Privacy Policy

Last Updated: May 20, 2026

1. Introduction

Welcome to WhichNotes ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use our website, application, and services (collectively, the "Service").

By accessing or using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect information to provide and improve our Service. This includes:

2.1. Personal Information You Provide

• Account Data: When you register, we collect your email address and authentication credentials. If you sign up via a third-party provider (e.g., Google), we receive your email and basic profile info from them.
• User Content: We process the notes, texts, URLs, and documents you submit to the Service ("User Content") to perform AI analysis and generate knowledge graphs. You retain full ownership of your User Content.
• Payment Information: If you purchase a subscription, our payment processor (Paddle) collects your billing details. We do not store your credit card information on our servers.

2.2. Information Automatically Collected

• Usage Data: We use analytics tools (like PostHog) to understand how you interact with our Service (e.g., pages visited, features used, session duration).
• Device Information: Browser type, operating system, and IP address for security and debugging purposes.
• Cookies: We use cookies for authentication (to keep you logged in) and, with your consent, for analytics. See Section 2.3 for details.

2.3. Cookies

We use two categories of cookies:

Strictly Necessary Cookies (no consent required)

| Cookie | Set by | Purpose | Duration | |--------|--------|---------|----------| | sb-*-auth-token | Supabase | Keeps you logged in (authentication session) | Session / up to 7 days |

Analytics Cookies (requires your consent)

| Cookie | Set by | Purpose | Duration | |--------|--------|---------|----------| | ph_* | PostHog | Product analytics — pages visited, features used, session duration | Up to 1 year | | PostHog session recording | PostHog | Records anonymised interaction data to improve the product (all inputs are masked) | Session |

When you first visit WhichNotes, a cookie consent banner is shown. Analytics cookies are only activated if you click Accept. You can withdraw your consent at any time by clearing your browser cookies or contacting us.

Managing cookies: You can block or delete cookies via your browser settings. Blocking strictly necessary cookies will prevent you from logging in.

3. How We Use Your Information

We use your data for the following purposes:

• To Provide the Service: processing your notes, generating AI summaries, and visualizing your knowledge graph.
• To Maintain Your Account: managing your login session and subscription status.
• To Improve the Service: analyzing usage patterns to fix bugs and develop new features.
• To Communicate: sending you service-related updates (e.g., security alerts, changes to terms) and, with your consent, product newsletters.

4. Artificial Intelligence & Data Processing

WhichNotes is an AI-powered tool.

• AI Integration: We utilize large language models (such as those provided by OpenAI) to analyze your content.
• No Training on User Data: We explicitly do not use your User Content to train public AI models. Your data is sent to the AI provider solely for the purpose of generating the response (summary, graph, etc.) requested by you. We prioritize your privacy and intellectual property.
• Disclaimer: Please do not submit highly sensitive personal data (e.g., health data, financial secrets) into the AI analysis tools unless necessary.

5. Sharing Your Information

We do not sell your personal data. We only share data with third-party service providers who help us operate the Service:

• Supabase: For secure database hosting and user authentication.
• Paddle: For payment processing and subscription management (Merchant of Record).
• OpenAI: For AI text processing and analysis (note summarization, topic extraction, connection scoring, image/document OCR).
• ElevenLabs: For voice transcription when you use the Dictation feature. Audio is streamed directly to ElevenLabs for real-time transcription and is not stored by ElevenLabs after transcription is complete. ElevenLabs acts as a data processor under GDPR Article 28. For more information, see ElevenLabs Privacy Policy.
• PostHog: For privacy-friendly product analytics. We do not use any other tracking tools like Google Analytics or Meta Pixel.
• Resend: For sending transactional emails (e.g., password resets, welcome emails).
• Vercel: For application hosting and edge delivery.

We may also disclose information if required by law or to protect our rights and safety.

5a. Sub-Processor List (GDPR Article 28)

The following sub-processors may process personal data on our behalf:

| Sub-Processor | Purpose | Data Processed | Location | |---|---|---|---| | Supabase (DigitalOcean) | Database & authentication | Account data, notes, user settings | EU (Frankfurt) | | OpenAI | AI text/image processing | Note content sent for analysis | USA | | ElevenLabs | Voice transcription | Audio stream during dictation only | USA | | PostHog | Product analytics | Usage events (anonymized) | EU | | Paddle | Payment processing | Billing data only | UK/USA | | Resend | Transactional email | Email address only | USA | | Vercel | Application hosting | Request logs (IP, headers) | USA/EU |

To request the Data Processing Agreement (DPA) for any sub-processor, contact support@whichnotes.io.

6. Data Retention

• Account Data: We retain your account information as long as your account is active.
• User Content: Your notes are stored securely until you delete them or delete your account.
• Deletion: You can request account deletion at any time via the application settings. Upon deletion, your data is removed from our active databases (subject to standard backup retention cycles).

7. Security

We implement industry-standard security measures to protect your data, including encryption in transit (HTTPS) and at rest. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. International Data Transfers

Your information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those from your jurisdiction. By using the Service, you consent to such transfer.

9. Your Privacy Rights

Depending on your location (e.g., GDPR for EU, CCPA for California), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Export your data (Portability).

To exercise these rights, please contact us at support@whichnotes.io.

10. Children's Privacy

Our Service is not intended for individuals under the age of 13 (or 18, depending on local laws). We do not knowingly collect personal information from children. If we become aware that we have collected such data, we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

• Email: support@whichnotes.io