JF Meeting Privacy Policy

1. Introduction

Welcome to JF Meeting (available at https://www.meeting.jfsolution-bd.com), a high-performance, self-hosted video conferencing and real-time collaboration platform operated by JF Solutions Limited (“we”, “us”, or “our”).

This Privacy Policy explains how information is collected, used, processed, and safeguarded when you access or use the JF Meeting platform, including our web applications, video conferencing rooms, personal meeting rooms, scheduling tools, and calendar integrations.

We are committed to respecting your privacy and protecting the integrity of your personal communications. By using JF Meeting, you acknowledge the data handling practices described in this policy.

2. Information We Collect

We strictly practice data minimization, collecting only the information necessary to provide, secure, and operate the conferencing service. We distinguish between the following categories of information:

• Account Information: When you register for an account, we collect your display name, email address, password hash (encrypted via industry-standard Argon2id or bcrypt), and authentication session tokens.
• Meeting Information: When you schedule or host meetings, we record meeting titles, scheduled start and end times, timezone designations, meeting codes or slug identifiers, meeting access passcodes (where enabled by the host), participant display names, assigned roles (host, co-host, participant), attendance entry/exit timestamps, and historical meeting records associated with the host’s account.
• Technical & Security Information: When you interact with our servers, our infrastructure records standard technical operational logs, including IP addresses, browser and device user-agent strings, request timestamps, referring URLs, rate-limiting counters, and security audit events necessary for fraud prevention, server diagnostics, and platform protection.
• Calendar Integration Information: When you voluntarily connect a third-party calendar service (such as Google Calendar or Microsoft Outlook / Microsoft 365), we store the authorized provider account identifier, provider account email address, and encrypted OAuth access and refresh credentials required to synchronize your scheduled meetings.

3. Google Calendar Integration

JF Meeting provides an optional integration with Google Calendar, allowing hosts to seamlessly synchronize scheduled video conferences and recurring meeting series directly with their Google Calendar schedule.

Scope of Requested Access: When you connect your Google account, JF Meeting requests permission via the official Google OAuth 2.0 authorization framework for the following least-privilege calendar scope:

https://www.googleapis.com/auth/calendar.events — View and edit events on your calendars

How We Use Google Data:

• The Google Calendar API is used strictly to create, update, or cancel calendar entries corresponding to meetings scheduled through JF Meeting.
• Meeting titles, scheduled start/end dates, timezones, and join links are written to your primary calendar upon your instruction.
• OAuth 2.0 access and refresh tokens returned by Google are encrypted at rest using authenticated AES-256-GCM encryption on our secure database servers. Raw tokens are never sent to or exposed in frontend client code.

4. Microsoft Outlook / Microsoft 365 Integration

JF Meeting similarly provides an optional calendar integration with Microsoft Outlook and Microsoft 365 via the production Microsoft Graph API.

Scope of Requested Access: When authorized, JF Meeting requests access to the Calendars.ReadWrite permission alongside basic identity scopes (openid profile email offline_access).

Usage & Storage: This permission is used solely to create, update, and manage calendar event items representing your JF Meeting sessions. All Microsoft OAuth credentials are encrypted at rest with authenticated AES-256-GCM and are never exposed to browser clients or used for any secondary purpose. JF Meeting does not access emails, OneDrive files, Teams chats, or other unrelated Microsoft 365 services.

5. How We Use Information

We use the information collected exclusively for legitimate, direct operational purposes:

• Facilitating Video Conferences: Generating secure access tokens, routing real-time WebRTC media streams, and managing conference participant states.
• Account & Session Management: Authenticating registered users, maintaining secure login sessions, and safeguarding password credentials.
• Meeting Scheduling & Invitations: Storing scheduled meeting parameters, generating stable meeting links, and delivering invitation metadata.
• Calendar Synchronization: Synchronizing meeting dates, times, and joining instructions with connected Google or Microsoft calendars.
• Meeting History & Attendance: Providing hosts with meeting history summaries, participant counts, and session duration metrics.
• Security, Abuse Prevention & Troubleshooting: Protecting our infrastructure against denial-of-service attacks, brute-force authentication attempts, and malicious activity.

