Straight answer: AI meeting bots like Otter, Fireflies, Fathom and the AI Companion built into Zoom and Teams are recording, transcribing and often storing your client conversations without proper consent, and most small business owners have no policy for this at all. If you run client calls, you need a two-minute disclosure habit and a one-page rule for what these tools are allowed to touch, before your next meeting, not after something goes wrong.
The bot that joined my call without asking
Three months ago I was on a discovery call with a prospective client, a director of a mid-sized recruitment firm. Twelve minutes in, a small window popped up in the corner of the Zoom screen: “Fireflies.ai Notetaker has joined the meeting.” Nobody had said a word about it. I asked who invited it. Silence, then a slightly sheepish admission from the marketing manager that she’d connected her calendar to Fireflies weeks ago and it auto-joins every call on her calendar. Every single one.
That meant every call she’d had for weeks, sales calls, HR conversations, board updates, had a transcript sitting in a third-party tool’s servers, searchable by anyone with her login, and quite possibly used to train or refine that tool’s own models depending on the settings she’d never checked.
That’s not a rare story. It’s now the default for a huge chunk of small businesses, and almost nobody has stopped to ask what it means.
What these tools are doing with your conversation
The pitch for AI notetakers is good: you stop scribbling notes, you get a searchable transcript, you get an automatic summary and action list, you save maybe 20 to 30 minutes of admin per meeting. Fathom, Otter, Fireflies, Grain, Read.ai, plus the native versions now built into Zoom AI Companion and Microsoft Copilot for Teams, all do roughly the same job.
But here’s what’s happening underneath, and it’s the part the demo videos skip:
- The audio is sent off your device to the vendor’s servers, often in the US, to be transcribed and processed.
- Most tools keep the full transcript indefinitely unless you go into settings and delete it manually.
- Several free and lower tiers reserve the right to use recordings to improve their models, meaning your client’s pricing conversation or your candidate’s salary negotiation becomes training data.
- The bot often has permission to read your calendar, meaning it can auto-join meetings you forgot were sensitive, HR reviews, disciplinary calls, supplier negotiations.
- Transcripts get shared automatically to a wider team channel by default in tools like Fireflies and Grain, so a private one-to-one can end up visible to five colleagues who had nothing to do with the call.
None of this is hidden exactly, it’s in the terms of service. But almost nobody reads the terms of service for a £15-a-month notetaker, and that’s exactly why it’s a problem worth fixing now rather than after a client asks why their contract negotiation is sitting in a shared workspace.
The disclosure problem nobody wants to deal with
Here’s the uncomfortable bit. In the UK, recording a call where someone hasn’t been told it’s being recorded sits in a grey area depending on what’s recorded and why, and under UK GDPR, processing someone’s voice and personal data through a third-party AI tool needs a lawful basis, which in practice usually means informing them and, in a lot of cases, giving them the chance to say no.
Most small businesses currently rely on a vague assumption that “everyone knows Zoom records these days” as their consent. That is not consent. Consent has to be specific, informed and freely given. A tiny notification bubble that disappears after four seconds, which is all some of these bots show, does not meet that bar.
I’ve had three separate client conversations this year where the other party pointed at the bot and asked, politely but pointedly, “is that thing storing this?” Two of those people were solicitors. They knew exactly what they were asking. If you can’t answer that question in one sentence, you’ve got a gap.
Why this bites harder for service businesses specifically
If you’re a consultant, coach, agency, accountant, solicitor or anyone whose entire value is built on client trust and confidentiality, this matters more than it does for a retailer chatting to a supplier. Your client is often telling you things on that call they wouldn’t want in a shared workspace: their revenue numbers, a staff problem, a legal issue, a competitor they’re worried about.
I work with small businesses on building an AI setup that fits how they operate rather than bolting on whatever tool looked good in a LinkedIn demo, and the notetaker question comes up in almost every single audit now. Usually the business owner didn’t choose the tool themselves, an employee turned it on months ago and it’s been quietly recording ever since.
The three-step check I now do with every client
This takes about fifteen minutes and it’s the thing I’d tell every small business owner to do this week, not next quarter.
- Step one, find every bot that’s live. Check your calendar settings, your Zoom account, your Teams admin panel, and ask your team directly: “which of you has connected Otter, Fireflies, Fathom, Read.ai or Grain to your calendar?” You will find at least one you didn’t know about.
