Privacy Policy

1. Who we are

Meenira PA is a product of Meenira (OPC) Private Limited (CIN U63120HR2026OPC151838), Gurgaon, Haryana, India (“Meenira”, “we”, “us”).

Registered office: Gurgaon, Haryana, India

Email: meenira@meenira.com (privacy and data requests: support@meenira.com) · WhatsApp: +91 89173 17880

This policy explains how we handle personal data under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025. For the people who use Meenira PA, Meenira is the Data Fiduciary: we decide how your data is used, and we are responsible for it.

2. Who this policy is for

• Early-access members on Telegram. This is the version people can join today, by invite. It is text chat with a smaller set of tools. Sections 3 and 4 describe it.
• The full PA. It works on WhatsApp, in a web app and on a phone line, with voice notes, meeting minutes, documents and calendar. It is in private testing: it is set up for one person at a time (its “user” in this policy) and is not open to early-access members. Section 5 describes it. We will update this policy before any part of it opens to more people.
• Other people whose messages or voices reach the PA: people in WhatsApp groups where the PA is used, callers to its phone line, people in meetings it records, and people its user emails or names. Section 6 is for them.

3. Early access on Telegram: what we keep

You join with a personal invite link. The link works once and expires after 7 days; we store only a one-way hash of it. Before the bot answers anything, it shows how it handles your data and asks you to accept. When you open the invite, the bot keeps your Telegram user ID and first name so it can show you that notice. If you decline, it removes them at once and stores nothing about your chats; if you neither accept nor decline, they are removed after 7 days. Either way you need a new invite to start again.

When you accept, we keep:

• Your Telegram account: your Telegram user ID and the first name on your Telegram profile. We do not get your phone number from Telegram, and we do not ask for your email.
• Your choices: language, tone (casual, polite or formal) and what you want help with (reminders, notes and memory, daily briefing, productivity).
• Your consent record: when you accepted, and which version of the notice you accepted (the current one is 2026-10-25-v3).
• Where your invite came from, for our own reporting.
• Your messages and the bot’s replies, kept for 30 days and then deleted.
• A short summary of your recent chats, so the bot can follow a longer conversation. It never covers a message older than 30 days.
• Long-term memory: facts you ask it to remember, facts it noted from your chat (see section 4), your notes, and a search index of them.
• Your reminders.
• Daily usage counts: how many messages you sent each day and what they cost us, to keep to the daily limits.

The early-access bot works with text messages in private chats only. It ignores group chats. If you send a voice note, photo, sticker or file, it replies that only text is supported; it does not save, read or forward it, and it does not count against your daily limit.

When you ask for the weather or a web search, only the city name or the search words are sent to the lookup service (section 9). Currency conversion and sums are worked out on our server.

4. How memory works, and sensitive data

What the AI sees

For each reply, the AI model gets your newest messages, the summary of earlier ones, and up to 15 of your saved facts (the ones you saved yourself come first), plus the 5 facts or notes that best match your message. Saved text is marked as data, not instructions.

Facts it notes automatically

Only if you accepted the current notice and chose “Notes & Memory”, the bot may note a few lasting facts from your own messages after it replies, such as a birthday, your city, your work or a routine. A fact is kept only if all of these are true:

• you said it plainly (the AI rates its confidence at 0.8 or more);
• it is about family, a preference, a date, a place, work, a routine or a name;
• it came from one of your own messages, not from the bot;
• it does not touch a sensitive subject (below);
• it would not overwrite a fact you saved yourself.

Never noted automatically: health or medical details, religion or beliefs, caste or community, sex life or orientation, political views, money and bank details, account, card or ID numbers (such as Aadhaar, PAN or passport), passwords, OTPs and PINs, and phone numbers (any run of 10 or more digits). A filter in our code checks every proposed fact for these subjects, in English and some Hindi words, and drops it if one appears. We also tell the AI to leave these subjects out of the chat summary; that part is an instruction to the AI, not a filter.

When you say “remember …”

If you ask it to remember something, it stores what you asked, including sensitive things you choose to share, such as a health detail. The one exception is secrets: it refuses passwords, OTPs, PINs, CVVs, and account, card, Aadhaar, PAN or passport numbers (and any number of 12 or more digits), even when asked. Notes you save are kept as you write them, so please do not put passwords or ID numbers in a note.

You can see everything with /memory and remove it at any time (section 13).

