Privacy Policy

Last updated: 1 June 2026

This Privacy Policy explains how NoteBot (“we”, “us”, “our”) collects, uses, stores, and protects your personal information when you use the NoteBot cloud platform (“Service”).

1. Information We Collect

Account Information

• Email address (required for account creation and authentication)
• Display name (optional, set by you)
• Authentication tokens managed by Supabase Auth

Meeting Data

• Audio recordings uploaded by you
• Transcripts generated from your recordings
• AI-generated meeting briefs, summaries, and action items
• Screen capture keyframes

Usage Data

• Pages visited and features used (via Vercel Analytics, anonymised)
• Error reports (via Sentry, no personal data attached)

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Generate transcripts and AI summaries from your recordings
• Send transactional emails (invites, password resets, share notifications)
• Process payments and manage subscriptions
• Detect and prevent abuse or unauthorized access

3. Data Storage and Security

All data is stored in Supabase infrastructure in the ap-southeast-2 (Sydney, Australia) region. Data is encrypted at rest and in transit using TLS 1.2+.

Meeting recordings and generated files are stored in Supabase Storage with access controlled by Row Level Security policies tied to your team membership.

4. Data Retention

Your data is retained for as long as your account is active. If you request account deletion, your data enters a 14-day grace period during which you can cancel the request. After the grace period, all personal data and meeting content is permanently and irreversibly deleted.

We may retain anonymised, aggregated usage statistics that cannot be linked back to you.

5. Your Rights

You have the right to:

• Access your personal data via the Settings page or data export feature.
• Correct your profile information at any time.
• Delete your account and all associated data.
• Export your data in a portable format (ZIP download from Settings).
• Withdraw consent by deleting your account.

6. Third-Party Processors

We use the following third-party services to operate the platform:

Each processor is contractually bound to handle data only for the purposes described and in accordance with applicable data protection laws.

7. Cookies

We use only essential cookies required for authentication (Supabase auth session cookies). We do not use advertising, tracking, or third-party marketing cookies.

8. International Data Transfers

Your data is primarily stored and processed in Australia (ap-southeast-2). Some third-party processors (Vercel, Stripe, Groq) may process data in other jurisdictions. Where data is transferred internationally, we ensure appropriate safeguards are in place under applicable law.

9. Compliance

We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). For users in the European Economic Area, we comply with the General Data Protection Regulation (GDPR). Our lawful basis for processing is contractual necessity (to provide the Service you signed up for) and legitimate interests (to improve and secure the Service).

10. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. The “Last updated” date at the top indicates the most recent revision.

12. Contact

For privacy-related questions or requests, contact us at privacy@notebot.app.