Privacy notice

Minbar is responsible for the personal information described here (the “controller”, in data-protection terms). Contact: support@minbar.co.uk.

Recordings and what’s made from them belong to the organisation that uploads them. For those, Minbar processes them on the organisation’s behalf to provide the service, and the organisation decides what’s recorded, uploaded and published. If you appear in a recording (for example as a speaker or in the audience) and have a question about it, contact the organisation that published it, or us and we’ll pass it on.

• Your account: your email address, password (stored scrambled, never readable), name, job title and picture if you add them, and your two-step verification if you switch it on.
• Your organisation: its name, type, logo, brand colours and settings, its members and their roles, and the email addresses of people invited to join.
• Recordings and what’s made from them: uploaded video and audio, transcripts, corrections, editorial reports, captions and translations, clips, trailers, finished videos, and the names of speakers the organisation enters.
• Where you use Minbar from: the approximate city, region and country your internet connection appears to come from, worked out by our website host from your internet address. We record it at most once an hour while you’re signed in, and keep only the place (accurate to about 10 km) and the time, never the internet address itself. We keep where you first used Minbar, where you were last active, and a history of these places, so we can see how use changes over time. A VPN or mobile network can make this inaccurate.
• Activity and security records: sign-ins (including the internet address used), password resets, and what’s done in an account (for example projects created, decisions made in reviews, renders, team changes), plus technical errors, including error messages shown to you on a page (the page, the message and when). These help us keep accounts secure and fix problems, often before you report them.
• Plans and payments: an organisation’s plan, and payments recorded against it (amounts, dates, invoice references). Minbar doesn’t take or store card details.
• Publishing: if an organisation connects a YouTube, Instagram or TikTok account, the account’s name and picture, and the permission the platform gives Minbar to post (stored encrypted), plus what’s posted and when, how many views, likes, comments and shares each posted video has, and the account’s followers, kept day by day.
• Messages and moderation: notifications, email preferences (including unsubscribing), and, if a concern is reported about an account or a recording, the record of how it was looked into.
• Sponsored cards: if ads are shown, only daily totals of how many times each was seen and clicked, not who saw it.

• To provide Minbar to you and your organisation: processing recordings, making videos and reports, teams and invitations, publishing when asked, and the emails that go with them. This is needed to provide the service you’ve signed up for.
• To keep Minbar safe and working: securing accounts, preventing misuse, checking recordings against Minbar’s rules, restricting access from some countries, investigating reports, and fixing problems. These are our legitimate interests in running a safe, reliable service. Checking recordings is to flag concerns for a person to review; nothing is decided automatically.
• To understand and plan Minbar: which features are used, how much is processed, and where people use it from, so we can plan capacity and improve the service. This is also our legitimate interest, and uses the approximate location only. Minbar’s platform admins can export this as reports, or have reports emailed to them and to people they choose who help run Minbar; they’re reminded that reports can contain personal information and shouldn’t be shared further.
• To tell you about Minbar: updates about new features and changes, which you can stop at any time (see Emails).
• To keep records we must keep, such as payment records for accounting.

We don’t sell personal information, and we don’t use it for advertising profiles.

Minbar uses these services to run. Each processes information only to provide its service to us. Recordings are rendered on processing computers run by Minbar itself. A talk is transcribed either there, or, for organisations using Minbar’s newer transcription, by AssemblyAI and checked by Google’s Gemini, which receive only its sound.

Where information is processed outside the UK, it’s protected by the safeguards UK data-protection law requires, such as the UK's approved data-transfer agreements. We may also share information where the law requires it.

• Accounts, organisations and their recordings are kept while the account or organisation exists, until they’re deleted. Deleting a project deletes its files.
• Activity and security records are deleted after a year; error records after 90 days.
• Approximate location: where you first used Minbar and were last active are kept while your account exists, and deleted with it. The history of places is deleted after 13 months.
• Payment records are kept as long as the law requires for accounting.
• Connected publishing accounts are kept until the organisation disconnects them; then everything Minbar kept from that platform is deleted (see section 6). What’s already posted stays on that platform.

To close your account or delete your information, email support@minbar.co.uk. Step-by-step instructions are on Deleting your data.

An organisation can connect its own YouTube channel, Instagram account or TikTok account in Publish, to post approved videos from Minbar. Only owners and editors can connect one, and only when they choose to.

