Ata

Privacy policy

Last updated: October 6, 2026

Ata is a browser extension that transcribes meetings on Google Meet, Zoom and Microsoft Teams and uses artificial intelligence to generate minutes, summaries and tasks. This page explains, in plain language, what data passes through Ata, what it is used for, and what you can do about it.

We do not sell your data, we do not show ads, and we process meeting content to deliver the features you use and protect the service, as described below.

1. What we collect

• Account data. Your email and your account identifier, when you sign in with email and password, Google or Microsoft. This lets you access your meetings from any device.
• Meeting content. The text of the captions shown by the meeting platform itself, with the name of who spoke and the time of each line, plus the title, the platform, the duration, and any notes, highlights and tags you add.
• Generated summaries. The minutes, summaries and chat answers you ask the AI for.
• Calendar, if you connect it. With read-only access, we read the title, time, link and attendees of upcoming events, to name the meeting and let you know when it is about to start. Ata never creates, changes or deletes events.
• Assistant and FAQ questions. When available, this feature sends your question and previous messages included in the request to Azure to answer questions about Ata. Questions and answers are stored in Supabase for review, answer reuse and content improvement. Records include language and request source, without attaching an account or storing the IP in that table; the IP is used temporarily to limit requests. Text may contain personal information you enter: do not submit transcripts or sensitive information here. Closing the tab ends the local conversation but does not delete questions already recorded.
• Meeting ratings, if you give one. After a meeting, Ata asks how it went, on a scale of one to five stars, with an optional comment. We store the rating, the comment, and a few numbers about the meeting that help us understand the rating: platform, extension version, language, number of speaking turns, duration, how much of the speech had no speaker name, and whether minutes had already been generated. No excerpt of the conversation is included. We use this only to improve Ata.
• Testimonials, if you submit one. Through the site's testimonials page, we store name, role, email, rating, text and photo. The email is never published. Everything else appears on the site only with your authorization and after review, and you can ask for it to be removed whenever you want.
• Early access list, if you join it. Through the site's access page, we store your name, your email, how you said you heard about Ata, and, when it exists, the campaign or link that brought you to the site. We use this only to send your invitation and to understand which outreach works. You can ask to leave the list at any time, and your data is deleted.
• Subscription. If you subscribe to the Pro plan, we store the plan status. Payment is handled by Stripe, and we do not receive or store your card details.

2. Where the data lives

Meetings are stored first in your browser's local storage. When you are signed in to your account, they are also synced to our servers, hosted on Supabase, so that you do not lose anything when you switch computers. Access depends on your account, server security rules and the sharing options you enable. Providers may process data outside Brazil; the recipients and purposes are described in this policy.

3. Artificial intelligence: data and processes

The data path: captions and notes in your browser → Ata's server → Microsoft Azure OpenAI → an answer in Ata. Syncing meetings to your Supabase account is separate from AI generation.

• What do we send, and when? When you generate minutes, summaries or tasks, we send transcript text, speaker names, template instructions and context such as the title, capture dates, duration and time zone. Long meetings may be split into excerpts and intermediate summaries. Chat requests include your question, the conversation history included in the request, and the selected meeting transcript or relevant excerpts from several meetings when you search your whole history.
• Is anything sent automatically? With Automatic title enabled, a transcript excerpt may be sent when the meeting ends to suggest a title, without another click. Turn this off in Settings → General to stop this automatic request. Capturing captions does not, by itself, require generating AI minutes.
• Who provides the AI? We use GPT models hosted by Microsoft in Azure OpenAI. Ata manages the model and credentials on the server. You do not need a ChatGPT account or a personal AI key. This integration does not send requests to ChatGPT or the OpenAI-operated API.
• Does content train models? Ata does not use your meetings to train models. Under Azure's conditions, inputs and outputs are not made available to OpenAI or used to train generative foundation models without the customer's permission or instruction. Ata does not authorize that use.
• Does Microsoft retain requests? Our integration disables the stored completions feature. This does not remove Azure's safety controls: content flagged for potential abuse may be retained and reviewed by authorized Microsoft personnel. We do not guarantee zero retention or claim an approved exemption from this monitoring.
• Where is data processed? We use Azure's Global deployment type: processing may take place outside Brazil and outside the resource's region. The resource location alone does not restrict the country where AI processes the text.
• Are audio, video or images sent to AI? This flow sends text. Ata does not record audio or video. Capture screen downloads an image of the visible tab to your device; it does not automatically send that image to AI or meeting sync.

See Microsoft's descriptions of Azure privacy and abuse monitoring.

