1. Who we are
InlineMeet (“we”, “us”) provides video meetings at inlinemeet.com and a video-calling API that other products build on. InlineMeet is the controller of the personal data described here — the people who visit our site, create an account, host or join meetings at InlineMeet, or are invited to one.
When a company builds InlineMeet into its own product through our API, that company is the controller of its users’ data and we are its processor: we handle that data only on its instructions. If you joined a call inside another company’s app, their privacy policy applies, and our GDPR policy describes what we do on their behalf.
Questions about privacy, or a request about your data: privacy@inlinemeet.com.
2. What we collect
When you create an account
- Your name, email address and workspace name.
- Your password — only as a salted scrypt hash. Nobody at InlineMeet can see it.
- When you confirmed your email and when you last signed in.
- Whether you’d like product tips and offers by email — your choice, changeable any time.
When you subscribe
- Your plan, number of host licences and subscription status. Payment details go straight to Stripe; we never see or store your full card number.
When you host or join a meeting
- The name you join with, and meeting details a host enters: title, agenda, time, settings and passcode.
- If a host invites you by email: your email address, the name they gave, and whether you’ve said you’ll attend.
- Audio, video, screen shares and chat pass through our media servers to the other people in the call. They are not stored — unless the host records the meeting. Chat messages, reactions, polls and Q&A are never stored.
- Recordings, when a host starts one. Everyone in the call sees that it is recording.
- Whiteboards, which are saved with the meeting room so they are there next time.
- When each participant joined and left, used to measure usage and bill for it.
Automatically
- Your IP address, needed to connect you to a call. For abuse limits we store only a keyed hash of it, which can’t be turned back into the address.
- Server logs (requests, errors) — kept for 7 days.
- Which pages are visited, the site that linked to them and the type of browser and device — counted without cookies. To count each visitor once a day we keep a hash of your IP address and browser made with a key we delete the next day, so it can’t be traced back to you or linked across days. Kept for 13 months.
- The cookies listed below. We don’t use advertising or cross-site tracking cookies.
We do not track whether you open our emails or click their links.
3. How we use it, and our legal basis
| What we do | Legal basis (UK and EU GDPR) |
|---|---|
| Run your account and your meetings, record when asked, and send the emails the service needs | Performing our contract with you (Art. 6(1)(b)) |
| Take payments, invoice, and keep accounting records | Contract; legal obligation (Art. 6(1)(c)) |
| Prevent abuse, fraud and attacks — rate limits, bot checks, meeting limits | Our legitimate interest in keeping the service safe and available (Art. 6(1)(f)) |
| Email meeting invitations a host asked us to send | The host’s and our legitimate interest in arranging the meeting you were invited to |
| Send account holders tips and offers about our own plans | Legitimate interest, under the “soft opt-in” for existing customers (PECR reg. 22). Opt out any time |
| Understand and improve the service from aggregate measurements | Legitimate interest |
| Google Analytics, and any optional marketing cookies | Your consent (Art. 6(1)(a)), given and withdrawn in the cookie banner |
4. The emails we send
Service emails — confirming your address, receipts for a subscription, meeting invitations and updates — are part of the service, so they don’t have an unsubscribe link.
Tips and offers — a welcome series and a reminder of what a paid plan adds — go only to account holders who haven’t opted out. Every one has a one-click unsubscribe link, and you can switch them off in your settings.
If you were invited to a meeting, we got your address from the host, and we only email you about that meeting. We don’t add you to any list.
6. Where it’s stored
Our servers and media servers are in the EU (Germany and Finland), and recordings are stored in Ireland. Some providers — Stripe, Resend and Cloudflare — process data in the United States. Those transfers are covered by the UK Extension to the EU–US Data Privacy Framework or by Standard Contractual Clauses with the UK Addendum, as listed on our GDPR page.
7. How long we keep it
| Data | Kept for |
|---|---|
| Your account | Until you ask us to delete it. Then within 30 days, except what we must keep for tax |
| Recordings | Until the host deletes them, or their account is deleted |
| Instant meetings and their whiteboards | 7 days after the meeting ends |
| Scheduled meetings, invitees and responses | Until the host deletes the meeting |
| Usage and billing records | As long as we need them to bill you, and as accounting and tax law requires — in the UK, 6 years after the financial year they relate to |
| Server logs | 7 days |
| Hashed addresses and device ids used for limits | Until the limit resets — at most 2 hours |
| Webhook delivery history | 30 days |
8. How we protect it
- Everything travels encrypted: HTTPS for the site and API, DTLS-SRTP for audio and video.
- Recordings are encrypted at rest and only ever handed out through links that expire.
- Passwords are stored as scrypt hashes, API keys as SHA-256 hashes; neither can be read back.
- Every customer’s data is kept apart: no request can read across workspaces.
- Access to production systems is limited to the people who run them.
9. Your rights
Under the UK GDPR and the EU GDPR you can ask us to:
- give you a copy of your personal data (access), in a portable format where it applies;
- correct it, or delete it;
- restrict how we use it, or object to our using it on the basis of legitimate interest — including for marketing, which we always stop;
- withdraw a consent you gave, at any time.
Email privacy@inlinemeet.com from the address on your account. We answer within one month, and we may need to confirm it’s you first. If the data belongs to another company’s app (you joined a call inside it), we’ll pass your request to them.
If you’re unhappy with how we handled your data, you can complain to the Information Commissioner's Office (ICO) or your local data protection authority — though we’d like the chance to put it right first.
10. Children
Accounts are for people aged 16 and over. Children may join meetings run by an organisation — a school, say — that uses InlineMeet; that organisation is responsible for having the right to include them. If you think a child has given us data they shouldn’t have, email privacy@inlinemeet.com and we’ll delete it.
12. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data you’ve already given us, we’ll tell account holders by email before it applies.
13. Contact us
InlineMeet. Privacy: privacy@inlinemeet.com. Anything else: hello@inlinemeet.com.