Privacy Policy

What personal data VTag One processes, why, where, for how long, with whom it is shared, and what rights you have. Includes how we use data received from Google APIs.

Last updated:

Who we are

VTag One is a product of VTag Labs GmbH, Stixchesstr. 107, 51377 Leverkusen, Germany (Handelsregister B, Amtsgericht Köln, HRB 128732; managing director: Hüseyin Deniz). Privacy contact: privacy@vtaglabs.com. The full company details are in the imprint linked in the footer.

This policy applies to the VTag One web application and to the meeting notetaker that works with it. It follows the General Data Protection Regulation (GDPR), including the information duties of Articles 13 and 14.

Our role: controller or processor

  • Your account (name, e-mail address, sign-in and security data): VTag Labs GmbH is the controller.
  • Content that your organization puts into VTag One (documents, chats with the assistant, meeting transcripts, connected mail, calendar and files, commitments and approvals): the organization that invited you is the controller. VTag Labs GmbH processes this content on its behalf and on its instructions. Questions about this content, and requests to access or delete it, go first to your organization.

What data we process

  • Account and organization data: name, work e-mail address, language, organization and role, invitation and membership records, sign-in events and sessions.
  • Content you or your organization add: uploaded documents, chat messages with the assistant and its answers, entries in the organization's memory, commitments, decisions and approvals.
  • Connected sources, only if you connect them: Gmail messages, Google Drive files and Google Calendar events that the assistant reads with your own Google permissions (see the section on Google user data). Access tokens are stored encrypted.
  • Meetings, only where the notetaker joins: the written transcript of the meeting and the items extracted from it (decisions, commitments, tasks, open questions with a short quote and a timestamp). Audio is not kept as a recording. The section "Meeting notetaker" at the end of this page has the details.
  • Operational data: audit entries of actions (who did what, without message content), usage counts, technical logs and error reports, and push notification addresses if you enable notifications.

Google user data

This section applies if you connect a Google account.

Statement of compliance. VTag One's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy: developers.google.com/terms/api-services-user-data-policy

What we access. Only after you connect your Google account and approve Google's consent screen, and only with your own permissions: your Gmail messages (to search and read them when you ask, so that the assistant can answer with a cited source and prepare reply drafts), your Google Drive files (to search and read them when you ask), your Google Calendar events (to detect meetings and, after your approval, to create invitations), and, for Google Meet, the meeting data needed to know who attended. A mail is sent only if this feature is enabled for your organization and you press Send on the draft.

How we use it. Only to provide the user-facing features you asked for, to you and your organization. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to data brokers or advertising platforms.

Artificial intelligence. To answer your question, the relevant excerpts are sent to the language model that powers the assistant, through our model gateway (see "Who receives data"). We do not use data received from Google APIs to develop, improve or train generalized artificial intelligence or machine learning models, and we require our processors not to do so either.

Humans. Our staff do not read your Google data, except where you gave your explicit agreement for specific data (for example in a support case), where it is necessary for security purposes such as investigating a bug or abuse, where the law requires it, or where the data is aggregated and anonymized and used for internal operations.

Transfers. We pass Google user data on only to the service providers listed below, to the extent needed to provide the feature, for security purposes, or where the law requires it.

Storage and removal. Content that the assistant reads may be kept as a copy inside your organization's workspace so that answers can cite their source. Copies are stored on our servers in the EU and are subject to a storage quota per organization. If you disconnect a source, the copied data of that source is removed. You can also revoke VTag One's access at any time in your Google account settings.

Why we process data and on what legal basis

  • To provide VTag One to you and your organization (account, assistant, documents, connected sources, approvals): performance of the contract, Article 6(1)(b) GDPR, or, for content processed for your organization, the instructions of the organization as controller.
  • Security, abuse prevention, technical logs and operating the service: our legitimate interest, Article 6(1)(f) GDPR.
  • Meeting notetaker: the legitimate interest of the organization in documenting its meetings, Article 6(1)(f) GDPR, with a notice in the meeting chat and a right to object at any moment. The organization, as controller, is responsible for assessing this legal basis for its own meetings.
  • Legal duties (for example retention under commercial or tax law, or answering authorities): Article 6(1)(c) GDPR.
  • Where we ask for consent (for example when you connect a Google account): Article 6(1)(a) GDPR. You can withdraw consent at any time; this does not affect processing before the withdrawal.

Providing the data needed for your account is required to use VTag One. We do not take decisions about you that have legal effects by automated means alone: the assistant prepares, a person approves.

Human approval for outward actions

The assistant can prepare actions such as an e-mail draft or a calendar invitation. Outward actions are designed to need a person's approval. Content the assistant reads from outside sources is treated as information, not as an instruction to act.

