The short version
- We never record or store your meetings: no audio, no video, no captions.
- What you say is sent to Google Gemini only to be transcribed and translated. Tolkmeet does not store it; Google handles it under its API terms.
- We keep your account details and how many minutes you translate, so we can bill you fairly.
- We use only essential cookies, for signing in. No ads, no trackers.
Who we are
Tolkmeet is run by 휘슬리, a sole proprietorship in the Republic of Korea (representative: 박혜연; business registration number 155-03-03588), registered at 서울특별시 구로구 구일로4길 65, Republic of Korea. We are the data controller for the personal data described here: we decide why and how it is processed.
Privacy contact: privacy@tolkmeet.com. Privacy officer: 박혜연, pphhyy1004@naver.com.
What we collect and why
For each kind of data, this table shows what it is used for and the legal basis we rely on.
| Data | What it includes | Why we use it | Legal basis |
|---|---|---|---|
| Account | Name, email address, a one-way hash of your password (or your Google sign-in identity if you sign in with Google), the name you show in meetings, preferences such as language, theme and caption size | Create and run your account, sign you in, send account emails | Contract |
| Security | Signed-in devices (browser and operating system, last active time), passkeys, the authenticator (TOTP) secret and hashed recovery codes if you turn on two-step verification | Protect your account and let you see and sign out devices | Contract; legitimate interests (keeping accounts secure) |
| Trusted device | A cookie that remembers a device for two-step verification | Skip the second step on a device you chose to trust | Consent (only if you tick the option) |
| Meetings you schedule | Title, time, languages, and the email addresses of guests you invite | Send invitations and show your meeting list | Contract; legitimate interests (letting hosts invite guests) |
| Usage | Meeting start and end times, number of participants, languages chosen, minutes translated | Apply plan limits, bill fairly, keep the service running | Contract; legitimate interests (running and improving the service) |
| Billing | Plan, billing status, Paddle customer and subscription IDs, and when you consented to provision and transfer to Paddle. Never your card number or other payment details | Manage your subscription and keep records | Contract; legal obligation (tax and accounting) |
| Payment records | For each payment: the Paddle transaction ID, what was bought (a plan subscription or extra hours, and the hours added), the amount and currency, and any amount refunded | Apply what you bought, handle refunds and chargebacks (including removing refunded hours), answer support requests | Contract; legitimate interests (handling refunds, chargebacks and support requests) |
| Support emails | The sender address and content of emails you send to an @tolkmeet.com address | Answer your questions | Legitimate interests (answering inquiries); contract where the inquiry is about your account or a purchase |
| Technical | IP address in web server, app and relay (TURN) server logs, kept up to 14 days. Logs never contain what was said | Security, abuse prevention, rate limiting | Legitimate interests (protecting the service and its users) |
| Speech in meetings | Audio and the text transcribed and translated from it, while a meeting runs | Show live translated captions | Contract |
Where we rely on legitimate interests, we have weighed them against your rights; you can object (see Your rights).
Speech and captions
When translation is on, your browser streams your speech directly to Google’s Gemini Live API, which returns text. The text passes through our server to Gemini to be translated and is delivered to the other participants.
We use Gemini’s paid service, under which Google does not use the content to train its models. We do not store audio, transcripts or translations. Each participant can save their own captions to their device as a text file.
Video and audio
Video and audio travel between participants with WebRTC encryption (DTLS-SRTP), either directly or, when a direct connection is not possible, through our own relay server in Seoul. The relay forwards encrypted data and cannot decrypt, see or record it.
