Privacy Policy

Last updated: 3 October 2026

This policy explains the personal data processed by the Qbitgate Meet web service and the Qbitgate mobile app (com.qbitwise.qbitgate).

Data controller: Qbitwise Inc.

1. Our core commitments

We do not use your data for advertising; the service shows no ads.
We do not sell, rent or otherwise commercially transfer your data to third parties.
We do not use your data to train AI models, and we require the same commitment from the providers we use.
We process the minimum data needed to run the service.
Meetings are not recorded by default.

2. Data we process

2.1. Account data

Name, email address, profile picture, optional organisation and location, session records.

Purpose: account creation, authentication, authorisation. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

We do not hold passwords. Sign-in is only via Google or Apple; no password is created or stored for you.

2.2. Identity verification and biometric data

This data is processed only when you use the identity-verified meeting feature and read your national ID card into the mobile app over NFC. If you do not use that feature, this section does not apply to you.

Data processed: national ID number, the name and date of birth read from the card, the biometric photo stored on the card chip, cryptographic signatures from the card and your device, and the public part of the device key generated on your phone.

Purpose: to verify that a participant holds the identity they claim, and to check during the meeting that the same person remains on camera. Legal basis: your explicit consent (GDPR Art. 9(2)(a)). Biometric data is a special category of personal data; you may withdraw consent and have all of it erased by deleting your account.

Who sees it in a meeting: In an identity-verified meeting, your name is shown to the other participants as the legal name on your ID card, and the meeting host can see the photo on your ID card during the meeting. If you join with your account, the company and location from your profile appear on your identity badge. If an AI expert is in the room, it may address you by name, using a form of address based on your gender. This is also shown on screen before you join.

We do not photograph your ID card and we do not store an image of it. Data is read from the chip over NFC in a cryptographically verifiable way. Face verification compares the chip photo against your live camera image.

2.3. Meeting content

Audio, video, screen sharing and chat messages during a meeting.

Purpose: providing the conferencing service. Legal basis: performance of a contract; explicit consent for optional features such as translation, transcription and the AI assistant.

When recording and transcription are off, audio and video are never written to disk; media is processed only while in transit.

2.4. Technical and operational data

IP address, device and browser information, connection quality metrics, session identifier, join timestamps, error logs.

Purpose: security, abuse prevention, service reliability. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) and legal obligation.

These records contain no meeting content (audio, video or transcript text) — only technical metadata.

2.5. Cookies and browser storage

We use only cookies that are strictly necessary for the service to work; we use no advertising or tracking cookies.

Session (qg_session, 30 days): recognises your session after you sign in.
Sign-in security (qg_oauth_google, qg_oauth_apple, 10 minutes): verifies during Google or Apple sign-in that the request is yours.
Device marker (qg_device, 1 year): a random identifier assigned to your browser when you create or join a meeting. It is used to prevent abuse and to stop a person the room owner has blocked from rejoining from the same browser; it is not used to track you on other sites.
Room host (qg_host_…, 6 hours): shows that you are the host of a Quick Meeting you opened without an account.
Preferences (qg_locale interface language; qg_ui_profile and qg_ui_auto screen layout; 1 year).

The name you use in meetings, your camera/microphone and video quality choices, encrypted-meeting keys, and the information needed to return to a meeting after a page reload are kept in your browser's local storage. Encrypted-meeting keys are never sent to our servers.

When you create a meeting without an account, a bot-protection check runs to prevent automated abuse; during this step your browser and connection information (such as your IP address) is processed only to detect bots.

3. Encryption

All network traffic is encrypted in transit with TLS 1.2+, and real-time media with DTLS-SRTP. This also applies to traffic between our own servers.

Identity and biometric data are stored with field-level AES-256-GCM encryption, with decryption keys held separately on the application server. In the mobile app, device keys are generated inside the phone's hardware security module (Android Keystore) and never leave the device.

4. End-to-end encryption (E2EE)

In E2EE-enabled meetings, media is encrypted on the participant's device and decrypted only on other participants' devices. Our media server routes packets but cannot access the content.