6. How We Share Information

We do not sell, rent, monetize, or trade your personal information to data brokers, advertising networks, or third parties under any circumstances.

We share or process information only in the following strictly limited contexts:

• Core Infrastructure Providers: Data is hosted and processed on our dedicated server infrastructure and telecommunications hosting providers solely to execute platform operations, databases, and media transmission.
• Third-Party Calendar Providers (At Your Direction): When you explicitly connect Google Calendar or Microsoft Outlook, meeting event payloads are transmitted to the respective API to create or modify calendar entries as directed by you.
• Legal Requirements: We may disclose information if required to do so by applicable law, valid judicial subpoena, or legal process, or to protect the safety, rights, and property of our users or the public.

7. Video, Audio and Screen Sharing

Real-time audio, video, and screen-sharing media streams are transmitted through the JF Meeting WebRTC conferencing infrastructure powered by our high-performance media server.

• Media streams are encrypted in transit between participant endpoints and the media server using standard WebRTC security protocols (DTLS and SRTP).
• Audio and video streams are processed in real time to route media between active conference participants.

8. Calendar Data & Revocation

Integrating your external calendar with JF Meeting is completely voluntary:

• You explicitly initiate and authorize the connection via your provider’s official consent screen.
• Calendar data received is strictly limited to verifying connection status, user email, and managing events created for your JF Meeting conferences.
• Disconnecting at Any Time: You can disconnect your Google Calendar or Microsoft Outlook account at any time from the Calendar Settings page in your dashboard.
• Effect of Disconnection: Disconnecting immediately deletes the stored encrypted OAuth access and refresh tokens from our active database and terminates future synchronization. Disconnection does not retroactively delete past event entries that were already written to your external calendar before disconnection.

9. Data Security

We implement robust technical and organizational measures designed to protect personal data against unauthorized access, destruction, loss, or alteration:

• Transport Layer Security (TLS): All web traffic and API communications are encrypted in transit over HTTPS using modern TLS 1.3 / 1.2 cryptography.
• Encrypted Token Storage: External OAuth tokens for Google and Microsoft calendar services are encrypted at rest using authenticated AES-256-GCM with unique cryptographic initialization vectors.
• Password Protection: Account passwords are never stored in plaintext and are hashed using modern salted key derivation functions.
• Access Controls & SQL Protection: Database queries utilize parameterized statements to protect against injection attacks, and strict role-based checks prevent unauthorized cross-tenant data access.

Please note that while we employ rigorous security practices, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security against all conceivable threats.

10. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to satisfy operational, legal, and security requirements:

• Account Data: Retained for the duration of your active account with JF Meeting. If an account is deleted, associated credentials and profile identifiers are purged.
• Meeting History & Metadata: Maintained to provide host account history, past meeting logs, and attendance summaries until deleted or reset by the account owner.
• Technical Logs: Server access and rate-limiting logs are retained for a rolling operational window for security auditing, diagnostic troubleshooting, and abuse prevention, after which they are routinely cleared.

11. User Rights and Choices

JF Meeting provides users with accessible controls over their personal information:

• Profile Updates: You can review and update your display name, email address, and security credentials directly from your account settings.
• Calendar Disconnection: You may connect, manage, or revoke Google and Microsoft calendar integrations at will via your Calendar Settings.
• Meeting Management: Hosts may edit, cancel, or delete scheduled meetings, personal rooms, and recurring meeting series at any time.
• Inquiries: You may contact us regarding your personal data or privacy inquiries through our official contact channels.

12. Children’s Privacy

JF Meeting is intended for general business, organizational, and professional communication. The service is not directed to children under 13 years of age (or under the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal identifiable information from children under 13. If you become aware that a child has provided us with personal information without parental consent, please contact us so we can take immediate steps to remove the data.

13. Changes to this Privacy Policy

We may update or modify this Privacy Policy periodically to reflect changes in our technology, legal obligations, or application functionality.

When modifications occur, we will update the “Last Updated” date at the top of this page. Any revisions take effect immediately upon posting to this public URL. We encourage users to periodically review this page to stay informed about our data handling practices.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact: