Privacy Policy

1. Introduction

RAITECH AI LLC ("RAITECH," "Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use HeyFibi and its AI meeting assistant Fibi, together with our related platforms and websites (collectively, the "Services").

This Privacy Policy applies to information we collect:

Through our Services, including the HeyFibi platform and the Fibi AI meeting assistant
Through our websites, including www.heyfibi.com
In email, text, and other electronic communications between you and RAITECH
Through the meeting bot that joins meetings on Zoom, Google Meet, and Microsoft Teams
When you connect third-party knowledge sources (such as Notion, Google Drive, OneDrive) to your HeyFibi account
When you interact with our advertising on third-party websites and services

This Privacy Policy does not apply to information collected by third parties, including third-party websites, applications, or services that may link to or be accessible from our Services.

IMPORTANT — Meeting Participants: If you are a participant in a meeting that a HeyFibi customer has invited Fibi to join, the HeyFibi customer (typically the meeting host or their organization) controls how your meeting data is used. This Privacy Policy primarily governs our collection and use of data from our direct customers, website visitors, and the limited data we process on behalf of customers as a service provider.

By using our Services, you acknowledge that you have read and agree to this Privacy Policy. If you do not agree, do not use our Services.

2. Information We Collect

2.1 Information You Provide as an Account Holder

When you register, subscribe, or communicate with us, we collect:

Contact information (name, email, profile picture, organization name)
Account credentials (managed via Google SSO at MVP — we receive your name, email, and Google account ID; we do not receive or store your Google password)
Business information (company name, role, team size)
Payment information (processed and stored by Stripe — we do not store full card numbers on our servers)
Communications, feedback, and support requests
Configuration data for Fibi (agent name, custom voice selection, wake word settings, knowledge source selections, citation display setting, retention preferences)

2.2 Knowledge Sources You Connect

When you connect a third-party knowledge source (Notion, Google Drive, OneDrive, or uploaded documents) to your HeyFibi account, we process:

OAuth authorization tokens (handled via Composio, our third-party integration and OAuth management partner — see Section 5)
Document content, metadata, and structure necessary to index and retrieve information during meetings
Vector embeddings derived from your content, stored in our database to enable Fibi to retrieve relevant passages during meetings
Source citations (which document, page, or section a Fibi answer was drawn from), where citation display is enabled for the agent

Every file you upload directly, and every file, folder, or page you connect from Google Drive, OneDrive, or Notion, is indexed into our database so Fibi can retrieve it during meetings. When you remove a document, file, or page from your connected sources, it is deleted from our database immediately (see Section 6.4 and Section 7.1).

Connecting a knowledge source through Composio grants HeyFibi permission to access that specific third-party account or service on your behalf. You can revoke this permission at any time from the Sources section of your workspace, which immediately disconnects the integration and stops any further access.

We only access content from sources you have explicitly connected. We do not browse, index, or retain content from sources you have not connected.

For full detail on how we protect confidential content in connected knowledge sources, see Section 6.4.

2.3 Meeting Data

When you invite Fibi to a meeting on Zoom, Google Meet, or Microsoft Teams, we process the following on your behalf:

Meeting audio: Streamed in real time through our meeting bot infrastructure to our speech-to-text provider for transcription. We do not retain raw audio recordings — audio is processed in transit and discarded.
Wake-word detection: A small audio buffer is processed by an on-device wake-word engine to detect the phrase "Hey Fibi." This buffer is not retained or transmitted off the processing pipeline.
Meeting transcripts: Generated from meeting audio and stored in your HeyFibi workspace.
Fibi questions and answers: The questions asked of Fibi during the meeting, the answers Fibi provided, and the source citations for each answer where citation display is enabled for that agent.
Meeting metadata: Participants' display names as shown in the meeting platform, meeting platform, start/end time, duration, and the calendar/meeting URL you provided.
Post-meeting outputs: Summaries and action items generated after the meeting.

A note on meeting participants: Display names and any statements made by other participants during the meeting will appear in transcripts and summaries. The HeyFibi customer who invited Fibi is responsible for obtaining consent from all meeting participants in accordance with applicable recording and consent laws (see Section 6).

