Privacy policy

1. Who we are

notesai.me (“Note AI”, “we”, “us”) is operated by Kartikeya Mishra, Lucknow, Uttar Pradesh, India. For the purposes of the GDPR and UK GDPR we are the controller, and under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the data fiduciary, for the personal data described here. Contact: privacy@notesai.me.

2. What we collect and why

The free Action Item Extractor and templates

Text you paste or type into the extractor is processed entirely in your browser by code running on your device. It is not uploaded to our servers, not stored by us and not used to train any model. To save you from losing work, your latest draft and your date-format choice are kept in your own browser's local storage. You can remove them with the tool's Clear button or by clearing site data in your browser.

Beta waitlist

When you join the waitlist we store:

• your email address;
• whether you ticked the optional box to receive product news, and the version of the wording you agreed to;
• which page you signed up from, the country your request came from (derived from the request by our host, not your precise location) and the date;
• a salted, one-way cryptographic hash of your IP address, used only to block automated abuse. We do not store your IP address in readable form.

We use this to invite you to the beta and send essential messages about your place on the list (legal basis: taking steps at your request before a contract, and our legitimate interest in running the beta). We send product news and marketing emails only if you ticked the optional, unticked-by-default box (legal basis: consent). Every marketing email includes an unsubscribe link, and you can withdraw consent at any time by emailing privacy@notesai.me. Withdrawal does not affect earlier processing.

What we do not collect

We do not run our own analytics trackers or session-recording tools. We do not ask for or collect government ID numbers, card numbers, bank account numbers or other sensitive financial data. Any operational logs we keep use hashed identifiers rather than readable IP addresses.

3. Advertising and cookies

Some pages (the free tool, templates and guides) show ads served by Google AdSense. Pages such as the home page, legal pages and contact page do not show ads.

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
• You may opt out of personalised advertising by visiting Google Ads Settings, or opt out of some third-party vendors' use of cookies at aboutads.info.
• Learn more about how Google uses information from sites that use its services.

Visitors in the European Economic Area, the United Kingdom and Switzerland are shown a consent message from a Google-certified consent management platform before any personalised advertising cookies are set. You can change your choice at any time through the privacy link shown by that message. Visitors in US states with privacy laws may be shown a “do not sell or share” message. We also honour Global Privacy Control signals where the law requires it.

4. Who we share data with

We never sell or rent personal data. We share it only with service providers that help us run the site:

• Vercel Inc. (website hosting and delivery);
• Google LLC (Firebase Firestore database for the waitlist, hosted in Mumbai, India; and Google AdSense for ads);
• an email delivery provider, when we send beta invitations.

Some providers process data outside your country, including in the United States. Where the GDPR or UK GDPR applies, such transfers rely on the European Commission's Standard Contractual Clauses or equivalent safeguards offered by the provider. We may disclose data if required by law.

5. How long we keep it

Waitlist records are kept until the beta ends or you ask us to delete them, and in any case no longer than 24 months after your last interaction. Hashed abuse-prevention data is kept for no longer than 30 days.

6. Security

The site is served only over HTTPS with HSTS. The waitlist database cannot be read or written from browsers; only our server can access it using restricted credentials. No system is perfectly secure, and we will notify you and the relevant authorities of a personal data breach where the law requires.

7. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data or complete incomplete data;
• have your data deleted (erasure);
• withdraw consent at any time, as easily as you gave it;
• object to or restrict processing, and data portability (GDPR/UK GDPR);
• know what personal information is collected and opt out of its sale or sharing (California and other US states). We do not sell personal information;
• nominate another person to exercise your rights in the event of death or incapacity (DPDP Act);
• complain to a supervisory authority, such as your local EU data protection authority, the UK ICO, or the Data Protection Board of India.

Email privacy@notesai.me from the address concerned. We reply within 30 days and will not discriminate against you for exercising your rights.

8. Grievance officer (India)

Under the DPDP Act and the Information Technology Rules, grievances can be sent to our grievance officer, Kartikeya Mishra, at grievance@notesai.me. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

9. Children

Note AI is not directed at anyone under 18 and we do not knowingly collect their personal data. If you believe a child has joined the waitlist, contact us and we will delete the record.

10. Changes

If we change this policy, we update the date at the top. If a change materially affects how we use data you have already given us, we will email waitlist members before it takes effect.

See also: Terms of service · AI disclaimer · Contact