Three routes a recording can take
| Route | What leaves the device | Who sees it |
|---|---|---|
| On the device | Nothing, for transcription and minutes | Only the device |
| Through the tool's server | The audio, passed to a transcription provider, then the transcript to an AI model | The tool and the providers it names |
| Your own AI account | The audio and transcript go to the provider under your account | The provider, under your agreement with them |
None of these is right or wrong in itself. What matters is that you know which route your meetings take, that it matches what you told the people in the meeting, and that the providers' terms suit how sensitive the meetings are.
Why it matters
Meetings carry a project's most commercially sensitive conversations. The NCSC's guidance on large language models makes the general point: a query sent to an AI service is visible to the provider, so understand the terms of use and privacy policy before sending anything sensitive. The ICO's guidance on AI and data protection explains how the data protection principles apply when personal data goes through an AI system.
Questions to ask any meeting notes tool
- Where does the audio go, and which named companies process it?
- Is the audio kept after the transcript is made, and for how long?
- Is any of it used to train a model?
- Where are transcripts and minutes stored, and who in my organisation can see them?
- Can I delete a meeting everywhere, and how quickly?
- What do people I share minutes with see: the minutes only, or the transcript and recording too?
How Note Metric answers them
- The original recording stays on the device that made it unless you choose to keep a copy on the server.
- You choose the engine. Included processing passes the recording through the Note Metric server to the providers named in the privacy policy, and the server keeps no audio once the transcript is made, unless you choose to keep a copy. Your own OpenAI key sends audio from your device straight to OpenAI, which keeps it up to 30 days for abuse checks. On this iPhone, on iPhones that support it, makes transcripts and minutes on the phone with nothing sent.
- A shared link shows the minutes, actions, decisions and risks, never the transcript, your notes or the recording.
- Deleting your account removes everything the Note Metric server holds for it.
The privacy policy names every provider and says what each one receives.
Questions
Is on-device transcription less accurate?
It can be, depending on the device and the recording. On a noisy site, a server engine often does better; on a quiet call, on-device may be all you need.
Do I need to tell people which AI provider is used?
Your privacy information should say who receives personal data. In the meeting, it is enough to say the meeting is recorded for minutes and point people to where the detail is.
Can I use a free consumer AI app to write minutes?
Check its terms first. Some consumer services can use what you send to improve their models unless you opt out, which may not suit a project's commercial conversations.
Sources
- NCSC, ChatGPT and large language models: what's the risk?: what the provider can see, and reading the terms before sending sensitive material
- ICO, Guidance on AI and data protection: how data protection law applies to AI systems that process personal data
- ICO, The right to be informed: telling people who their data is shared with
- NCSC, Guidelines for secure AI system development: what to expect of a supplier building on AI
Our summaries of these documents are not their wording: read the source before relying on it. This guide is general information, not legal advice for a particular case. Note Metric and AI Metric Ltd are not affiliated with or endorsed by any body named here.