Your account and contacts

Meishio is operated by Zovamo Ventures Private Limited (CIN U55101DL2013PTC260253), L-49 Laxmi Nagar, East Delhi, Delhi 110092, India. It stores the account identifier from the provider you use to sign in (Google, or Microsoft or LinkedIn when you choose those), plus your email address and name. Signing in with a provider that confirms the same email address opens the account you already have. It does not request access to Gmail, Outlook mail, or your LinkedIn connections. Google Contacts access is requested separately when you choose to connect it. You choose which contacts to save. Sending edits back starts off for a new primary connection, and can be enabled in Connections; existing connections keep your earlier choice. Additional Google accounts are read when you choose and receive only destination updates you review. That access is used to create and update contacts in a Meishio label. If you also allow Other contacts (the people Gmail saves when you email them), Meishio reads that list read-only. Those people are kept apart in “People you've emailed”: they are not added to your contacts, sent to Google, checked by Meishio Search or included in counts and your map until you add them, and choosing “Not a contact” keeps them out of later imports. Removing a contact from Meishio archives it in Meishio only and never deletes it from Google. Meishio never deletes the contacts already in your Google account and changes them only with fixes you approve, each of which can be undone. A session cookie keeps you signed in. Refresh credentials for Google Contacts are stored encrypted using AES-256-GCM. Disconnecting an additional account removes its stored credentials. Turning off the primary connection clears its credentials after cleanup succeeds; a failed cleanup is shown for retry. Deleting your Meishio account removes its stored credentials.

You can also sign in with a code sent to your email. Resend processes your email address and the verification message to deliver that code. Codes expire after ten minutes and work only in the browser that requested them. Meishio stores keyed hashes of codes and browser secrets, your email, attempt counts, expiry times and a keyed hash of the requesting IP address for sending limits. These temporary records are removed after their expiry is more than 24 hours old when further codes are requested. A verified code opens the account with that exact email address, or creates a new one. After verifying a Gmail mailbox, you can choose an existing account that uses an alias of that same mailbox. Existing alias accounts and their contacts stay separate; they are never automatically merged. This choice does not apply to other email providers. Email sign-in does not connect Google Contacts or grant access to your inbox.

Cards, contact details, notes, follow-ups and research you save are associated with your account. Other users cannot browse your private address book. If you deliberately share selected details into a team workspace, members can view that separate team copy as described below. Administrators can manage accounts, credit balances and access; the service operator also has operational access to stored data.

Google user data

What Google user data Meishio accesses

Signing in with Google uses the openid, email and profile permissions. Meishio stores the Google account id, the email address Google has verified, and your name. If Google sends a profile-photo web address, that address stays in the sign-in session for up to 7 days and is not saved as a photo file. Meishio does not request access to Gmail.

Google Contacts is separate from signing in. When you connect Google Contacts, you choose which contacts to import. Sending changes back starts off for a new primary connection and can be enabled in Connections; older connections retain your earlier preference. Additional accounts refresh when you read them, and updates are sent only after you review the destination and fields. Meishio asks for the contacts permission (https://www.googleapis.com/auth/contacts), which can see, edit, download and permanently delete contacts. From each saved contact it reads the name, email addresses, phone numbers, company, job title, department, postal address, website and profile links, the biography note, and the contact groups that person is in. It also reads a photo when copying one onto a contact you added. That same permission is how Meishio creates and updates contacts in a Meishio label, and how the primary connection deletes only contacts Meishio created when you turn that connection off. Additional-account disconnect does not delete contacts in Google.

If you also allow Other contacts, Meishio asks for the read-only contacts.other.readonly permission (https://www.googleapis.com/auth/contacts.other.readonly). From that list it reads names, email addresses and phone numbers, and a photo only when copying one onto a contact you later add. It never writes to Other contacts.

How Meishio uses Google user data

Your Google account id, email and name open and recognise your Meishio account. Saved contacts are read so you can review them, choose who to add, and sort business contacts from personal ones. A contact you add can be kept in Meishio, shown in your counts and on your map, and included in a Meishio Search check you start. Other contacts stay in “People you've emailed” until you add them. They are not added to your contacts, sent back to Google, checked by Meishio Search, or included in counts and your map until you add them, and choosing “Not a contact” keeps them out of later imports.

