The short version: if you're using an AI notetaker on client calls, that recording, transcript and every awkward pause is likely being stored, and on the cheaper plans it may be used to train the model, unless you've paid for the enterprise tier and switched the setting off yourself. Most small business owners have never checked. You should, this week, before your next call.
The bot that joined my call without asking
About eight months ago I was on a discovery call with a prospective client, a mid-size recruitment firm, and their AI notetaker announced itself thirty seconds in with a little chime and a message in the chat: "Fireflies.ai Notetaker has joined the meeting." Nobody had asked me. Nobody had mentioned it in the calendar invite. I found out because I happened to glance at the participant list.
I stopped the call. Not dramatically, I just said "before we carry on, can you tell me what that bot is and what happens to this recording afterwards?" There was a pause. The person on the other end didn't know. It came with their calendar tool, it had been switched on by someone in IT eighteen months earlier, and nobody had thought about it since.
That moment changed how I run calls. I now ask at the start of every single one, "is anyone recording, and is there an AI bot on this call?" It takes ten seconds and it has never once been awkward. What's awkward is finding out after the fact.
The bit nobody puts in the "best AI notetaker" roundup
Every list of the best AI meeting assistants tells you about accuracy, integrations with your calendar, and whether it summarises action points well. Almost none of them tell you the thing that matters for a small business owner handling client conversations: what the terms of service say about your data once the call ends.
Here's the uncomfortable part. On the free or entry-level tiers of most of these tools, your terms of service usually allow the company to use recordings and transcripts to improve their product, which in plain English means training their models. You are not paying for the service with money on the free tier, you are paying with your clients' conversations. That includes anything a client tells you in confidence, pricing they've shared, a complaint about a competitor, a personal detail dropped in passing.
Otter's Business plan (roughly $20 per user per month at time of writing) and its enterprise tier give you the option to opt out of data being used for training. The Basic and Pro tiers don't give you that same clarity in the settings menu, and most users never dig into the privacy policy far enough to find out. Fireflies has a similar structure, its Pro plan sits around $10 a month and its Business plan around $19, with data retention and training controls only becoming fully visible on the higher tiers. Fathom, which is popular precisely because its core recording and summarising features are free, states plainly in its terms that it can use call data to improve the product unless you're on a paid Team plan with the setting adjusted.
None of this makes these tools bad. I still use one most weeks. It makes the assumption that "it's just a notetaker, what's the harm" wrong.
The legal bit small business owners skip past
In the UK, under GDPR, if you're recording a call that includes personal data, you generally need to tell the other party and, in most interpretations, get their consent, not just yours. Slipping a line into your terms and conditions six months ago doesn't count as informing someone on a call today. In several US states, including California, Florida and Illinois, two-party consent laws mean recording a call without the other person's knowledge can be a civil or even criminal matter, regardless of what your AI tool's own policy says.
The AI bot doesn't remove that obligation, it just makes it easier to forget about, because the recording happens automatically in the background and nobody has to press a button. That's the actual risk. It's not that the technology is sinister, it's that it's invisible, and invisible things get skipped.
Five checks before you let a bot into your next client call
- Say it out loud. At the start of the call: "I've got an AI notetaker running, are you happy with that?" If they say no, turn it off. This alone solves 90 percent of the legal exposure.
- Read the actual settings, not the marketing page. Go into your account settings and find the toggle for data use in training. Most tools have one, buried under Privacy or Data Controls, not on the homepage.
- Check retention, not just usage. Some tools keep transcripts indefinitely by default. Set a deletion schedule, 90 days is a sensible default for client sales calls that don't need permanent record.
- Separate client-sensitive calls from internal ones. Use the bot freely for internal team standups where the stakes are low. Be far more careful on calls where a client shares pricing, personal circumstances or competitor information.
- Put a line in your client agreement. One sentence covering how calls may be recorded and why, so consent is documented rather than assumed. It also builds trust rather than eroding it, the same way a brand builds trust over time by being upfront rather than vague, which is really the whole lesson behind how GoPro built a brand people trust instead of one people merely tolerate.
Why this matters more for solo consultants and small teams than for big companies
A large company has a legal team that reviews vendor contracts and a data protection officer whose entire job is to catch this stuff. A one-person consultancy or a five-person agency has none of that. You signed up for the free trial of a notetaker on a Tuesday afternoon because you were tired of typing notes during calls, and you never thought about it again.