Who receives data

We host VTag One on our own servers at Hetzner in Helsinki, Finland (EU), with a self-hosted database. We use the following service providers (sub-processors) where they are needed for the features you use:

  • Hetzner Online GmbH: server hosting (Helsinki, Finland).
  • Cloudflare: DNS and delivery of the web application and the status page.
  • Resend: delivery of system e-mails such as invitations and sign-in codes.
  • Recall.ai: the meeting notetaker that joins a video meeting and produces the transcript.
  • OpenRouter and the language-model provider(s) behind it: OpenRouter is the gateway to the language model that powers the assistant. The excerpts needed to answer your request are sent through it to the model provider.
  • Google: the Gmail, Drive, Calendar and Meet interfaces of the account you connect yourself, and push notification delivery to your devices if you enable notifications.

Your organization is also a recipient of the content you share in it, within the permissions it sets. We may disclose data where a law or an authority requires it. The current list of our processors is available on request at privacy@vtaglabs.com.

Transfers outside the EU/EEA

Our servers are in the EU. Some of the providers above, in particular the language model route and some global services, may process data outside the EU/EEA. Where a transfer outside the EU/EEA requires it, we put appropriate safeguards such as the EU standard contractual clauses in place. We do not claim that the language model processing is limited to the EU.

How long we keep data

  • Meeting transcripts: 30 days, then deleted. Extracted items are kept until the organization deletes them or sets a retention period.
  • Chat attachments: 30 days.
  • Copies of connected mail and Drive content: until you or your organization disconnects the source, then removed.
  • Account closure (target period): after you ask to close your account there is a 14-day window to change your mind, then your data is deleted.
  • Organization closure (target period): the organization's data is read-only for 30 days and then deleted; the organization receives a confirmation of the deletion.
  • Records we must keep by law are kept as long as the law requires.

Other data is kept only as long as needed for the purposes above. We are finalizing fixed periods for audit entries and technical logs and will state them here. Closure periods are target periods until the closure flow in the application is complete.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 21 GDPR), and the right to withdraw consent. For content processed for an organization, please contact the organization first; we help it answer you. You can also write to privacy@vtaglabs.com. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or with the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Changes to this policy

We update this page when our processing changes. The date at the top shows the current version. Where a change is significant we tell the members of an organization in the application.

Meeting notetaker

What the VTag One Notetaker does in a meeting, what it keeps, for how long, and how you can object.

Last updated:

What it does

The VTag One Notetaker joins a Google Meet meeting on behalf of an organization that uses VTag One. It appears in the participant list as VTag One Notetaker and, as soon as it is let in, writes a notice in the meeting chat: on whose behalf it joined, the purpose and a link to this section. Nothing is transcribed before that notice is posted.

It turns the conversation into a written transcript and extracts structured items from it: decisions, commitments, tasks and open questions, each with a short quote and a timestamp.

Audio is not stored

Audio is not stored as a recording. Short pieces of audio are held encrypted only until they are converted into text, then deleted. Only text is stored.

How long data is kept

  • Transcript: 30 days, searchable for the invited members of the organization. Then it is deleted.
  • Extracted items (decisions, commitments, tasks, open questions with their quote and timestamp): kept without a fixed end by default, so the organization keeps its record after the transcript is gone. The organization can set a retention period.
  • A deletion request under the GDPR is applied item by item.

Who can see it

Before the organizer approves it, only the organizer and authorized people of the organization see the transcript. After approval, the organization's members who attended the meeting see it, within their own permissions. External participants get nothing by default; the organizer may share the extracted items (not the transcript) by email.

How to object

  • Type "no recording" in the meeting chat (also "kayıt yok" or "keine Aufnahme"), or open the link in the notice.
  • Recording stops at once, your contributions are deleted and the organizer is notified; the organizer decides whether the notetaker continues or leaves.
  • The organizer can also remove the notetaker at any time, from VTag One or from Google Meet.

Controller, processor and legal basis

The organization that sent the notetaker is the controller. VTag Labs GmbH processes the data on its behalf, on servers in the EU (Hetzner, Helsinki).

Legal basis: legitimate interest of the organization in documenting its meetings (Art. 6(1)(f) GDPR). The notice in the chat and the right to object at any moment are part of this balance. The organization, as controller, is responsible for assessing this legal basis for its own meetings.

Your rights

You have the right to access, rectification, erasure, restriction, objection and data portability, and the right to lodge a complaint with a supervisory authority. Contact the organization that ran the meeting, or VTag Labs GmbH at contact@vtaglabs.com.