Meishio writes to Google to create and update contacts in the Meishio label, to apply a fix you approve (a country code, an email label, or a title or company you accepted), and to remove contacts Meishio itself created when you turn sync off. Each approved fix can be undone. Meishio never deletes the contacts that were already in your Google account. Removing a contact from Meishio archives it in Meishio only. A later import or sync does not bring that person back. If Meishio created a copy of them in Google, that copy stays until you turn sync off. Google user data is used only to provide these features to you. It is never sold and never used for advertising.

Google user data is not used to train a generalized AI or machine-learning model. Meishio does not train or fine-tune any model on it.

Who Google user data is shared with

Google user data is not sold. Other Meishio users cannot open your private address book. You can deliberately share selected Google-sourced contacts into a team workspace, as described below. Administrators can manage accounts, credit balances and access, and the service operator has operational access to stored data to run the service.

Contacts imported from Google, including people you add from “People you've emailed”, are not sent to OpenAI, Google's Gemini API or any other AI writing service.

When an import or address-book check cannot tell whether a Google contact is business or personal, Meishio may send that entry's organisation, title and work email domain — never the name, a phone number, a full email address, a postal address, a note or a photo — to the TypeSafe API, a third-party AI model provider, as a single request to sort that entry, when a TypeSafe key is configured. A free-mail domain such as gmail.com, or a domain that contains the person's name, is not sent. An entry left with no organisation, title or work email domain is not sent; it waits in Maybe for you to decide. Entries TypeSafe does not decide, and every entry when no TypeSafe key is configured, are sorted by Meishio's own rules and are not sent anywhere else. Google user data is not sent to TypeSafe to train a generalized model.

If you start a Meishio Search check on a saved contact, including one that came from Google, Meishio sends that contact's name, company, title, city and work-email domain to Serper for Google web results and to Exa for public search results or page excerpts. Exa is in the United States. Optional clues and a LinkedIn profile link you supply for discovery are also used in these searches. A free-email domain such as gmail.com is not sent, and the full email address is not sent. The same fields, plus short excerpts of the public pages these services return, then go to the TypeSafe API, a third-party AI model provider, when that key is set, to compare the results with the contact. That comparison is not used to train a generalized model. For a contact from Google, the comparison is never sent to OpenAI or Gemini; when TypeSafe is not confident, no change is suggested. The same applies when you use “Find who this is” on a row of a Google import. Discovery shows possible matches with public sources; you confirm the person and preview changes before applying details.

If you request research on a contact that came from Google, its name and company, or the LinkedIn link saved on it, are sent to Exa, and the sources found are saved for you. No AI summary is written for that contact, so nothing about it goes to OpenAI or Gemini. A follow-up draft for a person from Google is written by Meishio from a template and is not sent to an AI service.

A work-email domain from a Google contact may be looked up on the public web to suggest a company name. Only the domain is sent, never the person's name or the full email address, and the company name found can be shown to other Meishio users who have contacts at that domain. To look for a public profile photo, Meishio may send Gravatar a one-way SHA-256 hash of an email address that came from Google, never the address itself. If you sign in with Google, that sign-in email is the address Resend receives when Meishio emails you. Card photos are not read from Google; where a scanned card goes is under “Services used to process your data”.

How Google user data is protected

The Google Contacts refresh token is encrypted with AES-256-GCM before it is stored, and the plaintext is not written to logs. Access tokens are used only to call Google and are not saved. Photo downloads from Google do not follow redirects, so that token is not sent to any other site. The contacts, notes and copied photos are stored in the Neon database and private Blob storage in Singapore described below. Every connection is encrypted, and every read of your contacts is limited to your account.