5. The full PA: what it handles

• WhatsApp messages. The PA has its own WhatsApp number and reads it through a linked WhatsApp Web session on our server. In a direct chat it answers only its user. Messages to it and its replies are kept as the conversation history, with a rolling summary of older turns.
• Voice notes. They are turned into text by a speech-to-text service, and it replies with the text it heard. If you sent a voice note, it may answer with a spoken voice note too.
• Files and photos. Some photos, voice notes, videos and files are copied to our storage in Mumbai when they arrive, so they can still be read after WhatsApp’s copy expires: only those the user sends, and in groups those the user sends or that are addressed to Meenira (by its name or an @mention, or as a reply to one of its messages). Nothing is copied in an incognito chat, and other people’s direct messages and ordinary group media are not copied. Copies are deleted after 30 days unless the user keeps them as a document or meeting minutes. When the user sends a document or image to the PA, its text is read on our server (text recognition is done locally) and added to the user’s knowledge base.
• The web app (pa.meenira.com/app): the user’s reminders, tasks, notes, minutes, habits, preferences and chat, behind a password.
• The phone line. Calls are carried by a telephone provider. What callers say is turned into text live, and replies are spoken by a text-to-speech service. Calls are not recorded as audio, except when the user asks the PA to record a meeting. The user can get a recap after their own calls, and a nightly report on how the line performed.
• Meeting minutes. The PA can join a meeting by phone dial-in, join a Google Meet as a guest notetaker, create a Google Meet that Google records, or work from a recording the user sends. The audio is stored, transcribed with speaker labels, and turned into minutes with action items. The minutes are sent to the user on WhatsApp and, if asked, by email.
• Inbox. Links, PDFs and YouTube videos the user forwards are fetched, and a short summary, tags and a 500-character preview are kept. The page or file itself is not kept.
• Google, when the user connects it. Google Calendar: it reads events and, after asking, books, moves or cancels them. Gmail can be connected read-only, but the PA does not read mail yet. Google Meet: it creates meetings, adds co-hosts by email, and downloads only the recordings Meet made.
• Email. It sends email (such as minutes, or a message the user approved) through an email provider.
• Habits, daily inspiration and preferences. Habit names, check-ins and streaks; the daily quote, affirmation or prayer-reminder setting, including any tradition the user chooses; and preferences such as briefing time and city, quiet hours, reply style and the name to use.
• Approvals. Before it sends an email, books or cancels an event, calls someone or messages someone else, it shows what it will do and waits for a yes. The user can relax this for some actions, but never for calls or messages to other people.
• A short-term WhatsApp archive. A separate service on our server records incoming WhatsApp messages, including messages the sender later deletes for everyone, and deletes each one after 48 hours. The PA can search it when its user asks what someone said. The archive records Meenira’s own WhatsApp number only.

Incognito: when the user says “start incognito”, for the next hour the PA does not save the conversation or anything new to memory, and our logs record only the length of each message. Files are still copied to storage as they arrive.

Memory works as in section 4, except that the full PA does not note facts automatically: it saves what its user asks it to save.

6. Other people the PA hears from

The PA works for its user, but it also handles other people’s data. For that data, Meenira is the Data Fiduciary, and you can always write to us about your data (section 13).

People in WhatsApp groups where the PA is used

• Anyone in the group can ask the PA something by starting a message with its name or @mentioning it. That message, the sender’s WhatsApp name, and any message it replies to are sent to the AI, and the reply is posted in the group.
• Those messages and replies are kept as the group’s conversation history, with a rolling summary. Facts, notes and documents saved in a group are kept for that group.
• Ordinary messages that are not addressed to the PA are not read or answered by it. But photos, voice notes, videos and files posted in the group are copied to our storage as they arrive (section 5), and the short-term archive keeps incoming messages for 48 hours.
• If the user asks, the PA keeps a group member’s Google email address so they can be made co-host of a Google Meet.

If someone who is not the PA’s user sends it a direct message, it does not answer or keep the text. Any file sent is still copied to storage.

People who call the PA’s phone line

• The PA says at the start: “Hello, this is Meenira, a private AI assistant. This call is transcribed so I can help, and you can say delete my data at any time.”
• We keep your phone number, when you called, the text of what you said and what the PA replied, and timing details.
• These are deleted automatically 30 days after the call (checked twice a day). If you say “delete my data” during a call, the PA deletes the record of your earlier calls at once, and this call when you hang up.
• The PA’s user gets a nightly report on how the line performed, which can include questions callers asked.

People in meetings the PA records

• By phone dial-in, the PA says when it joins: “Hello, this is Meenira, an AI assistant. I’m recording this meeting to write the minutes.”
• In Google Meet, it joins as a guest named “Meenira (notetaker for …)” and posts a notice in the meeting chat that the meeting is being recorded for minutes. If it cannot post the notice, it tells its user to tell everyone. In a meeting the PA created, Google shows its own recording notice.
• The PA tells its user to let attendees know. The recording, the transcript (with speakers labelled “Speaker 1”, “Speaker 2” and so on) and the minutes are kept for the user.

Anyone else the user mentions

Names, birthdays, phone numbers or other details the user tells the PA about other people are stored as the user’s notes and memory. The PA’s user is asked to share only what they need.

7. How we use data

• To answer you and do what you ask: reminders, notes, memory, lookups and, in the full PA, minutes, documents, calendar and email.
• To remember context you have allowed it to keep, and to show it to you.
• To run invite-only sign-up and record your consent.
• To keep to daily limits and stop abuse.
• To keep the service working and secure, and to fix problems.
• To meet our legal obligations and respond to lawful requests.

We do not sell personal data, use it for advertising, or use it to train or fine-tune AI models. Groq’s terms say it does not train on API data, and we ask Deepgram not to use our audio to improve its models.