2.4 Information Collected Automatically

When you use our Services, we automatically collect:

Device information (IP address, browser type, operating system)
Usage data (pages visited, features used, session duration, meetings attended)
Log data (access times, errors, system activity)
General geographic location derived from IP address
Product event data including button clicks, page views, feature interactions, and session events. This data is processed through our product analytics provider for the purpose of understanding and improving the Services. Product event data does not include meeting content, transcripts, document content, or Fibi questions and answers.
Cookies and similar tracking technologies (see Section 10)

We do not record user sessions, capture keystrokes, or replay user interactions with our Services.

2.5 Information from Third Parties

We may receive information from:

Authentication providers when you sign in with Google SSO (name, email, profile information)
Integration providers when you connect a third-party knowledge source
Payment processors regarding subscription and billing status
Public business databases for the limited purpose of validating account information

2.6 Sensitive Personal Information

We do not intentionally collect sensitive personal information (Social Security numbers, financial account numbers, health information, biometric identifiers, or precise geolocation). If you upload documents or connect knowledge sources containing such information, you are responsible for ensuring you have the right to do so. We strongly recommend you do not connect knowledge sources containing regulated data (such as PHI subject to HIPAA, or payment card data subject to PCI DSS) to HeyFibi. HeyFibi is not currently HIPAA-compliant and does not sign Business Associate Agreements (BAAs).

Our Acceptable Use Policy contains a full list of content categories that may not be connected to or processed by the Services.

3. How We Use Your Information

We use information for:

Service Delivery: Operating the platform, processing payments, managing accounts, providing customer support, indexing your connected knowledge sources, dispatching Fibi to meetings, generating transcripts, answering questions during meetings, generating post-meeting summaries, and maintaining the Services.

Communications: Sending service notifications, transactional emails (trial reminders, billing receipts, password changes), responding to support inquiries, and sending marketing communications (with consent where required).

Improvement and Development: Analyzing usage patterns, monitoring product performance, detecting and fixing bugs, and developing new features using only aggregated and de-identified data.

Security and Compliance: Detecting threats, preventing fraud, investigating abuse or policy violations, complying with legal obligations, and protecting the rights and safety of users.

Business Operations: Managing customer relationships, facilitating corporate transactions, conducting internal audits, and managing vendors.

3.1 AI Training Restrictions — Important

We contractually prohibit our AI subprocessors from using your data to train their general-purpose models. See Section 5 for the subprocessor categories and the linked subprocessor page for current named vendors.

4. Legal Basis for Processing

For individuals in jurisdictions requiring legal bases for processing, we process personal information based on:

Contract Performance — Providing the Services you subscribed to
Legitimate Interests — Improving the Services, detecting fraud, conducting analytics, marketing to businesses
Consent — Marketing communications (where required), optional data collection, certain cookies, and processing of any sensitive information
Legal Obligations — Complying with laws, responding to legal requests, meeting regulatory requirements

5. How We Share Your Information

We do not sell personal information. We share information only with the categories of recipients described below, all of whom are contractually obligated to protect it.

5.1 Subprocessors by Category

We rely on third-party service providers to deliver the Services. We disclose the categories of subprocessors below in this privacy policy. A current, named list of our subprocessors, along with each provider's purpose, data type, and region, is maintained at heyfibi.com/subprocessors and updated when material changes occur.

Meeting platforms. Fibi joins meetings hosted on Zoom, Google Meet, and Microsoft Teams. These platforms are not subprocessors but are the venues in which our Services operate. Their handling of meeting data is governed by their own terms and privacy policies.

Subprocessor change notice. We will provide notice via email or in-app announcement at least 30 days before adding a new material subprocessor.

5.2 Zero Data Retention for Meeting Content at Subprocessors

We operate a Zero Data Retention policy with respect to meeting content (audio, transcripts, Fibi questions and answers, summaries, and action items) held by our subprocessors. This means:

Meeting audio is not stored by our meeting bot or speech-to-text providers after processing — it is streamed in transit and discarded.
Transcripts and Fibi answers are not retained by LLM or text-to-speech providers after the immediate processing required to generate the response.
Meeting content is never used to train internal or external AI models by RAITECH or by our subprocessors.