What Minbar receives: permission to upload videos and set their details, the account’s name, picture and ID (so you can see which account is connected), and, for YouTube, the channel’s playlists (to add a video to one). For Instagram and TikTok, Minbar also reads the numbers for the videos it posted: views, likes, the number of comments and shares, and on Instagram the reach and saves; and the account’s number of followers. It keeps one copy of these a day, to show how they change (Reach). Minbar doesn’t read your other videos, the comments themselves, messages, who your followers or subscribers are, or the account’s other analytics, and reads none of these numbers from YouTube.

What Minbar does with it: only what you ask: upload the video and the title, description, tags and settings you chose, then show you its link and those numbers. The access is stored encrypted, isn’t shared with anyone, isn’t used for advertising, and isn’t used to train AI.

YouTube: Minbar uses YouTube API Services. By connecting a channel you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to what Google does with your information. Minbar’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Stopping it: press Disconnect in Publish. Minbar then cancels its access with the platform where the platform allows (YouTube and TikTok), and deletes everything it kept from that platform: the access, the account’s name and picture, and the platform’s IDs, links and numbers for videos posted from Minbar, and the account’s daily numbers (the record that you posted, and the wording you wrote, stay in Minbar). You can also remove Minbar’s access yourself: for YouTube, in your Google account’s security settings; for Instagram and TikTok, in each app’s settings under apps and websites. Videos already posted stay on the platform until you remove them there.

Minbar protects the information it holds, and especially sensitive information such as passwords, sign-in records and the access you give it to a YouTube, Instagram or TikTok account, in these ways:

• Encrypted in transit: everything sent between your device, Minbar and the services in section 4 travels over encrypted connections (HTTPS/TLS). Minbar doesn’t accept unencrypted connections.
• Encrypted at rest: Minbar’s database and file storage are encrypted on the disks they’re stored on, in London, UK (Supabase on Amazon Web Services).
• Connected accounts encrypted a second time: the access a platform gives Minbar to post (for YouTube, the Google OAuth tokens) is encrypted with AES-256-GCM before it’s saved, using a key that is kept separately from the database. It’s only decrypted by Minbar’s own systems at the moment of posting or reading the numbers described in section 6, and it’s never shown on screen, in emails or in error reports.
• Passwords: Minbar never sees or stores your password in readable form. Sign-in is handled by Supabase, which keeps only a one-way hash of it.
• Access limited by organisation: every table in Minbar’s database has row-level security, so an account can only read the data of the organisations it belongs to, and within an organisation only what its role allows. Organisations’ recordings and files are kept in private storage and opened through links that expire.
• Two-step verification: every account can switch it on, and it can be made compulsory for Minbar’s administrators. The administrators who run Minbar are the only people with access to its systems, and only to run and support the service.
• Information from Google kept to the minimum: Minbar keeps only what section 6 lists. It isn’t sold, isn’t used for advertising, isn’t used to train AI, isn’t sent to any AI service, and isn’t read by people, except with your permission, to investigate a security problem, or where the law requires it. It’s deleted when you disconnect.
• Records and monitoring: sign-ins and important changes are recorded so misuse can be spotted (kept for a year, see section 5), and errors are reported without names, emails or content.
• If something goes wrong: if a breach puts your information at risk, we’ll tell the ICO within 72 hours where the law requires it, and tell the people affected without delay, with what happened and what to do.

No system is perfectly secure, but these protections are reviewed whenever Minbar changes how it stores or uses information. To report a security concern, email support@minbar.co.uk.

Minbar uses only the cookies it needs to work, so there’s no cookie banner:

• Sign-in cookies, which keep you signed in.
• A one-day cookie that notes your approximate location has already been recorded today, so it isn’t recorded again.

Your browser also remembers a couple of your choices on your own device (for example, whether to make files smaller before uploading). There are no advertising or tracking cookies.

Minbar sends emails you need for your account: confirming your email, password resets, invitations and their reminders. These can’t be turned off while you have an account.

Minbar updates (news about features and changes) have an unsubscribe link in every email. If you unsubscribe, you’ll still see updates in Minbar itself, under What's new.

Under UK data-protection law you can ask us to:

• give you a copy of the personal information we hold about you;
• correct it if it’s wrong;
• delete it;
• stop or limit using it, or object to how we use it;
• give it to you, or another service, in a form that’s easy to reuse.

Email support@minbar.co.uk. We’ll reply within one month. Some of these rights have limits, for example where we must keep a record by law; if so, we’ll explain.

If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator, at ico.org.uk.

When Minbar starts keeping something new or using a new service, we’ll update this notice and the date at the top. For significant changes, we’ll also tell you in Minbar or by email.