- Step two, check where the transcripts go and for how long. Open the settings, not the marketing page, the actual account settings, and find the data retention period and the sharing default. Fireflies defaults to sharing with your workspace team. Fathom’s free tier keeps recordings for a set period before you have to pay to extend it. Turn off auto-sharing unless you specifically want it on.
- Step three, write one sentence you say out loud at the start of every call. Something like: “Quick heads up, I’ve got an AI notetaker running for this call so I can send you an accurate summary after, are you happy with that?” That’s it. It takes four seconds and it turns a legal grey area into a clean yes.
What to use instead, or alongside it,
I’m not telling anyone to bin these tools, they save time and I still use one myself for internal team calls. The fix isn’t avoidance, it’s control. A few practical adjustments:
- Use the paid business tiers rather than free tiers where possible, most of them exclude your data from model training by default at the business level, whereas free tiers often don’t.
- Set a hard retention limit, 90 days is sensible for most client work, then let it auto-delete.
- Keep client-sensitive calls, contract negotiations, HR conversations, off the notetaker entirely and take manual notes instead. Not every call needs a transcript.
- If your team collaborates visually on the output, a board tool like the one covered in this look at Miro’s approach to building sticky, visual workflows keeps summarised notes in a space your team controls, rather than scattered across five different AI tools’ own servers.
What it costs to get right
Roughly, here’s what the main tools charge as of 2026, and the free tiers are exactly where the data-training risk sits:
- Otter.ai Business: around $20 per user per month, excludes your data from training on this tier.
- Fireflies.ai Business: around $19 per user per month, with admin controls to stop auto-sharing.
- Fathom: free for individuals, paid team tier is where retention and sharing controls open up.
- Zoom AI Companion: bundled into paid Zoom plans, meaning it’s already live on your account whether you switched it on deliberately or not.
- Microsoft Copilot for Teams: an add-on cost of roughly $30 per user per month on top of your Microsoft 365 licence.
If you want to show clients or your own team exactly how much admin time this saves versus the risk it carries, it’s worth building something visual rather than just telling them, the same logic I wrote about in how interactive calculators pull people in and make an abstract number feel real, a simple “time saved versus meetings recorded” calculator makes the trade-off obvious in a way a paragraph of terms and conditions never will.
The bit most advice on this topic skips entirely
Almost every piece written about AI meeting tools focuses on productivity, the hours saved, the summaries generated, the follow-up emails written automatically. Almost none of them mention that the same AI systems training on your meeting transcripts are the same class of AI systems now deciding whether your business gets mentioned when someone asks ChatGPT or Perplexity a question in your industry. If you’ve never checked whether AI search tools are describing your business accurately, or ignoring you completely, that’s worth fifteen minutes too, and I laid out exactly how to check it in the AEO audit framework. The two problems, private transcripts feeding models and public visibility in AI search, sit closer together than most business owners realise.
Frequently asked questions
Do I legally have to tell people an AI notetaker is recording the call?
In the UK, under GDPR, you need a lawful basis to process someone’s voice and personal data, and in practice that means telling them clearly and giving them the chance to object, a quiet on-screen notification is not enough on its own. Saying one sentence out loud at the start of the call covers you and takes four seconds.
Which AI notetaker is safest for client confidentiality?
Paid business tiers of Otter, Fireflies and similar tools generally exclude your transcripts from model training and let an admin set retention limits and turn off auto-sharing, whereas free tiers often don’t offer those controls, so the safer choice is usually the paid tier with the settings actively configured, not left on default.
Should I stop using AI notetakers altogether?
No, they save time on admin, but treat sensitive calls, contract negotiations, HR conversations and anything involving a client’s financials, as calls where you take manual notes instead, and reserve the AI tool for routine meetings where a transcript adds value without much risk.
My employee connected a notetaker to their calendar without telling me, what now?
Check the account’s data retention and sharing settings immediately, delete anything sensitive that’s already been recorded if the tool allows it, and set a simple written policy so it’s clear which meetings can have a bot present and which can’t, most small businesses that get caught out here simply never had that policy written down.
Related reading: The Best AI Productivity Tools for Entrepreneurs in 2026 (What I Use, Daily) and What AI Notetakers Are Doing To Your Sales Calls (And How To Fix It).
For the bigger picture, see my full guide to AI marketing.
Useful references
Related: ai email summaries open rates small business.
