Privacy policy

What we collect

Account data: email address, password hash or Google sign-in identifier, optional name and contact email, language choice, two-step sign-in settings.

Your content: notes, files, images, voice memos and the titles, summaries, tags, folders and links created from them, plus shares and comments.

Usage data: sign-in times, how many automatic-organising requests you make and their size (not their content), and anonymous page-view counts without any identifier.

Billing data (once payments are on): handled by Paddle as merchant of record. We receive subscription status, never your full card details.

Special categories of data

You may store health information (for example in the HEALTH folder) or other sensitive data. We process it only to provide the service to you, based on your explicit consent given by saving it. You can withdraw consent by deleting the content or your account.

Why and on what legal basis

To provide the service you signed up for (contract, GDPR art. 6(1)(b)).

To keep the service secure, prevent abuse and understand overall usage and costs (legitimate interest, art. 6(1)(f)).

To meet accounting and tax obligations for payments (legal obligation, art. 6(1)(c)).

We do not sell your data, use it for advertising, or use your content to train AI models.

Automatic organising

To create titles, summaries, tags, folders, links, reports and idea searches, the relevant parts of your content are sent to a language-model provider through our hosting platform's AI gateway. The provider processes it only to return the result. Results are generated automatically and may be wrong; they are not professional, medical, legal or financial advice. No decisions with legal or similarly significant effects are made about you.

You can turn off automatic organising in your profile. New notes then stay in RAW and nothing is sent for processing until you start it yourself (Re-organize, reports, idea search). Processing may take place outside the EU, mainly in the United States. Where EU-only processing is enabled, the app says so in your profile and voice-memo transcription is unavailable.

Who processes data for us

Lovable (application hosting, database, file storage and AI gateway) and its sub-processors.

Language-model providers reached through the AI gateway (currently OpenAI and Google models; voice memos are transcribed by OpenAI).

Google, only if you choose to sign in with Google.

Paddle, once payments are enabled.

Some of these may process data outside the EEA. Where they do, transfers rely on the EU Commission's standard contractual clauses or an adequacy decision. [VERIFY HOSTING REGION AND TRANSFER MECHANISMS]

How long we keep it

Your content stays until you delete it. Items in the trash stay until you empty them.

Hibernated accounts are deleted permanently after 30 days unless you sign in again. Immediate deletion removes everything at once.

Anonymous usage counts may be kept longer. Billing records are kept as required by Finnish accounting law (generally 6–10 years).

Your rights

You can access, correct, export and delete your data, restrict or object to processing, and withdraw consent. Most of this you can do yourself in the app (profile, download reports, delete account). For anything else, email us.

You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

Security

Data is encrypted in transit, access is restricted to your account by database rules, and two-step sign-in is available. Shared links can be read by anyone who has them until you revoke them.