Meeting content is stored only on systems we control, in your dedicated workspace, and is subject to the retention rules in Section 7.

Product event data is treated separately. Product event data (button clicks, page views, feature interactions, session events) is processed by our product analytics provider in accordance with their published terms and our data processing agreement with them. Product event data is not meeting content and does not include transcripts, document content, or Fibi questions and answers. Our product analytics provider is contractually prohibited from using customer data to train AI models.

5.3 Other Recipients

HeyFibi Account Holders Who Invited Fibi (for meeting participants): If you are a participant in a meeting hosted by a HeyFibi customer, your transcript, statements, and any questions you ask Fibi will be available to the HeyFibi account holder who invited Fibi to the meeting and, depending on workspace settings, to other members of that workspace.

Business Transfers: If we are involved in a merger, acquisition, or sale of assets, information may be transferred. We will notify affected customers.

Legal Requirements: We may disclose information to comply with applicable laws, respond to lawful subpoenas or court orders, enforce our agreements, protect rights and safety, or address security issues.

With Your Consent: When you explicitly authorize sharing.

Aggregated and De-identified Data: We may share aggregated or de-identified data that cannot reasonably be used to identify you.

6. Meeting Recording, Consent, Participant Rights, and Confidential Sources

6.1 Fibi Joins Meetings as a Visible Participant

When invited to a meeting, Fibi joins as a named, visible participant. Immediately upon joining, Fibi posts a message in the meeting chat disclosing that: (1) Fibi AI has joined the call, (2) the call will be recorded and transcribed, and (3) Fibi is actively listening to the conversation and will respond to direct questions using a wake word.

Host control. The meeting host, or the HeyFibi account holder who invited Fibi, can remove Fibi from the meeting at any time using the meeting platform's standard participant controls (e.g., removing a participant). Once removed, Fibi immediately stops listening to and processing audio for that meeting.

6.2 Customer Responsibility for Participant Consent

The HeyFibi account holder who invites Fibi to a meeting is responsible for obtaining any required consent from other meeting participants under applicable federal, state, and local recording and wiretapping laws.

Two-party (all-party) consent jurisdictions in the United States include but are not limited to: California, Connecticut, Delaware, Florida, Hawaii, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Vermont, and Washington. If any participant is located in one of these jurisdictions, all participants must typically consent to the meeting being recorded or transcribed.

We provide tools to support consent — including the in-meeting chat notification, whose consent message can be customized for each Fibi agent in the agent configuration — but we cannot verify compliance on the customer's behalf.

6.3 Rights of Meeting Participants

If you are a meeting participant (not a HeyFibi account holder) and you wish to:

Object to your statements being processed by Fibi during a meeting
Request a copy of, or deletion of, transcript data containing your statements
Understand who controls the meeting data

you should first contact the meeting host or their organization, as they control the data.

If the meeting host will not respond to your request, you may contact us directly at privacy@heyfibi.com. We will work with the relevant HeyFibi customer and, where required by applicable law, take reasonable steps to delete or redact data identifying you from transcripts and summaries within 30 days, subject to verification of your identity and the customer's legitimate business need to retain the underlying meeting record.

6.4 Connected Knowledge Sources and Confidentiality

When you connect a knowledge source to HeyFibi, the following protections apply to your content. This section is the primary statement of how we protect confidential customer content.

You control what Fibi can see.

Fibi only accesses sources you explicitly select. We do not browse, index, or retain content from sources you have not connected.
Workspace administrators may further restrict which sources are available for use within the workspace.
For each meeting, the meeting inviter selects which connected sources Fibi may use. Fibi does not draw on sources outside the configured scope for that meeting.

Tenant isolation. Your connected source content, vector embeddings, transcripts, and any derived data are logically isolated from every other customer workspace via row-level security in our database. Embeddings and content are tagged with workspace identifiers, and queries cannot retrieve data across workspace boundaries.

