Who we are
The seller of the MeiMei Phone Assistant and operator of this website ("we") is QIKO CARGO COMPANY LIMITED, Kowloon, Hong Kong. We sell the MeiMei device and publish the companion assistant software as open source. Company details and postal address are on the Imprint page. For questions about this policy or about personal data we process on this website, contact us at privacy@meimeiassistant.com.
As we are not established in the EU, our representative in the EU under Art. 27 GDPR is: TODO_EU_GDPR_REPRESENTATIVE.
What we process on this website
When you place an order we process your email address, order details (bundle, quantity, delivery country) and the order and payment status. Card data is processed directly by Stripe as an independent payment provider; we never see or store your card number.
If you create an account we process your login email and account role. These records are used to fulfil your order, provide support and prevent fraud.
What the device and assistant process
The MeiMei device pairs with a mobile phone over Bluetooth and, during AI-assisted calls, can access: contact names and numbers (PBAP), SMS metadata and content (MAP), live call audio, transcripts produced by speech recognition, the replies generated by the assistant, and the call history.
These are personal data — including data about your callers — and they are processed whenever the assistant feature is used on a call.
Local, self-hosted processing by default
The assistant backend runs in Docker containers on hardware chosen and operated by you (typically your own machine on your own network). By default, call audio, contacts, and transcripts are not sent to any server operated by MeiMei, and the software sends no telemetry.
You choose which AI providers the assistant uses by entering your own API keys. If you configure a cloud provider (for example OpenAI, Anthropic, Google, Mistral, Deepgram, or OpenRouter), the voice or text needed for that step is transmitted to that provider under your own account and keys. If you configure only local providers, processing stays entirely on your hardware. If you choose MeiMei AI instead of your own keys, see MeiMei AI below.
MeiMei Cloud (optional)
If you use MeiMei Cloud Calling, your Wi-Fi device sends live call audio to our service hosted by Amazon Web Services in the United States (us-east-1), which passes it to the AI providers you choose and plays their answers back on the call. Call audio is streamed and is not stored.
We store in your MeiMei account the call transcripts, the contacts and messages synced from your phone, your settings, the device identifier and usage records, for as long as you keep them; you can delete them at any time. If you use MeiMei Memory, we store in the United States (hosted by Amazon Web Services, us-east-1) the memories that you or your AI assistants save, together with the data needed to search them; you can export or delete them at any time. Deleted items leave the live service within minutes and the backups when their retention period ends.
For call, contact, message and memory data that we process on your behalf, you are the controller and we act as your processor (Art. 28 GDPR); for your account, billing and the security of the service, we are the controller. Amazon Web Services hosts the service in the United States (us-east-1) as our sub-processor. The AI providers you configure receive the audio or text they need under your own account and keys, may process it outside the EU, and do so under their own terms.
If you use MeiMei Connect, the connector on your MeiMei installation keeps an outgoing connection to our service hosted by Amazon Web Services in the United States (us-east-1). When an AI agent that you authorised (for example Claude, Claude Code or ChatGPT) asks to place a call or send an SMS, we check the request against the policy in your account (allow-list, daily caps, approvals), relay it to your installation and return the result. We process the request details, such as the number and the message text, only for this and for the audit log. The audit log of requests, approvals and results is kept in your MeiMei account until you delete it; you can also revoke each agent at any time.
MeiMei AI (optional)
If you choose MeiMei AI for a device or an appliance, the AI step uses our own accounts with Google (Gemini API) and OpenAI instead of your provider keys. The call audio or text needed for that step is sent, streamed, from our service (or, for an appliance, through our gateway) to those providers. MeiMei does not store call audio. Transcripts of cloud calls are kept in your MeiMei account as described under MeiMei Cloud.
For this data we act as your processor (Art. 28 GDPR) and Google and OpenAI are our sub-processors. They may process it outside the EU and do so under their own terms; where data leaves the EU we rely on the safeguards of Chapter V GDPR.
We keep usage records (units used, amounts and the day, per device or appliance) to bill you and to show your usage. Payment is handled by Stripe. MeiMei AI is for adults (18 or older) using it for their business or household; you confirm this when you activate it.
If you set a device to "My own keys", nothing changes: the voice or text is sent to the providers you configured, under your own account and keys.
AI Transparency
Who is responsible (GDPR roles)
For contact, SMS, and call data processed by the device, the operator — the person or organisation that deploys and runs the device — is the data controller under the GDPR. We provide the hardware and software (the "means") but do not operate the processing and cannot access your data.
For orders and accounts on this website, we are the data controller.
Purposes and legal bases
The assistant answers and handles calls on behalf of the operator based on the legitimate interest of the operator (Art. 6(1)(f) GDPR) or another basis the operator establishes for their own context. Website orders are processed to perform the purchase contract (Art. 6(1)(b) GDPR). Support and security rely on legitimate interest.
Where calls are recorded or transcribed, national rules implementing the ePrivacy Directive may require the consent of the participants. Checking and obtaining any such consent is the duty of the operator.
Retention
Call transcripts, logs, and configuration are stored only on the storage of the operator, for as long as the operator keeps them. Operators should define a retention period suited to their use and delete data that is no longer needed.
Website order records are kept for as long as required for fulfilment, warranty, support, and statutory bookkeeping obligations, then deleted or anonymised.
Sharing and international transfers
We do not sell personal data. For this website we share data with Stripe (payment processing) and with Amazon Web Services (AWS), which hosts the site and the order service in its us-east-1 region in the United States. For call data, the only third parties are the AI providers chosen by the operator, accessed under the account of the operator; if the operator chooses MeiMei AI, they are Google and OpenAI as our sub-processors (see MeiMei AI above).
We are established in Hong Kong, and some recipients are located outside the EU/EEA. MeiMei Cloud, MeiMei Connect and MeiMei Memory are hosted by Amazon Web Services in the United States (us-east-1), so the data of these services, including that of customers in the EU/EEA, is transferred to and stored in the United States. The legal basis for this transfer under Chapter V GDPR is: TODO_US_TRANSFER_BASIS. Where personal data is transferred to another third country, we rely on the safeguards of Chapter V GDPR. Where the operator uses third-party AI providers, the operator governs that relationship under their own account terms.
Your rights
Under Articles 15-21 GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing. Where processing is based on consent you can withdraw it at any time. You can also lodge a complaint with your supervisory authority.
Because call and contact data is controlled by the operator, please address requests about that data to the operator of the device. For website orders and accounts, contact us at privacy@meimeiassistant.com.
Security
Local, self-hosted processing keeps call data inside the environment of the operator. The control panel is protected by username and password, connections to AI providers use TLS (the local link between a Wi-Fi model device and the computer of the operator is encrypted with TLS when the device has the appliance fingerprint; a device set up without it uses an unencrypted link meant for a trusted local network), and we apply reasonable technical and organisational measures in line with Art. 32 GDPR.
Children
The product is not intended for children under 16 and we do not knowingly process their data.
Changes to this policy
We may update this policy as the product evolves. The current version is always published on this page with the date above.