Privacy policy
In short: your notes and transcripts stay in your browser. We keep only what we need to sell and support a subscription.
Last updated
Only the website is live for now: the extension is not in the stores yet and purchases are closed. The site does not ask for your data and sets no advertising or analytics cookies. This document describes the service after launch; the controller and seller details will be published here before then.
Who is responsible
The controller is the owner of the Notesavo service (details will be published before the extension and the paid version launch; contact: support@notesavo.com). We process data under the GDPR and Russian Federal Law 152-FZ.
What stays only with you
- Your notes and transcripts library — in browser storage (IndexedDB).
- Flashcards, review progress, settings.
- Your API key in “your own API key” mode.
We cannot see this data. If you enable sync, data is encrypted on your device. The sync key is protected by a 12-word recovery phrase that is shown once and never stored by us; only ciphertext reaches our server.
What goes to servers and why
| Data | Where | Why | Retention |
|---|---|---|---|
| The video transcript and its fragments | Us (job check) and the AI provider via our gateway | Build notes, answer questions, count minutes fairly | We do not store the text; for billing a summary we keep only one-way line fingerprints for up to 7 hours. Finished notes are cached for up to 90 days, without the transcript, and only for videos YouTube confirms as public by their ID |
| Audio in 10-minute chunks | Us (length measurement) and the speech recognition provider | Get text when there are no subtitles; charge only the minutes the recording lasts | Never stored by us |
| Us and the payment provider | Send your key, receipt and subscription emails | While the account exists and as accounting law requires | |
| License record and devices (the key is stored only as a one-way HMAC) | Us | Check the license, 3-device limit | While the license is valid |
| Minute and request counters | Us | Enforce limits | 13 months, no video titles or text |
| Anonymous events (only if the user enables analytics in the extension) | Us | Find where the product breaks | 13 months; off by default |
In “your own API key” mode, transcript fragments and audio go from your browser straight to your provider — our server is not involved.
Payment data
We never see or store card numbers. USD payments are processed by Paddle as merchant of record; RUB payments by YooKassa.
Why we may process it (legal bases)
- To provide the extension, notes, limits and purchases you asked for — performance of a contract (GDPR Art. 6(1)(b)).
- To keep accounting and tax records — legal obligation (Art. 6(1)(c)).
- To prevent abuse of free limits and secure the service — our legitimate interests (Art. 6(1)(f)).
- Anonymous product analytics in the extension — only with your consent, which you can withdraw in settings at any time (Art. 6(1)(a)).
Service providers and international transfers
We use processors for hosting and the database, AI and speech recognition, email delivery and payments. Some are located outside your country, including outside the EEA. Where personal data leaves the EEA we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses. The list of processors and their countries is available on request at support@notesavo.com and will be published here before launch.
Your rights
You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Delete your account in your account or email support@notesavo.com. We reply within 10 business days. Payment records are kept as long as the law requires. If you are in the EEA or the UK, you may also complain to your local data protection authority.
Children
Notesavo is not intended for children under 16 in the EEA and the UK, or under 13 elsewhere, unless a parent or guardian consents. We do not knowingly collect their data; if you believe a child has given us data, email support@notesavo.com and we will delete it.
Website
No ad trackers or pixels. The website currently sends no visit events to external analytics services. In the extension, anonymous product analytics is off by default and is enabled only if the user turns it on in settings.
Changes
We will email you 14 days before material changes. The last update date is at the top of the page.