Source ownership within your workspace. By default, a connected knowledge source is scoped to the workspace member who connected it. Workspace administrators may extend access to additional members or roles via configuration. Members cannot retrieve content from sources they have not been granted access to.

Participant access controls during meetings. Meeting hosts can configure which meeting participants are permitted to invoke Fibi using the wake word. By default for client-facing or external meetings, only the host may invoke Fibi. This protects against external participants querying your internal sources.

No training on your content. Your connected source content, embeddings, transcripts, and meeting data are never used to train our AI models or those of our subprocessors. We restate this commitment in Sections 3.1, 5.2, and 13.3.

Citation and audit trail. Citation display is configurable on a per-agent basis. Where enabled, every answer Fibi provides includes a citation to the specific source, page, or section from which the answer was drawn. This provides an auditable record of which content was retrieved during each meeting and allows you to detect any configuration issue immediately.

Source disconnection. When you disconnect a knowledge source, or remove an individual file, folder, or page, the corresponding embeddings and indexed content are deleted from your workspace immediately. Disconnection cascades to any pending Fibi requests referencing that source.

Original file access. For files you upload directly to HeyFibi, you can download the original through your workspace settings, subject to access controls, audit logging, time-limited signed URLs, and rate-limiting on bulk downloads. For content from connected third-party knowledge sources (such as Notion, Google Drive, or OneDrive), HeyFibi does not provide download access to the original files — citations link back to the source platform, where the source platform's own access controls apply. This ensures HeyFibi cannot be used to bypass the access controls of your connected systems.

Regulated and restricted data. You may not connect knowledge sources containing data subject to HIPAA, PCI DSS, GLBA, FERPA, attorney-client privilege, or similar regulatory regimes unless we have separately agreed in writing. See our Acceptable Use Policy for the full list of prohibited content categories.

Customer responsibility for connected content. By connecting a knowledge source, you represent that you have the right to do so, that the content does not violate any third-party intellectual property, privacy, or confidentiality rights, and that you have provided required notices and obtained required consents from any third parties whose information is contained in the source. Full warranties and the related indemnification are set out in our Terms of Service.

7. Data Retention and Deletion

We retain personal information only as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law. Account administrators can adjust retention periods within the limits described below.

7.1 Retention Periods by Data Type

Data Type

Default Retention

Raw meeting audio

Not retained

Meeting transcripts

Retained until you delete the meeting

Meeting summaries and action items

Retained until you delete the meeting

Fibi question/answer logs (with source citations)

Retained until you delete the meeting

Vector embeddings of connected documents

Duration the source remains connected

Account information

Duration of account + 30-day grace period

Payment and billing records

7 years

Marketing email lists

Until you unsubscribe

Security and audit logs

Retained indefinitely

Database backups

7 days

Product event data at analytics provider

365 days

7.2 Account Deletion

You can request deletion of your account and all associated data at any time by contacting privacy@heyfibi.com or using the in-app account deletion flow.

What happens when you delete your account:

We provide a 30-day grace period after account closure during which you can restore your account and recover data. The grace period is for your benefit and may be waived on written request.
After 30 days, the following data is permanently deleted from active systems: account profile, configuration, transcripts, summaries, action items, Fibi question/answer logs, vector embeddings, connected source content, and product event data identifiable to your account at our analytics provider.
Deletion is completed within 30 days of the end of the grace period.
The following data may be retained after deletion for legal, financial, or regulatory reasons: payment and billing records (7 years), security and audit logs (1 year), and any data subject to a legal hold.

7.3 Backups and Subprocessor Propagation

Backups. Deleted data may persist in encrypted backup systems for up to 7 days before backups are rotated and the data is permanently destroyed. Backups are not actively queried, are encrypted at rest, and are subject to the same access controls as production data.

Subprocessor propagation. When your account is deleted, we instruct our subprocessors to delete any data they hold about you within their standard deletion windows. Because we operate under a Zero Data Retention policy for meeting content at subprocessors (see Section 5.2), most subprocessors hold no retained meeting content to delete. For subprocessors that retain operational data (such as billing, email delivery, or product analytics), deletion timelines vary by provider. We can provide additional detail on request.

