Who we are and what this covers
MinitHub is a product of MAROTECH SOLUTIONS, a business registered in Malaysia (SSM 202603017053 (CT0159782-U)), Kampung Masjid Haji Kadir, 21100 Kuala Terengganu, Terengganu, Malaysia ("we", "us"). This policy covers the MinitHub app, our servers, the minit pages we host for share links, and this website.
We follow Malaysia's Personal Data Protection Act 2010. Where another country's law gives you more rights, you have those too.
What MinitHub does, and who decides
MinitHub records a meeting on your phone, or takes a recording you import. It turns the speech into text and uses AI to write a minit (meeting minutes) from it.
- You decide what is recorded, who is in the recording, and who you share the minit with. You are responsible for telling people they are being recorded and getting their consent (see "People in your meetings").
- We process the recording and what comes from it only to give you the service: the transcript, the minit, action items and reminders.
What we keep and why
Your account
- Your email address, to sign you in with a 6-digit code and to write to you about your account.
- Your name, if you give it or if Apple or Google shares it with us.
- If you sign in with Apple or Google, the account number that service gives us and the email address it shares.
- If you sign in with Apple, we keep an encrypted token from Apple so that deleting your account also disconnects MinitHub from your Apple ID.
- Your plan, and when a subscription started, renews or ends.
- Your settings, for example the minit language, your default template and the switches in Settings.
We do not use passwords. A sign-in code is stored only as a one-way hash, works for 10 minutes, and is deleted within 25 hours (we keep it a day for the daily sign-in limits).
Your recordings and what comes from them
- Audio. The recordings you make or import. Video you import never leaves your phone: the app sends only the sound.
- Transcripts. The text of what was said, split by speaker ("Speaker 1", "Speaker 2"), with times.
- Speaker names. The names you give speakers. The AI may suggest a name from what was said. It is used only if you tap to accept it.
- Minit. The minit the AI writes, your edits, and its earlier versions (the last 3 versions are kept).
- Action items. What, who and when, taken from the minit or added by you.
- Bookmarks you drop while recording.
- Questions you ask about a meeting ("Ask about this meeting") and the answers.
- Reports you send about the AI's minit or an answer ("Report this"): the reason and the note you write. They go to our support team.
- Templates you make: their name, section headings and hints.
- Your letterhead: logo, organisation name, address and phone, if you add them.
Voices are not stored as biometrics. We keep no voiceprint or voice profile. Speaker labels exist only inside one meeting.
People in your meetings
Your recordings hold the voices and words of other people. You may also type the names and email addresses of attendees and of people who own action items. We keep these in your account only, to show their names in the transcript and minit, to send them the minit by email when you ask us to, and to remind them by email before an action item is due (Pro, on unless you turn it off). Emails we send for you show your name, and replies go to you.
Sensitive data
Meetings can include health, religious, financial or other sensitive facts. We treat all meeting content as sensitive. It is encrypted on the way. Recordings and files are encrypted in storage. Transcripts, minit, names, action items, contacts and questions are encrypted again in our database; meeting titles, templates, bookmarks and your letterhead are stored without that extra encryption, so search and documents work. No staff member reads it, it is never used to train AI, and you can delete it at any time.
Usage and billing
- How many minutes of minit you use each month, so we can apply your plan's limits. Kept for 24 months as billing records, and deleted with your account.
- For each processing job: which AI service ran it, how long it took, its cost to us and any error code. This holds no meeting content. After 12 months it is no longer linked to the meeting, and when you delete your account it is no longer linked to you.
- When you agreed to our AI notice, and to which version (see "AI notice and your consent").
Your phone
- A notification token, if you allow notifications, so we can send them to your phone. The notifications MinitHub sends by itself never show a meeting name, a person's name or meeting content on the lock screen. Now and then we send a notice we write ourselves (for example about an update); it never names a person or a meeting either.
- Which notifications you have read, so the app's inbox shows what is new.
- The app's version, sent with every request, so we can tell you when an update is ready, show you the right notices and check sign-ins against bots.
- Your recordings are saved on your phone first, inside the app, and are not included in iCloud backup. The phone copy is removed the next time you open the app, 7 or more days after it uploaded and once its minit is being written or is ready. A recording that has not uploaded, or whose minit failed (so you can upload it again), stays on the phone until you delete it.
- A copy of what you last saw in the app, kept on your phone so the app opens and reads without a connection. Only you, on that phone, can see it. It is deleted when you sign out or delete the app.
The app does not ask for your location or your contacts list. It uses the microphone only while you are recording.
People who get emails from a MinitHub user
A MinitHub user can email the minit of a meeting to the people who were there, and, with owner reminders on, the people they named as owners of action items get an email from that user, through MinitHub, the day before an item is due. For each of these emails we keep:
- A record of the send (which account sent it, to which email address, and when), to deal with complaints and abuse. It is deleted after 180 days.
- For a minit email, a link to a read-only page of that minit (no recording, no transcript). We keep only a one-way code of the link, never the link itself. It works for 30 days, or until the user stops sharing the minit.