With E2EE on, real-time translation, transcription, summaries and the AI assistant cannot work — the server being unable to decrypt media is by definition a precondition for those features. The meeting owner makes this choice deliberately and the selected mode is visible to all participants. We never silently downgrade E2EE to enable a feature. Identity verification is likewise mutually exclusive with E2EE.

5. Real-time translation and transcription

When enabled, meeting audio is processed in real time for speech recognition and translation. The audio stream is not retained and is not used for model training.

In a room with transcription and AI summaries enabled, the transcript text is stored in our database so the meeting owner can read it afterwards. It is deleted automatically 90 days after the meeting ends; the owner can delete it earlier, and it is also deleted when the owner's account is deleted. If the owner marks a meeting for "legal hold", that meeting is exempt from automatic deletion.

Transcription is on by default in the Voice Translation Demo and High-Security Meeting types; in other rooms it is off and can be turned on in the room settings. In a room with transcription on, this is shown on screen before you join and indicated throughout the meeting.

6. AI voice assistant

When enabled, the assistant listens only on push-to-talk, when a user explicitly triggers it; it never listens continuously. While active, a visible indicator is shown to all participants.

7. Recording (video)

Meeting video recording is not currently available in the service; our system does not capture or store audio or video recordings of meetings.

If this feature is offered in future, all participants will be visibly notified when recording starts, and retention periods and deletion rights will be updated in this policy.

8. Retention periods

Account data: for as long as your account exists.
Meeting transcripts and summaries: deleted automatically 90 days after the meeting ends; the room owner can delete them earlier. Meetings the owner marks for "legal hold" are kept until the owner deletes them or the owner's account is deleted.
Identity and biometric data: for as long as your account exists; irreversibly erased when the account is deleted.
Web session: 30 days. Mobile app session: 30 minutes (held only in memory on the phone, never written to disk).
QR identity-verification and device-pairing codes: 3 minutes.
Technical records: at most 90 days. This includes server logs and meeting join records (IP address, device marker, join time, the name you used in the meeting). After this period the personal information is deleted; usage statistics that cannot be linked to a person (such as meeting duration and participant counts) may be kept.
Room blocks: when a room owner blocks someone from a room, the block record is kept until the room is deleted; blocks based on IP address are short-lived.
Backups: encrypted database backups are kept for 14 days; deleted data drops out of the backups at the end of that period.

9. Where data is held and who it is shared with

All of our servers are located in Türkiye (Istanbul). Our face verification service also runs on our own infrastructure.

We share data only with the providers needed to run the service:

Data centre (Türkiye, Istanbul) — server hosting.
Google and Apple (USA) — authentication at sign-in only; they pass us only your name, email and account identifier.

Your identity and biometric data are never transferred abroad and are not shared with any of the providers above.

10. Your rights

Under the GDPR (and Turkish KVKK Art. 11) you have the right to: learn whether your personal data is processed, access it and obtain a copy, request rectification, request erasure, object to processing, withdraw consent where processing is based on it, and seek compensation for damage caused by unlawful processing.

You can exercise access and erasure directly yourself: from your profile page you can download all of your data as JSON, and permanently delete your account together with all personal data. Deletion is irreversible and includes your identity and biometric data.

For other requests — or if you cannot access your account — email us at the address below. We complete requests within 30 days at the latest.

11. Children's data

The service is not designed for people under 18 and we do not knowingly collect personal data from them. If we become aware of such data, we delete it.

12. Security measures

TLS 1.2+ / DTLS-SRTP in transit; field-level AES-256-GCM encryption for identity and biometric data.
Optional end-to-end encryption (see section 4).
Role-based access control and least privilege.
Room access via short-lived, server-signed tickets; room locking and guest-access controls.
Mobile device keys generated in the hardware security module and bound to biometric authentication.
Regular dependency scanning and patching.

13. Data breach notification

If a personal data breach is identified, we notify the competent supervisory authority within 72 hours and affected individuals as soon as reasonably possible.

14. Changes to this policy

We announce material changes 30 days before they take effect, by email and/or in-product notice. The version is shown at the top of this page.