Legal holds. We may retain data beyond stated periods if it is subject to a legal hold, ongoing investigation, or applicable retention requirement under tax, accounting, or regulatory law.

8. Your Privacy Rights

8.1 Texas Residents (TDPSA)

Texas residents have the right to:

Know whether we process your personal data and access such data
Correct inaccuracies in your personal data
Delete personal data you provided
Data Portability — Obtain a copy of your data in a portable, usable format
Opt Out of targeted advertising, sale of personal data (we do not sell), and profiling for legal or significant decisions

8.2 California Residents (CCPA / CPRA)

California residents have the right to:

Know categories and specific pieces of personal information we collect, sources, purposes, and third parties with whom it is shared
Delete personal information (subject to legal exceptions)
Correct inaccurate information
Opt Out of sale or sharing (we do not sell or share for cross-context behavioral advertising)
Limit Use of sensitive personal information
Non-Discrimination for exercising rights

8.3 Other State Residents

Residents of Colorado, Connecticut, Utah, and Virginia have rights similar to those described above under their respective state privacy laws.

8.4 How to Exercise Your Rights

Email: privacy@heyfibi.com
Phone: (214) 380-2867
Mail: RAITECH AI LLC, Attn: Privacy Officer, 1925 E. Belt Line Rd., Carrollton, TX 75006

We verify your identity before responding. Authorized agents must provide written authorization or a valid power of attorney. We respond within 45 days (and may extend up to 90 days with notice).

8.5 Appeal Process

If we deny your request and you reside in a state with comprehensive privacy legislation, you may appeal by emailing privacy@heyfibi.com with "Privacy Rights Appeal" in the subject line. We will respond within 45–60 days as required by law. If we deny your appeal, we will provide information about contacting your state attorney general.

9. Data Security

We protect your information through layered safeguards spanning our infrastructure, application, and customer-controlled surfaces. This section describes those safeguards specifically and is updated as our practices evolve.

9.1 Technical and Administrative Safeguards — TLS 1.2+, AES-256, Google SSO with provider MFA, secrets manager, least-privilege, two-factor on production accounts, NIST CSF + AI RMF alignment.

9.2 Account-Level Security and Workspace Controls — Google SSO at MVP, workspace admin controls, audit logging, session security, MFA recommendation, workspace activity reports on request.

9.3 Incident Response and Breach Notification — Contain, investigate, notify within 72 hours, report in writing, cooperate with customer investigations. Scope of notification spans single-workspace, multi-workspace, and platform-level events.

9.4 Database Protections — RLS on every customer-data table; AES-256 encryption at rest; TLS in transit; network-level restrictions; administrative credential controls with quarterly rotation; encrypted, retention-limited, access-restricted backups; monitoring for unusual access patterns. CMEK and per-tenant database isolation planned for future enterprise tier.

9.5 Defense in Depth for Multi-Tenant Data — Application-layer + database-layer enforcement of workspace identifiers; monitoring; rate limiting on data export and download operations; audit logging; restricted administrative credentials.

9.6 Customer Security Controls — MFA on Google accounts, quarterly membership review, per-meeting source scope, audit log review, source disconnection discipline, role-based access settings, prompt notification at security@heyfibi.com.

9.7 Limitations — No security system is impenetrable. We implement industry-standard protections, monitor for unauthorized access, and respond rapidly. We do not guarantee absolute security against determined insider attacks, sophisticated state-sponsored actors, or zero-day vulnerabilities. Our commitments: transparency, rapid detection and response, honest disclosure, continuous improvement.

10. Cookies and Tracking Technologies

10.1 Types of Cookies

Essential Cookies — Required for Service functionality (authentication, security, session management)

Performance / Analytics Cookies — Anonymous usage statistics and product event tracking via our analytics provider, used to understand and improve the Services
Functionality Cookies — Remember preferences and settings
Marketing Cookies — Deliver relevant advertisements (with consent where required)

10.2 Product Analytics Specifics

Our product analytics provider sets cookies for the purpose of session tracking, user identification (by anonymous user ID), and event correlation. We do not enable session recording, keystroke capture, or interaction replay through our analytics provider. Cookies set by the analytics provider include a user identifier and a session identifier, and persist for the duration set in our analytics provider's configuration.

