In the last piece, I checked eight AI notetakers and found that MeetGeek and Fireflies both say they do not train on your meeting content. That answer is now settled between these two, and it is the same answer, so it cannot decide between them.
The questions that can decide are the ones that come after training. How long does a recording stay on their servers? Where does it live? How is it deleted when you ask? Who else touches it along the way? Those answers are different, and they are written down in the same policies, so I checked them the same way, from the vendors' own pages in November 2026.
One limit up front, carried over from the last piece: a privacy policy is a promise, not an audit. I found no independent study measuring whether either tool actually keeps, stores, or deletes data the way its pages say. What follows is what they promise, in their own words, and what you can check yourself.
The short answer
| Question | MeetGeek | Fireflies |
|---|---|---|
| Trains on your meetings? | No, on any plan, unless you opt in in writing | No, on every plan including Free |
| How long is a meeting kept? | Set by your plan, transcripts 3 months to unlimited, audio 1 to 12 months | You set auto-delete per format, custom retention is Enterprise |
| Where does it live? | EU or US, your choice, backups in the same region | US by default, storage region is Enterprise only, processing stays in the US |
| How is it deleted? | Gone from active systems in 30 days, backups purged in a further 35 days, 65 days total | Delete anytime, account data deleted within 30 days of closure |
| Who else touches it? | Four main subprocessors, listed publicly | Subprocessor list on its trust page, 30 days to object to a new one |
| HIPAA BAA? | On all plans | Enterprise only, with Private Storage |
That table is the whole piece in one glance. The rest is where each row comes from, and where the fine print changes the headline.
Retention: one sets it by plan, the other lets you set it per format
MeetGeek sets retention by plan, and publishes the numbers in a table. Transcripts and notes are kept 3 months on Basic, 1 year on Pro, unlimited on Business, and custom on Enterprise. Audio is kept 1 month, 6 months, 12 months, and custom on the same plans. Video is not included on Basic or Pro, 12 months on Business, custom on Enterprise. On Enterprise you can also set a different period per team, for example shorter for HR interviews and longer for sales calls.
That is a clear answer, and it is also a fixed one. On Pro, your transcript is gone after a year whether you wanted it kept or not, unless you delete it sooner yourself, which you always can. The plan decides the maximum, you decide the minimum.
Fireflies works the other way around. Its guide says you can set up automatic data deletion, and you can set one time for everything, or give video, audio, transcript, and summary each their own retention period. That is more control than MeetGeek gives a Pro user, because you choose the period instead of taking the plan's number.
The catch is the plan gate. Fireflies lists custom data retention as an Enterprise feature on its security page, alongside the Rules Engine and Super Admin. So the per-format control exists, and the question to ask before you rely on it is which plan you are actually on. A freelancer on Pro should not assume the Enterprise control is in their settings.
Residency: storage and processing are two different questions
MeetGeek offers a real choice at signup. Each workspace runs in one region, the EU or the US, and your meeting content and its encrypted backups are stored in that region, on AWS. Your contract is with its EU company if you pick the EU instance, and with its US company if you pick the US instance.
There is a caveat, and MeetGeek states it plainly. Some data is processed centrally regardless of instance, such as account and billing data, support conversations through Intercom in the United States, and product analytics through Mixpanel in the European Union. So your meetings stay in your region, and your support tickets do not necessarily. That is a normal split, but it is worth knowing before you tell a client that everything is in the EU.
Fireflies is simpler to describe and harder to move. By default, it stores and processes your data in US cloud infrastructure running on AWS. Its own blog puts it plainly: data sitting in US infrastructure falls under US law regardless of which company owns it, and choosing a storage location changes only where the data rests.
Enterprise Private Storage is the way out of the default. It is a dedicated storage bucket that holds only your organization's data, in a location you choose, either managed by Fireflies or in your own AWS S3 or Google Cloud Storage bucket. But the same blog is clear about the limit: with Private Storage, your meeting data rests in a bucket you control while transcription, summarization, and every other operation run on Fireflies servers in the United States. If your requirement covers processing location as well as storage location, Private Storage addresses the storage half and processing stays with Fireflies.
