Legal
Data Retention
What Just Say It keeps, where it is kept, for how long, and how to delete it — one table, from what the product does today.
This page is the working detail behind section 5 of the Privacy Policy (“How long we keep it”); the two say the same thing, and if you find a place where they do not, tell us and we fix it. It is also our written policy for keeping and destroying faces and voices, which some laws ask us to publish. Questions and requests go to [email protected] from the address you sign in with.
What is kept, where, and for how long
| What | Where it lives | How long | How it goes |
|---|---|---|---|
| A conversation’s recording — the transcript, the slides as they showed, the notes and the written notes document, the chat, the quiz and vote records, the index of its points the co-presenter recalls from and, for an exact quote, the transcript’s own lines in spans | A folder of its own on the server that ran it, and a copy in our private storage bucket in North America; the list’s row — title, when, how long, who took part by account id — in our ledger | Until you delete it. The server’s own copy is slimmed after 365 days to what the list needs; the bucket keeps the whole recording and serves it back when it is opened. | Delete it from your history (one at a time), or “Delete all my conversations…” at the end of the list — the folder, the bucket’s copy, the index, the ledger’s row, and the films, memes, clips and slide pictures made from it all go, here and in the bucket; a copy a browser or the network cache fetched before the deletion may remain until it expires. “Make private” keeps a conversation out of recall and search without deleting it. |
| A trial’s recording (no account) | The same places | One hour, unless you sign in within it — then it is yours like any other. | Automatic. |
| A film, and a photo or voice take someone gave for it | The film and its poster in the server’s media cache and the bucket’s media area, named by the file’s own digest; the photo and the take with that conversation’s recording; a film’s list of who starred, as account ids, in the recording | With the recording. | “Delete my files” on the film card removes your own photo and take; deleting the recording removes the film and its poster, here and in the bucket (a copy already in the network cache may remain until it expires); removing a saved photo or voice the host added removes the films made with it. |
| A photo and voice you chose to save for films and memes, and your “be in the memes” choice. While you have said yes, the photo is what the memes’ pictures and short videos of you are made from — in a room whose host turned video memes on, a five-second clip starring one person who said yes, made by the same picture-making service as the memes’ pictures; a room where nobody said yes gets no clip of anyone | Your account’s private files in the bucket; a picture or clip made for a meeting in the server’s media cache and the bucket’s media area, named by the file’s digest, and listed in that meeting’s recording | Until you delete them, or three years after the last use, whichever comes first. | Settings → Your photo → Delete, and the “be in the memes” switch, which stops every later picture and clip; deleting your photo removes the memes, clips and slide pictures made from it, and deleting the recording removes the ones made for that meeting. The three-year sweep runs daily. |
| A team face — a team photo you said yes to on your own screen, or a snapshot the host took and confirmed (held, unusable, until confirmed) — and the host’s record of having accepted responsibility for the faces they add | The host’s private files in the bucket, with who the face is (the account, or the seat in that one meeting), how it was given (your yes, or the host’s word), and when; the switch and its acceptance in a small file beside them | Three years after the face was last used, or until the person or the host removes it, whichever comes first. | Settings → Team faces → Remove (the person or the host), or the Remove link in a meeting-notes e-mail that carries one: the files go here and in the bucket, a note of the removal keeps the face from ever being used again, and the memes, films and slide pictures made from it go with it. The three-year sweep runs at start-up and every day after. |
| Your camera backgrounds — nine pictures made from your photo when you click “Make my backdrops”, which you can put behind you on camera, and which a meme of you may be set in. A plain blur needs no picture and never leaves your device | Your account’s private files in the bucket, beside your photo | Until you delete your photo. | Removing your photo (Settings → Your cast → your own entry → Remove) removes the nine pictures with it, here and in the bucket. A new photo makes the old pictures out of date until you make new ones. |
