Account: name, work email, password (hashed), role, language, organisation/workspace. Meeting content: audio and (if enabled) video recordings, transcripts, speaker labels, notes, summaries, agendas, tasks, attendance, and files. Voice data: because we transcribe speech and label speakers, we process voices. This may count as sensitive data, so we handle it with extra care. Usage and technical: IP address, device/browser, app activity, and logs. Audit: security and governance logs (who did what, when, and from which IP). Billing: plan and invoice details for paid, self-serve customers (card data is handled by our payment provider).

AI drafts only: AI writes drafts of minutes, summaries, and action items. A person must review and approve them before they are final. AI can make mistakes, so check it. No AI training on your data: We do not use your content (recordings, transcripts, or anything else) to train, retrain, or fine-tune AI models. Our AI providers are contractually banned from using it to train their models. An organisation can also turn AI features off. Recording consent is the organiser's job: The customer and the meeting organiser are responsible for recording lawfully. Before recording, the organiser must tell all participants that the meeting is recorded, transcribed, and processed by AI, and get their consent — including from external guests. A recording indicator is shown when recording is on.

Meeting records: as long as your organisation's settings say. Cancelled or deleted meetings sit in Trash for 30 days, then are deleted. Audit logs: at least 180 days (configurable). Account data: we delete or anonymise your personal account data within 30 to 90 days after your account closes, unless the law requires us to keep it longer.

Privacy Policy

How Formeets collects, uses, and protects your data — and the choices and rights you have under the Saudi Personal Data Protection Law (PDPL).

Company Commercial name

Next Generation Networks for Communications and Information Technology Co. (“NGN”)

Company Legal NAme

COMPANY SHABAKAT AL-JIL AL-QADIM FOR COMMUNICATIONS AND INFORMATION TECHNOLOGY

CR / VAT

1010519084 / 311489021400003

Address

3227 Prince Muhammad Ibn Abdulaziz St., 7950 Al Olaya District, Riyadh 12313, Saudi Arabia

Contact

support@formeets.com

In short

We run ForMeets, a platform that schedules meetings, records and transcribes them, and uses AI to draft notes, summaries, and action items. This policy explains what we collect and why, your choices, and your rights under the Saudi Personal Data Protection Law (PDPL). We do not sell your data, we do not use it to train AI models, and we host all data in Saudi Arabia.

1. Who controls your data

For meeting content (recordings, transcripts, notes, tasks), the organisation that uses ForMeets is the controller and NGN only processes it on that organisation’s instructions (see our DPA). For account, billing, and website data, NGN is the controller. If you are a meeting participant or guest, contact the host organisation to exercise your rights over meeting content.

2. What we collect

Account: name, work email, password (hashed), role, language, organisation/workspace.
Meeting content: audio and (if enabled) video recordings, transcripts, speaker labels, notes, summaries, agendas, tasks, attendance, and files.
Voice data: because we transcribe speech and label speakers, we process voices. This may count as sensitive data, so we handle it with extra care.
Usage and technical: IP address, device/browser, app activity, and logs.
Audit: security and governance logs (who did what, when, and from which IP).
Billing: plan and invoice details for paid, self-serve customers (card data is handled by our payment provider).

3. Why we use it

To provide and secure the Service, sync your devices, send notifications, support you, handle billing, improve the product (using aggregated or de-identified data), and meet legal duties. Our legal bases under the PDPL are mainly performance of a contract, your or your organisation’s consent, our legitimate interests, and legal obligations.

4. AI and recording

AI drafts only. AI writes drafts of minutes, summaries, and action items. A person must review and approve them before they are final. AI can make mistakes, so check it.
No AI training on your data. We do not use your content (recordings, transcripts, or anything else) to train, retrain, or fine-tune AI models. Our AI providers are contractually banned from using it to train their models. An organisation can also turn AI features off.
Recording consent is the organiser’s job. The customer and the meeting organiser are responsible for recording lawfully. Before recording, the organiser must tell all participants that the meeting is recorded, transcribed, and processed by AI, and get their consent — including from external guests. A recording indicator is shown when recording is on.

