connect your Google account, Synopsist is granted permission to access Google Meet activity and Google Drive. We limit this access as follows:

• We subscribe to the Google Workspace Events API to receive a real-time push notification when one of your Google Meet meetings ends. We do not poll or monitor your account continuously.
• Upon receiving a meeting-end notification, we retrieve only the transcript file associated with that meeting from your Google Drive.
• We read the full text content of the transcript solely to generate your executive summary.
• If you configure a Cloud Storage Output folder for Google Meet in Integrations, we write branded PDF and DOCX files to that specific folder only. We do not access any other folders.
• We do not modify, delete, move, or share any of your existing Drive files.
• Synopsist platform administrators may view transcript retrieval logs and manually trigger summary generation for specific meetings. This is done solely for support and operational purposes.
• We request only the meetings.space.readonly and drive.file scopes, plus your basic profile and email address. drive.file limits us to files you have opened with or created through Synopsist — we cannot browse or read the rest of your Drive.
• You can disconnect at any time from your Security settings or directly from your Google Account permissions page. Disconnecting deletes your stored OAuth tokens, cancels the Workspace Events subscription immediately, and revokes Synopsist's authorization with Google once no other Google connection on your account is still using it.

Synopsist does not use Google user data to train AI models, serve advertising, or share with third parties beyond what is necessary to generate your summary. Our AI provider (Anthropic) processes transcript text solely to return a summary response and does not use it to train generalized models. Synopsist's use of Google user data is limited strictly to the purposes described in this policy.

When you connect a Zoom, Microsoft Teams, or Webex account, Synopsist's access is limited as follows:

• We receive a webhook notification from the platform only when a meeting transcript becomes available.
• We retrieve only that specific transcript — we do not browse, list, or access any other meetings, recordings, files, calendar entries, or account data.
• We read the full text content of the transcript solely to generate your executive summary.
• We do not modify, delete, or share any data within your Zoom, Microsoft, or Webex account.
• You can revoke our access at any time from your Security settings page, or directly from the platform's own connected-app permissions page. Revoking access deletes your stored OAuth tokens immediately.

If you choose to connect your Google Calendar or Microsoft Calendar in Integrations, Synopsist can automatically schedule an AI notetaker to join and record a meeting on your behalf, instead of relying on your meeting platform's own cloud recording. This is a separate, optional connection — it does not happen automatically when you connect Google Meet, Zoom, Microsoft Teams, or Webex above.

• We request read-only access to calendar events only (Google's calendar.events.readonly scope, or Microsoft's Calendars.Read permission), together with your email address (userinfo.email) so we can show you which account is connected. We cannot create, edit, move, or delete any calendar event, and this narrower events-only permission means we also cannot see your list of calendars, their sharing permissions, or your calendar account settings.
• We read only the start time and meeting link (for example, a Zoom, Google Meet, Microsoft Teams, or Webex URL) of your upcoming events — not attendee lists, descriptions, attachments, or any other event content.
• To provide this feature, we share your calendar's OAuth refresh token with our notetaker infrastructure provider, Recall.ai, which watches the calendar directly and schedules the notetaker bot on our behalf. This differs from the integrations above, where Synopsist itself retrieves data via webhook — here, Recall.ai acts on the calendar using access granted specifically for this feature. See Third-Party Service Providers below.
• A notetaker is scheduled only for a meeting whose platform you have separately turned to "Notetaker" mode in Integrations. If a platform is left on its default ("Silent") setting, we still read that event's meeting link to check it, but do not schedule a bot for it.
• Disconnecting your calendar (from Integrations) deletes your stored refresh token, cancels any notetaker bots already scheduled for future meetings, tells Recall.ai to stop watching the calendar, and revokes Synopsist's authorization with Google. If you also have Google Meet/Drive connected, that connection keeps working and the authorization is revoked when you disconnect it as well.

If calling is enabled on your account, Synopsist gives you a phone number and can place and receive calls on your behalf. This section describes what that involves.

• Phone numbers we store: the Synopsist number assigned to you, which is what the people you call see, and the number of your own phone, which we ring first so you can take the call on your usual handset. Your own number is never shown to the people you call.
• Calls are recorded, and by default the other person is told: when you place a call from Synopsist, the person you are calling hears a spoken announcement that the call is being recorded, before you are connected. This is on by default and can be switched off under Calling, for agents who prefer to say it themselves. Recording laws differ by state and several require every participant to agree, so telling clients and obtaining any consent the law requires remains your responsibility either way, and entirely yours if you switch the announcement off.
• Calls placed from a CRM dialer: where your CRM places the call and rings you through your Synopsist number, that CRM controls the connection to the other person, so Synopsist cannot play its announcement to them. On those calls the obligation to tell them rests entirely with you and your CRM.
• What happens to the audio: the recording is sent to our transcription provider to produce a transcript, and then the audio recording is deleted. We do not keep call audio. The transcript, and any summary generated from it, are kept like any other meeting record and are deleted when you delete them.
• Calls that are not written up: when a call reaches an answerphone, no summary is produced, because there was no conversation. If you have switched the setting on, a single line is added to the client's record noting that a voicemail was left.
• Text messages: if you enable calling by text, messages you send to your own Synopsist number are read in order to understand which client you want to call. Messages from others to that number are passed through to you.
• Who is on the call: a summary is filed against a client identified by email address, phone number, or name. Where none of these identifies anyone, the summary is filed against no one rather than guessed at.