How long Google user data is kept, and how it is deleted

Your Google account id, email and name are kept for as long as the Meishio account exists. A contact you add from Google stays in your account, including after you archive it, until you delete the account. Archiving it hides it in Meishio and leaves the original in Google. A photo copied from Google stays on that contact until you remove the photo or delete the account. The log of phone numbers and email addresses before and after a fix you approved stays until you delete the account. Saved Google contacts you do not add are deleted when you finish the import. An unfinished import, including the Google rows staged in it, is deleted after 7 days. People from Other contacts are kept on “People you've emailed” (name, email addresses, phone numbers, company and title) until you delete the account. Choosing “Not a contact” keeps that person out of later imports and leaves that row in place. A one-way hash of the name, organisation, title and email domain, plus a short sorting note, may be kept after the import so a later import can be sorted faster. It does not include the phone number or the full email address. Turning Google Contacts sync off deletes the stored refresh token and removes the contacts Meishio created in the Meishio label. It does not delete contacts that were already in your Google account.

In Settings → Account, “Delete my account” deletes the Google user data Meishio holds for you: the contacts, photos copied from Google, import rows, the “People you've emailed” list, Google links and the change log, and then the account itself. You are signed out straight away and have seven days to cancel deletion by signing in again with a verified account. After that window, Meishio permanently removes the private data and revokes its Google Contacts access. Team copies and handover follow the separate team-workspace rules above. Contacts already in your Google account are not deleted from Google. Deleted rows can remain in the database provider's short-term recovery history until that history rolls over. You can download this data first from the same Settings → Account page.

Meishio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Team workspaces and coworker discovery

You choose which people to share into a team workspace. Meishio copies their name, title and company, and their current work email and office phone numbers only if you include them (each is off until you switch it on). Office numbers are numbers saved as work or landline that Meishio confirms are fixed lines, not mobiles. The team also sees that you know them and a relationship summary derived from your saved meeting count, contact channel and recency. The summary can show how many times you met, whether you have their card or only an email, and a strength rating. It does not show the underlying dates, places, event names, private notes, numbers saved as mobile or personal, addresses, photos or card images.

Sharing a Google-sourced contact requires an additional confirmation that names the workspace and its current members. Meishio does not offer sharing every Google contact in one step. Team admins control membership; current members and people admins admit later can read retained team records. Admins can export those records. Team notes and follow-ups written in the workspace are visible to its members.

Unsharing removes your “you know them” relationship. Your private copy stays yours. A team record the team has edited, filed or otherwise used can remain after you unshare, leave or delete your account. When you request account deletion, pending team follow-ups are handed to an active admin or editor and invitations you created are revoked. Recovering your account during the seven-day window does not reverse that handover or restore those invitations.

“Let coworkers on my work email find me in Meishio” is off by default. If you turn it on, a team admin signed in with the same eligible company email domain can see your name and sign-in email as an invitation suggestion. Personal, academic and shared-provider mailbox domains are excluded. Turning it off removes you from subsequent suggestions; it does not retract an invitation already sent.

Where your data is stored

Your account, contacts and notes are stored in a Neon Postgres database in Singapore (region ap-southeast-1). Meishio's servers run on Vercel in Singapore (region sin1). Contact photos and My card images are kept in private Vercel Blob storage and are shown only through your signed-in account.

Services used to process your data

Google, Microsoft or LinkedIn handles sign-in, depending on the button you use. When you scan a card, its image may be sent to the OpenAI API, a third-party AI model provider, or, if OpenAI is unavailable, Google's Gemini API to read the information. In the same step the reader says whether the photo is a business card at all; if it is not (a product label, a receipt, a screenshot), nothing from that photo is saved and it does not count as a scan. Extracted information may be sent to TypeSafe for accuracy checking or, when TypeSafe does not answer, to OpenAI (or Gemini, if OpenAI is unavailable) for the same check. Before anything is sent, your phone looks for card shapes in the photo and outlines them in the camera view; that check runs on your device and sends nothing.

When you request research, Meishio sends the relevant person and company search terms to Exa. It saves source links, bounded source text, professional facts and summaries for your review. OpenAI (or Gemini, if OpenAI is unavailable) receives these sources and the role, company, background and goals you choose to save in your professional profile to produce a relevant brief, except for contacts imported from Google, which get no brief. When you request your own profile or company research, the LinkedIn URL you provide is sent to Exa. Research does not automatically replace your saved contact details.

