Master Yi One Privacy Policy

Master Yi One Pty Ltd operates Master Yi One at https://masteryione.app. This policy explains how we handle personal information when you use our website, workspace software and optional integrations.

A business using Master Yi One may provide information about its employees, clients, prospects and meeting participants. That business also determines how it uses its workspace records and who may access them. Contact the relevant business about its own practices, or contact us for assistance with information we handle.

Depending on the features you use, we may handle:

• Account and business contact information, workspace membership and permission settings.
• Contact, client, lead, deal, project, commercial and meeting records entered or uploaded to a workspace.
• Meeting notes, recordings, transcripts, documents and AI inputs or outputs when those features are used.
• Subscription, billing and invoice information relevant to the service.
• Technical and security information recorded by our application, authentication or hosting services, such as request, device, session, usage and error information.
• The Google account information, calendar details and authorization credentials described below, only when you connect Google Calendar.

We receive information from you, your workspace, people invited to contribute and services you authorize. Not all categories are collected from every user.

We use personal information for the following purposes:

• Provide the features you use, including workspace records, meetings and optional integrations.
• Maintain accounts, workspace membership and permissions.
• Deliver enabled AI, transcription and research features using the relevant content described below.
• Respond to support requests and send account or service messages.
• Manage subscriptions, billing and invoices.
• Investigate security or reliability issues and meet applicable legal requirements.

Declining an optional integration does not require you to give us its data. Without information needed for a particular feature, we may be unable to provide that feature.

Connecting Google Calendar is optional. Choose an account and approve Google's permission screen. We do not receive your Google password.

New connections request Google account identification, email and read-only access to events on calendars you own. The integration reads only your primary calendar and does not change Google events or request Gmail or Drive access. Previously granted broader permissions are not automatically reduced by this update.

We use your Google identifier and email to identify the connected account. We read and store event titles, times, participants and organisers, descriptions, locations, meeting links, identifiers and update or cancellation information. An encrypted authorization credential and sync state allow background updates.

The default view covers the previous 30 days and next 90 days; you can change the range. All-day, declined, cancelled and non-default event types are excluded. The display range is not a deletion deadline.

Your imported calendar inbox is visible only to you through the application. Other workspace members and Admins cannot read it.

Choosing Link meeting copies the selected event into a shared meeting associated with your chosen Client, Deal or Lead. Workspace permissions govern the shared record.

Disconnecting stops sync and, after successful revocation and removal, deletes the connection and personal inbox. If revocation fails, sync pauses and you are asked to retry. Shared meetings remain. Revoking access in Google alone does not delete information already stored in Master Yi One.

We use MiniMax and DeepSeek for AI meeting briefings, summaries, chat and business analysis. Workspace settings may select another supported provider, including OpenAI, Anthropic or Google. A selected provider or fallback may receive relevant meeting titles, participant details, notes, transcripts and CRM context to process the requested feature.

Google-imported account and event details are excluded from application-controlled AI requests. Linked Calendar meetings are excluded from workspace Agent reads and automated AI briefings and company research. If you separately supply a recording, its audio and transcript may be processed by enabled transcription, summary, chat or SOW preparation features without imported Calendar metadata. Linking a Calendar event alone does not enable AI processing of its details.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google-imported data for advertising, sell it, or use or transfer it to train or improve general-purpose AI models.

Provider processing is governed by applicable terms, including MiniMax's API terms and privacy policy, and DeepSeek's Open Platform terms. MiniMax's published terms allow use of inputs and outputs for service development and improvement. We do not promise blanket no-training or zero-retention arrangements across all providers.

Speech transcription is separate from text AI. Recording audio is sent to Deepgram or a workspace-selected OpenAI transcription model when transcription is enabled.

Optional Firecrawl research uses a selected or inferred company identity from independently supplied CRM or meeting information with general research topics. Calendar-origin meetings cannot start this research or automatically copy their attendees into CRM contacts. The query does not automatically append the meeting title or notes.

AI output may be inaccurate or incomplete. Review it before relying on it or sharing it.

