WorkStation is built with privacy-by-design principles. We collect only the data necessary to deliver, improve, and secure your meetings, webinars, and team chats.
- Meeting data: Video, audio and chat content are encrypted in transit (TLS, and DTLS-SRTP for media). Messages, transcripts and meeting records are stored in our own database on servers we operate; files and recordings are stored in private Cloudflare R2 storage. Recordings and transcripts are written only when somebody records or switches captions on, and everyone in the room is told when they do.
- Service providers we use: Our servers are rented from Netcup, and our email server from Hetzner; we run the software on both ourselves. Cloudflare serves this website, carries the app's traffic to our servers, and stores files, recordings and our encrypted database backups in R2. Anthropic receives text only when your workspace has switched AI features on. Notifications pass through Google (Firebase, and Chrome's push service), Apple or Mozilla, carrying no message text. Card payments are handled by Stripe, and card details never reach us.
- AI processing: Summaries and transcripts are sent to our AI provider over an encrypted channel from our servers, never from your browser. There is no on-premise or on-device inference and we will not claim one. If AI must not touch your data, it stays switched off for your workspace, which is the default.
- Data retention: On the free plan, content older than 100 days is hidden and is restored in full if you upgrade; content older than a year is deleted permanently. Paid plans keep everything for as long as you are subscribed, subject to any retention policy your workspace sets. You can permanently delete your data at any time.
- The Android app and notifications: While you are signed in to the app, your phone registers a Firebase Cloud Messaging token with us (its platform and the app version with it) so that messages, calls, task updates and meeting reminders can reach the phone when the app is closed. A notification carries only who it is from or which conversation it is in, a category, and — for a call — the caller's name. It never carries the message. That is deliberate: the notification passes through Google, and there is no agreement with them covering your content. Signing out deletes the token from our servers and from Firebase, and deleting your account deletes it too.
- Camera and microphone: The app asks for the camera and the microphone only for calls and meetings, and only while one is running. That audio and video travels to our own media server so the other people can see and hear you; nothing is recorded on your phone and nothing is kept by us unless somebody in the meeting starts a recording — which goes to our private file storage at Cloudflare R2 — or switches live captions on, which are produced by transcription software running on our own servers. Both are announced in the room while they happen. Custom meeting backgrounds you add from your own photos stay in that browser on that device, and are never uploaded.
- Notifications in a browser: If you switch on notifications on the website, we store the push subscription your browser gives us — an address at your browser vendor's push service, its two encryption keys, and the browser's own description of itself — so we can address a notification to it. The same rule applies: an identifier and a category, never a message. Turning notifications off deletes the subscription.
- Where you are signed in: Each sign-in records the IP address and the browser or device description it came from, when it started, and when it was last used. It is there so you can see every device signed in to your account in Settings and end any of them, and so an unfamiliar sign-in is visible to you. We derive no location from it and the app asks for no location permission. A sign-in expires after 30 days.
- Signing in with Google: If you choose "Continue with Google", Google tells us your Google account's identifier, your email address, whether Google has verified it, your name and your profile picture — nothing else, and never your contacts, mail or files. We use them to find or create your account here and to fill in a blank profile. We never see your Google password and we keep no Google access token: once you are signed in, your session is ours, exactly as if you had used a password. Google sees that you signed in to WorkStation. If you have two-factor authentication on here, we still ask for your code.
- Your profile and your workspace's record: Your name and email address, and anything else you choose to put on your profile — photograph, job title, department, phone number, time zone. Your workspace also keeps an append-only log of actions taken in it (who did what, to which item, when) for security and accountability. That log never holds a message, a prompt or an AI answer, and it is not swept by the retention clock above.
- Your rights: Access, rectification, deletion, and portability requests can be made through your Trust Center or by emailing contact@wsmeetchat.com.
- Deleting your account: You can delete your account yourself, from Settings in the app, on any device. It is scheduled for at least 30 days later — never sooner, and later if a workspace you solely own turns out to have people in it who have not yet been warned, in which case we warn them, move the whole request back another 30 days and email you the new date. Signing in cancels it at any time before it begins; once it has begun it cannot be stopped. When it runs: your sign-in credentials, your sessions, your phone's notification token and any browser push subscriptions are destroyed, and your profile — name, photograph, contact details — is stripped. A workspace you are the only owner of is destroyed with it, along with everything in it. What is not destroyed: the messages you wrote stay in the conversations you sent them to, authored by "Deactivated User", because a colleague's thread is a shared record rather than one person's data; the workspace's action log is append-only; and recordings and transcripts follow the meeting's own 90-day retention. What is removed, what is kept and what to do if you cannot sign in are set out in full on the account deletion page, which needs no account to read.
- Live meeting AI assistant: When a participant switches on the AI assistant during a meeting, it transcribes the conversation via our self-hosted transcription and sends that transcript to our AI provider (Anthropic), under our data terms, to generate that participant's own private notes. It is disclosed to the room at join, not by a live in-call indicator. Nothing it produces is retained beyond the meeting's 90-day retention window, and it never runs in Healthcare (end-to-end encrypted) meetings.