| A share link you sent (slides, notes or a film) from the Share panel | Our ledger: a hash of the link’s secret, the address masked and hashed, the views counted — the address in plain text only in the e-mail we sent | Seven days, or until you revoke it. | Revoke it in the Share panel. |
| The links in a meeting-notes e-mail — one share per recipient, made in the host’s name, which anyone holding the link can open | The same, in our ledger | Thirty days, or until the host revokes it. | The host revokes it in the Share panel; a recipient keeps the meeting in their own conversations only after signing in. |
| An “ask about this” answer and its sources | The server’s memory, so you can share it into the room | One hour. | Automatic. |
| Your minutes, plan, blocks, films’ credit, team pool and welcome meetings | Our ledger, by month, under your account id (your plan and card are your ELAV8 account’s) | While the account is in use; monthly rows stay for billing. | Ask us; a plan change or cancellation is made in your ELAV8 account. |
| Connected accounts (Gmail, Notion, Linear, a server of your own) — the sign-in token | Encrypted in a vault the connections gateway alone opens; never on the web server | Until you disconnect. | Settings → Connections → Disconnect — the token is revoked at the provider where it allows and deleted here. |
| What a connected account answered | Nowhere: a search’s results are read to write your answer and discarded; only counts are kept | Not kept. | — |
| Usage records — which pages, controls and features were used, as names and moments, never content | Our analytics store under a random identifier; the link between that identifier and your account in the ledger | Kept to understand the product over time; the link to your account goes when you ask, or after 25 months unused. | Ask us; the browser switch in Settings → Help us improve stops new records at once. |
| A meeting bot in your Zoom, Meet or Teams call | The vendor keeps no recording (recording is off by our configuration); its minutes count on the host’s month like a microphone | The vendor’s copy: none. Ours: the recording above. | With the recording. |
| Server logs and audit events | Codes and counts only — never a word said, written or shown; the connections gateway’s audit rows in the ledger | Platform logs for days; audit rows 90 days; the ledger’s idempotency records 7 days; trial counters 1 day. | Automatic. |
| A waitlist address, an Enterprise enquiry, a creator application | Files the makers read, and the one e-mail each sends | An address left at “Tell me when there’s room”: until that one e-mail is sent, then removed. Anything else: until you ask us to remove it; a creator payment’s record as long as the law requires. | Write to us. |
| Your sign-in address | Your own browser’s encrypted cookie and the server’s memory while you are signed in — never a recording or a log; where the product must recognise it later (a team invitation sent to it, a calendar Ziggy watches, a share made for it) a one-way code of it in a file, from which the address cannot be read back; an address you type into a form (the waitlist, an enquiry, a creator application, a share) is kept as that row says | While you are signed in; a one-way code as long as the thing it is for (the invitation, the calendar, the share). | Sign out; the invitation, the calendar and the share each say how they are ended. |
How to delete
- One conversation: open your history, choose it, Delete. It is removed from our storage too, not only from your list.
- Every conversation you hosted: “Delete all my conversations…” at the end of the history list — one confirmation, one request, every recording you hosted goes with its bucket copy, its index and its ledger rows.
- Your photo and voice: Settings → Your photo → Delete; a film card’s “Delete my files”. A team face: Settings → Team faces → Remove, by the person or the host. What was made from a deleted photo or face — memes, clips, slide pictures, films — goes with it.
- A connected account: Settings → Connections → Disconnect.
- Everything we hold under your account: write to [email protected] from the address you sign in with. We confirm when it is done, and we never treat you differently for asking. Your ELAV8 account — the sign-in, the plan, the payments — is deleted there.
What is never kept
- Audio of a conversation. The microphone is transcribed as it streams; no sound file of a conversation is written anywhere. The one sound file we keep is a voice sample someone records on purpose for a film, as the table says.
- Your network address with a usage record.
- A connected account’s messages or documents, beyond the moment they are read to answer you.
- Anything a conversation said, in a server log.
Last updated 2026-10-17. This page is a draft, written from what the product does. A lawyer has not read it yet; it will say so here until one has.