Security and data handling
This page describes what Qarar does today, as its code and configuration do it: where your data is stored, who processes it, how long it is kept and who can reach it. We hold no security certification yet, and say so plainly below.
How data flows
- Upload
Your browser or the Mac app sends the recording to getqarar.com over HTTPS, and it is kept in private Cloudflare storage.
- Transcription
Qarar cuts the audio into chunks and sends them, inside Cloudflare’s network, to Kalemio’s transcription gateway, which runs them on GPU servers reserved for Qarar at RunPod. The gateway deletes its copy of the audio when the job ends, and its copy of the text after 7 days.
- Storage
The transcript and speaker names are saved in your workspace on Cloudflare. While a meeting is processed, its working state, such as speaker names and glossary hints, is also held in Cloudflare Durable Objects, which Cloudflare places near where the meeting is first used; that part may sit outside eastern North America.
- Notes
Only text, never audio, is sent through OpenRouter, with zero data retention required: a request goes only to a provider that has committed not to store the prompt or output and not to train on them, and otherwise fails and is retried later; see the privacy policy. You can turn AI notes off for any meeting, and then its transcript is sent to no model.
- Sharing
A meeting is visible to its workspace members, to people you share it with by email, and to anyone with an active view-only link.
- Deletion
Audio is deleted when the retention period you chose ends. After a temporary processing failure, that period counts from the failure so the meeting can be tried again; other failures delete the audio straight away. Deleting a meeting deletes its audio, transcript, notes and notepad.
Subprocessors and regions
The outside companies that process Qarar customer data. Qarar is operated by Kalemio, which also runs the transcription gateway. Integration destinations your team adds itself, such as Slack, Teams, Zapier or your own server, are your choice and are not listed here.
| Company | What it does | Data | Region |
|---|---|---|---|
| Cloudflare | Hosts the site and app, stores recordings, transcripts and accounts, runs the transcription gateway, and sends sign-in and notification emails. | All account and meeting data. | Recordings, transcripts and accounts in eastern North America. A meeting’s temporary processing state (Durable Objects) is placed by Cloudflare near where it is first used, and requests pass through its global network. |
| RunPod | GPU servers that run the transcription and speaker engine on chunks of meeting audio. | Audio chunks while they are processed, the resulting text, and glossary entries and attendee names as spelling hints. | Not pinned to one region; RunPod picks the data centre. |
| OpenRouter | Routes note writing, name correction and meeting-type suggestions to the model provider.Current model providers: OpenAI and Google. Only text, never audio, is sent through OpenRouter, with zero data retention required: a request goes only to a provider that has committed not to store the prompt or output and not to train on them, and otherwise fails and is retried later; see the privacy policy. | Transcript text, speaker names, title, attendees, glossary terms and notepad lines. No audio. | United States, and the model providers’ regions. |
| Stripe | Payments, invoices and tax for paid plans. | Account email, workspace name, and the card and billing details you enter with Stripe. Nothing from meetings. | United States and other Stripe regions. |
| Google, Microsoft Optional | Sign-in, only if you choose to sign in with one of them. | Your email address and a stable account ID. | The provider’s regions. |
Encryption
In transit: every connection to getqarar.com uses HTTPS, and plain HTTP requests are redirected or refused. Qarar reaches the transcription gateway over an internal Cloudflare binding; the gateway reaches RunPod, and Qarar reaches OpenRouter and Stripe, over HTTPS.
At rest: Cloudflare encrypts the data stored in R2, D1 and Durable Objects.
In the application: the secret calendar address is also encrypted with AES-256-GCM and bound to your account. Sign-in codes, session cookies, device tokens and share-link addresses are stored only as hashes.
What we do not do: audio, transcripts and notes are not end-to-end encrypted. Qarar’s servers can read them in order to transcribe and write notes.