Meishio Search, which checks saved contacts for new roles, sends a contact's name, company, title, city and work-email domain to Serper for Google web results and to Exa for public search results or page excerpts. Full email addresses and personal email domains are not sent. The TypeSafe API or the OpenAI API, each a third-party AI model provider, or, if OpenAI is unavailable, Google's Gemini API compares the results with the contact, and any change is shown to you to accept or ignore; contacts imported from Google are compared by TypeSafe only. When you import contacts from your phone or a file, each entry's organisation, title and work email domain may be sent to the TypeSafe API or the OpenAI API, each a third-party AI model provider, or, if OpenAI is unavailable, Google's Gemini API, to sort business contacts from personal ones. Sorting never sends the entry's name, a phone number, a full email address, a free-mail domain such as gmail.com, or a domain that contains the person's name; an entry left with none of those three is not sent and waits in Maybe for you to decide. When you import from Google Contacts, those fields may go to TypeSafe only; anything TypeSafe does not decide is sorted by Meishio's own rules. Only if you choose “Suggest tidy-ups” during an import, each entry's name (with phone numbers and email addresses taken out), organisation, title, email domain, and phone and email labels are sent to the OpenAI API, a third-party AI model provider or, if OpenAI is unavailable, Google's Gemini API, to suggest cleaner names, companies and labels. Phone numbers, full email addresses, postal addresses and notes are not sent, and nothing changes until you apply a suggestion. Entries imported from Google Contacts are never sent for tidy-ups. These providers process data under their own policies.

Where these providers process data: OpenAI is in the United States. Google's Gemini API runs on Google's own servers, which are not limited to one country. Exa is in the United States. Meishio's own servers and database are in Singapore, as described above. Contacts imported from Google are not sent to OpenAI or Gemini.

On the try page, without an account, “See where they are now” sends only the name, company and title you read from a card or typed to Exa and to the TypeSafe API or OpenAI (Gemini if OpenAI is unavailable), and shows the current company and title with the public pages they came from; Meishio does not store the result or the card, only counts lookups to limit them (2 a day), and public pages for that name and company may be kept for 30 days in the same shared cache Meishio Search uses. Reading a card on the try page is limited the same way: each read is recorded against a one-way, keyed hash of your IP address (the address itself is not stored), and those records are deleted after two days.

Reading-language preferences can show a translated title, company or department beside its original. Meishio sends only those fields, without names, emails, phone numbers, notes or other private context, to OpenAI, a third-party AI model provider, or Google’s Gemini API if OpenAI is unavailable. Google-sourced fields follow the same Google-data AI restrictions described above. Reading versions are cached privately for your account; only reviewed generic job titles, department labels and company aliases enter a shared dictionary. An address may separately be sent on its own for Latin-script romanisation for reading, with its printed numbers and Latin tokens checked for preservation; this reading stays in your private account cache and never enters a shared dictionary. Names are never machine-translated. Saved originals, maps, copy actions and Google sync keep the original values. Public news headlines and summaries may also be translated. Opening a translated article sends only its public URL to Google Translate.

Company news is found with Exa, a web search service. Meishio searches by company name only — never your contacts' names or details. To write a one- or two-line summary of an article, the article's public text is sent to OpenAI (or Gemini, if OpenAI is unavailable); only the summary and a link to the article are kept, and the article text is not stored. Summaries are shared by everyone who follows that company. Headlines that name someone you know are matched inside Meishio, and you can turn company news off in Settings.

When you search in plain words (such as “HR heads in Singapore”), the words you typed are sent to OpenAI (or Gemini, if OpenAI is unavailable) together with lists that hold no personal details — the country names, event names, contact types and industries in your book — so it can turn them into filters; your contacts' names, emails and other details are never sent, and the filters are applied to your contacts inside Meishio. Searches that find nobody are kept in your account, visible to no one else, to improve matching.

