Privacy Policy

Last updated: 14 September 2026

This Privacy Policy explains how NoteBot (“we”, “us”, “our”) collects, uses, stores, and protects your personal information when you use the NoteBot cloud platform (“Service”).

1. Information We Collect

Account Information

• Email address (required for account creation and authentication)
• Display name (optional, set by you)
• Authentication tokens managed by Supabase Auth

Meeting Data

• Audio recordings uploaded by you
• Transcripts generated from your recordings
• AI-generated meeting briefs, summaries, and action items
• Screen capture keyframes

Usage Data

• Pages visited and features used (via Vercel Analytics, anonymised)
• Error reports (via Sentry, no personal data attached)

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Generate transcripts and AI summaries from your recordings
• Send transactional emails (invites, password resets, share notifications)
• Process payments and manage subscriptions
• Detect and prevent abuse or unauthorized access

3. Data Storage and Security

All data is stored in Supabase infrastructure in the ap-southeast-2 (Sydney, Australia) region. Data is encrypted at rest and in transit using TLS 1.2+.

Meeting recordings and generated files are stored in Supabase Storage with access controlled by Row Level Security policies tied to your team membership.

4. Data Retention

Your data is retained for as long as your account is active. If you request account deletion, your data enters a 14-day grace period during which you can cancel the request. After the grace period, all personal data and meeting content is permanently and irreversibly deleted.

We may retain anonymised, aggregated usage statistics that cannot be linked back to you.

5. Your Rights

You have the right to:

• Access your personal data via the Settings page or data export feature.
• Correct your profile information at any time.
• Delete your account and all associated data.
• Export your data in a portable format (ZIP download from Settings).
• Withdraw consent by deleting your account.

6. Third-Party Processors

We use the following third-party services to operate the platform:

Each processor is contractually bound to handle data only for the purposes described and in accordance with applicable data protection laws.

7. Cookies

We use only essential cookies required for authentication (Supabase auth session cookies). We do not use advertising, tracking, or third-party marketing cookies.

8. International Data Transfers

Your data is primarily stored and processed in Australia (ap-southeast-2). Some third-party processors (Vercel, Stripe, Groq, OpenRouter, Hugging Face) may process data in other jurisdictions. Where data is transferred internationally, we ensure appropriate safeguards are in place under applicable law.

9. Compliance

We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). For users in the European Economic Area, we comply with the General Data Protection Regulation (GDPR). Our lawful basis for processing is contractual necessity (to provide the Service you signed up for) and legitimate interests (to improve and secure the Service).

10. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. The “Last updated” date at the top indicates the most recent revision.

12. NoteBot Live Assist (Chrome extension)

NoteBot Live Assist is an optional Chrome extension that shows you private coaching in Chrome’s side panel during Google Meet calls. This section describes what it handles.

What it reads

• The captions Google Meet shows on screen during a call you are in, including the names of the people speaking. Captions must be turned on in Meet. It reads nothing else on the page and does not change the call.
• The call type you pick, the goal you type for a call, and any question you type into the panel.
• On NoteBot’s own website, a request from the page asking whether the extension is installed, which it answers with its version number.

What it sends, and where

• The most recent part of the conversation, your goal or question, the call type, what the call has covered and signalled so far, and the meeting code are sent to NoteBot over an encrypted connection, with a sign-in token that identifies your account.
• NoteBot uses the meeting code to find the matching invitation in your connected Google Calendar and your earlier NoteBot meetings, then sends the conversation and that context to the AI providers listed in section 6 to write the suggestions, estimate how the other side is feeling from their words, and pick out objections, buying signals and commitments. Those providers handle the text under their own terms.

What it keeps

• On your device, for the current browser session only: your NoteBot sign-in token, and for each call the goal you typed and what the panel has built up (mood readings, signals and checklist progress). These are cleared when Chrome closes.
• On your device until you remove the extension: the call type you picked last.
• NoteBot does not save the live transcript or the suggestions. For each suggestion it records only which AI model answered, to track usage.

Who can see it

No bot joins the call and other participants are not notified. The panel is part of Chrome, not the Meet page, so presenting a tab does not show it; presenting your entire screen or the Chrome window will.

Removing the extension from Chrome deletes everything it kept on your device. For questions about Live Assist, use the contact details in section 13.

13. Contact

For privacy-related questions or requests, contact us at emily@cancelcosts.com.