Privacy Policy

1. Who we are

Nota is an iPhone audio-notetaking application operated by ICHD SIA ("we", "us" or "our"), based in Latvia. ICHD SIA is the controller of the personal data described in this policy.

Postal address: Kantori - 2, Ezernieki, Ezernieku pagasts, Kraslavas novads, LV-5692, Latvia
Privacy and support: hi@leiguts.com

This policy covers the Nota app, its cloud processing service and this website. If someone records you using Nota, this policy explains our handling of content sent to us. The person making the recording is responsible for their own lawful collection and use of it.

2. Data we handle

• Your local notebook. Recordings, imported audio, titles, folders, favorites, tasks, transcripts, summaries, speaker labels and chat history are stored on your iPhone. Preferences are also saved on the device.
• Content you choose to process. When you confirm cloud processing, we receive that note’s audio and processing choices, such as language and summary format. We produce and store its transcript, speaker labels and summary. A question sends the question, the current note’s transcript and summary, and relevant recent chat turns.
• Service and security data. We handle a random installation identifier, authentication credentials, internal device and request identifiers, processing status, usage balances, subscription status and security records. Network requests expose an IP address and technical connection information to our infrastructure. Our application rate limits use keyed, pseudonymous IP-derived values.
• Purchases. When subscriptions are available, Apple and our subscription provider process purchase and renewal information. We receive information needed to verify access, such as a product, subscription period, transaction reference and subscription state. We do not receive your full payment card number.
• Support messages. If you email us, we receive your email address, the message and any details or attachments you choose to include. You do not need to send a recording or transcript to ask for help.

Nota does not require a personal account to create a local notebook. Installation identifiers are pseudonymous; this does not make cloud requests or their contents anonymous.

3. Why we use data

Where the EU General Data Protection Regulation applies, we use the following legal bases:

• Providing the requested service — contract, Article 6(1)(b). Recording and managing your notes, performing the AI processing you request, answering questions, administering subscriptions and responding to service-related requests.
• Operating and protecting the service — legitimate interests, Article 6(1)(f). Preventing abuse, securing sessions, enforcing fair usage, avoiding duplicate processing or charges, resolving failures and handling general business correspondence. We balance these interests against your rights.
• Meeting legal obligations — Article 6(1)(c). Responding to valid legal demands, applicable recordkeeping duties and requests concerning data-protection rights.
• Optional processing — consent, Article 6(1)(a), where required. Optional tracking or other processing that requires consent is subject to the applicable permission or consent flow. You can withdraw consent without affecting the lawfulness of processing that already occurred.

Microphone, speech-recognition and notification permissions are controlled through iOS. Permission to use a microphone is separate from your confirmation to upload a recording. We do not use AI outputs to make decisions about you that produce legal or similarly significant effects.

4. Cloud processing and AI

You choose which recordings to send for cloud processing. Audio and note content are processed by Nota’s backend and OpenAI’s API to generate transcripts, summaries, speaker labels and answers. Without cloud processing, supported on-device transcription and local editing can be used instead.

We do not send the contents of your other notes as context for a question. We do not use recordings, transcripts or chats to train our own AI models. OpenAI explains its API content handling, training rules and endpoint-specific retention in its API data controls documentation. Provider security or abuse-prevention retention can differ from the lifetime of a note in Nota.

Only record or upload content you are entitled to use, and obtain any consent required from other participants. Avoid submitting sensitive information that is unnecessary for the task. Speaker labels are generated labels within a recording; Nota does not create a cross-recording voice identity profile.

5. Service providers and disclosures

We use providers to deliver specific parts of the service:

• OpenAI: audio transcription and AI processing of the content you submit.
• Apple: app distribution, in-app payments, relevant device services and permission controls.
• Adapty, in builds with subscriptions enabled: subscription products, paywall presentation, purchase verification and entitlement state. This can include an internal customer identifier, transaction information and paywall interaction data.
• AppsFlyer, in builds with attribution enabled: app-installation and session attribution information. The current integration uses its Strict SDK with restricted collection. We do not send note content, audio or chat text to Adapty or AppsFlyer.
• Hosting, network-security and email providers: infrastructure needed to deliver the app backend, website and support email. This website is delivered through Cloudflare.