Who we share data with
We do not sell personal data. Paddle.com Market Limited is the Merchant of Record for all our orders. For payments it acts as an independent controller, not on our behalf: when you open checkout we send it your email address, an internal user ID and the plan, and it collects your name, country and payment details directly from you under its own privacy policy. Google, Amazon Web Services and Cloudflare are our processors and handle data only on our instructions. Before you pay, we ask for your separate consent to provide these items to Paddle and to transfer them to the United Kingdom; without it you can’t pay, but you can still join meetings as a guest.
| Recipient | Role | Country | What they do | Data |
|---|---|---|---|---|
| Google LLC | Processor | The United States and other countries where Google operates | Speech recognition and translation (Gemini API); Google sign-in if you choose it; a connectivity check (STUN) when joining a meeting; our support mailbox (Gmail) | Audio and text during a meeting; your Google identity; IP address; support emails you send us |
| Paddle.com Market Limited | Independent controller (Merchant of Record) | United Kingdom | Payments, invoices, sales tax and VAT, refunds | Email address, internal user ID, plan; name, country and payment details you enter directly with Paddle |
| Amazon Web Services | Processor | Republic of Korea (Seoul) | Hosting and encrypted backups | All data we store |
| Cloudflare, Inc. | Processor | United States and other countries where its network operates | Account and invitation emails; receiving and forwarding emails sent to @tolkmeet.com addresses | Email address and email content |
We may also share data with professional advisers (such as lawyers and accountants) and with authorities where the law requires it.
International transfers
Our servers are in Seoul, Republic of Korea (Amazon Web Services, ap-northeast-2). Google processes data in the United States and other countries where it operates, Cloudflare in the United States and other countries where its network operates, and Paddle in the United Kingdom, as listed above. Data is transferred when you use the service, over encrypted connections (TLS). Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.
Cookies
We set only essential cookies:
- Session: keeps you signed in (30 days)
- Trusted device: remembers a device you chose to trust for two-step verification (30 days, only if you opt in)
- Google sign-in state: protects signing in with Google (10 minutes)
We do not use advertising or tracking cookies. You can block or delete cookies in your browser settings, but then you will not be able to sign in.
How long we keep data
- Account data, usage records, payment records and meeting records are kept while your account is open. When you close your account, we delete all of this immediately, using secure deletion; backup copies of the database are deleted within about a day.
- You can delete a meeting yourself from your meeting list, before it starts or after it ends.
- Your email address in meetings other people invited you to is part of their records; you can ask them, or us, to remove it.
- Sign-in sessions expire after 30 days.
- Billing records are kept by Paddle as long as tax law requires.
- Server logs (web server, app and relay server, including IP addresses) are kept up to 14 days.
- Support emails are kept for up to one year after your inquiry is resolved, then deleted.
- Audio, transcripts and translations are not stored by us. Google handles them under its API terms; Cloudflare keeps email delivery and forwarding logs under its own policy.
Your rights
Depending on where you live, including Korea, Japan, the United Kingdom and the European Union, you have the right to:
- access the personal data we hold about you
- have it corrected (rectification)
- have it deleted (erasure)
- restrict how we process it
- receive it in a portable format (portability)
- object to processing based on legitimate interests
- withdraw consent at any time, without affecting earlier processing (to withdraw the Paddle consent, email privacy@tolkmeet.com; we record the withdrawal; a new checkout asks for this consent again, and plan changes are blocked until you give it. An active subscription keeps renewing until you cancel it in account settings, and Paddle keeps the records tax law requires)
- complain to a data protection authority, such as the one where you live
You can change most details and close your account in account settings, and download a copy of your data in Account › Data & account › Your data › Download (JSON). For anything else, write to privacy@tolkmeet.com. We respond within one month.
Security
We protect your data with appropriate technical and organizational measures, including: passwords hashed with Argon2 and checked against known breaches; optional two-step verification and passkeys; encrypted connections (HTTPS/TLS) and WebRTC encryption; encrypted backups; access limited to the operator; secure deletion; and rate limiting against abuse.
Children
Tolkmeet accounts are for people aged 16 and over.
Changes and contact
If we make a material change, we will email account holders before it takes effect. Questions or requests: privacy@tolkmeet.com. Data controller: 휘슬리 (representative: 박혜연), 서울특별시 구로구 구일로4길 65, Republic of Korea; business registration number 155-03-03588. Privacy officer: 박혜연, pphhyy1004@naver.com.