That's not a criticism, it's exactly what I did too. But it means the risk sits disproportionately with the smallest businesses, the ones least equipped to spot it. If you're already working through how AI fits into your operations more broadly, this is exactly the kind of gap that turns up when someone experienced looks at your setup, which is the whole point of proper AI consulting for small business rather than just adopting whatever tool a podcast recommended.
The consent problem is really an email marketing problem in disguise
If you've ever set up an email list, you already understand the principle here, you just haven't connected it to your meeting bot yet. Every reputable email platform, Mailchimp included, requires explicit opt-in before you can email someone, precisely because regulators decided a long time ago that people should control what happens to their information and their attention. The entire architecture behind how Mailchimp built its marketing strategy around consent and deliverability exists because assumed consent kept getting businesses into trouble.
An AI notetaker sitting silently on a Zoom call is the same problem wearing a different outfit. Nobody ticked a box. Nobody was told clearly. The difference is email consent got regulated hard and fast because spam was visible and annoying. Meeting recording consent hasn't caught up yet in most small businesses' habits, even though the legal exposure is arguably worse, because it can include financial details, health mentions, or a complaint about a named third party that ends up sitting on a server somewhere being used to fine-tune a model.
What I do now
I use a notetaker on almost every call because the summaries save me an hour a week I used to spend writing up notes. But three things changed permanently after that Fireflies moment.
First, I say it out loud every time, no exceptions, even with clients I've worked with for years. Second, I pay for the tier that lets me switch off training use, because the ten pounds a month difference is nothing compared to the risk of a client's confidential pricing turning up, however unlikely, in someone else's AI output somewhere down the line. Third, I delete transcripts after 90 days unless there's a specific reason to keep one, using a calendar reminder because none of these tools nag you to tidy up after yourself.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
None of this is complicated. It took me about twenty minutes to set up across the two tools I use regularly. The reason most people haven't done it isn't difficulty, it's that nobody's told them it needs doing, in the same way nobody tells you upfront, when you're building an audience through content, that trust compounds slowly and vanishes fast, a point made repeatedly through the career-long business lessons from Joe Pulizzi on building something people rely on rather than something that merely functions.
If you want engagement without the data risk
There's a wider point buried in here about how much data small businesses collect without thinking it through. If your goal on a discovery call is really just to qualify a lead or understand a prospect's numbers, there are lower-risk ways to get there than an always-on recording bot. Something like an interactive calculator on your website lets a prospect hand over exactly the numbers you need, on their terms, before you've even had a call, with none of the ambiguity about what's being recorded or where it goes. It won't replace the human conversation, but it can do a lot of the early data gathering that people currently do by letting a bot listen in on a call and hoping the summary catches the right bits.
The plain truth about all of this
AI notetakers are useful. I'm not telling you to stop using them. I'm telling you that "it's just recording the meeting" is doing a lot of quiet work to make you feel this is smaller than it is. It's recording a conversation with a real person, about their real business, often including things they'd never put in writing, and handing it to a third-party company whose terms of service you almost certainly didn't read past the first screen. That's not a reason to panic. It's a reason to spend the twenty minutes checking your settings this week, the same way you'd check a contract before signing it, because that's effectively what you did the day you clicked "accept" on the free trial.
Frequently asked questions
Do I legally have to tell people I'm using an AI notetaker on a call?
In the UK, under GDPR, yes in most cases, because recording someone's voice and processing it counts as handling personal data and they're entitled to know. In several US states, including California and Illinois, failing to get consent for recording a call can breach two-party consent laws regardless of what the tool's own terms say. Saying it out loud at the start of the call takes ten seconds and covers most of the risk.
Which AI notetakers let me stop them using my calls to train their models?
Most of the major tools, including Otter, Fireflies and Fathom, offer this control, but usually only on paid business or enterprise tiers, not the free or entry-level plans. Check under Privacy or Data Controls in your account settings rather than assuming the free version protects you by default.
Is it worth paying more just for the privacy setting?
For any business handling client pricing, complaints, or personal details on calls, yes. The difference between free and business tiers is usually ten to fifteen pounds a month, which is a small price against the risk of confidential client information contributing to a model's training data.
Should I stop using AI notetakers altogether?
No, they save real time on summarising and follow-ups. The fix isn't avoidance, it's disclosure, choosing the right tier, and deleting transcripts you don't need after 90 days rather than letting them sit indefinitely on someone else's server.
Related reading: Why AI Notetakers Are Quietly Costing You Deals and The AI Notetaker Sitting In On Your Client Calls Might Be Breaking Your NDA.
If you want the full breakdown, here is everything I know about AI marketing.
Related: work with Lilach on AI
