Privacy Policy
Mei is an AI employee for businesses. To do her job she reads and acts on the work data your organisation chooses to connect — email, calendars, chats, documents and accounting records. That is a serious responsibility. This policy explains, in plain language, what we collect, why, where it lives, how long we keep it, and the rights you and your organisation have over it.
1. Who we are
The Mei service ("Mei", "we") at meiapp.co and in the Mei apps is operated by Stratton Arbor Private Limited, a company registered in India. For the data your organisation connects to Mei, your organisation is the data fiduciary/controller and we act on its instructions as a processor; for your account and billing data, we are the data fiduciary.
2. What we collect
Account data — name, work email, phone number, organisation, role, password (hashed), plan and billing status.
Connected workspace data — only from the platforms your organisation's administrator explicitly connects, and only within the permissions granted at connection time: emails and attachments, calendar events, chat messages (e.g. WhatsApp, Slack, Teams), documents and spreadsheets, notes, tasks, and accounting records (e.g. invoices, payments, ledgers from Zoho Books, Tally or similar).
Content you create with Mei — commands, chat history, documents Mei drafts, meeting recordings and notes where your plan includes them, voice interactions while a voice session is active.
Technical data — device type, app version, IP address, and logs needed to run and secure the service.
3. What Mei does with it
Only what she was hired to do: read and rank your inbox, draft replies, chase payments, prepare briefings, track promises and deadlines, file and generate documents, take meeting notes, reconcile books, and answer you by chat, voice or phone. We do not sell your data, use it for advertising, or use your organisation's content to train our own or third-party foundation models.
4. AI processing
Mei's intelligence runs on enterprise AI providers — currently Anthropic (Claude) and OpenAI, with Google AI for limited lightweight tasks. Relevant snippets of your connected data are sent to these providers to process each task, under agreements that prohibit them from training on your data. Voice features use OpenAI's realtime models; call transcription uses OpenAI transcription models.
5. Sub-processors
We use a small set of infrastructure providers to run the service: DigitalOcean (servers, India region), MongoDB Atlas (database, AWS Mumbai), Anthropic and OpenAI (AI processing), Google (AI processing and connected Google Workspace APIs), Meta (WhatsApp Business messaging), Twilio (telephony), Brevo (transactional email), Razorpay and Stripe (payments — card details never touch our servers), and Sentry (error monitoring, with personal data scrubbed). We maintain a current sub-processor list and will notify organisation administrators of material changes.
6. Google user data
Where your organisation connects Gmail, Google Calendar or Google Drive, Mei's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you see — reading and ranking mail, drafting replies, scheduling, and filing documents — never for advertising, and it is not sold or transferred except as necessary to provide the service, to comply with law, or as part of a merger/acquisition with equivalent protections.
7. Where data lives & how it's protected
Production data is stored in India (servers in Bangalore, database in AWS Mumbai). All traffic is encrypted in transit (TLS); data is encrypted at rest; third-party platform credentials and tokens are additionally encrypted at the application layer. Access is restricted to the minimum necessary, protected by firewalls and audited. Payment card data is handled entirely by Razorpay/Stripe.
8. Retention
Connected workspace content (emails, chats, documents, accounting records processed for tasks) — retained while the connection is active; purged when your organisation disconnects a platform or deletes its account.
Mei's work product (chat history, briefings, ledgers, generated documents, meeting notes) — retained for the life of the account; your organisation can delete items at any time.
Voice and call audio — processed in real time; recordings are not retained beyond transcription and notes unless your plan's meeting-notes feature stores them at your request.
Account and billing records — retained as required by Indian tax and company law (typically 8 years for financial records).
Backups — encrypted backups rotate on a short cycle; deleted data may persist in encrypted backup sets for up to 35 days after deletion before it is overwritten by rotation.
9. Your rights
Under India's Digital Personal Data Protection Act (DPDP) and comparable laws, you may access, correct, update or request deletion of your personal data, withdraw consent, and nominate a person to exercise these rights. For data your organisation connected, requests route through your organisation's administrator; we support them in fulfilling every request. Write to privacy@meiapp.co — we respond within 30 days.
10. Grievance officer
Karan Malik, Grievance Officer, Stratton Arbor Private Limited — privacy@meiapp.co. We acknowledge grievances within 48 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
11. Children
Mei is a workplace product for adults. We do not knowingly process data of persons under 18 except as it incidentally appears inside an organisation's connected business content.
12. Changes
We will post changes here and notify organisation administrators of material changes before they take effect. Continued use after the effective date constitutes acceptance.