So the contrast is clean. MeetGeek gives you a region choice on every plan, for the meeting itself and its backups. Fireflies gives you a US default on every plan, and a storage choice only on Enterprise, with processing still in the US either way.
Deletion: what "gone" means, and how long it takes
MeetGeek publishes a timeline. You delete a meeting from the meeting page, or close your account from your settings, at any time. Recordings, transcripts, and summaries leave its active systems within 30 days. Encrypted backups are overwritten within a further 35 days. In total, your data is fully gone within 65 days.
Fireflies is less specific in its privacy policy, and the difference matters. Its policy says it stores personal information associated with your account for as long as your account remains active, and if you close your account, it will delete personal information related to your account within 30 days.
Its "Zero Data Retention" promise is a different promise, and it is easy to misread. The policy defines it precisely: meeting content is not stored by any third-party vendor after processing, not accessed by any third-party vendor once the service is completed, and not used for training internal or external AI models. That is a promise about vendors, not a promise that Fireflies deletes your meeting the moment processing finishes. Your meeting stays in Fireflies until you delete it, or your retention setting deletes it, or you close your account.
Fireflies also says you can delete meetings manually at any time, and its DPA says that following expiration or termination, it will, at your instruction, delete or return all customer personal data, unless the law requires it to keep it, in which case it will isolate and protect it. I did not find a meeting-content backup purge timeline in the policy section I read, so I am not stating one. If a backup timeline matters to you, ask Fireflies for it in writing before you rely on one.
Who else touches it: subprocessors, and the de-identified exception
MeetGeek publishes a short subprocessor list, four names. AWS does cloud hosting and storage, in your region. OpenAI does AI summaries, insights, and chat, in your region, with no training and zero data retention. Mixpanel does product analytics, with no meeting content, in the EU. Intercom does support tickets you send, in the US. If you subscribe to updates, MeetGeek tells you at least 30 days before adding a new subprocessor, and you can object.
Fireflies also publishes a subprocessor list, on its trust page, and its DPA gives you 30 days to object to a new subprocessor. The notice period is the same. The list is longer, which is expected for a larger product with more integrations, and the DPA is where the details live.
The difference worth reading is what each vendor does with de-identified data. Fireflies' DPA says it may create and derive de-identified data to improve its products and services and for other business purposes, and its terms say it may derive usage, statistical, and other data from your content and use that derived data for its internal business purposes, including analyzing and improving the services. That is not training on your meetings, and Fireflies' terms separately say it will not use your content to train, retrain, fine-tune, or otherwise improve any generative AI models. But it is a use beyond delivering the service, and it is in the contract.
MeetGeek draws a narrower line. Its privacy policy says it improves the services using usage analytics that contain no meeting content. No meeting content in the analytics, no de-identified meeting data feeding product improvement. That is a cleaner promise, and it is one of the few places where MeetGeek's wording is actually stricter than Fireflies'.
What they do with your data beyond the service
This is where the two diverge most, and it has nothing to do with training.
MeetGeek says it does not sell personal data, and does not share it for cross-context behavioural advertising. That is a short sentence, and it covers the whole product.
Fireflies' privacy policy has a whole section on targeted advertising and analytics. It says it discloses certain categories of personal information, identifiers, cookie and device IDs, and browsing data, to show you targeted ads on third-party properties and expand the reach of its own marketing campaigns. Those disclosures may be considered sales, sharing, or targeted advertising under state privacy laws. You can opt out of the cookie-based part through the Your Privacy Choices link in the site footer, but that opt-out is linked to your browser only, so you have to renew it on a new device or browser, or if you clear your cookies. Other identifiers need a web form.
That is not a training issue, and it is not a meeting-content issue. It is a marketing-data issue, and it is the kind of thing a privacy-conscious buyer should know before choosing, because it is the one place where Fireflies' policy is materially looser than MeetGeek's.