Follow-up drafts

Meishio does not offer a next-day follow-up. When you open a message draft yourself, Meishio may send the event name and each person's company, title and draft language (English or Japanese, chosen from the card) to the AI service that writes the draft (OpenAI, or Gemini if OpenAI is unavailable). The person's name, email address and phone number are not sent: the AI service writes a placeholder, and Meishio puts the name in after the draft comes back. Your notes about the person are not sent. People imported from Google are never sent: their draft is written from the template below.

If no AI service is available, Meishio writes the draft itself from a template, which may include a short note of yours. That draft is made inside Meishio and is not sent to any AI service. Drafts are saved on the contact so the AI service is not asked again.

Scan location

Location is only asked for when you open the “Scanning at” label on the Scan screen, and only used if your browser allows it. Your browser then sends your device's approximate position, rounded to about 1 km, to BigDataCloud, which returns the name of the place (usually the city). BigDataCloud processes this under its own policy.

The place name is used for the “Scanning at” label and to name the event your cards are grouped into. When you save a card, Meishio stores the place name and the position rounded to about 100 metres on that event, only to keep cards scanned close together in the same event. It is deleted with the event or your account. Card photos are saved without camera or location metadata.

Public web results in Meishio Search

When Meishio Search looks up public web pages about a person or company, it may reuse results found in the last 30 days for other Meishio users looking up the same public page. This search cache shares only public web results; it does not share your contacts, notes, phone numbers or emails. Team copies you deliberately share use the separate controls described above. See Your data for more.

Contact photos from Gravatar

For a contact with no photo, Meishio checks Gravatar in the background, once per set of email addresses, for a public profile photo. It sends Gravatar a one-way SHA-256 hash of up to three of the contact's email addresses, never the addresses themselves or any other detail. If Gravatar has a public photo for one of them, Meishio only notes that it exists and offers it on the contact page (“Use photo from Gravatar?”). Opening the contact does not contact Gravatar; the photo is fetched, through Meishio, only when you tap See photo or Use, and a resized copy is saved only if you tap Use. “Not now” hides the offer until the contact's email addresses change. Photos added this way before are kept; you can replace or remove them.

Payments

Meishio is free while in early access and does not take payments today. When paid plans are switched on, payments in Indian rupees are handled by Razorpay (UPI or card) and payments in other currencies by Stripe (card). You enter your card or UPI details on the payment provider's checkout, and they are handled by that provider under its own policy; Meishio never receives or stores your card number or UPI details. Meishio keeps a record of each payment: the amount, currency, date, the period it pays for and the provider's payment reference. See the refund and cancellation policy.

Emails from Meishio

When a check you started (for example an address book check) finishes in the background, Meishio emails your sign-in address once, if the check took more than a couple of minutes or finished after you left the page. The email says how many people were checked and how many changes wait for your review. It names no contacts. This email is on by default. Turn it off in Settings under “Email me when a background check finishes”. The optional email update is off until you choose it. Both are sent through Resend, which receives your email address and the email's content to deliver it.

Suggested email addresses

To suggest likely email addresses, Meishio keeps anonymous counts of email formats per organisation domain (for example, first.last at example.com), pooled across users. Only the format and counts are kept — never anyone's name or address — and a format is used only after it has been seen in at least three different users' contacts.

When you choose “Find the email format”, Meishio sends the organisation's email domain or name to Exa to find published addresses at that domain. Only the format found, the number of addresses that showed it and the page links are saved on your account; the addresses themselves are not kept. A suggested address is marked “Suggested” and is never used for drafts, exports or Google Contacts until you confirm it. Meishio does not contact the mail server to test an address.

The anonymous counts are not removed when you delete your account, because they hold nothing about you or your contacts.

Company names from email domains

To suggest company names, Meishio looks up the public website of a work email's domain (for example kitagawa-motors.co.in) and keeps the company name it finds. Personal email domains like gmail.com are never looked up.

Only the domain is sent and stored, never a person's name or email address. The name found is shared with other Meishio users who have contacts at the same domain, and is kept for 30 days. A suggested company is only saved on a contact when you apply it.

