At NOTA, we take your privacy seriously. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have. We only collect information necessary to provide our meeting summary services. Your meeting recordings and transcripts are encrypted both in transit and at rest.
We do not sell your personal data to third parties. We use industry-standard security protocols to ensure your information remains confidential and is only accessible by authorised systems for processing.
1. Who we are
NOTA (“we”, “us”, or “our”) is a meeting summary service. We act as the data controller for the personal data you provide to us. If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@joinnota.com.
2. Information we collect
We collect the following categories of information:
Account information: your name and email address when you create an account or sign in.
Meeting content: audio and/or video recordings you upload, plus the transcripts, summaries, action items, and timestamps we generate from them.
Usage and device information: log data (IP address, browser type, device type) and basic interaction data (pages viewed, features used) to operate and improve the service.
Support communications: any messages you send us when contacting support.
3. How we use your information
We use the information we collect to:
• Provide, maintain, and operate the NOTA service — including generating meeting summaries, transcripts, and action items from your uploaded recordings.
• Authenticate you and manage your account.
• Communicate with you about service updates, support requests, and account matters.
• Detect, prevent, and address technical issues, abuse, or fraud.
• Improve our services, features, and user experience.
4. Legal basis for processing
Where required by applicable data protection law (including the General Data Protection Regulation, or GDPR), we rely on the following legal bases:
Contract: we process your account information and meeting content to deliver the services you have requested under our Terms of Service.
Legitimate interest: we use limited usage data to operate, secure, and improve the service.
Consent: for optional categories such as analytics and performance/error tracking, we only process data after you have given explicit consent via our cookie consent banner. You can withdraw this consent at any time.
5. Third-party sub-processors
We use trusted third-party service providers to operate the service. Each provider acts as a data processor on our behalf and is contractually bound to protect your data:
Supabase — hosts our database, authentication, and file storage. Your recordings, transcripts, summaries, and account data are stored with Supabase. Supabase hosts your data in the European Union (West Europe — Ireland).
Deepgram — provides speech-to-text transcription of uploaded recordings. Audio data is sent to Deepgram for processing; Deepgram is headquartered in the United States and processes data under Standard Contractual Clauses (SCCs) approved by the European Commission.
Sentry — captures anonymised error reports and session replays to help us fix bugs quickly (only when you have opted in to performance cookies).
6. Where your data lives
Your account data, recordings, transcripts, and summaries are stored with our infrastructure provider, Supabase, in the European Union (West Europe — Ireland). Because your data remains within the EU, no international transfer is required for primary storage.
When you upload a recording for transcription, the audio is sent to Deepgram for processing. Deepgram operates from the United States, so this constitutes a transfer of personal data outside the EU. To protect your data, Deepgram relies on European Commission-approved Standard Contractual Clauses (SCCs) as the transfer mechanism. We do not transfer your personal data to any other non-EU/EEA country.
7. Data retention
We retain your account information and meeting data for as long as your account remains active, or as long as necessary to provide the service. You can delete individual meetings at any time within the app, and you can delete your entire account — upon which we will delete all associated data within 30 days, except where we are required to retain it by law.
8. Your rights
Depending on your location, you may have the following rights regarding your personal data:
• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (subject to legal retention obligations).
• Portability — receive your data in a machine-readable format.
• Restriction — request that we limit processing of your data.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — withdraw any consent previously given (e.g., via the cookie banner).
To exercise any of these rights, email us at support@joinnota.com. We will respond within 30 days.
9. Automated decision-making
NOTA uses artificial intelligence to generate transcripts, summaries, and action items from your meeting recordings. These outputs are generated automatically and may contain inaccuracies. We do not make legally significant decisions about you based solely on automated processing. You should not rely on AI-generated outputs alone for critical decisions.
10. Children’s privacy
NOTA is not intended for children. By using the service, you confirm that you are at least 16 years old. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.
11. Cookies
We use cookies to operate the service. Essential cookies (such as authentication cookies) are always active. Analytics and performance cookies are only used after you have given consent via our cookie banner. For more information, see our Cookie Policy.
12. Data security
We implement a variety of security measures to protect your personal information. Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest. Access to personal data is restricted to authorised systems and personnel. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page and updating the “Last updated” date above. We encourage you to review this policy periodically.
14. Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with your local data protection authority.
15. Contact us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at support@joinnota.com.