Privacy Policy
This Privacy Policy explains the items of personal information collected, the purpose of use, retention period, provision to third parties, entrustment of processing, and the rights of users and how to exercise them during the use of the Notit service (hereinafter referred to as the “Service”) provided by the Company.
Notit's Privacy Principles
- Data minimisation: We collect personal information only to the extent necessary to provide and operate the Service, and do not request information unrelated to the stated purposes.
- Purpose limitation: We use personal information only for the purposes described in this Policy. If a purpose changes, we follow the procedures required by applicable law.
- Secure storage and encryption: The Company uses Google Cloud as part of its service infrastructure. Customer content that the Company stores in Google Cloud is protected by default encryption at rest. Information entrusted to external service providers listed in Sections 5 and 6 may be processed on their systems, and personal information transmitted between the Service and our servers over the internet is protected using encrypted communications such as HTTPS/TLS.
- Limited access: Access to personal information is granted and managed only for personnel and systems with a job-related need.
- Limited retention: We securely dispose of personal information when its processing purpose is fulfilled or its retention period ends, except where applicable law requires separate retention.
- User control: Users may request access, correction, deletion, suspension of processing, withdrawal of consent, or account deletion at any time.
1. Items of Personal Information Processed
The Company collects only the minimum personal information necessary for each processing purpose, including providing the Service and meeting applicable legal obligations. We do not request information unrelated to the stated purposes and, where applicable, identify whether an item is required or optional.
1) Membership Registration and Account Management
- Required items: Email address, name or nickname, password or social login credentials
- Optional items: Profile image, preferred language, school or affiliation information
2) Information Collected During Service Provision
- Information generated or stored during service use, such as voice data (including recordings of classes made by users), uploaded files, transcriptions, translations, summaries, study materials, and notes
- Device IDs (including Android Advertising ID, app set ID, iOS IDFA and IDFV), device information, browser information, OS information, access logs, IP address, cookies, and service usage history
3) Payment and Paid Service Usage
- Payment status, transaction history, paid product information, payment method identifier
- ※ The Company may process sensitive payment information such as card numbers and account numbers through payment service providers without directly storing it.
4) Customer Support and Enquiry Responses
- Enquiry content, response history, attachments, report and dispute resolution records
5) Marketing and Notifications
- Email address, marketing consent status, campaign response information
6) Rewarded Advertising
- IP address; user interactions such as app launches, taps, and rewarded video views; and app and advertising SDK diagnostic information
- Device and account identifiers (including Android Advertising ID, app set ID, iOS IDFA and IDFV), device, OS and app information, and approximate location
- Advertising privacy consent status and ad reward processing records
- ※ The iOS IDFA is available only when App Tracking Transparency permission is granted. If permission is denied, non-personalised ads may still be served when allowed by the applicable privacy choices.
2. Purpose of Personal Information Processing
- Membership registration, identity verification, account management
- Service provision including voice transcription, translation, summarisation, storage, and study material generation
- Paid service provision, payment processing, refund processing, subscription management
- Responding to customer enquiries, handling complaints, resolving disputes
- Preventing fraudulent use, conducting security checks, ensuring service stability
- Service improvement, statistical analysis, feature enhancement
- Using device IDs for third-party advertising, advertising and service usage analytics, and marketing
- Providing rewarded ads, measuring and analysing ad performance, preventing advertising fraud, and issuing ad rewards
- Providing marketing information such as events, benefits, and updates (only if separate consent is obtained)
How Class Data Is Processed
- The Company does not store audio from classes recorded by users. For both direct class recordings and imports from YouTube or audio URLs, audio is extracted and converted to text. Only the converted text data is stored; the audio is not stored.
- Other users cannot access any of a user's data, including class text data, class metadata, and notes. The Company limits access to systems required to provide the Service and personnel with a job-related need.
- Class text data and class metadata are used only to generate outputs requested by the user, such as notes, Replay, and Exam Insights. They are not used for any other purpose, including AI training or analysis.
- When generating outputs requested by the user, LLMs provided by OpenAI, Google, and others may read and transform class text data and class metadata.
