Privacy Policy

Sotalabs Technology JSC ("Sotalabs", "we", "us", or "our") is the data controller for personal data collected through the NoteX: AI Note Taker application (the "App"), available on Google Play, the App Store, and atnotexapp.com.

By using NoteX, you agree to the collection and use of your data as described in this Privacy Policy. Please read it carefully. If you do not agree, please discontinue use of the App.

• Account information: name, email address, username, password (stored as a secure hash)
• Profile settings and in-app preferences
• Content you create: meeting transcripts, notes, summaries, flashcards, quizzes
• Communications with us: support tickets, feedback, survey responses
• Payment details — processed directly by our payment providers; we do not store card numbers

• Device identifiers, operating system, app version
• Usage events and feature interactions (anonymized where possible)
• Crash reports and performance diagnostics (anonymized)
• Session duration and log timestamps

When you record a meeting or upload audio/video content, NoteX processes this data to generate transcripts, summaries, and AI-powered outputs. This content is:

• Transmitted securely over TLS 1.2+ to our AI processing pipeline
• Processed transiently — AI subprocessors do not store it after processing completes
• Stored in your account only — you control deletion at any time
• Never used to train, fine-tune, or improve any AI or ML model

When you connect Google Calendar, NoteX reads event metadata (title, time, attendee names) to associate meetings with your notes. We do not store, share, or use Google Calendar data beyond the active session, and we fully comply with Google's Limited Use Policy for Workspace API data.

Our AI pipeline operates under the following principles:

• No training use: We contractually prohibit all AI subprocessors from using your data to train, fine-tune, retrain, or benchmark any AI or ML model — for any purpose, ever.
• Data minimization: Only the content required for a specific feature is sent for AI processing.
• Purpose limitation: Content is processed only for the feature you invoke, not for other purposes.
• Transient processing: AI providers process and immediately discard your content — no retention after the request completes.
• Contractual controls: All AI subprocessors are contractually prohibited from using your data for training.
• Your control: AI-powered features are opt-in and can be disabled in Settings at any time.

We use a limited, audited set of subprocessors to operate NoteX.

To request a copy of any subprocessor's DPA or to object to a new subprocessor, contact hello@notexapp.com.

We do not sell, rent, or broker your personal data. We share data only in these limited circumstances:

• With subprocessors listed in Section 4, solely to operate the service
• With Sotalabs affiliates, subject to equivalent data protection standards
• In connection with a merger, acquisition, or asset sale — we will notify you in advance and ensure equivalent privacy obligations apply
• When required by law, court order, or regulatory authority — we will notify you where legally permitted to do so
• To protect the rights, safety, or property of Sotalabs, our users, or the public in cases of confirmed fraud or security incidents

We may share aggregated, de-identified data that cannot reasonably identify you for research or benchmarking purposes.

NoteX is operated from Vietnam. Our subprocessors may process data in the United States and European Union. For transfers outside the EEA, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements incorporating GDPR-compliant transfer mechanisms
• Encryption in transit (TLS 1.2+) and at rest (AES-256) for all transferred data
• Subprocessor assessment for SOC 2 Type II or equivalent security certification

We retain your data only as long as necessary for the purposes described here or as required by law.

Upon account deletion, data purge begins within 30 days. Billing records are retained for 7 years as required by Vietnamese and international tax law.

We implement industry-standard technical and organizational security measures:

• Encryption in transit: TLS 1.2+ for all data transmissions between your device and our servers
• Encryption at rest: AES-256 for all stored data and backups
• Access controls: Role-based access, least-privilege principles, mandatory MFA for all administrative access
• Security monitoring: Continuous threat detection, intrusion detection systems, and incident response procedures
• Vendor assessments: Subprocessors are evaluated for SOC 2 Type II or equivalent compliance
• Regular testing: Annual penetration testing and quarterly vulnerability assessments

In the event of a personal data breach that is likely to affect your rights, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR.

Depending on your jurisdiction, you have the following rights. Contact hello@notexapp.com to exercise any of them. We respond within 30 days (GDPR) or 45 days (CCPA).

To delete your account and personal data, go to Settings → Account → Delete Account in the app, or email hello@notexapp.com. We will process verified deletion requests within 30 days.

We may decline requests that would compromise account security (e.g., outstanding legal proceedings, unresolved disputes, or legal retention obligations). We will explain any such limitation in writing.

In addition to the rights in Section 10, California residents have the following rights under the CCPA as amended by the CPRA:

• Right to Know: What personal information we collect, use, disclose, and sell (we do not sell)
• Right to Delete: Request deletion of your personal information held by us and our service providers
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale / Sharing: We do not sell or share personal information for cross-context behavioral advertising; no opt-out is required
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Right to Limit Sensitive PI Use: We do not use sensitive personal information for inferential or secondary purposes

To submit a CCPA request: hello@notexapp.com or via in-app Settings. Authorized agents may submit requests on your behalf with documented authorization.

NoteX is not directed to children under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children.

If you believe a child has provided personal data through our App, please contact hello@notexapp.com immediately and we will delete it promptly.

The NoteX web application (notexapp.com) uses cookies and similar technologies for authentication, security, and analytics.

We do not use cross-site tracking, browser fingerprinting, or persistent user profiling for advertising.

We may update this Privacy Policy periodically. For material changes that affect your rights or how we process your data, we will:

• Post the updated policy atnotexapp.com/privacywith an updated Effective Date
• Send an in-app notification and/or email at least 30 days before changes take effect
• Require renewed consent where the applicable legal basis requires it

Continued use of NoteX after the effective date of non-material changes constitutes acceptance of the updated policy.

For questions, requests, or complaints regarding this Privacy Policy or our data practices:

EU residents may also contact their national data protection supervisory authority if they believe their rights have not been respected.