Privacy Policy

Maglis is a product of InfiniSync, a division of Arotech for Information Technology (أروتك لتكنولوجيا المعلومات), Commercial Registry No. 105300000152797, Cairo, Egypt (“Maglis”, “we”, “us”).

For account data, and for workspaces used by individuals, Maglis is the data controller. Where an organisation provides Maglis to its staff under a contract, that organisation is the controller of its meeting data and Maglis processes it on the organisation's behalf under a Data Processing Agreement. Contact: privacy@maglis.ai.

• Account data: name, email address, organisation, role, language and currency preference, and sign-in records.
• Meeting data: meeting title, participants, start time and platform; the audio recording; the transcript; and the documents Maglis drafts (minutes, action items, proposals), with your edits.
• Files you upload: audio or video recordings you submit for transcription.
• Ask Maglis conversations: the questions you ask and the answers given.
• Connected accounts: if you connect a calendar, Zoom or Slack, the connection tokens and the event details we need to join your meetings.
• Billing data: plan, invoices and billing contact. Card details are collected and held by our payment processor; Maglis never sees or stores full card numbers.
• Product telemetry: usage events, error reports and performance metrics. On-screen text and form inputs are masked, so no meeting content is captured.

We do not sell personal data, we do not show advertising, and we do not use your meeting data for any purpose other than providing the service to you.

Maglis uses AI models to transcribe your meetings and draft your documents. Neither Maglis nor any of our providers uses your recordings, transcripts, documents or Ask Maglis conversations to train, fine-tune or improve any AI model. AI-drafted documents can contain errors; review them before you rely on them or send them.

We use a small number of providers to run the service: meeting capture, speech-to-text, AI drafting, database and storage, application hosting, background processing, email, error monitoring, analytics and payments. Each is bound by a written contract to keep your data confidential, to process it only to provide the service, to protect it with appropriate security, and never to use it to train their models. Organisations using Maglis under contract receive the named list in their Data Processing Agreement and 30 days' notice before any change. Others can request it from privacy@maglis.ai.

Your data is stored in the European Union, in Frankfurt, Germany, and backups stay in the same region. Speech-to-text and AI drafting are processed in the United States. These transfers are protected by contracts that include the EU Standard Contractual Clauses and by the security measures in section 7. The speech-to-text provider deletes its working copy once your document is ready, and the AI provider keeps no copy of your data.

Where the law of your country restricts transfers of personal data abroad, including Egypt's Personal Data Protection Law and Bahrain's Personal Data Protection Law, we rely on the safeguards those laws recognise.

• All traffic is encrypted in transit with TLS 1.2 or higher, including between Maglis and its providers.
• All stored data, including backups, is encrypted at rest with AES-256.
• Calendar, Zoom and Slack connection tokens are additionally encrypted by Maglis with AES-256-GCM.
• Each workspace is isolated from every other by database row-level security.
• Changes to meetings, recordings, documents and share links are written to an append-only audit log.
• Production access is limited to named founders, each protected by multi-factor authentication.

No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as the law requires. Report security concerns to security@maglis.ai.

Workspace owners and admins can delete a meeting at any time, which removes its transcript, documents and share links and deletes any recording still held by a provider. Owners can delete the whole workspace at any time.

• With people you choose: when you send a document by email or create a share link. Share links can expire and can be revoked at any time.
• With the members of your workspace, according to their role.
• With our service providers, under section 5.
• With authorities, only where the law compels us. Where the law allows, we tell the affected customer first and disclose no more than required.
• With a successor, if our business is merged or sold, under the same protections as this policy and with notice to you.

Depending on where you live, including under Egypt's Personal Data Protection Law (Law No. 151 of 2020), Bahrain's Personal Data Protection Law (Law No. 30 of 2018) and the EU GDPR, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and withdraw consent at any time.

Email privacy@maglis.ai. We respond within 30 days. If your workspace belongs to an organisation, we may refer your request to it as the controller. You can also complain to your data-protection authority.

The Maglis notetaker joins meetings visibly under its own name and announces itself in the meeting chat. If you took part in a meeting recorded with Maglis, you can ask the person who invited the notetaker to delete the meeting, or contact privacy@maglis.ai.

If you connect Google Calendar, Maglis requests read-only access to your calendar events (calendar.events.readonly). We read upcoming events to find meeting links, times, titles and guest email addresses, so the notetaker can join the meetings you choose and documents can be sent to attendees. Maglis never creates, changes or deletes calendar events.

Maglis's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never sell this data, use it for advertising or use it to train AI models, and people at Maglis do not read it except with your permission, for security, or where the law requires. Disconnecting Google Calendar stops all reading and deletes the stored tokens.

We use essential cookies for sign-in, session security and your language preference (maglis_locale), and a privacy-respecting analytics tool that masks on-screen text. We use no advertising or cross-site tracking cookies.

Maglis is a business service and is not intended for anyone under 18. We do not knowingly collect their personal data; if you believe we have, contact us and we will delete it.

We will post any change on this page with a new date. For a material change, we will email workspace owners at least 30 days before it takes effect.

Privacy questions and requests: privacy@maglis.ai. Security reports: security@maglis.ai. Postal: Arotech for Information Technology, Cairo, Egypt.