Clopal ClopalBack to home

TRUST CENTER

Privacy policy

How Clopal collects, uses, discloses, protects, and retains account, Google, and conversation data.

Effective and last updated August 23, 2026

Scope and roles

This policy applies to the Clopal website, web application, desktop application, meeting assistant, and connected integrations. For business workspace data, the customer organization generally determines why the data is processed and Clopal processes it to provide the service. Clopal acts independently for account security, billing, service administration, abuse prevention, and its own legal obligations.

The organization using Clopal is responsible for giving meeting participants required notices and establishing a lawful basis for recording, transcription, and analysis.

Information we collect

  • Account and workspace data: name, work email, Google account identifier when Google sign-in is used, password credentials in hashed form, workspace membership, role, plan, language preferences, and authentication and verification records.
  • Conversation data: meeting URL and metadata, participant names and assigned roles, audio supplied during a call, transcripts, recordings when enabled, notes, cue cards, summaries, analyses, call goals, and sources used to ground an answer.
  • Meeting invitation data: invitations sent to a user’s unique Clopal alias, including the calendar UID and revision, organizer, title, time, supported meeting link, approval state, and bot lifecycle. The alias is an inbound processing address, not a user mailbox.
  • Sales and knowledge data: customer and account records, contact details, relationship history, uploaded documents, website material a user asks Clopal to import, and approved follow-up actions.
  • Technical data: IP address and request metadata available to our infrastructure, device and browser information, timestamps, service logs, provider status, usage measurements, errors, and security events.
  • Contact data: information submitted through our contact or demo form.

    • How we use information

  • Authenticate users and operate accounts, workspaces, trials, plans, and support.
  • Join requested meetings, transcribe speech, retrieve approved knowledge, generate live guidance, produce post-call records, and provide coaching and relationship workflows.
  • Execute an email or calendar action only after the authorized user reviews and approves it.
  • Secure the service, enforce tenant and feature boundaries, reconcile call state, prevent abuse and repeated trial misuse, diagnose errors, and maintain audit-relevant records.
  • Comply with law and enforce agreements. We may use aggregated or de-identified operational information to understand reliability and capacity, but not to identify or contact meeting participants.

    • Google user data

    Google sign-in requests openid, email, and profile so Clopal can identify the user, verify the email address, display the account identity, and create or access the correct Clopal account. Sign-in does not grant Gmail or Calendar access.

    If a user separately connects Google Workspace, Clopal requests gmail.send and calendar.events.owned. Calendar access is limited to event data on calendars the connected user owns. It is used to read scheduled event metadata, including title, time, organizer, attendees, response state, and video-meeting link. Clopal also checks an event's description and location only to identify a supported Google Meet, Zoom, or Microsoft Teams link. This lets the user review upcoming and recent meetings, approve one for preparation, and schedule the visible meeting assistant. Calendar access is also used to create a follow-up event only after the user reviews and approves it. Gmail access is used only to send a user-reviewed email.

    The integration does not read mailbox contents, download email history, manage Gmail drafts, access Google Drive, change calendar settings, create or delete calendars, or delete calendar events. We store the connected Google account email, granted scope list, token expiry, encrypted OAuth access and refresh tokens, and the user’s approve or skip decision with the event identifier, revision, scheduled time, and meeting-link snapshot. Other calendar metadata is retrieved for the connected user’s calendar view and is not retained as a separate calendar copy. Google data is not sold, used for advertising, or used to train generalized AI or machine-learning models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. A plain-language summary is available on our Google data use page.

    Google connection controls

    A user can disconnect Google Workspace in Account settings; Clopal then marks the stored connection revoked and stops using it. A user can also revoke Clopal from the Google Account permissions page. Revoking at Google immediately prevents further API access. Removing a Clopal account or completing an authorized deletion request removes the associated integration record under the applicable deletion process.

    Emails and events already created in Google remain in the user’s Google account and are governed by Google and the user’s organization; disconnecting Clopal does not delete them.

    Service providers and disclosures

    We disclose only the data needed to operate a requested feature. Current service categories include Amazon Web Services for hosting, storage, and transactional infrastructure; PostgreSQL-backed application storage; Recall.ai for the visible meeting bot and recording capture; Deepgram for speech transcription; Google Gemini APIs for generation and embeddings; Google OAuth, Gmail, and Calendar for user-authorized Google functions; and configured transactional email delivery providers. Customer-owned storage or CRM providers apply only when a workspace enables them.

    We may also disclose information when required by law, to protect users or the service, in a corporate transaction subject to appropriate protections, or at the customer’s direction. We do not sell personal information or share it for cross-context behavioral advertising.

    Retention and deletion

    Account and workspace data is retained while the account or business relationship is active and as needed for security, billing, dispute resolution, and legal obligations. Recording retention is plan-dependent: current standard plan configurations range from 7 days for trials to 30, 90, 365, or up to 3,650 days for higher plans. A customer agreement or customer-owned storage configuration may set different terms.

    Calendar approval records and email-invitation records remain with the associated account or workspace until they are deleted, the account or workspace is removed, or an applicable agreement or legal requirement directs otherwise. The raw invitation email is processed to extract calendar details and is not retained as a mailbox copy. Transcripts, analyses, knowledge, sales records, action receipts, and audit-relevant records remain until deleted, archived, the workspace is removed, or an applicable agreement or legal requirement directs otherwise. Workspace administrators can archive calls and may request or execute an authorized user-data purge. Deleted material may persist temporarily in protected backups and provider systems before normal backup expiry. See the data deletion instructions.

    Security and international processing

    We use HTTPS, server-side authorization, tenant-scoped queries, encrypted Google OAuth tokens, restricted service credentials, access controls, security headers, lifecycle reconciliation, logging, and deletion controls. Data may be processed in countries where Clopal or its service providers operate. Where required, the customer and Clopal are responsible for appropriate transfer safeguards. No system can guarantee absolute security.

    Your choices and rights

    Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal data, and to complain to a supervisory authority. Because customer organizations control most workspace and meeting data, we may refer a request to that organization. We may verify identity and authority before acting.

    Users can update profile and language settings in the product, disconnect Google, revoke Google permissions, clear browser storage, and ask their workspace administrator or Clopal through the contact page for assistance.

    Children and changes

    Clopal is a business service and is not directed to children. Users must not intentionally submit children’s data unless their organization has a lawful, authorized business purpose and all required protections.

    We will update this page when material practices change and revise the effective date. Where legally required, we will provide additional notice.