1. Our two roles
InlineMeet is built to be used in two ways, and the GDPR gives us a different role in each:
- Controller — for our own customers’ accounts, our website, and meetings hosted at InlineMeet. Our privacy policy covers that.
- Processor — when a customer builds calls into their own product with our API or embeds our call screen. The customer decides whose data is involved and why; we process it only to provide the service to them. The terms below are our commitments to those customers, and form our data processing agreement (DPA) under Article 28 of the UK GDPR and the EU GDPR.
2. What we process for customers
| Whose data | The customer’s users who join calls, and anyone else the customer lets into them |
|---|---|
| What data | The identity and display name the customer gives each participant (which can be a pseudonym); audio, video, screen shares and chat in transit; recordings and whiteboards the customer chooses to keep; when each participant joined and left; IP addresses, to connect calls |
| Special category data | None by design. If a customer’s calls may carry it (a health consultation, say), the customer is responsible for having a lawful basis and telling participants |
| Why | To provide calls, recordings, whiteboards, webhooks and usage billing to the customer |
| For how long | For as long as the customer keeps it, and no longer than the agreement lasts (see “When the agreement ends”) |
3. Our commitments as a processor
When we process personal data on a customer’s behalf, we:
- process it only on the customer’s documented instructions — their API calls, settings and this agreement — and tell them if we believe an instruction breaks data protection law;
- never use it for our own purposes, never sell it, and never use call content to train any model;
- make sure everyone with access is bound by confidentiality;
- keep it secure with the measures below;
- use other processors only as described under “Sub-processors”;
- help the customer answer people exercising their rights — the API deletes recordings, rooms and whiteboards, and we handle anything it can’t;
- help with data protection impact assessments and consultations with a regulator;
- tell the customer about a personal data breach without undue delay (see “Breaches”);
- delete or return the data when the agreement ends;
- give the customer the information they need to show compliance, and allow audits as set out below.
4. Security measures
- Encryption in transit: TLS for every web and API request; DTLS-SRTP for all audio and video.
- Encryption at rest for recordings and backups.
- Isolation: every API key belongs to one customer, and every query is scoped to it. Customers’ rooms are named apart on the media servers, so two customers can never share one.
- Least privilege in calls: what each participant may publish is fixed in their token by the customer and enforced by the media server, not the browser.
- Secrets: API keys stored only as SHA-256 hashes, passwords as scrypt hashes; webhooks signed with HMAC-SHA256.
- Short-lived access: recordings are only reachable through links that expire; join tokens expire.
- Data minimisation: addresses and device ids used for abuse limits are kept only as keyed hashes; call content is never stored unless recorded.
- Operations: production access limited to the people who run it, monitoring and alerting, logs kept 7 days.
5. Sub-processors
Customers give us general authorisation to use the sub-processors below. Each is bound by a contract with data protection terms at least as protective as these. We stay responsible for their work.
| Sub-processor | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers that run the application, the media servers that carry calls, and logsEverything the service handles, including live audio and video in transit | Germany and Finland (EU) |
| MongoDB, Inc. (Atlas) | The application databaseAccount details, meeting details, room settings, usage records | EU region |
| Amazon Web Services EMEA SARL (S3) | Storage of cloud recordingsRecording files and their metadata | Ireland (eu-west-1) |
| Stripe | Payments, subscriptions and invoicesBilling name, email, address, payment card details (we never see full card numbers) | UK and Ireland, with processing in the US |
| Resend (Plus Five Five, Inc.) | Sending email — sign-up confirmation, receipts, invitationsEmail address, name, the content of the email | United States |
| Cloudflare, Inc. (Turnstile) | Telling people from bots at sign-up and when starting a meetingIP address, browser characteristics | Global network, United States |
| Google LLC (Google Analytics, through Firebase) | Measuring how the website is used — only for visitors who allow analytics cookiesPages visited, where the visit came from, device and browser, approximate location, and a random id in a cookie | United States |
We give customers at least 30 days’ notice by email before adding or replacing a sub-processor. A customer who objects on reasonable data protection grounds can tell us; if we can’t address it, they may end the affected service and get a refund of what they prepaid for it.
6. International transfers
We keep data in the UK and EEA where we can: our servers and media servers are in Germany and Finland, and recordings are stored in Ireland. Where a sub-processor handles data outside the UK and EEA, the transfer is covered by:
| MongoDB, Inc. (Atlas) | UK Addendum / EU Standard Contractual Clauses for any access from the US |
|---|---|
| Amazon Web Services EMEA SARL (S3) | UK Addendum / EU Standard Contractual Clauses for any access from the US |
| Stripe | EU–US and UK Extension to the Data Privacy Framework; Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | EU Standard Contractual Clauses with the UK Addendum |
| Cloudflare, Inc. (Turnstile) | EU–US and UK Extension to the Data Privacy Framework; Standard Contractual Clauses |
| Google LLC (Google Analytics, through Firebase) | EU–US and UK Extension to the Data Privacy Framework; Standard Contractual Clauses |
7. People’s rights
If someone asks us to act on their rights over data we hold for a customer, we pass the request to that customer promptly and don’t answer it ourselves unless they ask us to. Customers can act on most requests directly: the API lists, downloads and deletes recordings, and deletes rooms and their whiteboards.
For data where we are the controller, see your rights in our privacy policy.
8. Breaches
If we become aware of a personal data breach affecting a customer’s data, we tell them without undue delay, and within 48 hours — leaving them time to meet their own 72-hour duty to tell their regulator. We tell them what happened, what data and how many people are likely affected, the likely consequences, and what we’re doing about it, and we keep them updated as we learn more.
For a breach of data where we are the controller, we notify the regulator within 72 hours where the law requires, and the people affected when the risk to them is high.
9. Recordings and consent
Every participant sees when a call is being recorded. Whether a recording is lawful — whether participants need to be told beforehand or asked to agree — depends on the customer’s purpose, so it is the customer’s decision and responsibility. Recordings are kept until the customer deletes them.
10. When the agreement ends
For 30 days after an account closes, the customer can download their recordings. After that we delete the customer’s personal data — including from backups as they expire — except where the law requires us to keep something (invoices, for example). We confirm deletion in writing on request.
11. Audits and information
We answer reasonable security and privacy questionnaires, and share the information a customer needs to show their own compliance. Enterprise customers may audit our compliance with these terms once a year, on 30 days’ notice, at their own cost, through an independent auditor bound by confidentiality — or more often if a regulator requires it or after a breach.
12. Contact
Data protection questions, requests and objections: privacy@inlinemeet.com. We are not required to appoint a Data Protection Officer; our privacy lead answers that address.
You can complain to the Information Commissioner's Office (ICO) or the data protection authority where you live.