10.3 Your Choices

You can control cookies through your browser settings. You may also opt out through:

Our cookie consent banner (shown on first visit where required)
A privacy preferences screen in your account settings, which allows you to opt out of product analytics tracking
Digital Advertising Alliance: www.aboutads.info/choices
Network Advertising Initiative: www.networkadvertising.org/choices

Disabling cookies may affect Service functionality. We do not currently respond to Do Not Track signals.

11. Geographic Scope and International Data Transfers

HeyFibi is currently offered to customers located in the United States. Customers outside the US may use the Services at their discretion and are responsible for compliance with their local laws. We do not actively market the Services to individuals in the European Economic Area, United Kingdom, or other jurisdictions with comprehensive data protection laws beyond the US states listed in Section 8.

All personal information is processed and stored in US-based data centers. If you access the Services from outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from those in your jurisdiction.

EU and UK availability is planned for a future phase. When introduced, we will implement appropriate transfer mechanisms, including standard contractual clauses.

12. Children's Privacy

Our Services are not directed to individuals under 18. We do not knowingly collect information from children under 18. If we learn we have collected information from a child under 18, we will delete it promptly. Contact us at privacy@heyfibi.com if you believe we have collected children's information.

13. Artificial Intelligence and Automated Processing

13.1 AI Technologies Used in HeyFibi

Fibi is powered by large language models, speech recognition, speech synthesis (including a custom, per-agent voice provided via third-party text-to-speech services), on-device wake-word detection (Picovoice Porcupine), and vector retrieval (pgvector). Named providers are listed on our subprocessors page.

13.2 Transparency

Fibi identifies itself as an AI participant in every meeting and discloses in the meeting chat upon joining that the call will be recorded and that Fibi is actively listening (see Section 6.1). Citation of source material is configurable per agent; where enabled, every answer includes a citation.

13.3 No Training on Customer Data

We do not use your meeting content, transcripts, connected documents, vector embeddings, or any personally identifiable information from your account to train general-purpose AI models. Our AI subprocessors are contractually or by policy prohibited from using your data to train their general models. This commitment extends to our product analytics provider — product event data is not used for AI model training. This commitment is restated in Sections 3.1 and 5.2.

13.4 Limitations and Human Oversight

Fibi's answers are generated by an AI system and may occasionally be incomplete, out-of-date, or incorrect. We recommend that important business, legal, financial, or other consequential decisions not be made solely on the basis of Fibi's output without human review.

13.5 Texas Responsible AI Governance Act (TRAIGA)

We comply with TRAIGA effective January 1, 2026 by disclosing AI use (Fibi self-identifies in every meeting), serving legitimate purposes, avoiding prohibited uses, and maintaining an AI risk management program aligned with the NIST AI RMF.

13.6 Voice Data and Biometric Identifiers (Including Illinois BIPA)

We do not create voiceprints or biometric identifiers for the purpose of identifying or authenticating individuals. The wake-word engine operates on-device using acoustic pattern matching. To the extent any data is deemed a biometric identifier under Illinois law (BIPA), we maintain a written retention schedule and destroy such data within three (3) years of the individual's last interaction with us.

14. CCPA Disclosures (California Residents)

Categories of Personal Information Collected in the Last 12 Months:

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last Updated" date and provide notice of material changes via email or in-app notification at least 30 days before they take effect (except for changes required by law, which may take effect immediately).

16. Contact Information

Privacy Inquiries: Email: privacy@heyfibi.com Mail: RAITECH AI LLC, Attn: Privacy Officer, 1925 E. Belt Line Rd., Carrollton, TX 75006 Phone: (214) 380-2867

Security Incidents: security@heyfibi.com Data Protection Officer: dpo@heyfibi.com Legal Matters: legal@heyfibi.com General Support: support@heyfibi.com Website: www.heyfibi.com

We respond to privacy inquiries within 30 days.

17. Acceptance

By using our Services, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, do not use our Services. Continued use following changes constitutes acceptance of those changes.

Last Updated: July 6, 2026