8. Consent

• Telegram members: we process your data on the basis of the consent you give on the bot’s first screen. The bot records the version you accepted; the current notice is version 2026-10-25-v3, and members who accepted an earlier one are asked to accept it. Automatic fact-noting needs version 2026-10-24-v2 or later and the “Notes & Memory” choice; you can turn that choice off in /settings.
• Withdrawing consent: send /delete. It erases your data straight away and ends your account (section 13). What was done before is not affected.
• The full PA’s user agrees to how it works when it is set up for them, and we keep a record of that consent.
• Other people: callers and meeting attendees are told at the start of the call or meeting, as described in section 6.
• We may also process data without consent where the DPDP Act allows it, such as to comply with law.

9. Service providers we use

These providers (sub-processors) help us run Meenira PA. Each gets only what it needs for its job. The last column says whether Telegram early access uses it.

The model that turns memory into a search index runs on our own server, and so does text recognition for images. Their model files were downloaded once from public sources (such as Hugging Face); no personal data is sent to them.

We may also disclose data when the law requires it, for example to comply with a court order or a lawful request from a government authority.

10. Where data is processed

• Our servers, databases, files and recordings are in AWS’s Mumbai region (ap-south-1), India. The AI model (Amazon Bedrock) is called in the same region.
• Telegram members: the AI model and our storage are in India. Your messages also pass through Telegram, which runs its own servers outside India, and web-search words and weather city names go to DuckDuckGo and wttr.in, which may be outside India.
• The full PA also uses providers based outside India: Groq (backup model and speech-to-text), Deepgram (speech-to-text and voice), Meta (WhatsApp), Plivo (calls), Google (when connected), Resend (email) and the lookup services. They may process data outside India.

The DPDP Act allows transfers outside India except to countries the Government restricts by notification. We will not transfer data to a restricted country.

11. How long we keep data

Early access on Telegram

The full PA

Server logs can include the first few words of the full PA’s messages and replies (not in incognito). Telegram members’ messages are not written to our logs. Server logs are kept for 90 days, database backups for 30 days. We may keep data longer where a law requires it.

12. How we protect data

• All traffic to our servers and to our providers uses encrypted connections (HTTPS or TLS).
• Telegram members’ data is kept in its own database, separate from the full PA’s. Every record carries the member’s account, every lookup is limited to it, and the service refuses to start if pointed at the full PA’s database.
• The Telegram bot can use only a fixed list of tools. It cannot send email, make calls, join meetings or run commands on our server, even if asked.
• Saved text is passed to the AI marked as data, not instructions.
• Limits: 60 messages a day and 10 a minute for each Telegram member, and a daily spending cap.
• The web app password is stored as a one-way scrypt hash. Five wrong passwords in 15 minutes block further tries, and the session cookie is signed and cannot be read by page scripts.
• Google Calendar and Gmail sign-in tokens are stored encrypted (AES-256-GCM). The PA can ask Google only for fixed permissions: calendar events, and read-only Gmail.
• The phone line accepts calls from our telephone provider only with a secret token.
• The PA asks before acting for its user, as described in section 5.

If a personal data breach affects you, we will tell you without undue delay, and we will notify the Data Protection Board of India and affected people where the DPDP Act and Rules require it.

13. Your rights and how to use them

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you and how we use it, and who we have shared it with.
• Correct, complete or update it.
• Erase it, unless the law requires us to keep it.
• Withdraw consent at any time, as easily as you gave it. This does not affect what was done before.
• Raise a grievance with us, and then with the Data Protection Board of India.
• Nominate another person to exercise your rights if you die or become unable to.

Do it yourself, in the chat

These work straight away. They are not requests that wait for us.

Or write to us

For anything else, such as a copy of your messages, a group member’s request, or naming a nominee, email support@meenira.com with the subject “DPDP request” and say what you want. Telegram members: tell us the first name on your Telegram account; we may ask you to confirm the request from the bot. We acknowledge requests within 7 days and resolve them within 30 days.

14. Children

Meenira PA is meant for adults. Sign-up is by personal invite, and the bot does not ask your age. You must be 18 or older, and we do not knowingly invite anyone under 18 We do not knowingly process a child’s data without the verifiable parental consent the DPDP Act requires. If you believe we hold a child’s data, write to us and we will delete it.

15. Cookies

pa.meenira.com sets no cookies and runs no analytics or advertising trackers; its fonts are served from our own site. The web app at pa.meenira.com/app uses one essential cookie to keep its user signed in, for up to 30 days. It is not used for tracking.

16. Changes to this policy

We will update this page when our practices or the law change, and change the date at the top. If a change is significant, we will tell Telegram members in the bot before it applies, and ask for consent again where the law requires it. We will update this policy before any part of the full PA opens to more people.

17. Grievance Officer and complaints

Grievance Officer: Tapas Kar, support@meenira.com

Write to support@meenira.com with the subject “Grievance (DPDP)”, or address post to the registered office above.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India under the DPDP Act.