Privacy Policy

Scope of this policy

This policy covers our public website and the authenticated application. It does not cover third-party websites or services that we link to but do not control. Capitalized terms not defined here have the meaning given in our Terms of Service.

Person responsible for protecting your information

In accordance with Law 25, we have designated a person responsible for the protection of personal information (our "Privacy Officer"). This person oversees our privacy practices and handles access requests, corrections, and complaints. You can reach the Privacy Officer using the details in the Contact section below.

Personal information we collect

We collect the following categories of personal information:

• Account information: your name, email address, and a securely hashed password when you create an account.
• Content you create: the notebooks, sections, pages, text, tags, and media (images, files, and audio) you add to the Service. This content may itself contain personal information that you choose to include.
• AI inputs: when you use optional AI features, the text or audio you submit for transcription, summarization, or rewriting, and the questions you ask the page AI chat together with the answers it returns.
• Technical and usage information: IP address, browser and device information, log data, and security and audit records generated when you use the Service.
• Notification settings: if you turn on the optional daily task digest, we store that it is on and the time zone your browser reports, so the email arrives at 9:00 a.m. where you are rather than where our servers are. We delete the stored time zone as soon as you turn the digest off, and every notification email carries a one-click link to stop it.
• Cookies and similar technologies: described in the Cookies section below.

Please do not store personal information that you are not authorized to process.

How and why we use your information

We use personal information to provide, operate, secure, and maintain the Service; to authenticate you and protect your account, including our audit trail; to deliver features you request, such as AI transcription, summaries, sharing, import, and export; to communicate with you about your account, support, and material changes; to send the task reminders and the daily digest you switch on, which you can switch off at any time from any of those emails or in Settings; and to comply with our legal obligations. We use your information only for the purposes identified when it is collected, for compatible purposes, or where the law otherwise permits. Where the GDPR applies, our legal bases are the performance of our contract with you, your consent for optional features such as analytics and the daily task digest, our legitimate interests in operating and improving the Service, and compliance with legal obligations.

Artificial-intelligence features

Optional features such as meeting transcription, summaries, text rewriting, and the page AI chat send the content involved to a third-party AI provider, acting as our processor, to generate a result that is returned to you. These features run only when you trigger them, and our provider does not use your content to train its models. For transcription, summaries, and rewriting, the result is stored in your notebook. For the page AI chat, your questions and the assistant's answers are stored as a per-page conversation history on our servers so the conversation is there when you return; to answer, the assistant also reads the page you are on and the pages linked to it. Chat history is kept while your account is active: you can clear a page's conversation at any time, it is deleted when the page or your account is deleted, and conversations inactive for twelve months are deleted automatically. AI output may be inaccurate or incomplete and should be reviewed before you rely on it; it is not professional advice. This processing may take place outside Québec and Canada (see Where your information is processed). We do not use your personal information to make decisions about you based solely on automated processing.

Meetings and other participants

The AI Meeting Notes feature records your microphone and the audio of your call. A recording will normally contain the voices and words of other participants, who may not have a note2it account.

When you record, you act as the party responsible for that personal information: you are responsible for informing participants and obtaining any consent required where you are. Recording and consent rules vary by jurisdiction and by workplace, and some require the agreement of every participant. Before each recording, the Service requires you to confirm that you understand this responsibility; note2it does not itself notify the other participants in your call.

Audio recordings are retained until you delete the recording, the page it is stored on, or your account. Transcripts and summaries remain in your notebook until you delete them or your account.

Transcripts may include speaker labels such as "Speaker 1" and "Speaker 2". These labels are estimated from the transcript text alone: we do not analyze voice characteristics, create voiceprints, or process any other biometric identifiers.

If you took part in a recorded meeting and want to know what we hold, or want it corrected or deleted, contact our Privacy Officer. The account holder who made the recording generally controls that content; we will direct your request to them and assist as the law requires.

Connected apps (AI assistants)

On plans that include it, you can connect third-party applications — such as the Claude AI assistant — to your account through an authorization screen. A connected app can read and, only if you grant it, edit your notebook content on your behalf, within the permissions you approve. Your content is shared with a connected app only at your direction, and the app's provider then processes it under its own privacy policy, which you should review; unlike the AI features above, a connected app acts on your instructions, not as our processor. For each connection we store the app's name, the permissions you granted, and an access credential in hashed form — never the credential itself. Connected-app activity on your account is recorded in our security log. You can see every connection and revoke its access at any time in the app's Settings; revocation takes effect immediately. We never connect an app to your account ourselves, and no app gains access without your explicit approval.

