Privacy Policy

We collect information you provide, information generated when you use the Service, and limited information from services you choose to connect.

• Account and waitlist information, including your name, email address, password credential in protected form, profile image if provided, account identifiers, timezone, approximate location label derived from your device timezone, and waitlist source.
• Your content, including voice recordings, raw and cleaned transcripts, notes, tags, prompts, AI settings, people-directory entries (such as names, aliases, email addresses, phone numbers, and organizations), and actions you ask the Service to draft or send.
• Audio data. Every recording is transmitted to Deepgram for transcription. We do not retain the original recording after that request unless you enable “Retain original audio” or separately choose to upload it.
• Connected-service information. If you connect an email, calendar, task, messaging, or notes account, we receive connection identifiers, account or workspace labels, authorization status, and the data needed to perform the action you request. Our integration provider manages the connected account credentials.
• Subscription and transaction information, including your plan, subscription status, renewal date, payment-provider customer and subscription identifiers, and billing events. Payment card and bank details are collected and processed by our payment provider, not stored by Kipnote.
• Device, usage, and diagnostic information, such as IP address, browser or app type, user agent, operating system, session information, timestamps, request and error logs, and information about feature and integration use.
• Communications and support information, including messages, feedback, and other information you send to us.

We use personal information to:

• Provide, operate, maintain, and secure the Service; authenticate users; sync settings; and prevent duplicate or unauthorized requests
• Record, transcribe, clean, organize, search, and retrieve your notes and resolve references to people in your directory
• Generate AI-assisted summaries, classifications, dates, and proposed actions, and carry out actions you review or authorize in connected services
• Process subscriptions, confirm entitlements, handle cancellations, and maintain financial and transaction records
• Respond to support requests, administer the waitlist, send service-related notices, and send product updates where permitted by law
• Monitor reliability, troubleshoot errors, prevent fraud and abuse, enforce our Terms, and protect users, the public, and the Service
• Analyze and improve features and user experience using aggregate, de-identified, or otherwise lawfully processed information
• Comply with legal obligations and establish, exercise, or defend legal claims

Cloud transcription sends the audio you submit to Deepgram to produce a transcript. We do not place that audio in Kipnote’s persistent audio storage unless you have enabled original-audio retention. If you enable retention, the original recording is stored with your account until you delete it through an available control or ask us to delete it. Turning retention off stops future uploads but does not by itself delete recordings already retained.

When AI features are enabled, relevant transcripts, prompts, directory context, and requested action details are sent to the selected AI provider through Cloudflare AI Gateway, which logs each request and response, including that content, for monitoring and troubleshooting. These logs are kept for a limited period and deleted as newer logs replace them. If you pause AI processing, new memos are saved without AI analysis or automated action dispatch.

If you use your own API key from Anthropic, OpenAI, Google, xAI or OpenRouter, we validate it with that provider and store it encrypted on our servers for your account so it works across your devices. Devices see which providers have a saved key, but cannot retrieve it. Our server decrypts it when needed for requests to that provider. You can replace or remove it in account settings. Your use of a third-party key and model is also governed by that provider’s terms and privacy policy.

We do not use your private voice recordings, transcripts, notes, or connected-service content to train our own general-purpose AI models. Third-party AI and model providers process data under their applicable terms and privacy policies, which may vary by the model or account configuration you select.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising and do not serve targeted advertising in the Service. We may disclose information in the following circumstances:

• Service providers. Cloudflare provides hosting, database and object storage, security, diagnostics, and the AI Gateway that routes and logs AI requests; Deepgram transcribes submitted audio; AI providers (Anthropic, OpenAI, Google, xAI or OpenRouter, as configured or selected) process AI requests; Composio facilitates connections to third-party applications; and Creem processes checkout, subscription, and payment information. These providers process information on our behalf or as otherwise described in their own notices.
• Connected applications. At your direction, we send content and action details to services you connect, such as email, calendar, project-management, messaging, and notes providers. Content created in those services remains subject to their policies even after you disconnect them from Kipnote.
• Legal and safety reasons. We may disclose information when we reasonably believe it is necessary to comply with law or legal process; protect rights, safety, and property; investigate fraud or abuse; or enforce our agreements.
• Business transfers. Information may be disclosed as part of due diligence or transferred in a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate confidentiality protections.
• With your direction or consent. We may disclose information for another purpose that we explain when you direct us or provide consent.