4. When something is shared

• Public links. If you create a share link, anyone with the link can view that set of minutes. We count how many times the link was opened and through which channel (email, WhatsApp, Slack), to show you whether the minutes were received. We do not record who opened it or their address.
• Teams. Meetings you place in a team become visible, with the transcript and the minutes, to the people on that team. Team members can see each other's emails. When you leave the team, or remove the meeting from it, it becomes only yours again.
• Sending minutes. When you send minutes by email or WhatsApp, the message goes out through your own email or WhatsApp: Ata does not receive the list of recipients. On Slack, the message goes straight from your browser to the channel you connected, and the channel address is stored only in your browser.
• Connected AI assistants. If you connect Ata to an assistant compatible with MCP, that assistant can query the content authorized by the connector using your personal URL. Processing by that external assistant follows its own policies, which may differ from those of the Azure service Ata uses. You can revoke the URL in Connect to AI; this does not delete copies the assistant already received.
• Published testimonials. If you submit a testimonial and authorize it, your name, role, photo, rating and text become visible to anyone on the site.
• Ata's administration. The team that administers Ata sees account data (email, plan, access dates, number and titles of meetings) to provide support and handle billing. It does not read meeting content or minutes through the admin panel, and every change made to an account is logged.
• Service providers. Supabase (storage, authentication and server processing), Microsoft Azure OpenAI (AI generation), Cloudflare (website hosting and delivery), Stripe (payments), Google and Microsoft (login and calendar, when you connect them). They receive only what is necessary to provide the service.

Outside of these cases, we only share data when the law requires it.

5. Analytics on this site

On the ataai.app site, we measure how people browse to understand what works and to improve the page. This applies only to the site, not to the extension.

• Cloudflare Web Analytics. Counts visits and page views without using cookies and without identifying you.
• Google Analytics and Microsoft Clarity. Record pages visited, clicks, scrolling and the path taken through the site, and Clarity also records the browsing session anonymously. These two tools use cookies and are only enabled if you allow analytics in the cookie notice. The data stays with Google and Microsoft, who use it to generate these reports.
• Meta Pixel (optional). With your specific advertising consent, we measure visits, confirmed registrations and confirmed payments to evaluate Ata ads on Facebook and Instagram. Meta receives the event, advertising cookie/click identifiers and, for purchases, the amount and currency. We do not send emails, names, transcripts or meeting content. The code runs on a separate page outside the dashboard and cannot access meeting pages. You can withdraw consent in Cookie preferences; advertising is unchecked by default. Meta may process data internationally under its privacy policy. Ad blockers and declined consent may prevent measurement.

Campaign and referral attribution. When analytics consent and measurement are enabled, a random identifier lasting up to 30 days links visits, creatives, registration and account access. Withdrawing consent removes this optional association. A separate temporary proof can confirm a referral explicitly chosen during registration, even without analytics; it expires within 30 days and does not contain your login session. Purchase and credit records are kept separately for service delivery, reconciliation and audit. See Credits and referrals for the pilot terms in Portuguese.

Sign-up origin. To learn which channels bring new accounts, the site stores in your browser, for up to 90 days, the link's campaign parameters (utm), the domain of the site that sent you (not the full address) and the page you landed on. When you create an account, this origin is saved once to the account, based on our legitimate interest in understanding how Ata is promoted. We do not use it for advertising or share it with third parties. You can ask for it to be deleted at [email protected], and it is deleted along with the account.

You can change your choice at any time through the Cookie preferences link in the site footer. If you decline, we delete the cookies from these tools on this site.

6. Your rights and controls

Under Brazil's General Data Protection Law (LGPD) and, where applicable, the GDPR, you can access, correct, export and delete your data. Inside the extension, under Settings, you can:

• export a copy of everything Ata has stored;
• delete meetings and summaries from this device and request deletion of synced copies while signed in;
• delete your account, under Settings, Account, or at ataai.app/app: this deletes meetings, minutes, templates, any teams created only by you, and your login, and cancels the subscription immediately;
• set a local cleanup period: while the extension runs, it removes old ended meetings from this browser and preserves favorites. The default is Never. This routine does not delete cloud copies, which may return when syncing;
• hide email, phone, Brazilian ID/tax and card-number patterns in the text of recaps sent by email/WhatsApp. Review the result: this filter does not cover all personal data, change public-link content or run before AI requests;
• disconnect the calendar at any time;
• dismiss the request to rate a meeting, by clicking "Not now".

Cloud deletion requires a connection and completion of the server request. Clearing the browser alone does not confirm cloud deletion. If data remains after deletion, contact us to check removal, including FAQ questions and ratings. We do not promise instant deletion from backups, provider security records or copies exported or received by third parties. Feedback you submitted is kept without your email, only to fix errors. If you created a team with other people, transfer ownership of the team to someone else before deleting your account.

7. Meeting participants

8. Security

All communication with our servers uses an encrypted connection (HTTPS). Access to data is restricted per account, and AI provider keys are kept only on the server, never in the extension. Encryption protects transport; Ata servers and Microsoft need to process the text to generate answers. This is not end-to-end encryption.

9. Minors

Ata is not intended for anyone under 18, and we do not knowingly collect data from children.

10. Changes to this policy

If this policy changes in an important way, we will notify you inside the extension or by email before the change takes effect. The date at the top of this page shows the current version.

11. Talk to us

Questions, requests about your data, or any other privacy matter: [email protected].