Cookies and similar technologies

By default our website uses only strictly necessary cookies — for example, to remember your language preference and your cookie-consent choices. We do not use advertising cookies, and we do not load analytics or marketing technologies unless you opt in through our cookie banner or "Cookie settings". If you opt in to analytics, we use Google Analytics (provided by Google), with IP anonymization, to understand how the website is used; it sets the _ga cookies, and the data may be processed outside Québec and Canada (see Where your information is processed). You can review or change your choices at any time using the "Cookie settings" link in the website footer. The authenticated application uses a small number of strictly necessary cookies and local storage to keep you signed in and to remember interface preferences.

Service providers and disclosure

We do not sell your personal information. We share it only as needed to operate the Service, with service providers acting on our behalf under contract, including:

• Cloud hosting and infrastructure providers.
• A database provider, to store account and content data.
• An object-storage provider, to store uploaded media.
• An AI provider, for the optional AI features described above.
• An email provider, for transactional messages.

We may also disclose personal information where required by law, to protect our rights or the safety of others, or in connection with a business transaction such as a merger or sale, subject to applicable law. We publish the current list of these providers — with what each one does and where it processes data — on our Trust page at note2it.com/trust, and we update that list before adding a new provider that processes personal information.

Where your information is processed

Some of our service providers store or process personal information outside the Province of Québec, including elsewhere in Canada and in the United States. Before transferring personal information outside Québec, we assess the protection it will receive, taking into account the sensitivity of the information, the purposes of its use, the safeguards in place (including contractual clauses), and the legal framework of the destination. Where the GDPR applies, transfers outside the European Economic Area rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact our Privacy Officer for more information about these safeguards.

How long we keep your information

We keep personal information only for as long as necessary to fulfil the purposes described in this policy, to provide the Service, and to meet our legal, accounting, and security obligations. In particular:

• Account information is retained while your account is active. After your account is deleted, we delete or anonymize your personal information within a reasonable period, except where retention is required by law or to establish, exercise, or defend legal claims.
• Notes, notebooks, and uploaded media are retained until you delete them or your account.
• Meeting audio is retained until you delete the recording, the page it is stored on, or your account. Dictation audio is not stored at all: it is transcribed and immediately discarded.
• Meeting transcripts and summaries are retained until you delete them or your account.
• Page AI chat conversations are kept while your account is active; you can clear a page's conversation at any time, and conversations inactive for twelve months are deleted automatically.
• Audit and security records are retained for up to seven years, in line with our security obligations.
• Backups are deleted on a rolling schedule.

How we protect your information

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, tenant isolation, and an immutable audit trail of changes. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a confidentiality incident that presents a risk of serious injury, we will take reasonable steps to reduce the risk and will notify the Commission d'accès à l'information du Québec and affected individuals as required by Law 25, and other authorities or individuals as required by applicable law.

Your rights

Subject to applicable law, you may:

• Access the personal information we hold about you and obtain a copy.
• Have inaccurate or incomplete information corrected.
• Withdraw your consent to optional processing.
• Request deletion of your personal information, or that we stop disseminating it or de-index it, where the law allows.
• Request portability of the computerized personal information you have provided, in a structured, commonly used technological format.
• Where the GDPR applies, object to or request restriction of certain processing.

To exercise any of these rights, contact our Privacy Officer using the details in the Contact section. We will respond within the time required by law (generally 30 days under Law 25). We may need to verify your identity first. These services are provided free of charge, subject to the limited exceptions permitted by law.

Children and minors

The Service is not directed to children. We do not knowingly collect personal information from a minor under 14 years of age without the consent of a person having parental authority, unless collecting it is clearly for the minor's benefit. If you believe a minor has provided us personal information without appropriate consent, contact our Privacy Officer and we will take appropriate steps.

Questions and complaints

If you have a question or concern about how we handle your personal information, please contact our Privacy Officer first and we will do our best to resolve it. If you are not satisfied, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). If the GDPR applies to you, you may also lodge a complaint with your local supervisory authority. Residents of other Canadian provinces may contact the Office of the Privacy Commissioner of Canada.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect means you acknowledge the updated policy.