Last updated: October 17, 2026 فارسی
Avaje Enterprise Privacy Policy
Avaje Enterprise (enterprise.avajeapp.ir) turns an organization's meetings into minutes, decisions and action items. This policy explains what data we collect, how we use it, and how we protect it. For the Avaje notes app, see our Persian privacy policy.
Data we collect
- Account details: your name, email address or phone number, and your organization.
- Meeting content: audio that you record or upload, and the transcript, minutes, decisions, action items and comments made from it.
- Meeting details that you enter, such as title, date, description and participants.
- Google user data, described below, only if you choose to connect it.
Google user data
Google sign-in
If you sign in with Google, we receive your name, email address and profile picture (scopes openid, email and profile). We use them only to identify your account.
Google Calendar
With your permission, you can connect your Google Calendar. We read event details (title, time, description, location, organizer and attendee email addresses) to show your upcoming meetings and to start a meeting record from an event. If you turn on the option, we add one line with a link to the meeting record to that event's description. We do not change anything else in your calendar.
How we share it
We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalized AI or ML models. We share it with third parties only as described under "AI processing" below, and only to provide features you use.
AI processing
To write meeting minutes, we send the meeting's transcript, title and description (which may come from a calendar event) to Anthropic Claude Sonnet 5.5 through OpenRouter. Our OpenRouter account allows only Zero Data Retention endpoints (Amazon Bedrock and Google Vertex AI), which do not store this data and do not train on it. Routing to any provider that trains on or publishes data is turned off.
Speech is transcribed by Soniox, which receives only audio that you record or upload, never Google user data.
Limited Use
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Data protection
- All traffic between your browser, our servers and the services we use (Google, OpenRouter, Soniox) is encrypted in transit with HTTPS (TLS).
- Google OAuth tokens and other calendar credentials are encrypted at rest with AES-256-GCM. The encryption keys are kept outside the database and can be rotated.
- Every request is checked against the person's organization and role. Organizations are kept apart, and synced calendar events are visible only to the person who connected the calendar.
- Meeting audio is served only through signed links that expire.
- Only the people who operate the service can access its servers, and only to run and support it.
Retention and deletion
- We keep only calendar events from about 7 days in the past to 30 days ahead, and refresh them on every sync. Events outside that window are deleted, unless a meeting record was created from them.
- Disconnecting a calendar immediately deletes its encrypted tokens and all of its synced events. The same happens when a member leaves or is removed from the organization.
- If an administrator turns calendar connections off for the organization, all of its calendar data is deleted after 7 days.
- You can remove our access at any time in your Google Account permissions. Syncing then stops; disconnect the calendar in the app to delete what was stored.
- Meeting records, including a title or description that came from a calendar event, are kept while the organization's account is active. They are deleted within 30 days of a deletion request or of the account being closed.
- Once transcription is done, we delete the audio file and its transcript from Soniox. The OpenRouter endpoints we use keep no data.
Access and deletion requests
Your organization's administrators manage its data. To access your data or ask us to delete your account and its data, contact us. We complete deletion requests within 30 days.