Privacy policy

This policy explains what Smile Cast collects, why, and what you can do about it. It describes what the software actually does — including which third parties a meeting can call on — rather than a generic template.

1. Who is responsible for your data

Smile Cast operates this service and is the data controller for the accounts created on it. For business customers, the organisation that invited you may be the controller of the meeting content you create inside its workspace. Questions go to hello@smilecast.cc.

2. What we collect

• Account data. Name, email address, username, timezone, password (stored only as a salted hash — never in a readable form), and, if you choose one, a profile photo.
• Meeting data. Meeting titles, times, settings, who attended, and the codes used to join. This is the record that makes attendance reports and your meeting list work.
• Content you put in a meeting. Chat messages, questions and answers, poll votes, shared files, voice notes, shared notes and, if a host records, the recording. This exists so the meeting is useful after it ends, and can be exported or deleted by the workspace.
• Technical data. IP address, browser type, and the pages and endpoints you call. Used for security, rate limiting and diagnosing faults.
• Billing data. If you subscribe, your plan and payment status. Card details are handled by the payment provider; they never reach this server.

3. Media and meetings

Video and audio are carried directly between participants' browsers where the network allows. They are not recorded by default. A recording only happens when a host starts one, and the room shows a clear recording indicator to everyone while it runs. Uploading a finished recording to storage is a separate, deliberate action by the host.

4. Optional integrations and third parties

These are switched on or off by the operator, and each is described here so you know when it applies.

• Google reCAPTCHA. When enabled, sign-in and sign-up forms send a token to Google to score whether the submission looks automated. Google receives your IP address and signals from your browser. Google's own privacy terms apply.
• Sign in with Google. If you use it, Google tells us your name, email address and whether that email is verified. We store the email and name and nothing else; we never see your Google password.
• AI meeting assistant. When a hosted model is connected, the meeting's own chat, questions and notes are sent to that provider to write a summary. The assistant is optional: with no provider connected, summaries are written locally on this server and nothing leaves it.
• Payments. If paid plans are enabled, the payment provider processes the charge and shares only the result (plan, amount, status) with us.
• File storage. Uploaded recordings and files may be stored on this server or in a configured object-storage bucket (for example Amazon S3 or an S3-compatible service).

5. What we do not do

• We do not sell or rent your personal data.
• We do not use meeting content to target advertising.
• We do not read your meetings; access by staff is limited to what is needed to operate the service, and administrative actions are audit-logged.

6. How long we keep it

Account data is kept while your account exists. Meeting records, files, notes and recordings are kept until you or the workspace deletes them, or until the workspace is removed. Security and audit logs are kept for a limited period for fraud and incident investigation. When you delete your account we remove your personal data, subject to any records a business customer or the law requires us to keep.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, to object to certain processing, and to complain to a supervisory authority. Many of these are built into the product — you can edit your profile, export meeting notes and attendance, and delete meetings or your account. For anything else, contact us.

8. Security

Passwords are hashed, sessions are server-side and revocable, secrets are stored encrypted at rest, and traffic is served over TLS. No system is perfect; if we become aware of a breach affecting your data we will tell you and the relevant authority without undue delay.

9. Children

The service is not directed at children under the age required by local law to consent to data processing, and we do not knowingly collect their data.

10. Changes

When this policy changes we update the review date at the top. Material changes are announced in the product or by email where the law requires it.

11. Contact

Email hello@smilecast.cc.

This document describes how this software handles data. It is a starting point and not legal advice; have it reviewed for the jurisdictions you operate in before relying on it.