Fireflies.ai

GDPR overview

GDPR compliance is claimed explicitly on the home page, the Security page, the FAQ and the Trust Center, and it rests on concrete mechanisms. The privacy policy in force since 6 March 2026 contains an "Individuals in Europe" section setting out the legal bases used (contract, legitimate interest, legal obligation, and consent that can be withdrawn) and the rights of access including portability, erasure, rectification, objection and restriction, exercised by writing to support@fireflies.ai. Complaints can be filed with a supervisory authority, with links to the EDPB, the UK ICO and the Swiss PFPDT. The publisher is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework, and publishes a DPA incorporating the 4 June 2021 Standard Contractual Clauses and the UK IDTA version B1.0. No Article 27 representative and no data protection officer is named anywhere on the site.

Who owns the data?

The home page, the Security page and the Terms of Service all state that the customer keeps ownership of, and full control over, the content captured by the tool. Access to meeting content is described as conditional on the user's explicit consent. Users can delete their data at any time, including in bulk through the Delete Transcript endpoint of the API. Visibility is set meeting by meeting: a shareable link, workspace teammates, meeting participants only, or private. In short, Fireflies positions itself as a processor of customer conversations rather than as their owner, and states that it does not train models on them.

Reuse rights

Customers can reuse their own material without asking permission: transcripts, summaries, audio and video can be played back, edited, downloaded, shared and pushed into connected CRM, ATS, storage and task tools. On the publisher's side, the privacy policy in force since 6 March 2026 lists the purposes: running and improving the service, capturing audio and video, producing transcripts and summaries, powering the integrations the customer enables, plus account administration, technical and security notices, marketing messages that can be unsubscribed from, usage analytics, fraud prevention and legal obligations. Two exclusions are stated explicitly: personal information is not used to train AI models, a restriction the publisher says it imposes contractually on its vendors, and personal data is neither collected, used nor sold to train large language models. One practice does deserve attention: targeted advertising on third-party platforms, which may qualify as a "sale" or as "sharing" under US state privacy laws. Opting out is left to the user, through the Your Privacy Choices banner, a web form or a Global Privacy Control signal. Voice Data, meaning the voice characteristics generated by vendors to tell speakers apart and potentially treated as biometric data in some jurisdictions, is stated never to be received or processed on Fireflies' own servers and never used to identify or authenticate anyone. No advertising is targeted at people known to be under 18.

Data retention & training

Hosting summary

Fireflies.AI Corp. is established in the United States, and its privacy policy states that the company and its service providers process and store personal information on servers located in the United States and other countries. No further country or region is named, and no European data residency option is documented. The database is described as hosted in a virtual private cloud, with 256-bit AES encryption at rest and 256-bit SSL/TLS in transit. Enterprise customers can add Private Storage, meaning dedicated storage either managed by the publisher or hosted on the customer's own cloud account, at the location of their choice. International transfers rely on the 4 June 2021 Standard Contractual Clauses, the UK IDTA version B1.0 and certification under the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks. A subprocessor list is published at trust.fireflies.ai/subprocessors, although that page renders only with JavaScript and could not be read as static HTML. One technical caveat: the domain's IP address resolves to a Cloudflare anycast node, which says nothing about where the application itself is hosted.