Privacy notice — Supermeet

1. Who this notice covers

Organization staff and hosts who create an account on the console: name, email, role, sign-in codes, billing details.
Participants who join a session: the join record (session, name, role, time), a code that links the session to the account for leak tracing, chat, Q&A and poll answers, recordings when the organization records, and — when a session requires a verified identity — a mobile number, verified by a one-time code. In a secure session the app's attestation is checked at the join and not kept.
Students in classes with cameras (adult learners only): the camera picture goes live to the teachers while the student shares it and is never recorded or stored.
Guardians of participants under 18: the consent record the organization makes, with the guardian's name and contact.
Developers who integrate the SDKs: account, app registrations, API keys, usage.

2. What we do not do

Integrity records exist for security and attendance only. We do not build behavioural profiles of participants, score attention or engagement, show advertising, or track anyone across sessions. Participants never pay in the app; organizations buy on the web.

3. Children

Anyone under 18 is a child under the Act. For a participant under 18, the organization records the guardian's consent using guardian identities it already holds; the registration page asks for the date of birth and the guardian's name and contact. Consent can be withdrawn at any time; the records linked to that participant are then erased within 48 hours, and recordings follow the organization's retention policy.

4. How long we keep things

Data	Retention
Join records and mark-to-account maps	12 months
Recordings and replays	Organization setting, default 12 months, with an email to the organization 48 hours before erasure
Leak cases	Duration of the case plus 24 months
Consent and notice logs	At least one year after withdrawal or expiry
Billing records	As the tax law requires (six years)

5. Where data lives

Supermeet's application and database servers are in Bengaluru, India, where accounts, session records and consent records are kept. Recordings are kept in object storage whose location is not limited to India, and a content network delivers media to participants wherever they are. These providers process data under their data processing terms.

6. Your rights

You can ask to see, correct or erase your data, withdraw consent, and nominate someone to exercise these rights for you. Write to your organization first; organizations reach us through privacy@supermeet.io. If a leak investigation identifies your account, a person — not a machine — makes the decision, and you can appeal.

7. Grievances and breaches

Grievances: privacy@supermeet.io. We acknowledge within 72 hours and resolve within 90 days. In the event of a personal data breach we notify affected users without delay and file the report the Data Protection Board requires within 72 hours.

8. Changes

We publish changes here with the date; material changes are announced in the console and in the apps. This draft is dated 30 September 2026 and will be replaced by the counsel-reviewed version before launch.