We use cookies or equivalent authentication tokens that are necessary to keep you signed in, protect sessions, and operate the Service. Our web and native apps also use local device storage for settings, draft recovery, connection identifiers, and automation preferences. BYOK keys are stored encrypted on the server, not in persistent device storage. Native apps may store authentication tokens in protected operating-system storage.

We do not currently use third-party advertising cookies. You can clear local data through your browser or operating-system controls, but doing so may sign you out, remove unsaved drafts or local preferences, and require you to reconnect features.

Where the law requires a legal basis, we process information as needed to perform our contract with you and provide the Service; for our legitimate interests in securing, supporting, and improving the Service and communicating with you; with your consent, where requested; and to comply with legal obligations. You may withdraw consent at any time, but withdrawal does not affect processing already performed. If we rely on legitimate interests, we consider the impact on your rights and do not use that basis where your interests override ours.

We keep account information, notes, transcripts, people-directory entries, settings, connected-action records, and retained audio for as long as your account is active or as needed to provide the Service. Waitlist information is kept while it remains relevant to access and launch communications. Session, authorization, and verification records expire or are removed when no longer needed for authentication and security.

After an account or content deletion request, we delete or de-identify information within a reasonable period unless retention is required for legal, security, fraud-prevention, dispute-resolution, or financial-recordkeeping purposes. Residual copies may remain temporarily in backups and logs until they are overwritten under our normal retention cycle. Information sent to a connected service must be deleted from that service separately.

We use administrative, technical, and organizational safeguards designed to protect personal information, including encrypted transport, access controls, tenant-scoped storage, protected password handling, and hashed native-session tokens. No system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your credentials and should contact us promptly if you believe your account has been compromised.

Kipnote and our providers may process information in countries other than the country where you live. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers, such as adequacy decisions, standard contractual clauses, or another lawful transfer mechanism.

Depending on the feature and your device, you can:

• Edit or delete individual notes and people-directory entries
• Pause AI processing and automated action dispatch
• Turn original-audio retention off and delete retained audio where controls are provided
• Disconnect third-party integrations, understanding that this does not delete content already created in those services
• Cancel a paid subscription through the available billing controls; cancellation does not by itself delete your account or content
• Decline marketing communications using the unsubscribe method in the message, while continuing to receive necessary service and transaction notices
• Request access, correction, export, or deletion by contacting us

Depending on where you live, you may have the right to know or access the personal information we process; correct inaccurate information; delete information; receive a portable copy; restrict or object to certain processing; withdraw consent; and appeal a decision we make about your request. You may also have the right to complain to your local data-protection authority.

To exercise a right, contact us using the details below. We will not discriminate against you for exercising privacy rights. We may ask for information needed to verify your identity and authority. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity verification. If we deny an appealable request, you may reply to our decision to appeal.

In the preceding 12 months, we may have collected the categories described above: identifiers; customer-record and account information; commercial and subscription information; internet or electronic activity; approximate geolocation inferred from timezone or IP address; audio information; professional information you include in content or directory entries; and inferences produced to organize notes and propose actions. We collect these categories from you, your devices, connected services, and our service providers for the business and commercial purposes described in Sections 2 and 3.

We may disclose each applicable category to infrastructure, security, AI, integration, payment, professional-adviser, and connected-service recipients described in Section 4. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not knowingly use or disclose sensitive personal information to infer characteristics or for purposes other than providing and securing the Service. Residents of states that provide applicable rights may submit access, correction, deletion, portability, opt-out, limitation, and appeal requests as described in Section 11.

The Service is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided personal information, contact us so we can investigate and delete it as appropriate.

The Service may link to or interact with third-party websites, applications, AI models, and connected services. Their handling of information is governed by their own privacy policies, and we are not responsible for their independent practices.

We may update this Privacy Policy as the Service or law changes. We will post the revised policy with a new “Last updated” date and provide additional notice when required by law or when a change is material. Your continued use of the Service after the effective date is subject to the updated policy.