Privacy policy
Last updated: September 30, 2026
This policy describes what personal data Notibo collects, why we process it, and what rights you have. Notibo is operated by Ba-Ali Tech v/Farhad Ba-Ali (Danish CVR 43795481).
1. Data controller
Ba-Ali Tech v/Farhad Ba-Ali CVR: 43795481 Fyrreparken 74, 3. tv, 5240 Odense NØ, Denmark Contact: support@notibo.net
2. What data we collect
Account data: email, password (hashed), your name if you provide one, and account creation date. If you sign in with Google, we receive your name, email address and Google account identifier from Google Identity Services. When you create an account, we also store which page on notibo.net you came from, for example an article, or which other site sent you. That shows us which pages new users come from. Content you create or upload: audio recordings, live transcription sessions (audio streamed while you record), uploaded documents (PDF, PowerPoint and Word), transcripts, AI-generated notes (summary, key points, action items, flashcards), folder names, and any titles or edits you make. Usage data: your language preference, minutes of recording and live transcription used per month, and documents uploaded per month (shown against your plan's limits). Feedback: if you rate Notibo, we store your rating and comment. If you opt in to a public testimonial, the display name you choose is published on our homepage together with your comment. Email us to have it removed. If you cancel a subscription, we store the reason and the comment you choose to give. Analytics: Vercel Web Analytics records aggregated page views with the page URL, referrer, country or region, device type, operating system and browser version. It sets no cookies and uses no cross-site identifiers. Vercel Speed Insights measures how fast pages load and respond, such as load time and whether the layout shifts, together with the page address, device type, browser, connection speed and country. It also sets no cookies and uses no cross-site identifiers. Security: when someone signs in with a password, we store a hashed key of the email address and the IP address together with the number of wrong attempts, so sign-in can be locked after too many. The entry is deleted two days after the last attempt. When a Pro trial starts, we store a hashed key of the network (the IP address), your email address in a form without dots and +tags, and a cookie in the browser with the account's id. We use these only to keep the trial to one per person and to spot misuse. The network key is deleted after 90 days. On the sign-in, sign-up and password reset pages, Cloudflare Turnstile uses your IP address and information about your browser to check that you are a person. Payment data: handled by Stripe, our payment provider, and by Lemon Squeezy for add-on minutes and for subscriptions bought before 23 September 2026. We only receive your subscription status and your purchases of add-on minutes, not card details.
3. Why we process your data
We process your personal data to: deliver the Notibo service (transcription, AI notes, flashcards), manage your account and subscription, send confirmation and support emails, send up to five getting-started emails in the first 30 days after sign-up (each one has an unsubscribe link), understand aggregate usage of the site and which pages new users come from, and comply with legal obligations (bookkeeping, GDPR requests). Our legal basis is primarily the performance of the contract with you (GDPR Art. 6(1)(b)) and legitimate interests in operating and improving a secure service.
4. Third parties (processors)
To deliver the service we share selected data with these providers, all bound by confidentiality and data processing terms: • Supabase (EU region): database, authentication and file storage. • Groq (US): speech-to-text for regular recordings, up to about 70 minutes of audio. • Google Gemini API (US): AI notes, flashcards and live translation. It is also the automatic backup for speech-to-text, and in that case the whole audio file is sent to Google. • Deepgram (US): speech-to-text for recordings longer than about 70 minutes, and for all live sessions. We send a no-training flag with every request to Deepgram. • A Notibo-operated relay service that forwards live audio to Deepgram during live transcription. • Vercel (US): hosting notibo.net, cookieless, aggregated page analytics (Vercel Web Analytics) and page speed measurement (Vercel Speed Insights). • Stripe (Ireland and US): payment for subscriptions. • Lemon Squeezy (US): payment for add-on minutes and for subscriptions bought before 23 September 2026, as Merchant of Record. • Simply.com (Denmark): transactional email (sign-up confirmation, password reset) and our support@notibo.net mailbox. • Resend (US): getting-started emails. • Google Identity Services (US): optional "Sign in with Google". • Cloudflare Turnstile (US): checks that sign-in, sign-up and password reset come from a person, not a bot. Processors outside the EEA operate under the European Commission's Standard Contractual Clauses.
5. Retention
Account data and content are retained as long as your account is active. If you delete your account or request deletion, we remove all your recordings, documents, transcripts, notes, and flashcards within 30 days. Audio files are deleted from storage as soon as your transcript and notes are generated. Uploaded documents are deleted once processing finishes; if a step fails, the file is kept only so you can retry, and you can delete it yourself at any time under Settings → Privacy & data. We only keep the generated text and your flashcards. You can delete all your data (recordings and documents) at any time under Settings → Privacy & data → Delete all data, which removes both the database rows and any remaining files. Payment records are retained by Stripe, and by Lemon Squeezy for add-on minutes and for subscriptions bought before 23 September 2026, in accordance with Danish bookkeeping law (typically 5 years).
6. Your rights
You have the right to: access the data we hold about you, receive your data in a usable format (portability), have inaccurate data corrected, have your data deleted ("right to be forgotten"), restrict or object to processing, and lodge a complaint with the Danish Data Protection Agency (datatilsynet.dk). We've built export functionality into Notibo: go to Settings → Privacy & data → Export my data, and you'll get all your recordings and documents, including transcripts, notes, and flashcards, as readable Markdown files in a ZIP. Deleting all data or your account can also be initiated from the same menu.
7. Cookies
Notibo uses strictly necessary cookies only: your Supabase session and your language preference. If you sign in with Google in Safari, we also set two cookies that remember the sign-in attempt for at most 10 minutes, including the page you started from. They are deleted as soon as Google sends you back. When a Pro trial starts, we set a cookie with the account's id, so the same browser cannot start a trial on another account. It is kept for up to 13 months. We use Vercel Web Analytics for aggregate page statistics; it sets no cookies and does not track you across sites. No advertising pixels.
8. Changes
If we materially change this policy, we'll update the date at the top and notify you by email. Minor editorial corrections may happen without notice.
9. Contact
Questions about this policy or your rights? Email support@notibo.net. Replies within 1 business day.