- For a reminder or a minit email, a one-way code made from the email address (never the address itself), so the "stop" link in that email works without signing in. If the link is not used, the code is deleted after 90 days. If someone uses it to stop emails, we keep the code for 2 years, so we know not to email that address again: no more reminders or minit emails about that meeting, or about any meeting when they stopped all MinitHub emails.
Keeping the service safe
When you ask for a sign-in code, Cloudflare Turnstile checks that a person, not a program, is asking. It looks at signals from your browser or phone, not at what you type.
When a sign-in fails or a request is blocked, we note the time and the internet (IP) address, to stop abuse. These notes are deleted after 90 days. An address we block for abuse stays blocked until we lift the block.
AI notice and your consent
Before your first recording leaves your phone, the app shows a notice that names the AI services below and asks you to agree. If you tap "Not now", the recording stays on your phone and nothing is sent, live or later. If we add an AI service that is not in the notice you agreed to, the app asks you again before it sends anything.
Your meetings are never used to train AI, by us or by the services below.
The AI services that process your meetings
These services process your data for us, only to give you the service, under terms that do not let them use it for their own purposes or to train AI. They are outside Malaysia. We rely on your consent in the app and on these terms when we send your data to them.
| Service | What it does | What it gets | Where | Training and keeping |
|---|---|---|---|---|
| ElevenLabs | Speech to text: turns the recording into text, with speakers and times. With Live on (Pro), it also shows the words on your phone while you record | The audio of that meeting, which it fetches by a private link that works for 15 minutes, and words to listen for (your organisation name, your template's headings and your contacts' names). With Live on, the audio also goes to it from your phone while you record, over an encrypted connection, and the words come straight back to your phone | United States | Training on our data is switched off on our account. We delete the transcript at ElevenLabs as soon as we have fetched it. The live words are a preview: we do not store them. ElevenLabs may keep its own record of the live stream under its terms, which we cannot delete for you as we do the transcript. |
| Anthropic | Writes the minit, the action items, speaker name suggestions and the meeting title, and answers "Ask about this meeting" | The transcript with the speaker and attendee names you gave, the template (its name, section headings and hints; no extra instructions), the meeting's date, time, length and bookmarks, the minit language, and your questions to Ask. Never the audio, an email address, the meeting title or your letterhead | United States | Not used for training. Anthropic deletes what we send within 30 days. |
| Google Cloud (Vertex AI) | Does the same work as Anthropic (minit, rewrites, Ask answers) with the same AI model (Claude), only when Anthropic is not available | The same as Anthropic. Never the audio, an email address, the meeting title or your letterhead | Google's global network: it may be any country where Google runs this service | Not used for training under Google Cloud's terms. |
We use no other speech-to-text service. If we add one, we name it here and in the app's AI notice before any recording is sent to it.
Other services we use
We never sell your data, and there are no adverts in MinitHub. We do not use analytics, crash reporting or tracking tools. We share data only with the services that run parts of MinitHub, each only what it needs:
| Service | What for, and what it gets |
|---|---|
| OVHcloud | Hosts our servers and database in Singapore. It stores the data but does not use it. |
| Cloudflare R2 | Stores recordings and PDF and Word files, encrypted. |
| Brevo | Delivers our emails: sign-in codes, account emails, and the minit emails and reminders you send. It gets the recipient's address and the message. |
| Google Firebase | Delivers notifications to your phone. It gets your phone's notification token and the notification's words, which never name a meeting or a person. |
| Cloudflare Turnstile | The bot check when you ask for a sign-in code. It gets signals from your browser or phone and your IP address. |
| Apple and Google sign-in | Only if you choose it. Confirms who you are. |
| The app stores and RevenueCat | If you buy a subscription, your phone's app store takes the payment and RevenueCat tells us it is active. They know your account number, never what you keep in the app. We never see your card. |
We give data to the authorities only when the law requires it.
When you share a minit
- Share link. A link to a minit page shows a read-only copy of the minit (the meeting title and date, summary, sections, action items with their owners' names, attendees and, on Pro, your letterhead: logo, organisation name, address and phone, as they are when the page is opened; on Free, a MinitHub footer with links to our website and the app stores, which carry nothing about you or the minit). It never shows the audio or the transcript. Anyone who has the link can read it, so share it with care. It stops working after 30 days, or at once when you tap "Stop sharing this link". Search engines are told not to list it.
- Email, chat, PDF and Word. What you send leaves MinitHub. Copies in other people's inboxes, chats or files are outside our control, and deleting your account does not remove them.
Who at our end can read it
No staff member reads your recordings, transcripts, minit, speaker names, attendees or contacts. Our support and admin tools do not show them. Support can see your account's name, email address and plan, the state of a job and its error code, the reason you gave if you deleted your account, the reports you send with "Report this" (the reason and your note, which go to our support email and admin console; never the minit or the answer you reported), and, to deal with abuse, whether an email address was sent mail from your account (looked up only by that exact address, and every look-up is logged).
Only the business owner can reach the servers directly, and that access is logged. If you want help with a specific minit, you can send it to us yourself.