5. Where your data is hosted

We host all Customer Data in the Kingdom of Saudi Arabia, in the Riyadh region of Huawei Cloud (Middle East). We do not transfer personal data outside the Kingdom. If a customer’s specific requirements need a service that must run outside the Kingdom, we will do so only on that customer’s instructions and in line with the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom.

Only with: service providers that help us run ForMeets (hosting, AI, email) under confidentiality terms; identity and integration providers you connect (Google, Microsoft, Zoom, Jira); and authorities where the law requires. We do not sell your data or use it for advertising. Our sub-processor list is in the DPA.

Google user data (Google Calendar integration). Connecting Google Calendar is optional and is started only by you, from Account settings > Integrations > Google Calendar inside ForMeets. Nothing is read from your Google Account until you complete Google's consent screen.

What we access.
- calendar.calendarlist.readonly — to list the calendars in your account
so you can choose which ones to sync.
- calendar.events — to read events from only the calendars you explicitly
select, and to create, update and cancel Google Calendar events that
mirror meetings you organise in ForMeets, including a Google Meet link
and attendee invitations when you choose them.

What we store. For each calendar you select: the event id, title, start and end time, time zone, location, organiser and attendee email addresses and their replies, and the conference link. We do not access Gmail, Google Drive, Google Contacts or any other Google service.

How we use it. Google Calendar data is used only for features you can see and control in ForMeets: showing your Google events, adding the meetings you organise to your Google Calendar and keeping both in step, and, only if you turn it on, sending Siraj, the ForMeets AI assistant, to join the meetings you choose and write the minutes. For those minutes, the event's title and guest names are sent to our AI provider. Google Calendar data is shared only with the service providers that run these features for us (hosting, AI, email), under terms that forbid them from using it to train AI models. We do not sell it, we do not share it with data brokers or advertising networks, and we do not use Google Workspace APIs to develop, improve or train generalized or non-personalized AI or machine learning models.

Limited Use. ForMeets' use and transfer to any other app of raw or derived information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace User Data and Developer Policy, including the Limited Use requirements.

7. How long we keep it

Meeting records: as long as your organisation’s settings say. Cancelled or deleted meetings sit in Trash for 30 days, then are deleted.
Audit logs: at least 180 days (configurable).
Account data: we delete or anonymise your personal account data within 30 to 90 days after your account closes, unless the law requires us to keep it longer.

8. Your rights

How to disconnect. Account settings > Integrations > Google Calendar > Disconnect. This immediately revokes our tokens at Google, stops every push notification channel, and deletes your stored tokens and calendar selections. ForMeets then removes your imported Google events, except meetings Siraj joined or that someone worked on in ForMeets. To have those deleted too, email privacy@ngn-sa.com and we will delete them within 30 days. You can also revoke ForMeets at any time at https://myaccount.google.com/permissions.

Under the PDPL you can: be informed, access and get a copy of your data, correct it, ask us to delete it, withdraw consent, and object to certain uses. ForMeets also lets you export or delete your account data in your profile. To use these rights, email support@formeets.com (for account data) or the host organisation (for meeting content). You can also complain to SDAIA.

9. Security

We protect data with encryption in transit and at rest, role-based access, password hashing and account lockout, tenant isolation, and tamper-resistant audit logs. No system is perfectly secure, but we work to recognised standards.

10. Breaches

If a reportable breach happens, we will notify SDAIA within 72 hours where required, tell affected organisations without undue delay, and inform individuals if there is a risk of serious harm.

11. Children

ForMeets is for organisations and their adult staff and guests. It is not for children, and you must be at least 18 to use it.

12. Changes and contact

We may update this policy and will post the new date; we’ll give extra notice for major changes. Last updated: 13 October 2026. Questions: support@formeets.com.