Some providers act on our instructions; Apple and other providers may also process information for their own purposes under their privacy notices. We may disclose information when necessary to comply with law, protect rights or investigate abuse. If our business is transferred, relevant data may be transferred with appropriate protections and any notice required by law.

We do not sell your recordings, transcripts or chat content, and do not use that content for targeted advertising.

6. Storage, retention and deletion

• Local content: stays in your notebook until you delete it. Moving a note to Recently Deleted retains it for up to 30 days so that it can be restored. Expiry cleanup is performed when the app runs.
• Uploaded audio: the server removes its working audio copy after successful processing. Audio associated with an unfinished or failed job can remain available for recovery until the job is permanently deleted or a deletion request is fulfilled.
• Cloud results and answer records: stored to return results, recover interrupted work and avoid charging again for a completed request. They remain associated with the cloud note until its permanent deletion or a verified deletion request.
• Permanent deletion: removes the note from the app and queues deletion of its associated server content. If the device is offline, the app retries when it can connect. Merely moving a note to Recently Deleted does not immediately erase its server copy. Uninstalling the app does not send a server-deletion request.
• Operational records: limited identifiers, usage records, subscription references and security receipts may remain after content deletion for as long as necessary to prevent replay, enforce allowances, resolve disputes or satisfy legal duties. These records are separate from note text and audio.
• Support correspondence: retained while needed to resolve the enquiry and any related follow-up, dispute or legal obligation. You can contact us to request deletion.

Provider-held records are subject to the relevant provider’s retention rules. We assess retention by the purpose of the record, whether the issue is resolved, security needs and applicable legal obligations. Contact us if you need help locating or deleting cloud data, especially if you no longer have the app.

7. International processing

ICHD SIA is based in Latvia. Our infrastructure and service providers may process information outside your country, including outside the European Economic Area and in the United States. Data-protection rules in those locations can differ.

Where applicable data-protection law requires safeguards for a transfer, the transfer must be covered by a lawful mechanism, such as an adequacy decision or standard contractual clauses, and any required additional measures. Contact us for information about the locations and safeguards relevant to your data.

8. Security

We use HTTPS for connections to the service, restricted server access, device-session authentication, request limits and controls against duplicate processing. The app stores its installation credentials in iOS Keychain. No internet service or storage system can be guaranteed completely secure. Keep your device protected and do not send passwords or payment details in a support message.

9. Your choices and rights

Depending on your location and the applicable legal basis, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent for processing based on consent. Some rights are subject to legal conditions or exceptions.

Write to hi@leiguts.com with “Privacy request” in the subject. An app request reference can help us locate the relevant record; do not send your installation secret or authentication token. We may ask for information reasonably needed to verify your request. If you appear in someone else’s recording, explain that context so we can assess your request.

We respond within the period required by applicable law. Under the GDPR, this is normally one month; a permitted extension for a complex request will be explained within that period. You can complain to your local supervisory authority or Latvia’s Data State Inspectorate.

You can change device permissions in iOS Settings. You can manage or cancel an Apple subscription in your Apple Account settings. Removing permissions, deleting the app or deleting data does not by itself cancel a subscription.

10. This website and email form

This website does not add advertising pixels, analytics scripts or third-party web fonts. Cloudflare and our hosting infrastructure process technical request data to deliver and protect it; security features may use essential cookies or similar technologies.

The support form prepares an email in your own email application. Its fields are not submitted to our website server or saved in browser storage by our code. We receive the message only if you send it. Your email provider also handles that communication under its own policies. Using “Copy message” places the text on your device’s clipboard.

11. Children

Nota is intended for adults and is not directed to children. We do not knowingly collect children’s personal data through a child-directed service. If you believe a child has provided personal data to us, contact us so we can review and address it.

12. Changes and contact

We may update this policy as the service changes. The date at the top identifies the current version. We will provide additional notice when required for a material change.

Questions about privacy can be sent to hi@leiguts.com or to ICHD SIA at Kantori - 2, Ezernieki, Ezernieku pagasts, Kraslavas novads, LV-5692, Latvia.