Straight answer: If you use Zoom, Google Meet or Teams for client calls, there is a good chance an AI notetaker has already recorded a conversation you never meant to be transcribed and stored on someone else’s server. Most small business owners never chose this, it came switched on by default through a calendar integration, and the fix takes about twenty minutes.
The bot that nobody invited
Last spring I was on a discovery call with a manufacturing client based near Wolverhampton. Ten minutes in, he stopped mid-sentence and said, “Who’s Fireflies?”
There was a small square in the corner of the Zoom window with a robot icon, quietly transcribing everything, including the bit where he’d just told me his turnover, his biggest supplier problem, and a comment about a competitor that he definitely would not have wanted written down and stored anywhere.
I hadn’t turned it on. A calendar integration I’d set up three months earlier for internal team calls had quietly started auto-joining every meeting in my diary, client calls included. He asked me to remove it. I did, on the spot, and apologised. But the transcript already existed somewhere, on a server I don’t control, tied to his name and his business.
That moment is happening in thousands of small businesses right now and almost nobody is talking about it, because the marketing around AI notetakers is all about time saved, not about where the recording goes afterwards.
What these tools do with a recording
Otter, Fireflies, Fathom, Read.ai and the built-in AI companions inside Zoom and Teams all work roughly the same way. The tool joins your meeting as a participant, records audio and often video, converts it to a transcript, and stores that transcript on its own servers, not yours. Some of them summarise the call, pull out action items, and let you search across every meeting you’ve ever had. That part is handy for a solo consultant trying to remember what a client said in March.
The part that gets skipped in the sales page is retention and training use. Zoom faced a public backlash in 2023 after users noticed language in its terms of service that appeared to let the company use customer content, including AI companion transcripts, to train its models. Zoom rewrote the wording after the pushback, but the episode is a useful reminder: the default settings in software written by a company whose revenue depends on data are rarely the settings that protect you.
Free plans on most notetaker tools keep transcripts indefinitely unless you go in and delete them manually. Paid plans often add options to auto-delete after 30 or 90 days, or to opt out of your recordings being used to improve the underlying model, but those options are opt-in, buried in an account settings page most people never open.
The uncomfortable bit: consent theatre
Every one of these tools shows a small on-screen notice when it joins a call saying something like “this meeting is being recorded and transcribed.” Legally, in the UK, that often counts as consent under UK GDPR, because the other party stayed on the call after seeing it. Practically, almost nobody reads it. They see a notification flash for two seconds while they’re focused on what you’re saying, and they carry on talking.
That’s consent in the letter of the law and not much of anything in practice, and if you’re the one who invited the bot, the responsibility for making that consent real sits with you, not with the software company. Under UK GDPR, fines can reach £17.5 million or 4% of global annual turnover, whichever is higher, and while that ceiling is built for large-scale breaches, small businesses have been investigated by the Information Commissioner’s Office for far smaller data handling failures, usually triggered by a client complaint rather than a proactive audit.
If a client ever asked me to delete a transcript and I couldn’t tell them exactly where it lived or how to get it removed, that’s not a technology problem. That’s a trust problem, and trust is the entire product when you’re a consultant, a coach, or any small business that sells expertise rather than a physical thing. The same logic that built Howard Schultz’s approach to customer experience at Starbucks applies here: the small, unglamorous details of how you treat someone during an interaction are the reputation, not a footnote to it.
A five-step audit to run this week
This takes about twenty minutes and you only need to do it once, then revisit it every few months as tools update their defaults.
- Check your calendar integrations. Log into Otter, Fireflies, Read.ai or whichever tool you’ve connected, and look for “auto-join” settings. Turn off auto-join for any calendar and set it to ask you each time, or better, only add the bot manually to internal calls.
- Set a retention limit. Go into account settings and set transcripts to auto-delete after 30 days unless you specifically save one. Most tools bury this two or three menus deep under “data” or “privacy,” not under the main dashboard.
- Opt out of model training. Look for a toggle labelled something like “use my data to improve the product” and switch it off. It is almost always on by default.
- Tell people before the call, not during it. Add a line to your calendar invite: “I use AI transcription for note-taking, let me know if you’d rather I turn it off.” That’s real consent, given before the pressure of the conversation, not a notice they half-read while talking.
- Draw a hard line for sensitive calls. No bot on any call involving finances, HR issues, legal disputes, or anything a client explicitly asks to keep off the record. Take notes by hand or type them yourself. It’s slower. It’s also the only version where you fully control where the information ends up.
When it matters most, turn the bot off
I still use AI transcription. It’s useful for internal team calls, for recapping a workshop, for pulling quotes out of a podcast interview I’m doing for content. The line I draw now is simple: if the conversation involves someone else’s confidential information and I haven’t asked them directly, the bot doesn’t join. I take my own notes, slower and messier, but mine.
This is the kind of gap I flag in almost every audit when I work as an AI consultant for small business, because it’s rarely malicious, it’s just a default setting nobody questioned. Small business owners adopt these tools fast because the time saving is real, and they never circle back to check what the tool does once the call ends.
Trust is the actual asset you’re protecting
Companies that win long term rarely win on the flashiest feature, they win on consistency and on not doing the thing that quietly erodes confidence. Away built a brand people trust partly by being transparent about product issues rather than hiding them. Ahrefs built trust with its audience by publishing real data rather than marketing spin, and that only works because people believe the data hasn’t been quietly manipulated somewhere upstream. The AI notetaker sitting in your client calls is exactly that kind of upstream detail: invisible until someone notices, and expensive to your reputation the moment they do.
Napoleon Hill wrote about the accumulation of small, deliberate decisions being what separates businesses that last from ones that don’t, and there’s a version of that lesson buried in Hill’s business lessons that applies directly here: the decision to check a settings menu before your next client call is small, boring, and exactly the kind of thing that decides whether you keep a client for five years or lose them after one uncomfortable moment.
If you want a lower-risk way to use AI for engaging prospects that doesn’t involve recording anyone without asking, something like an interactive calculator on your site gives people a useful tool, captures a lead, and never touches a live conversation at all. Worth building into your funnel instead of leaning harder on tools that sit inside private calls.
Free resource: The First-Party Data Capture Mini-Guide.
Frequently asked questions
Is it legal to record a client call with an AI notetaker without asking first?
In the UK, showing an on-screen notice that a call is being recorded can technically satisfy consent requirements under UK GDPR if the other person stays on the call, but this is thin legal cover. If a client later objects, you want to be able to show you gave them clear notice before the call, not a flashing message during it, and that you can delete their data quickly on request.
Do Otter, Fireflies, and Zoom AI Companion use my meetings to train their models?
It depends on the plan and the settings, and defaults vary by provider and change over time. Most tools have a toggle for this buried in account or privacy settings, usually switched on by default. Check it directly inside your account rather than relying on general reassurance from marketing pages, since Zoom itself had to rewrite its terms in 2023 after users flagged unclear language about training data.
What should I use instead for calls with sensitive information?
Turn the AI notetaker off and take your own notes for anything involving finances, HR, legal matters, or information a client has asked you to keep confidential. It costs you speed, not accuracy, and it means the only copy of that conversation exists where you control it.
How often should I check my AI notetaker’s privacy settings?
Every three to six months, or whenever the tool announces a product update. Providers change default settings more often than most users realise, and a setting you switched off last year can quietly reset after an update. Twenty minutes every quarter is enough to stay ahead of it.
Related reading: The AI Meeting Notes Habit That’s Quietly Making Your Team Worse at Their Jobs and The AI Notetaker in Your Sales Calls Is Costing You More Than You Think.
