Privacy Policy

HeyMoa processes only the information needed to provide the Service, as listed below.

Attendee names are used for speaker labels, AI summaries, and improving speech recognition accuracy (Article 3).

Children under 14 may not sign up for HeyMoa.

Providing the Service: identifying members and keeping them signed in, running workspaces, transcribing meetings, saving and viewing notes, AI summaries and agent answers, and exporting to external tools when you approve. This processing is needed to perform the service contract with you.

Sending email and answering inquiries: sending meeting notes sharing emails, invitation emails, and service notification emails (such as reminders about long-paused meetings and notices of automatic ending), and answering inquiries. Service notifications and notification emails never include the meeting content, transcript, summary, or attendee names. Service notification emails are not advertising, and optional notifications can be turned off in notification settings or through the unsubscribe link in the email.

Advertising information (optional): we send product news and offers by email only if you have agreed, and you can withdraw your consent at any time in Settings > Notifications.

Automatic meeting ending: meetings paused for a long time are ended automatically after prior notice, and their analysis may proceed under the name of the person who started the meeting (or, if that person has left the workspace, another member who recorded the meeting or an administrator).

Operations and security: access logs, sign-in records, and server logs are used to prevent misuse, analyze outages, support users, and investigate security incidents.

Improving the Service: usage statistics and performance metrics are used to analyze how the Service is used and improve it (Article 5). Reasons for deleting an account are used only as statistics for improving the Service.

The voices and names of attendees who have not signed up are processed only to the extent needed to perform the service contract with the user who recorded the meeting.

On the web, the microphone is used only when you start recording and allow microphone access in your browser.

The desktop app can record the sound coming from your computer along with your microphone. Computer audio includes the voices of other participants in a video call. Both inputs work only when you have allowed them in your operating system (macOS or Windows).

Audio is sent in real time to a speech recognition provider to be transcribed, and the transcribed sentences are shown on screen.

To improve recognition accuracy, meeting context may be sent along with the audio. Meeting context consists of the project name, meeting title, attendee names, agenda, the glossary you entered, and the meeting's topic and background.

After the meeting, audio is kept in encrypted storage (AWS Seoul region, Republic of Korea) so that speakers can be separated. It is deleted as soon as speaker separation finishes, and in any case automatically 30 days after it was stored.

Speaker separation results are shown with labels such as "Speaker A". Assigning a person's name to a label is your choice. HeyMoa does not create information that identifies a specific person by voice (a voiceprint) and does not compare voices across meetings.

Some attendees may not have signed up for the Service, and their voices and utterances are processed in the same way. The user who starts recording must confirm the necessary procedures, such as notifying attendees and obtaining their consent.

Automatic transcripts and speaker separation may contain errors. You should check important decisions and proper nouns yourself.

HeyMoa does not use your meeting audio, transcripts, notes, questions, or answers to train AI models. The speech recognition and AI providers HeyMoa engages receive this data only on terms that it is not used for training. External AI agents that you connect yourself are subject to their own policies.

To produce summaries, real-time organization, and answers to questions, the meeting's transcript, notes, attendee names, and your questions are sent to large language model providers (Article 7). These requests are made on terms that inputs and outputs are not stored (zero data retention).

When the agent uses web search, search queries made for your question are sent to the AI model provider's search feature (Article 7).

A search index is built from transcripts and notes and kept so that past meeting notes can be found and referenced. The index is deleted when the original note is deleted.

HeyMoa does not make decisions based solely on AI results that significantly affect your rights or obligations (automated decisions under Article 37-2 of the Personal Information Protection Act). AI summaries are for reference only.

If you connect Linear or GitHub, an approval screen shows what the agent will write before it writes to that tool. Only actions you approve are executed.

If you allow an external AI agent such as Claude or ChatGPT to read your workspace, that agent can read all projects in the workspace and meeting transcripts (including attendees' utterances and names) within the scope you yourself can view. The agent can only read content and cannot change it.

An external AI agent's access expires automatically if it is not used for 90 days. You can disconnect Linear and GitHub integrations and external AI agents at any time, and stored access grants are destroyed when you do.

Essential cookies that keep you signed in: they remain after you close the browser, expire at most 30 days after you last used the Service, and are deleted when you sign out. If you block them in your browser, you cannot sign in.

To remember the state of the screen, screen settings such as the sidebar state, the workspace and project you last opened, and whether you have already seen guidance, along with recording status used to track the recording tab and recover a dropped recording, are stored in cookies and browser storage.

These values are stored separately for each browser and device. Records of which guidance you have already seen are cleared when you sign out.

To improve the Service, HeyMoa collects navigation paths, performance metrics, and feature usage records with Google Analytics 4, PostHog, Vercel Analytics, and Vercel Speed Insights. These tools may store identifiers in your browser or collect access information.

Instead of your email or name, PostHog receives internal member and workspace identifiers, the features you used and when (for example, creating a meeting, starting a recording, or completing a review), the address of the screens you visited (without extra details such as search conditions attached to the address), and device and browser information. Session recording and automatic click capture are not used.

Records processed on the server, such as meeting analyses, dropped recording connections, notifications and notification emails sent, automatic meeting endings, and account deletions, are sent to PostHog. Only member identifiers, workspace identifiers, and values such as the type, count, or number of days of each record are sent, never meeting titles or email addresses. Account deletion records include the type of reason chosen, but not any text you entered. Records processed on the server cannot be refused through browser settings.

The contents of meeting audio, transcripts, and notes are never sent to analytics tools.