If you switch calling on, Synopsist may send text messages to the mobile number you enter in your own account settings. There are two kinds: a reply when you text us to place a call, and lead alerts your CRM sends to your Synopsist number, which we forward to you. We do not send marketing messages and we never text your clients.

No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Sharing with subcontractors who support the service — our messaging provider, Twilio — is limited to delivering those messages. Every other category of sharing described in this policy excludes text messaging originator opt-in data and consent; that information is never shared with any third party.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to stop receiving them, or HELP for help. You can also turn them off at any time on the Calling page.

You can connect your own Gmail, Outlook or IMAP mailbox so that summaries are sent from your address and so that email with your clients keeps their open threads up to date. This is optional and off unless you connect it.

Only messages involving someone already on your client list are read. Every other message in your mailbox is ignored: not stored, not sent to a model, not looked at. Where a message does involve a client, what Synopsist keeps is what it derived from it — the thread, its detail and when it moved — and the message body is deleted once that is done.

The connection itself is held by Unipile, who supply the sign-in and pass us the messages. We never see your mailbox password, and Synopsist never holds the permission to read your mail directly. Disconnecting the mailbox in Synopsist removes the connection at Unipile too.

Sending a summary from your own address uses the same connection. A copy appears in your Sent items, exactly as if you had sent it yourself.

We share data with the following trusted service providers solely to operate the platform:

• Anthropic: Meeting transcript text is sent to Anthropic's Claude API to generate summaries. Data is processed per Anthropic's privacy policy.
• Google: OAuth tokens are used to access your Meet Recordings folder on Google Drive, and — if you separately connect Google Calendar — your calendar event times and meeting links. Data is processed per Google's privacy policy.
• Zoom: OAuth tokens and webhook notifications are used to retrieve meeting transcripts you've authorized. Data is processed per Zoom's privacy policy.
• Microsoft: OAuth tokens and webhook notifications are used to retrieve Microsoft Teams meeting transcripts you've authorized, and — if you separately connect Microsoft Calendar — your calendar event times and meeting links. Data is processed per Microsoft's privacy policy.
• Webex (Cisco): OAuth tokens and webhook notifications are used to retrieve Webex meeting transcripts you've authorized. Data is processed per Cisco's privacy policy.
• Twilio: If calling is enabled, Twilio carries your calls and text messages and produces the recording. Data is processed per Twilio's privacy policy.
• Deepgram: Call recordings are sent to Deepgram to be transcribed, and the audio is deleted afterwards. Data is processed per Deepgram's privacy policy.
• Recall.ai: If you use the AI notetaker feature, meeting audio and video is processed by Recall.ai to produce a transcript, which we then use to generate your summary. If you connect a calendar, Recall.ai also receives your calendar's OAuth refresh token so it can watch the calendar and schedule notetaker bots on your behalf, as described in Calendar Access above. Data is processed per Recall.ai's privacy policy.
• Unipile: If you connect your own mailbox, Unipile holds the connection to it on our behalf and passes us the messages involving people on your client list. Per their published policy, Gmail content is not stored by them at all, and for Microsoft and IMAP mailboxes only metadata is stored — email bodies are not. Their infrastructure is hosted in France. They act as a processor under our instructions, and disconnecting your mailbox in Synopsist deletes the connection at Unipile as well. Data is processed per Unipile's privacy policy.
• Stripe: Handles all payment processing and subscription management.
• Resend: Delivers transactional emails (welcome emails, summary notifications, password resets).
• Neon / PostgreSQL: Secure cloud database for storing your account and summary data.
• Vercel: Cloud hosting provider for our application.

We do not sell your data to any third party.

We retain your account data and summaries for as long as your account is active. If you request account deletion, we will delete your data immediately, except where retention is required by law. OAuth tokens are deleted immediately upon disconnecting any connected meeting platform (Google, Zoom, Microsoft Teams, or Webex) or calendar (Google Calendar or Microsoft Calendar).

We use industry-standard security practices including encrypted connections (HTTPS/TLS), hashed passwords (bcrypt), and scoped OAuth access. However, no system is 100% secure — please use a strong, unique password for your account.

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Disconnect any connected meeting platform (Google, Zoom, Microsoft Teams, or Webex) or calendar (Google Calendar, Microsoft Calendar) at any time from Integrations or the Security settings page.
• Export or receive a copy of your summaries.

To exercise these rights, contact us at support@synopsist.ai.

Synopsist uses browser localStorage (not cookies) to store your authentication token. We do not use third-party tracking cookies or advertising cookies.

Synopsist is intended for professional use by advisors, accountants, insurance agents, real estate agents, marketing agencies and similar client-facing professionals. We do not knowingly collect information from individuals under the age of 18.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how your data is handled, please contact us: