Privacy policy
In short: your notes and transcripts stay in your browser. We keep only what we need for the free limit, abuse protection and, once sales open, subscriptions.
Last updated
Only the website is live for now: the extension is not in the stores yet and purchases are closed. The site does not ask for your data and sets no advertising or analytics cookies. This document describes the service after launch; the controller and seller details will be published here before then.
Who is responsible
The controller is the owner of the Notesavo service (details will be published before the extension and the paid version launch; contact: support@notesavo.com). We process data under the GDPR and Russian Federal Law 152-FZ.
What stays only with you
- Your notes and transcripts library — in browser storage (IndexedDB).
- Flashcards, review progress, settings.
- Your API key in “your own API key” mode.
We cannot see this data. If you enable sync, data is encrypted on your device. The sync key is protected by a 12-word recovery phrase that is shown once and never stored by us; only ciphertext reaches our server.
What goes to servers and why
| Data | Where | Why | Retention |
|---|---|---|---|
| The video transcript, the text of an article or document (PDF, Word, PowerPoint) and their fragments; the files themselves are not uploaded | Us (job check) and the AI provider via our gateway | Build notes, answer questions, count minutes fairly | We do not store the text; for billing a summary we keep only one-way line fingerprints for up to 7 hours. Finished notes are cached for up to 90 days, without the transcript, and only for videos YouTube confirms as public by their ID |
| Audio in 10-minute chunks | Us (length measurement) and the speech recognition provider | Get text when there are no subtitles; charge only the minutes the recording lasts | Never stored by us |
| Us and the payment provider | Send your key, receipt and subscription emails | While the account exists and as accounting law requires | |
| License record and devices (the key is stored only as a one-way HMAC) | Us | Check the license, 3-device limit | While the license is valid |
| Minute and request counters | Us | Enforce limits | 13 months, no video titles or text |
| Install ID (a fingerprint of the key the extension creates on your device), extension version, registration and last-seen dates | Us | Grant the free limit and the trial, protect them from abuse | While the install is active; deleted after 13 months without requests |
| IP address | Us | Rate limiting, preventing mass registration and keeping one network from using up the shared free budget | Only as a one-way fingerprint, up to 48 hours (including the network fingerprint for its share of the shared budget); the /24 (IPv4) or /48 (IPv6) network of an install registration for up to 30 days |
| A one-way fingerprint of your email, if you confirmed it for the trial | Us | Grant the trial once per email | 13 months |
| YouTube video ID | Us and YouTube (to check the video is public) | Serve finished notes from the shared cache | Cache key up to 90 days |
| Anonymous events (only if the user enables analytics in the extension) | Us | Find where the product breaks | 13 months; off by default |
| Uninstall reasons you tick on the page after uninstalling (reason codes only, no text or page address) | Us | Understand why people leave | 13 months |
In “your own API key” mode, transcript fragments and audio go from your browser straight to your provider — our server is not involved.
Payment data
We never see or store card numbers. USD payments are processed by Paddle as merchant of record; RUB payments by YooKassa.
Why we may process it (legal bases)
- To provide the extension, notes, limits and purchases you asked for — performance of a contract (GDPR Art. 6(1)(b)).
- To keep accounting and tax records — legal obligation (Art. 6(1)(c)).
- To prevent abuse of free limits and secure the service — our legitimate interests (Art. 6(1)(f)).
- Anonymous product analytics in the extension — only with your consent, which you can withdraw in settings at any time (Art. 6(1)(a)).
Service providers and international transfers
We use processors for hosting and the database, AI and speech recognition, email delivery and payments. Some are located outside your country, including outside the EEA. Where personal data leaves the EEA we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses. The list of processors and their countries is available on request at support@notesavo.com and will be published here before launch.
Your rights
You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Accounts come with the paid version; you will be able to delete yours in your account, or email support@notesavo.com. We reply within 10 business days. Payment records are kept as long as the law requires. If you are in the EEA or the UK, you may also complain to your local data protection authority.
Children
Notesavo is not intended for children under 16 in the EEA and the UK, or under 13 elsewhere, unless a parent or guardian consents. We do not knowingly collect their data; if you believe a child has given us data, email support@notesavo.com and we will delete it.
Website
No ad trackers or pixels. The website currently sends no visit events to external analytics services. In the extension, anonymous product analytics is off by default and is enabled only if the user turns it on in settings.
Changes
We will announce material changes 14 days in advance on the site and in the extension, and by email if we have your address. The last update date is at the top of the page.