Privacy policy

anything2note ("we", "us") is operated by [Company legal name], a company registered in India at [registered address]. We are the data controller (and "data fiduciary" under India's Digital Personal Data Protection Act, 2023) for the personal data described in this policy.

This policy covers our website, web app, and iOS and Android apps (together, the "Service").

We collect only what we need to run the Service:

• Account data: your name, email address, and profile image if you sign in with Google or Apple.
• Your content: files you upload (audio, video, PDFs, Office documents, images), in-app recordings, links you submit, pasted text, and the notes, transcripts, flashcards and other outputs we generate from them.
• Usage data: the minutes and pages you use, features you open, and basic device and browser information, used to enforce plan limits and fix problems.
• Billing data: your plan, billing country and subscription status. Card, UPI and bank details are collected by our payment providers, not by us.
• Support data: anything you send us when you contact support.

• To provide the Service: transcribe, extract and generate outputs from your content, and answer your questions about it.
• To run your account: authentication, plan limits, billing and account notices.
• To keep the Service secure: detect abuse, prevent fraud and protect free-trial credits from bots.
• To improve the Service using aggregated, de-identified usage metrics. Never the contents of your uploads.

NoteWe do not sell your personal data, and we do not use your uploads, recordings, documents or notes to train AI models.

To generate your notes, we send the relevant content to third-party AI and infrastructure providers that act on our instructions. They may process it only to return results to us, under contracts that prohibit using it to train their models.

Our main sub-processors are:

• Cloud infrastructure and storage: [e.g. Cloudflare], [e.g. Vercel].
• Speech-to-text and language model providers: [list providers and regions].
• Authentication: Google and Apple, if you choose those sign-in methods.
• Payments: Dodo Payments, which sells subscriptions to you as merchant of record.
• Email delivery: [email provider], for sign-in codes and account notices.

Public YouTube videos are an exception to per-user processing: their transcript may be processed once and cached so it can be reused. Which videos you add, and everything generated for you, remains private to your account.

We keep your content for as long as your account is active, unless you delete it sooner.

• Delete originals after processing: an account setting, off unless you turn it on. When it's on, uploaded files and recordings are deleted once their notes are made. Your notes, transcripts and flashcards remain.
• Deleting an item removes its original file, transcript and outputs from our active systems immediately and from backups within [30] days.
• Deleting your account removes all your content within [30] days. We keep limited billing records for as long as tax law requires (currently up to 8 years in India).

If you create a read-only share link, anyone with the link can view the outputs you chose to share. They cannot see your original file, other items or your account. You can revoke a link at any time, and it stops working immediately.

Depending on where you live, including under India's DPDP Act, the EU/UK GDPR and US state privacy laws, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data or complete incomplete data;
• delete your data, or withdraw consent where we rely on it;
• object to or restrict certain processing, and port your data to another service;
• nominate someone to exercise your rights if you die or become incapacitated (India);
• complain to your local data protection authority or the Data Protection Board of India.

Most of this is self-serve: export or delete items from the app, and delete your account in Settings. For anything else, email privacy@anything2note.com and we will respond within [30] days.

We and our sub-processors may process data in India, the United States, the European Union and other countries. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, and we comply with any transfer restrictions notified under Indian law.

Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to staff who need it, protected by multi-factor authentication and logged. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

The Service is not directed at children under 13. In India, users under 18 need verifiable consent from a parent or guardian, and in the EU the age of consent may be up to 16. If you believe a child has given us personal data without the required consent, contact us and we will delete it.

We use strictly necessary cookies to keep you signed in and to secure the Service, plus privacy-friendly analytics that do not track you across other sites. We do not use advertising cookies.

If we make material changes, we will tell you by email or in the app at least 14 days before they take effect. The date at the top shows when this policy was last updated.

Questions or requests: privacy@anything2note.com.

Grievance Officer (India): [Name], [designation], [address]. Email grievance@anything2note.com. We acknowledge complaints within 24 hours and resolve them within the time required by law.

EU/UK representative: [to be appointed if required].