This Privacy Policy describes how Meidly (SASU, SIREN 989 292 016) collects, uses and protects your personal data when you use the meidly.com platform. Meidly is a platform that brings your customer exchanges together, analyses them and makes that knowledge available to your team. By using our service, you agree to the practices described below.
Meidly processes your personal data to operate, bill and secure the platform, and only measures its audience with cookies if you consent to it.
The content you import is sent to AI providers to be analysed; they delete it afterwards and never use it to train their models. Meidly keeps it for as long as you use the platform, then deletes it under the conditions of section 6.
You remain the owner of your content at all times, and you can exercise your GDPR rights whenever you like by writing to contact@meidly.com.
The entity responsible for processing your personal data is:
When you create your account, we collect:
If you sign in with Google (OAuth), which is possible for an existing account whose email address matches your Google account, or to create one for an address that has received an invitation that is still valid, Google provides us with your email address, your name and your profile picture. We use the email address to find your account, and the name and the picture only to fill in your profile when it does not have them yet. No other information is accessed.
When you sign in with Google for the first time, we record the identifier of your Google account in order to link it to your Meidly account, which also lets you keep signing in with Google after changing your email address with us. The tokens Google issues at sign-in (access token, identity token, refresh token) are never stored: sign-in only requests your email address, your name and your profile picture, and we never call Google services on your behalf.
To protect your account, we also keep a session version, which changes when you use "Log out of all devices", reset your password, confirm a new email address or deactivate your account, and which immediately invalidates every session opened before it. The single-use keys sent by email (account confirmation, password reset, email change) and the links of the invitations to a workspace and of the waitlist are stored only as a hash (SHA-256), with their expiry date where they have one, never in clear text. Before deleting your account or, for an account without a password, changing your email address, we ask you to authenticate again: with your password, or through a sign-in less than ten minutes old.
If you hold a referral link, we keep its code, its commission rate, the number of accounts that signed up through it and, for each payment of a referred account, its amount excluding VAT and the commission it earned you, together with the commissions deducted after a refund and the payouts made to you with the reference of your invoice. When you join the waitlist through a referral link, your place, then your account, keep the reference of the account that referred you.
To use the service, you work in the workspaces Meidly creates for you or that invite you, and interact with the platform's tools, which may involve submitting files or other types of content. We process the following data:
The records derived from your exchanges: customers and their companies (name, role, industry, size, the channel through which they came), the people on the customer's side with their role in the purchase, the competing products customers name, sales with their amounts and the reason stated for their outcome, commitments and their due dates, and persona portraits and targeting criteria.
The passages of each exchange with their readable version (hesitations and repetitions removed, punctuation added) and their vector representations used for search, the member of your team who imported each exchange, recognised by default as its seller, and a lighter audio copy of each video, used for its transcription.
The names of your customers, your team and the competitors, sent to the transcription provider so it recognises them.
For each exchange to which a sales method was applied, the criteria covered or not, with the positions of the passages and a short quote, and the name of the person who created each method
This content may include data relating to third parties such as prospects, customers or partners. You are solely responsible for ensuring you have the necessary authorizations before uploading and submitting any recording or text for analysis.
We automatically collect certain data when you use the platform:
Transactions are processed entirely by Stripe, which means Meidly never stores any bank card data. We only retain the billing information required for accounting purposes, namely the amount, date, transaction status and Stripe identifier. These billing data belong to the workspace that pays: each workspace has its own Stripe customer, subscription and credit balance, and every credit movement records the workspace it concerns and, for a paid action, the member who launched it.
When you connect the Chrome extension, an AI client (Claude, ChatGPT or another MCP client), a mailbox, a messaging account or a CRM, we process the following data:
For a mailbox, a LinkedIn, WhatsApp or Instagram account you connect: its identifier at Unipile, its name as the account presents it, its connection state, the member who connected it and, for LinkedIn, WhatsApp or Instagram, the identifier of the account at that service.
Meidly receives the new emails of that mailbox and, when the member who connected it asks for it from a customer record, retrieves the emails exchanged with the addresses of that customer over the period they choose, at most the last twelve months. It keeps only the emails exchanged with an address saved on a customer record: any other email is discarded on receipt, without being stored. A kept email (sender, recipients, date, text without the quoted history, and the names of its attachments, never their content) is added at once to an exchange of that customer, and only the identifiers of the message and of its thread are kept besides, so that it is never imported twice.
Likewise, Meidly receives the new LinkedIn messages of a connected account and, on request from a customer record, retrieves the conversations held with that customer's profile over the period chosen, at most the last twelve months. It keeps only the messages of a conversation in which a customer whose LinkedIn profile is saved on their record takes part: any other message is discarded on receipt, without being stored. A voice message of a kept LinkedIn, WhatsApp or Instagram conversation is downloaded through Unipile and stored as an audio file with its exchange, deleted with it, and transcribed when the exchange is analysed.