Voiceprints: the Fireflies lawsuit, stated as allegations
Fireflies has a pending biometric privacy case, and it belongs in this piece because it is about voice data, which is exactly what a notetaker collects.
Fireflies' own privacy policy says its service providers may use voice recordings to extract or generate data about participants' voice characteristics, called Voice Data, which may be considered biometric identifiers or biometric information in some jurisdictions. Its providers do not use Voice Data to identify or authenticate individuals, and Fireflies says it never receives or processes this information on its own servers. It also says it maintains a written retention schedule and guidelines for permanently destroying such information when the initial purpose has been satisfied, or within three years of an individual's last interaction with Fireflies, whichever occurs first.
The litigation is Fricker v. Fireflies.AI Corp., consolidated with Martinez v. Fireflies.AI Corp., in the Northern District of Illinois. It is a class action under Illinois' Biometric Information Privacy Act, alleging that Fireflies' Speaker Recognition feature created voiceprints without the written notice and consent BIPA requires. Fireflies moved to dismiss on July 15, 2026, briefing closed August 26, 2026, and there was no ruling as of October 26, 2026. A related California case is stayed pending that ruling. An earlier BIPA suit, Cruz v. Fireflies.AI Corp., was voluntarily dismissed in March 2026.
Those are allegations, not findings. No court has found Fireflies liable. I am including them because a pending BIPA case over voiceprints is a live risk to track if you record meetings with Illinois participants, not because it proves anything about the product today.
MeetGeek has no equivalent litigation in the research for this piece, and I am not claiming it never will. I am only saying the Fireflies case is the one that exists, and it is about the same voice data both tools handle.
HIPAA: one BAA on every plan, one only on Enterprise
MeetGeek offers a Business Associate Agreement on all plans, including Basic. Its security page says so plainly, and its privacy page repeats it. That does not make MeetGeek HIPAA compliant on its own, a BAA is one piece of a compliance setup, but it does mean the paperwork is not gated behind the most expensive plan.
Fireflies is HIPAA-ready on Enterprise plans only, with Private Storage and a signed BAA, both required together. Its security page and its Private Storage guide agree on that. So a healthcare team, or any team handling protected health information, faces a real fork: MeetGeek lets you sign the BAA on the plan you are already on, Fireflies requires the Enterprise plan and the storage upgrade first.
Which one to pick
If you want the meeting itself to live in the EU, or you need a BAA without an Enterprise plan, or you want retention set by a published plan table you can point a client to, MeetGeek is the cleaner pick on the policy. That is the affiliate link in this piece, and I will say so plainly: Try MeetGeek here. Fireflies is not an affiliate here, and there is no Fireflies link in this article.
If you want per-format auto-delete, and you are on a plan that includes it, and US storage and processing are fine for your work, Fireflies' controls are good, and its zero-retention promise at the vendor level is real. Just do not read that promise as Fireflies deleting your meeting, and do not assume the Enterprise controls, Private Storage, custom retention, or the BAA, are in the plan you are actually paying for.
The training question brought you here. It is settled, and it is a tie. Retention, residency, deletion, and who else touches your data are where these two actually differ, and now you know where to look.
How to check any notetaker in 60 seconds
Four searches, on the vendor's own policy page, in this order.
First, search for "retention." If the answer is a table by plan, you have a maximum. If the answer is a setting you control, check which plan that setting lives on.
Second, search for "residency" or "stored." Storage and processing are different questions, and a vendor that lets you choose where data rests may still process it somewhere else.
Third, search for "delete." Look for two numbers: how long until it leaves active systems, and how long until it leaves backups. If the policy only gives you one number, ask for the other.
Fourth, search for "subprocessor." A short public list with a notice period is a good sign. A DPA that lets the vendor create de-identified data from your content is not a training violation, but it is a use you should know about before you agree to it.
Policies change, and a policy from September is already a snapshot. If a policy changes after this piece, the policy wins, not this article.