- Class text data, class metadata, notes, and similar data are retained until the user deletes their account.
3. Processing and Retention Period of Personal Information
The Company retains and uses personal information until the purpose of collection and use is achieved. However, if retention for a specific period is required by relevant laws and regulations, it may be stored separately for that period.
| Category | Retention Period |
|---|---|
| Member Information | Until account deletion |
| Class Text Data, Class Metadata, Notes, and Similar Data | Until account deletion |
| MCP OAuth connection records | Authorisation requests: 10 minutes; authorisation codes: 5 minutes; access tokens: 1 hour; rotating refresh tokens: up to 90 days; connection grants: until the user disconnects or deletes the account |
| Marketing Communication Information | Until consent is withdrawn |
| Customer Enquiry and Dispute Resolution Records | 1 year after resolution or as required by applicable laws |
| Contract or subscription withdrawal, payment settlement, goods/service supply records | Retention period as required by relevant laws and regulations |
| Access logs and security records | Period necessary for security and service operation purposes or as required by relevant laws and regulations |
4. Provision of Personal Information to Third Parties
The Company does not, in principle, provide users' personal information to external parties. However, exceptions may apply in the following cases:
- When the user has given prior consent
- When required by special provisions of law or upon lawful request from state agencies such as investigative authorities
- When urgently necessary to protect the life, body, or property of the user or a third party
Claude Connection
When a user chooses to connect Notit to Claude and gives consent, the Company provides the following information to Anthropic PBC through the read-only connection.
| Recipient | Items Provided | Purpose | Retention |
|---|---|---|---|
| Anthropic PBC | Only the Notit courses, lectures, StudyPacks, transcripts, notes, summaries, keywords, exam points, and Quick Reviews covered by the permissions selected by the user and requested through a Notit tool | To answer the user's requests in Claude using the Notit data the user chose to connect | According to the Anthropic terms, product settings, and retention policy applicable to the user's Claude account |
The user may refuse this consent and continue to use Notit without the Claude connection. The user may withdraw consent at any time by disconnecting the app under Me → Integrations → MCP settings → Connected apps, or by removing Notit in Claude. No new Notit data is provided through that connection after withdrawal.
ChatGPT Connection
When a user chooses to connect Notit to ChatGPT and gives consent, the Company provides the following information through the read-only connection.
| Recipient | Items Provided | Purpose | Retention |
|---|---|---|---|
| OpenAI OpCo, LLC or OpenAI Ireland Limited, as applicable | Only the Notit courses, lectures, StudyPacks, transcripts, notes, summaries, keywords, exam points, and Quick Reviews covered by the permissions selected by the user and requested through a Notit tool | To answer the user's requests in ChatGPT using the Notit data the user chose to connect | According to the OpenAI terms, data controls, and retention policies applicable to the user's ChatGPT account |
The user may refuse this consent and continue to use Notit without the ChatGPT connection. The user may withdraw consent at any time from Notit's connected-app settings or by removing Notit in ChatGPT. No new Notit data is provided through that connection after withdrawal.
5. Outsourcing of Personal Information Processing
The Company may outsource certain tasks to external specialised companies to ensure smooth service provision. When entering into outsourcing agreements, the Company stipulates necessary requirements and supervises the contractor to ensure safe processing of personal information in accordance with relevant personal information protection laws and regulations.
| Contractor | Outsourced Tasks |
|---|---|
| Google Cloud | Server operation and data storage |
| Mailtrap | Email delivery |
| Google Play | Payment processing and refund processing |
| Apple App Store | Payment processing and refund processing |
| ElevenLabs | Real-time speech transcription (STT) |
| Google and OpenAI | AI processing including converting class recording data to text, translation, summarisation, and generating outputs requested by the user |
| Google AdMob and Google User Messaging Platform | Rewarded ad delivery, consent management, ad measurement and analytics, and fraud prevention |
6. Cross-border Transfer of Personal Information
The Company may store personal information overseas or entrust its processing to overseas service providers during service operations. In such cases, the Company will notify users of the recipient, destination country, transferred items, purpose of transfer, and retention and usage period in accordance with relevant laws and regulations.