Office addresses from company websites

Meishio uses the company names and email domains in your contacts to find those companies' public websites. Office addresses we read from those websites are shared across all Meishio accounts. Your contacts, their names and their emails are never shared.

Search and usage data

Meishio saves account-linked search records to limit usage and improve matching, including the query (unless query-text logging is disabled), result count, search type and time. The iPhone app also saves its device name and model with your account session so you can recognise signed-in devices.

The website, including pages shown inside the iPhone app, uses Vercel Web Analytics and Speed Insights for page counts, loading performance and limited interaction diagnostics. Vercel may receive page paths, referrers, approximate city or country, browser and device information, and performance measurements. Meishio removes query strings and fragments, replaces record identifiers and public card names with route templates, and masks unrecognised paths before sending them. For selected controls, Meishio also sends fixed screen and action names, repeated-tap signals, action outcomes and broad timing ranges to Vercel to help find usability problems. These events do not include contact details, typed content, screenshots, recordings, error messages or an account identifier added by Meishio. Tap detection uses temporary in-memory state. Events may still be associated with Vercel’s normal visit metadata; they are not a personal support history. Meishio suppresses analytics and performance events when your browser signals Do Not Track or Global Privacy Control. These services do not use advertising cookies or cross-site advertising tracking. When you arrive from a link that carries a short campaign tag (for example ?src=jetro or utm_source), Meishio keeps that tag, and the campaign name with it, in a first-party cookie for up to 30 days. If you then create an account, or join a waitlist or ask us about Meishio for a team, the tag is saved with it so we can see which links brought people in. Only the tag is kept, never the rest of the address, and it is not shared with anyone. See Vercel's analytics privacy information and performance privacy information.

Storage and your choices

Saved information remains in the service until you remove it or delete your account. Card photos are stored as a resized image without camera or location metadata; the original upload is not kept. When you finish an import, the entries you did not add are deleted, and a short sorting note keyed by a one-way hash is kept to speed up later imports. Unfinished imports expire after 7 days.

You can edit and export contacts in the app, and sign out from your account page. Removing a contact archives it in Meishio only: it stays in your Google Contacts, you can restore it from Archived, and nothing in Google is deleted or changed. Merging duplicates permanently deletes the duplicate record inside Meishio and does not delete that person from Google.

Basic email checks

When you choose Check email addresses, Meishio checks the selected contacts’ primary email formatting and looks up only the domain in DNS. The full address, name, notes, photos and Google tokens are not sent for these lookups. No message is sent. Domain mail settings cannot confirm that an individual mailbox exists or is still used, and a result does not establish that a person is inactive. You review any address problems; contacts are never automatically changed or removed. Private check results are included in your account data download and deleted with your account. Public domain-only DNS facts may be cached separately.

Download your data and delete your account

Download. In Settings, under Account, “Download my data” gives you one ZIP file with everything Meishio holds for your account: contacts (also as a vCard file), companies, notes and activity, events, card scans with their images, contact photos, My card, research, Meishio Search results, imports, your settings, and the log of changes Meishio made in your Google Contacts. You can download it up to 3 times a day.

Delete. In the same place, “Delete my account” deletes every contact, company, note, event, card image, contact photo, My card, research result, import, setting and log that belongs to your account, and then the account itself. You are signed out straight away and your public card goes offline. You have 7 days to change your mind: sign in again with your verified account before the deadline shown on the confirmation screen to cancel deletion. After that deadline, the deletion worker permanently removes your data and revokes Meishio's Google Contacts and Apple sign-in access; contacts already in Google are not deleted from Google. Download your data first. An administrator can arrange permanent deletion if you ask by email; that request is recorded in the audit log.

What is kept. Records of payments, if any, are kept for accounting, with the amounts and dates but with your account replaced by an anonymous id. The administrative audit log is kept, with your account replaced by the same anonymous id and administrator notes about you removed. Deleted data can remain in the database provider's short-term recovery history until that history rolls over.

For correction, or questions about retained data, contact support@getmeishio.com (more on the Contact us page). The same steps, including how to ask without the app, are on Delete your account. The Terms of Service cover your use of Meishio.