How long it is kept
| What | How long |
|---|---|
| Your account and settings | Until you delete the account |
| Audio | Until you delete it, or the meeting, or your account. If you turn on "Delete audio after 30 days" in Settings (off unless you turn it on), each recording's audio is deleted 30 days after it was recorded. The transcript and minit stay. |
| The recording on your phone | Removed at the next app start 7 or more days after it uploaded, once its minit is being written or is ready. A failed meeting's copy stays until you delete it. |
| Transcripts, minit, speakers, attendees, action items, bookmarks | Until you delete the meeting or your account. Only the last 3 versions of a minit are kept. |
| Questions and answers from "Ask about this meeting" | 30 days |
| Reports you send with "Report this" (the reason and your note) | 1 year, or until you delete the meeting or your account |
| Share links | Stop working after 30 days (or when you stop them); the record of the link is deleted 30 days later |
| Contacts, templates and your letterhead | Until you delete them or your account |
| Sign-in codes | 25 hours at most |
| Minutes used (billing records) | 24 months, or until you delete your account |
| Processing job records (no content) | 12 months linked to the meeting, then unlinked; unlinked from you when you delete your account; the unlinked cost rows are kept without a time limit |
| Security notes | 90 days |
| Database backups | Up to 30 days, then destroyed. Deleted data leaves the backups within that time. |
| At our AI services | ElevenLabs: the transcript is deleted as soon as we fetch it; with Live on, ElevenLabs may keep its record of the live stream under its own terms. Anthropic: up to 30 days. |
- PDF and Word files you make of a minit: kept for 7 days, so the same file downloads again quickly, and deleted within 8 days. After that they are made again from your minit when you ask for them.
- Minit emails and reminder emails: the send record (with the address) 180 days; a minit page link 30 days after it is made (its record 30 days more); the one-way code behind an unused stop link 90 days; the one-way code of an address that stopped MinitHub emails 2 years.
- When you delete your account, it is deleted from our live systems at once, and your recordings and files leave our file storage within 24 hours. See Delete your account.
- Security notes: up to 90 days.
- The app stores keep their own records under their own rules.
Where it is processed
Our servers are in Singapore. The AI services, file storage and the other services above may process data in other countries, mainly in the United States. We send each only what it needs, and each is bound to protect it and use it only for us. The AI notice in the app names the AI services before any recording is sent.
Keeping it safe
- Everything between the app, our servers and the services above is encrypted (HTTPS).
- Recordings and files in storage are encrypted (AES-256).
- Transcripts, minit, names, action items, contacts and questions are encrypted again in our database, with a key kept apart from the rest of the system.
- Copies of our database kept away from the server are encrypted before they leave it.
- Links to recordings are private, signed and short-lived (10 minutes to play, 15 minutes for the speech-to-text service).
- Each account can reach only its own data.
- On your phone, recordings are protected by the phone's own encryption. You can also lock the app with Face ID, Touch ID or your passcode in Settings.
No system is perfectly secure.
If there is a data breach
We keep a written plan for data breaches. If a breach puts your personal data at risk, we notify Malaysia's Personal Data Protection Commissioner and tell you, within the times the law sets. We will say what happened, what data was involved, what we are doing about it, and what you can do.
Your rights
- Get a copy. In the app, open Account, tap your name, then Download my data: we email you a link to a file with your account, settings, meetings, transcripts, speakers, minit (as data and as a PDF), action items, contacts, templates and minutes used, plus links to download your audio that work for 7 days. The link works for a few days, and the file is deleted from our servers after 7 days at most. For anything else we hold about you, write to us.
- Correct it. Edit your minit, names, action items and contacts in the app. For anything else, write to us and say what is wrong.
- Delete it. Delete a meeting, or only its audio, in the app. Turn on "Delete audio after 30 days". Or delete your whole account in the app, or ask us to.
- Stop notifications. Turn them off in the app's Settings or in your phone's settings at any time.
- Withdraw consent. You can stop using any optional part (sign-in with Apple or Google, notifications, reminders to action owners) at any time. To withdraw your consent to the AI processing, go to Account > Settings > AI processing and tap Withdraw consent: nothing new is sent to the AI services until you agree again. To remove what was already processed, delete your meetings or your account.
We answer every request within 21 days, and keep a record of it (what was asked, when, and our answer; never a copy of your data). We may ask you to confirm it is you first. If you are not happy with our answer, you can complain to Malaysia's Personal Data Protection Commissioner.
If you were recorded by a MinitHub user, your data is in their account and they decide what happens to it. Ask them first. You can also write to us, and we will help as far as we can without opening another person's account. You can stop reminder and minit emails at any time with the link in the email.
Children
MinitHub is not meant for anyone under 18. We do not knowingly keep data about children who use the app. A user who records a meeting with people under 18 must have the consent our Terms describe.
Data Protection Officer
Our Data Protection Officer is [OWNER: name of the Data Protection Officer], at support@minithub.com. Write "Data protection" in the subject.
Changes
When this policy changes, the date at the top changes. If a change matters, we will tell you in the app before it applies.
Contact
Write to support@minithub.com. MAROTECH SOLUTIONS, Kampung Masjid Haji Kadir, 21100 Kuala Terengganu, Terengganu, Malaysia.