Privacy in the apps

Who is responsible for what

When an organisation uses these apps, that organisation decides what to collect and why. Under the GDPR they are the controller and we are the processor acting on their instructions, see the Data Processing Agreement. Where we decide things for ourselves, such as who may hold an account with us, we are the controller. Nexcubator is a product of Aitina Tech Limited ("Aitina Tech", "we"), the data controller for personal data collected through this website. Our registered office is Block B, Maynooth Business Campus, Maynooth, Co. Kildare, Ireland. You can reach us about anything on this page through the contact form. We are established in Ireland, so our supervisory authority is the Irish Data Protection Commission.

What each app holds

nex-meet: meetings

What	Why	How long
An account holder's name and email address	To sign them in and to address mail to them. Sign-in is handled by Amazon Cognito in Ireland: it holds the password and the authenticator app setting, and the address is the username.	While the account exists
A guest's display name, and the email address they were invited at	To show who is in the room, and to send the invitation.	30 days after the meeting
The meeting's subject, its code and passcode, who attended and when	To run the meeting and to show the organiser their own history.	30 days
Audio and video	Carried between participants while the call is happening.	Never stored. Not recorded at any point
Chat messages	Sent directly between participants.	Never stored. They do not reach our servers
The transcript, only in a meeting where the organiser switched Genie on	So Genie can answer when it is spoken to, recap, and write the notes.	Deleted when the notes are written at the end of the meeting, and in any case within 24 hours
What Genie says during the meeting, and anything it proposed that somebody approved or turned down	So everybody sees the same thing, including somebody who joins late.	30 days, with the meeting
Genie's notes: the summary, decisions and tasks	Sent to the organiser whose Genie it was, and kept for them so their Genie remembers earlier meetings with the same people.	Until the organiser deletes them. They can wipe everything their Genie remembers from its page

nex-genie in meetings

• Off unless the organiser switches it on, for one meeting at a time. It is a paid feature that a Nexcubator administrator gives to a named person; nobody else sees the option.
• Everybody is told. Genie appears on screen as a participant labelled "AI assistant", and a notice goes to everybody in the meeting when it joins. A guest can ask the organiser to switch it off, and the organiser can do so at any moment; nothing said after that is transcribed.
• Where the words go. Speech is turned into text by Amazon Transcribe in Ireland, and Genie's answers and notes are written by a language model in Amazon Bedrock in Ireland. Neither keeps nor learns from what it is sent. Nothing leaves the EU.
• It proposes; people decide. A task, a follow-up meeting or a decision that Genie suggests becomes real only when somebody who is allowed to approves it.
• It does not assess people. Genie does not score, rate or profile anybody in a meeting, and what it hears is not used in any decision about the people who were in it.

nex-cal: booking pages

What	Why	How long
The page owner's name, email address and working hours	To draw the page and to address the confirmations.	While the page exists
A visitor's name, email address, anything they typed in the note field, and the timezone their browser reported	To make the booking, confirm it, and show times in their own clock.	90 days after the meeting
The cancellation link in a confirmation email	So somebody with no account can cancel.	120 days

nex-remind: reminders

What	Why	How long
The recipient's address, the text to be sent, and when to send it	To send the reminder.	30 days after it has been sent or given up on
Whether each attempt succeeded, and the provider's reason if it did not	So a failure is visible and can be retried rather than disappearing.	30 days

Every one of these is enforced by an expiry stamped on the record itself, not by a cleanup job somebody has to remember to run. When the date passes, the database deletes it.

What is stored on your device

No cookies, in any of the apps. Two things are kept in your browser's own storage and never sent anywhere except back to us:

• A sign-in token, so you are not asked for a code on every page. In nex-cal it lives in session storage and is gone when you close the tab.
• A seat token in nex-meet, if you have joined a meeting as a guest, so that reconnecting after losing your connection does not mean asking to be let in again.

Both are cleared by signing out, or by clearing site data in your browser. There is no advertising identifier and nothing that follows you to another site.

Where it is

Ireland, in Amazon Web Services, with one exception: the control interface for meeting media sits in Frankfurt because AWS publishes no equivalent in Ireland. Both are inside the EU, so nothing here is an international transfer. The full list is on the sub-processors page.

Your rights

You can ask for a copy of what we hold about you, ask for it to be corrected, ask for it to be deleted, ask us to stop, or complain to a supervisory authority (in Ireland, the Data Protection Commission). Ask through the contact form and we will reply within a month.

If your details are in one of these apps because an organisation invited you to a meeting or you booked time with them, that organisation decides what happens to the record. Ask them first; if it is easier to ask us, we will pass it on and help them answer.

What we will not claim

Meeting audio and video are encrypted in transit and are decryptable by the service that carries them, which is how Zoom, Google Meet and Microsoft Teams all work by default. We are not going to call that end-to-end encryption, because it is not. If we ever offer end-to-end encrypted meetings, this page will say so plainly and will say what stops working in that mode.