| Recipient | Destination Country | Items Transferred | Purpose of Transfer | Retention and Use Period |
|---|---|---|---|---|
| The aforementioned cloud and AI service providers | United States | Email, class recording data and its transcribed content, other service usage data, etc. | Service operation, data storage, and AI processing to generate outputs requested by the user | Until the outsourcing contract ends |
| Google LLC (AdMob and User Messaging Platform) | United States and other countries where Google provides its services | IP address, ad and app interactions, diagnostics, device and advertising identifiers, consent status | Ad delivery, consent management, performance analytics, and fraud prevention | For the period specified by Google's privacy policy and applicable law |
| Anthropic PBC | United States | Notit study data within the read permissions approved by the user | Encrypted transfer when the user asks Claude to use a Notit tool, so Claude can answer the user's request | According to the Anthropic terms, product settings, and retention policy applicable to the user's Claude account |
| OpenAI OpCo, LLC or OpenAI Ireland Limited, as applicable | United States, Ireland, and other countries where OpenAI provides its services | Notit study data within the read permissions approved by the user | Encrypted transfer when the user asks ChatGPT to use a Notit tool, so ChatGPT can answer the user's request | According to the OpenAI terms, data controls, and retention policies applicable to the user's ChatGPT account |
7. Procedures and Methods for Disposing of Personal Information
The company promptly disposes of personal information once its retention period expires or its processing purpose is fulfilled. However, if retention is required by relevant laws and regulations, the information will be separately stored.
- Electronic files: Securely deleted using methods that prevent recovery or regeneration
- Paper documents: Shredded or incinerated
8. User Rights and How to Exercise Them
Users may exercise the following rights with the company at any time.
- Request to access personal information
- Request to correct or delete personal information
- Request to suspend processing of personal information
- Request to withdraw consent
- Request to terminate membership
These rights may be requested through the contact information below, and the Company will take necessary measures without delay in accordance with relevant laws and regulations.
9. Measures to Ensure the Security of Personal Information
The Company takes the following technical and organisational measures, taking into account the service environment and level of risk, to protect the confidentiality, integrity, and availability of personal information.
- Default encryption at rest for customer content stored in Google Cloud
- Encrypted communications such as HTTPS/TLS for personal information transmitted over the internet
- Restriction and management of access to personnel and systems with a job-related need
- Protection of passwords, authentication information, and secrets
- Protection and review of access logs for service security
- Application of security updates and remediation of identified vulnerabilities
If a breach affecting personal information is confirmed, the Company will take steps to mitigate harm and follow required procedures, including notifying users and relevant authorities as required by applicable law.
Google states that the Google Cloud Services information security management system has undergone an independent third-party audit and received ISO/IEC 27001 certification. The certification is limited to the services within Google's published scope and does not certify the Company or Notit.
10. Use of Cookies and Similar Technologies
The Company may use cookies or similar technologies to provide services, offer a customised user experience, and analyse access patterns. Users may refuse cookie storage through their browser settings. Mobile app users can manage advertising identifier and personalised advertising choices through iOS App Tracking Transparency, Android advertising privacy controls, and the in-app privacy settings. However, refusing cookie storage may restrict access to certain services.
11. Children's Personal Information
The Company does not intentionally collect personal information from children under the age of 14. If the Company confirms that a child's personal information has been collected without the consent of a legal guardian, it will endeavour to delete such information without delay.
12. Chief Privacy Officer
| Name | Junbong Lee |
|---|---|
| Position | CIO |
| help@metaplad.com |
13. Remedies for Rights Violations
Users may contact the following agencies for reporting or consulting regarding personal information violations.
- Personal Information Infringement Reporting Center
- Personal Information Dispute Mediation Committee
- Supreme Prosecutors' Office
- National Police Agency
14. Changes to the Processing Policy
This Personal Information Processing Policy is effective as of 3 September 2026. The company will notify users of any additions, deletions, or modifications to the content via service announcements or separate notices.