Privacy Policy
Effective 19 October 2026
MetAt helps you keep track of the people you meet at events and follow up with them. This policy explains what we collect, why, who processes it, how long we keep it, and the rights you have. MetAt is operated by an independent sole proprietor based in California, USA. For any question about your data, or to have it deleted, email contact@metat.io and you will get a reply from a person.
1. Two kinds of data
- Your account data: about you, the MetAt user. We are the controller of this data.
- Contact data: about the people you meet and add to MetAt. You decide who to add and why; we store and process it on your behalf, acting as your processor. You are responsible for having a lawful reason to keep and contact them.
2. What we collect
- Account: email address; name, company, one-line pitch and LinkedIn URL you enter; time zone; plan, billing status and Stripe customer ID (we never see or store full card numbers).
- Sign-in: if you sign in with Telegram or LinkedIn, the name, username/ID and profile photo those services share.
- Contacts you add or import: names, companies, titles, Telegram usernames, phone numbers, emails, LinkedIn/X/Luma links, notes, follow-up status, and photos you choose to attach.
- Events: events, booths and side events you create, their dates and times, and a location you pin.
- Waitlist: the email address you enter on MetAt.io.
- Connected services, only if you connect them:
- Telegram Business or a connected Telegram account: the name, username and Telegram ID of people you start new chats with during your live events, and a photo you send in that chat with the caption or short note you add right after it. We never store the other person's messages. A connected account's login session is stored encrypted; you can end it any time in MetAt or in Telegram → Settings → Devices.
- Telegram event groups (connected account, only groups you pick): the name, username and Telegram ID of the group's members, added to the event you choose as a guest list, and checked again every few hours until the event is over. We never read or store the group's messages for this.
- Event conversation summaries (off unless you turn them on): MetAt reads your private chats with people from an event (from a day before it to three days after) and, in the event groups you picked, only the messages between you and that person (replies to each other and messages that mention you). That text is sent to Google's Gemini API to write a 1–2 sentence summary for your notes. Only the summary is stored; the messages themselves are not. Turning the setting off deletes all summaries.
- Google Calendar (read-only): the title, time, location and Luma link of calendar events that contain a Luma link. Other calendar events are not stored.
- LinkedIn and Luma (Chrome extension): connection status, headline, public profile link and event-related posts, read from pages your own browser opens, at a deliberately slow pace.
- HubSpot or a webhook you set up: we send your contacts there at your request.
- Live location: only while you share it with the MetAt bot; we keep only your latest position and delete it when sharing stops.
- Technical: server logs (IP address, browser type, time, page requested) kept for security and troubleshooting. We use a single sign-in cookie and no advertising or tracking cookies.
3. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the features you use | Contract |
| Billing and invoices | Contract; legal obligation |
| Sign-in links, service and billing emails | Contract |
| Waitlist and launch emails | Consent (unsubscribe any time) |
| Security, abuse prevention, debugging | Legitimate interests |
| Processing contact data you add | On your instructions, as your processor |
4. AI follow-up drafts
When you ask for a draft, the details needed to write it (the contact's name, company and title, your notes, the conversation summary if you turned summaries on, your name and pitch) are sent to Google's Gemini API, which returns the text. If you turn on event conversation summaries, the event messages described above are also sent to Gemini to write each summary. We don't send other contacts or your whole list. Google processes this under its API terms.
5. What we never do
- We never sell or rent personal data, or use it for advertising.
- We never send messages, emails or connection requests on your behalf.
- We never show anyone your location; proximity features only say roughly how far away someone is.
6. Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Render | Hosting the app | Singapore |
| Neon | Database | Singapore |
| Cloudflare | DNS and email forwarding | Global |
| Resend | Sign-in and service emails | Japan / USA |
| Stripe | Payments | USA |
| Gemini AI drafts and conversation summaries; Calendar if you connect it | USA / global | |
| Telegram | The MetAt bot and connected accounts | Global |
Some of these providers are outside your country. Where the law requires it, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.
7. How long we keep it
- Account and contact data: for as long as your account exists. When you delete a contact or your account, it is removed from the live database right away and from backups within 30 days.
- Billing records: as long as tax law requires (usually 7 years).
- Server logs: up to 30 days.
- Waitlist emails: until you join, unsubscribe or ask us to remove you.
8. Security
Data is encrypted in transit (HTTPS). Telegram sessions and third-party access tokens are encrypted at rest (AES-256). Access to production systems is limited to the operator. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
9. Your rights
Wherever you live, you can ask to access, correct, export or delete your data, and you can disconnect any connected service in Settings. Depending on where you live you may also have the right to object to or restrict processing and to complain to a data protection authority.
- California residents (CCPA/CPRA): you can request to know, delete and correct personal information. We do not sell or share personal information for cross-context behavioral advertising, and we won't treat you differently for exercising your rights.
- EU/UK residents (GDPR): the rights above, plus portability and objection to processing based on legitimate interests.
- People added to MetAt by a user: you can ask that user, or us at contact@metat.io, to remove your details, and we will help.
To make a request, email contact@metat.io. We reply within 30 days and may need to confirm your identity.
10. Google user data
MetAt's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to show you and your team which Luma events you are registered for, and is never used for advertising or sold.
11. Children
MetAt is a business tool and isn't meant for anyone under 16. We don't knowingly collect their data.
12. Changes
We'll post updates here and change the date above. For material changes we will email account holders before they take effect.
Contact
MetAt · California, USA · contact@metat.io