inlocus

Privacy Policy

What we collect, why, and what we don't do with it.

This is the legal-but-readable version. The short version: we record what you tell us to record, we use it to draft your tasks, and we don't sell or train on it.

EFFECTIVE · OCT 26, 2026·QUESTIONS? contact@inlocus.co

Who we are

Inlocus, Inc. ("Inlocus", "we", "us") is a Delaware C-corp based in San Francisco, California. We make a tool that turns your Google Meet conversations into approved Asana tasks. This Privacy Policy describes how we handle personal data when you use the Inlocus extension or website.

What we collect

From you, when you sign up

  • Account info — name, email, profile photo (if signing in with Google), workspace name.
  • Billing info — handled by Stripe; we receive only the last 4 digits of your card and billing country.

From your meetings, when you record

  • Audio from the Google Meet tab.
  • Transcript generated from that audio.
  • Drafted tasks generated from the transcript, plus any edits you make.
  • Meeting metadata — title, start/end time, attendee names from your calendar (if connected), the IDs of synced Asana tasks.

From integrations

  • Google Calendar (optional) — read-only access to your events, used to surface upcoming meetings in the extension popup.
  • Asana — read/write access to the projects you authorize, used to create the tasks you approve.

Automatically

  • Usage data — pages visited, features used, errors encountered. Aggregated and used to improve the product.
  • Device data — browser, OS, IP address, language. Used for security and abuse detection.

Why we collect it

We use your data only to:

  • Run the service you signed up for — record, transcribe, draft, sync.
  • Bill you (Pro plan).
  • Fix bugs and improve the product.
  • Detect abuse and keep your account secure.
  • Send you transactional email (receipts, security alerts) and — only if you opt in — occasional product updates.

Who we share it with

We share data only with the sub-processors listed on our Security page:

  • Google Cloud Platform — hosting and storage.
  • OpenAI — transcription and task drafting (zero-retention API).
  • Stripe — billing.
  • Postmark — transactional email.

For running the website itself (no meeting content is shared with them):

  • PostHog — product analytics (US). See Cookies.
  • Vercel — website hosting and cookieless traffic analytics (US).

We may also disclose data if compelled by valid legal process. We will tell you about it unless we are legally prohibited from doing so. We have not received any National Security Letters or FISA orders to date.

No AI training, no sale

We do not sell your data. Not now, not ever — and the term "sale" here uses the broad CCPA definition.

We do not train AI models on your meeting content. We don't, our model vendors don't, nobody does. This is contractual, not aspirational.

How long we keep it

  • Audio & transcripts — for the retention window your workspace admin set (7, 30, 90 days, or delete-after-each-meeting).
  • Drafted tasks & meeting metadata — for the life of the workspace, unless you delete the meeting.
  • Account & billing records — for as long as the account is active, plus 7 years after closure (for tax compliance).
  • Encrypted backups — purged within 30 days of primary deletion.

Your rights

Depending on where you live, you have rights to:

  • Access the personal data we hold about you.
  • Correct data that's wrong.
  • Delete your account and associated data.
  • Export your data in a portable format.
  • Object to certain processing.
  • Lodge a complaint with your data protection authority.

Most of these are self-serve from your account settings. For the rest, email contact@inlocus.co — we respond within 30 days.

Cookies and similar storage

We do not run advertising trackers and we do not use Google Analytics. We use product analytics (PostHog) to understand how the site is used, under our legitimate interest in running and improving it. How that works depends on your choice in the cookie banner:

  • Before you choose, or if you reject: we record page views and clicks without storing anything on your device. Visitors are counted using a hash that PostHog computes on its servers and rotates daily, so you can't be recognized across days.
  • If you accept: PostHog sets a first-party cookie so it can recognize repeat visits and sessions.
  • Global Privacy Control: if your browser sends a GPC signal, we treat it as a rejection and don't ask.

What we store on your device:

  • Sign-in tokens (browser local storage) — strictly necessary to keep you signed in. Removed when you sign out.
  • Your cookie choice (cookie_consent and __ph_opt_in_out_*, local storage) — strictly necessary to remember your answer. We ask again after 12 months.
  • Analytics (ph_*_posthog cookie and local storage) — only after you accept. Expires after 12 months.

Hosting analytics from Vercel are cookieless and don't store anything on your device. You can change or withdraw your choice at any time via Cookie settings in the site footer.

Children

Inlocus is for workplace use. We do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us and we will delete it.

Changes to this policy

We will post any changes here and, for material changes, notify account admins by email at least 30 days before the changes take effect. The "Effective" date at the top tells you which version you're reading.

Contact

Privacy questions: contact@inlocus.co
Security reports: support@inlocus.co
Anything else: contact@inlocus.co

Related: review our Security and Terms of Use.