Workspace information is available to people authorized under that workspace's access settings. Optional sharing or collaboration features may disclose information to recipients selected by the workspace.

We use Supabase for authentication, databases and file storage, and Vercel for application hosting. These services process information needed to operate the application. The AI, transcription and research providers described above process relevant content when those features are used.

Where configured, Resend processes recipient addresses and message content for account and service emails, and Stripe processes payment and subscription information for online billing. The recipients and information involved depend on the feature and the workspace's configuration.

We may disclose information when necessary to respond to lawful requirements or protect the security of the service, subject to applicable law and the additional restrictions on Google-derived data.

The choices available depend on the feature and your workspace permissions:

• Google Calendar is optional. You choose whether to connect an account and approve its read-only permissions.
• Keep imported calendar events in your personal inbox, or explicitly link a selected event to a shared workspace meeting. Linking does not send imported Calendar fields to AI. Independently supplied recordings and transcripts may use the enabled AI features described above.
• Use Manage in Google Calendar to change the display range or disconnect. Disconnecting removes the personal inbox after successful revocation and removal; it does not delete previously shared meetings.
• Authorised Admins can extend a recording's retention, confirm deletion or cancel deletion during its seven-day recovery period, subject to holds and safety checks.
• Contact support@masteryione.app or the relevant workspace administrator to request access, correction or deletion. We may need to verify your identity and authority.

Disconnecting an integration and deleting a recording affect different information. See Retention and deletion for what remains, AI services and Google data for provider processing, and Access and complaints for request limits.

Information may be stored or processed outside Australia. Our primary Supabase database is in Tokyo, Japan, and application server processing includes the United States. MiniMax's API privacy policy identifies US storage. Other providers, backups and support operations may use other countries; locations depend on the service and configuration.

We use authentication and workspace access controls, with owner-only application access to the personal calendar inbox. Google refresh credentials are encrypted with AES-256-GCM and are not exposed to browser clients. Application privacy settings do not exclude all technical access by infrastructure services or authorised personnel.

No system can guarantee absolute security. Please protect your account credentials and notify us if you suspect unauthorized access.

Retention depends on the information and its purpose. Disconnecting Google does not automatically delete shared meetings, recordings, transcripts, logs or backups.

Meeting recordings normally enter review approximately 30 days after saving, with in-app reminders. An authorised Admin can extend retention or confirm deletion of a specific file. Silence does not authorise deletion. Confirmation starts a full 168-hour recovery period (seven days), during which deletion can be cancelled. Holds, active processing and safety checks may delay or prevent deletion.

Audio deletion preserves transcripts, summaries, decisions, actions and audit records. The application confirms deletion after removing the storage object, verifying its absence and completing the audit. This does not erase downloaded copies, backups or every provider copy. Exercise and TTX audio have separate workflows.

Contact us or your workspace administrator to request access, correction or deletion. We may verify identity and authority and consider lawful retention requirements. Do not send passwords or access tokens.

There is no universal 30-day deletion deadline for all information. Removal from the active application does not establish removal from backups or a provider's systems.

We use cookies and browser storage to support sign-in, sessions, security and preferences such as appearance settings. Blocking or clearing essential storage may affect sign-in and operation of the service.

Service and account messages may be sent in connection with the features you use, including invitations, account notices and support responses.

Contact Master Yi One Pty Ltd at support@masteryione.app about access to personal information, a correction or deletion request, or a privacy complaint. Describe the information or concern and the relevant workspace. Do not include passwords or access tokens.

We may verify your identity and authority, assess your request or complaint and communicate our response. Access or deletion may be limited by another person's privacy, workspace authority or legal requirements. If we cannot fulfil a request, we will explain why, subject to those requirements.

If dissatisfied with our response, you may contact the Office of the Australian Information Commissioner where it has jurisdiction, or your relevant privacy regulator. OAIC guidance explains the requirement to complain to the organisation first and when escalation is available.

We may update this policy as the service or our information-handling practices change. The published version will show its effective date. Changes that require additional disclosure or consent will follow those requirements, including requirements applicable to Google-derived data.