To recognise a profile, Meidly looks it up once at LinkedIn, through Unipile and a LinkedIn account connected to the workspace, which may be that of another member, without notifying the person, and keeps only the identifier of the customer's profile. The participants of a message who are not customers are never looked up. A kept message (name of the sender, names of the other participants, date, text and the name or kind of its attachments, never their content, except the voice messages described above) is added at once to an exchange of that customer, with the identifiers of the message and of its conversation.
The same applies to a connected WhatsApp account, over the same period: Meidly keeps only the messages of a one-to-one conversation with a customer whose phone number is saved on their record, recognised by that number alone, without any lookup, and any other message, group conversations included, is discarded on receipt, without being stored.
The same applies to a connected Instagram account: Meidly keeps only the direct messages of a one-to-one conversation with a customer whose Instagram username is saved on their record; to recognise it, Meidly looks that username up once at Instagram, through Unipile and an Instagram account connected to the workspace, without notifying the person, and keeps only the identifier of the customer's account; any other message, group conversations included, is discarded on receipt, without being stored
For a CRM a manager connects to a workspace (HubSpot): the identifier and the name of the CRM account, the member who connected it, and the access it issues to us, stored encrypted.
After each analysis, and whenever a member clicks “Send to CRM” on an exchange, Meidly finds the customer's contact in the CRM by their email address, or, unless a manager turned this off, creates it with their name, email address, company and job title, then writes on it, as that manager chose, a note (title, date and type of the exchange, summary, names of the participants, commitments and a link to the exchange) and one task per commitment, assigned to the member who imported the exchange when the CRM knows their email address, which Meidly sends it for that purpose. When the exchange or the customer is edited in Meidly, the note, the tasks and the contact are updated, without overwriting what was edited in the CRM since the last send unless a member forces the send; on the contact, only the fields that are empty or that Meidly wrote are updated.
A member may also link the customer to a contact of the CRM by pasting its link, or create a customer from a contact of the CRM: Meidly then reads the name, email, company and job title of the contacts matching the search, and keeps only those of the contact the member picks. Meidly keeps the identifiers of that contact, of that note and of those tasks, with a fingerprint of what it wrote there, to recognise an edit made in the CRM and never duplicate the note or the tasks.
Disconnecting the CRM revokes that access with its provider
We only process your data for specific, documented purposes. For each processing activity, the legal basis under the GDPR is indicated below:
Meidly does not use your data for marketing purposes without your explicit prior consent.
To deliver its services, Meidly relies on a carefully selected set of sub-processors, each chosen for their security standards and their ability to comply with applicable regulations. The list below reflects the current sub-processors and may be updated as the platform evolves. The third-party tools you connect yourself (CRM, messaging) are not sub-processors of Meidly: you choose them, they process your data under the contract that binds you to them, and Meidly only exchanges with them the data needed for the import and the synchronisation you have enabled, within the permissions you grant.
Vercel is our main infrastructure provider, hosting both the application and the database (PostgreSQL) as well as uploaded files via Vercel Blob, stored in the European Union. The company is SOC 2 certified and headquartered in the United States, with data transfers governed by Standard Contractual Clauses (SCCs).
Stripe handles all payment processing on the platform. As a PCI-DSS certified provider, it ensures that bank card data never transits through Meidly's systems.
Resend is used to send transactional emails such as registration confirmations and platform alerts. Only the recipient's email address and the message content are transmitted.
Vercel Analytics measures the audience of the site without any cookie and without storing anything on your device: it records the pages visited, the referring site, the country, the browser and the type of device, attached to an anonymous identifier renewed every day that does not let us recognise you from one day to the next.
Crisp powers our in-app support messaging. When you are logged in, your email address and name are shared with this service so that our team knows who is writing without asking you, and the content of your messages is shared when you reach out to us.
Inngest orchestrates the background jobs that power file processing and analysis workflows, including the ingestion of uploaded audio and video files before they are submitted for AI analysis. Between two steps of a job, Inngest keeps what a step returns: for an assistant answer, the generated text and the references of the passages it cites, for the retention period of its run history.
When you import a file from Google Drive, the Google picker opens in your browser and Google processes your selection under its own terms; the access granted is limited to the files you pick. If you accept audience measurement in the cookie banner, Google Analytics places cookies on your device and receives the pages visited and technical data about your browser and your device; without that consent, Google Analytics is not loaded. Transfers to the United States are governed by the Standard Contractual Clauses described in section 5.
To deliver its AI-powered features, Meidly transmits certain content to third-party AI providers selected according to the task concerned. The providers currently used are:
None of these providers use submitted content to train their models, under the terms of their business offering. Content is processed confidentially, retained only for the time strictly necessary to perform the task and any abuse monitoring imposed on the provider, then deleted. These providers act as sub-processors of Meidly within the meaning of article 28 of the GDPR, and transfers outside the European Union are governed by the Standard Contractual Clauses described in section 5. The list of active AI providers may evolve as the platform's tools expand, and it is kept up to date in this section: any addition of a provider is published here, and you may object to it under the conditions of section 14.
