Draft. Replace this page with the lawyer-reviewed iubenda-generated Privacy Policy before public launch. The structure below describes the actual data flows so the generated policy can be tailored accurately.
Privacy Policy
Effective: 2026-04-27
Information we collect
- Account info: email address and password (hashed).
- Note content: audio recordings (processed in memory, not stored), text transcripts, structured fields you generate, and an optional reference code you enter.
- Usage data: minimal server logs for security and debugging.
- Payment info: handled directly by Stripe; we receive subscription status only.
We do not knowingly collect Protected Health Information (PHI). See our No-PHI Policy.
How we use it
- To run the service: transcribe audio, structure notes, store and display them to you.
- To bill you and enforce your plan limits.
- To respond to support requests.
- To investigate and prevent abuse or fraud.
Service providers we use
- OpenAI — transcription (Whisper) and field extraction (GPT). Audio and transcript are sent for processing. We use the standard API; OpenAI does not train on API data by default.
- Supabase — database (Postgres), authentication. Stores your notes encrypted at rest and in transit.
- Vercel — application hosting.
- Stripe — payment processing. Stripe handles payment data directly; we never see card numbers.
Retention
Notes auto-delete 7 days after creation by default. You may extend retention to 30 days from the dashboard. Account records are retained while your account is active. Closed accounts are deleted within 30 days. Backups, if any, are rotated per a standard schedule.
Your rights
Depending on your state, you may have the right to access, correct, or delete your personal information, opt out of certain uses, and not be discriminated against for exercising these rights. Email support@noteassist.app to make a request. You can also delete your notes and your account from the dashboard at any time.
Contact
Questions about this policy: support@noteassist.app.