How to refuse: you can block or delete cookies and site data in your browser settings. For example, in Chrome you can delete cookies and site data under Settings > Privacy and security > Delete browsing data, and in Safari under Settings > Privacy > Manage Website Data. You can also block requests to analytics tools with your browser's tracking prevention or a content-blocking extension. Google Analytics can be refused with the opt-out browser add-on provided by Google (tools.google.com/dlpage/gaoptout).

Refusing analytics tools does not limit your use of the Service. Deleting the authentication cookies, however, means you will need to sign in again.

HeyMoa destroys personal information without delay once the periods below end or you delete it. Records the table says are kept after account deletion are kept until the end of that period.

Account deletion: when you delete your account, you are signed out on every device right away and can no longer access the account. Account information and the data of workspaces you used alone are deleted from the service storage in turn, and remain in backups for up to 7 days before being removed automatically.

Names that remain in team records: even if you leave a workspace or delete your account, your name remains in that workspace's past meeting records. Attendee, speaker, approval, and task assignee labels, and your own utterances in transcripts, are the team's records, so the remaining members can still see them. Your email, profile photo, and sign-in method are deleted. If you want your utterances in team records deleted, you can ask the workspace administrator or HeyMoa (Article 8).

Workspace deletion: when an administrator deletes a workspace, all members lose access right away. The workspace's notes, transcripts, audio, agent conversations, integrations, and invitations are deleted in turn and remain in backups for up to 7 days.

Service notifications: a notification stores the meeting title and workspace name as they were when it was received. So even if a meeting note is deleted or someone leaves the workspace, the title remains in the recipient's notification list. When you open a notification, access permissions are checked again, and nothing is shown without permission.

Copies that cannot be recalled: emails already sent remain in recipients' mailboxes, and HeyMoa cannot recall or delete them. Inquiry content forwarded to Slack as an operations alert cannot be recalled either (Article 7). This is the same even if you delete a note or your account.

How data is destroyed: electronic files are deleted so that they cannot be recovered. Information that must be kept under other laws is kept separately from other information for that period.

HeyMoa does not provide or sell your personal information to third parties. When you share meeting notes by email yourself or connect an external tool or external AI agent, the data goes where you chose.

To operate the Service, HeyMoa entrusts processing to the providers below to the extent necessary. Personal information is transferred abroad to providers outside the Republic of Korea. This entrustment is necessary to perform the service contract. The following is disclosed under Article 28-8(1)(3) of the Personal Information Protection Act.

All transfers use encrypted network transmission. The retention periods below are taken from each provider's published policy as of October 22, 2026.

OpenRouter further entrusts processing to AI model providers (OpenAI, Microsoft, TypeSafe) (sub-processing). HeyMoa sends these requests on terms that inputs and outputs are not stored (zero data retention) and are not used for training.

If you do not want your information transferred abroad, you can refuse by not using the feature or by disconnecting it. If you refuse transfers needed for speech recognition, speaker separation, AI summaries, or web hosting, you cannot use those features. Analytics tools can be refused as described in Article 5 (except records the server sends to PostHog), and refusing them does not limit your use of the Service.

Details for each provider are below.

Please send inquiries about international transfers to team.minswon@gmail.com.

You can at any time ask to access, correct, delete, or stop the processing of your personal information and meeting data, and you can withdraw your consent.

What you can do directly in the Service: edit your profile, disconnect external tools and external AI agents, delete notes (workspace administrators), leave or delete workspaces, and delete your account (Settings > My Account).

For other requests, email team.minswon@gmail.com or the privacy officer in Article 10. After verifying your identity, HeyMoa tells you the outcome within 10 days of receiving the request. If HeyMoa must refuse or delay a request, it tells you why and how to object.

You can also make requests through a legal representative or an authorized agent, who must include a power of attorney.

Meeting attendees who have not signed up: you can ask the user who started the recording or that workspace's administrator, or email HeyMoa. HeyMoa confirms that you attended the meeting and then handles the request together with the workspace administrator.

For meeting records in a workspace that a company or organization uses for work, that company or organization decides how they are handled. In that case, HeyMoa forwards the request to the workspace administrator.

Information that must be kept under other laws is deleted after that retention period ends, even if you request deletion earlier.

HeyMoa takes the following measures to protect personal information.

Encryption: all data in transit is encrypted. The database and audio storage are encrypted at rest, and external tool integration credentials are additionally encrypted before they are stored.

Access control: meeting data can be viewed only by workspace members and by the people and services you share it with by email or connect. The audio storage is not public, and audio is delivered to the speaker separation provider through a temporary link that expires after a short time.

Credential management: cookies used to keep you signed in are protected so that scripts on web pages cannot read them. When you delete your account, remaining sign-ins and real-time connections are cut right away; when a workspace is deleted, connections to that workspace are cut.

Log management: meeting content is not written to server logs, and logs are deleted after the set period (Article 6).

HeyMoa designates the following privacy officer to oversee the processing of personal information and to handle users' inquiries and complaints.

Please contact the privacy officer about inquiries, complaints, or remedies concerning personal information. HeyMoa will respond and act without delay.

To seek remedies for an infringement of personal information, you can apply for dispute mediation or consultation with the agencies below. These agencies are independent of HeyMoa.

This Privacy Policy applies from the effective date shown at the top of this page.

When this Privacy Policy changes, HeyMoa announces what is changing and the effective date on this page and in the Service starting 7 days before the effective date. Changes unfavorable to you are announced starting 30 days before the effective date. When important items such as the information processed, purposes, or international transfers change, a comparison of the old and new text is published as well. Minor changes, such as updated processor contact details, may be announced together.

Previous versions of this Privacy Policy and the periods they applied are listed below.