Dictation in the assistant relies on the speech recognition built into your browser. Your voice is transcribed by the provider of your browser (for example Google for Chrome, Apple for Safari) under its own terms: Meidly never receives the audio, only the resulting text, which is then processed like a typed question.
When you hover a waitlist button or open its form, Google reCAPTCHA loads to tell a person from an automated submission. If you accepted cookies in the banner, it may also load in the background as soon as you arrive, so that the form opens faster. Google receives your IP address and technical data about your browser and your activity on the page, and may set cookies on your device. This processing relies on our legitimate interest in protecting the form against abuse, and the transfer to the United States is covered by the standard contractual clauses described in section 5.
When you connect a mailbox (Gmail, Outlook or another provider), a LinkedIn, WhatsApp or Instagram account, you authorise access on Unipile's connection page: Meidly never sees your password. Unipile keeps that access for as long as the account stays connected and sends Meidly its new emails or messages, which Meidly filters as described in section 2.5; for LinkedIn and Instagram, it also answers Meidly's lookups of the profiles of your customers. Disconnecting the account, from Meidly, deletes the access at Unipile.
Some of our sub-processors are headquartered outside the European Union, primarily in the United States. These international transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Article 46 of the GDPR, which provides an appropriate level of protection for your data.
Meidly applies a set of technical and organizational measures designed to protect your data against unauthorized access, disclosure or misuse:
No system is entirely infallible, and we make no claim otherwise. Should a data breach occur, we will notify the affected individuals and the CNIL within the timeframes required by the GDPR.
You have the following rights:
To exercise any of these rights, simply write to us at contact@meidly.com and we will respond within 30 days. If you do not have a Meidly account, for example because you left your address on the waitlist or because your words appear in an exchange imported by one of our users, you can request the erasure of your data by writing to the same address: there is no self-service form. When we process that data on behalf of a workspace, we pass your request on to that workspace and help it respond.
If you feel your rights have not been respected, you may also lodge a complaint with the CNIL at www.cnil.fr.
Meidly places the cookies that are strictly necessary for the service to function without asking you, in particular to manage your authentication session and your preferences. Audience measurement cookies (Google Analytics) are placed only if you accept them in the banner shown on your first visit; refusing them has no effect on the service. Vercel Analytics, our other audience measurement tool, uses no cookie. No advertising cookie is placed. A few display preferences (the height of the windows, the media you hid, the reminders you have already seen) are kept in your browser's local storage, without being sent to Meidly.
You may change your choice at any time with the button below; withdrawing your consent deletes the Google Analytics cookies. You can also disable cookies in your browser settings, though doing so may affect certain features of the service.
As a professional user, you bear full responsibility for the content you submit to Meidly through any of its tools, in particular with regard to the following points:
The analyses produced by Meidly are automatically generated by artificial intelligence models and are provided for informational purposes only. While we strive for quality, they may contain inaccuracies or omissions, and Meidly makes no guarantee as to their accuracy, completeness or relevance in any given situation. They should not be treated as legal, commercial or professional advice of any kind. In accordance with Article 22 of the GDPR, no decision producing significant legal effects is taken solely on the basis of automated processing: Meidly's AI outputs are decision-support recommendations, and the final decision always rests with you.
Within the meaning of Regulation (EU) 2024/1689 on artificial intelligence, Meidly acts as the provider of the AI systems built into the platform, and you act as their deployer when you use them in the course of your professional activity. Every content generated by the platform is presented as such in the interface, and it is a draft that you review before using or sending it.
These tools are intended neither for the management of human resources nor to infer the emotions of a person, and no result they produce may be the sole or decisive basis of a decision about a person: article 6 of the Terms of Service sets out in full the respective obligations of each party under that Regulation.
Applying a sales method describes an exchange or a customer, including how many criteria were covered out of the total, and gives no person a grade: it may not be used to evaluate a team member.
We reserve the right to modify this policy at any time. The update date will be shown at the top of this page. In the event of a substantial change, we will inform you by email or via a notification on the platform.
For any questions regarding this policy: contact@meidly.com
This processing concerns the personal data contained in the exchanges, customer records and content you import (identity, professional contact details, job title, what was said and, for a recording, the voice) of your customers, prospects, partners, their representatives and the members of your team. Its subject and nature are the transcription, analysis, indexing, search, storage and synchronisation described in the Terms, solely to deliver the service, and it lasts as long as you use the platform, then until the deletion provided for in section 6.
Where you use Meidly as a professional and process personal data of third parties (prospects, customers, partners) through the platform, you act as the data controller within the meaning of the GDPR, and Meidly acts as your data processor. In this capacity, Meidly undertakes to:
These provisions constitute the data processing agreement (DPA) within the meaning of Article 28(3) of the GDPR and apply to all personal data processing carried out in connection with your use of the platform.
By using our platform, you acknowledge having read, understood and accepted this Privacy Policy.