Retention and deletion
| Data | Kept for |
|---|---|
| Meeting audio | 30 days by default after the transcript is ready; choose 7, 30, 90, or 365 days in Settings. |
| Audio after a temporary failure | The same period, counted from the failure, then deleted. Used only to try again, up to 3 times, and never played back or shared. Other failures delete the audio straight away. |
| A failed attempt’s partial results | Deleted straight away: pieces of transcript, the voice data used to tell speakers apart, and the copies of audio sent for transcription. |
| Transcript, notes and notepad | Until you delete the meeting. |
| The gateway’s copy of the transcript | 7 days, then deleted. Its copy of the audio is deleted when the job ends. |
| Sign-in codes | 10 minutes, or until used. |
| Browser session / Mac device token | 7 days / 90 days after last use. |
| Security events / network hashes | 90 days / 30 days. |
| Device records | Deleted 180 days after last use. |
| Recording and upload records | 30 days. |
| Workspace activity log | The life of the workspace, then 90 days after it is deleted. |
| View-only links | 7 days by default. The creator picks one of: 1 day, 7 days, 30 days, or no expiry. A link can be turned off at any time. |
| Billing records | 7 years, as tax law requires. |
To delete your whole account, email support@getqarar.com from your account address. We delete your meetings, email address, sign-in methods, sessions and connected devices, and keep billing records for as long as the law requires.
Access controls
- Sign-in
- A one-time code sent to your email, or a passkey. A code expires after 10 minutes.
- Passkeys
- The private key stays on your device or in your password manager. Qarar stores only the public key, and your fingerprint or face never leaves your device.
- Devices and sessions
- Up to 3 trusted devices; a new device needs a code sent to your email. In Settings you can sign out any Mac, or every device at once.
- Roles
- Shared workspaces have an owner, admins and members. Only the owner and admins manage members and seats. A guest sees only the meeting shared with them.
- View-only links
- Read-only. Each expires after the time its creator chose (7 days by default) unless it was made with no expiry, can be turned off at any time, and plays audio only if it was included.
- Activity log
- Owners and admins see who shared a meeting, opened it through a link or edited it.
- Operator access
- The internal analytics dashboard shows meeting states and durations under a pseudonymous ID. It shows no audio, transcript, notes or email address.
- Browser
- A strict Content Security Policy: no inline scripts; external scripts are limited to payment and storage-denied purchase measurement. No advertising cookies or meeting content goes to advertising services.
Consent
- Before every upload or recording you confirm that everyone in the meeting agreed to be recorded and transcribed. Recording laws differ between countries, including the UAE, Saudi Arabia and Egypt.
- AI notes can be turned off per meeting; its transcript is then sent to no model.
- A voice profile is opt-in, made only with your agreement, and never sent to an AI model.
- Site analytics are Qarar’s own daily totals, with no cookies, and can be turned off at the bottom of every page.
- We do not train our models on your data, sell it or use it for advertising.
Saudi Personal Data Protection Law (PDPL)
The PDPL applies to processing the personal data of people in the Kingdom. Your organisation decides what is recorded and uploaded, so it is responsible for meeting content, and Qarar processes it on your organisation’s behalf.
Recordings, transcripts and accounts are stored in eastern North America and processed by the companies listed above. Qarar offers no storage in the Kingdom, and temporary working state in Durable Objects is placed by Cloudflare and may sit anywhere in its network. Transferring personal data outside the Kingdom has conditions under the PDPL and its transfer regulations; check them with your data protection officer before you upload.
People can ask to access, correct or delete their data by emailing support@getqarar.com.
We have not had a formal PDPL assessment and claim no registration or accreditation. If your organisation needs data kept in the Kingdom, Qarar does not offer that yet.
A note on the GDPR
If you are in the EU or the UK, the GDPR applies. Qarar processes your workspace’s meeting data as a processor. The data is stored outside the EU, and we offer no EU hosting. The DPA template leaves the transfer mechanism for the parties to agree.
Certifications
Qarar has no SOC 2 report and no ISO 27001 certificate, and it is not HIPAA compliant. Do not upload health information that needs HIPAA protection.
DPA template
A plain data processing agreement to start from with your legal team. It is a template for discussion only: unsigned, not reviewed by a lawyer, with bracketed parts to fill in. It includes the subprocessor list and retention periods from this page.
Reporting a security issue
Report a vulnerability or a suspected data incident to support@getqarar.com.
The privacy policy has the full detail of what Qarar collects and which model writes the notes.
Last updated: 5 October 2026