Privacy Policy

We process your data for the following purposes:

• Providing the service: Storing and displaying your notes, tasks, and study materials (legal basis: performance of a contract).
• Authentication: Verifying your identity and keeping your session secure (legal basis: performance of a contract).
• AI features: Processing your notes and documents to generate summaries, flashcards, quizzes, and chat responses (legal basis: consent, you opt in by using these features).
• Improvement: Analyzing usage patterns to improve features and fix bugs (legal basis: legitimate interest).
• Communication: Sending you service-related emails such as verification codes and password resets (legal basis: performance of a contract).

We use cookies and similar technologies for the following purposes:

• Essential cookies: Required for authentication and core functionality. These cannot be disabled.
• Preference cookies: Remember your theme, language, and UI settings. These are stored locally on your device.
• Analytics cookies: Help us understand how the app is used so we can improve it. Only enabled if you accept "all cookies".

You can manage your cookie preferences at any time by clicking "Reset cookie preferences" on the How to Use page.

We do not sell your personal data. We share data only with the following service providers, under strict data processing agreements:

• Cloud hosting & database: Your data is stored on secure, encrypted servers.
• AI providers: When you use AI features (summaries, flashcard generation, quizzes, chat), your note content is sent to AI models for processing. We use reputable providers and do not allow them to train on your data.
• Email service: For sending verification codes, password resets, and contact form responses.
• File storage: Uploaded files are stored in secure cloud storage with access controls.

When you share a note with another user, only that specific note's content is visible to them, not your other data.

Service providers we currently use:

• Base44 (Wix.com Ltd.): application hosting, database, file storage, email sending and usage analytics. The database is hosted on MongoDB Atlas in the United States (AWS, us-west-2 region).
• OpenAI, Google and Anthropic: AI processing, only when you use an AI feature.
• Stripe: payment processing for paid plans. We never see or store your full card number.
• Sentry (Functional Software, Inc.): error monitoring, hosted in the European Union, to detect and fix bugs.
• country.is, ipwho.is and GeoJS: IP address geolocation, used only to show the prices for your country; only your IP address is sent to them.

International transfers: Some of these providers process data outside the European Union, in particular in the United States (database, AI providers, payments). These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or otherwise on the European Commission's Standard Contractual Clauses. Israel, where Wix.com Ltd. is established, benefits from an adequacy decision of the European Commission. For more information about these safeguards: Contact.

We implement industry-standard security measures to protect your data, including encrypted data transmission (HTTPS/SSL), secure password hashing, and row-level access controls that ensure each user can only access their own data. Access to production data is restricted to authorized administrators.

We retain your data for as long as your account is active. If you delete a note, it moves to Trash and is permanently removed after 30 days. You can delete your account at any time from Settings, this permanently erases all your data, including notes, tasks, flashcards, uploaded files, and study history.

You have the following rights regarding your personal data:

• Right of access: Request a copy of your personal data.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data (also available via account deletion in Settings).
• Right to restriction: Limit how we process your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent for AI processing at any time (by not using AI features).

To exercise any of these rights, Contact. We will respond within 30 days.

Noto is designed for students, including those in secondary and higher education. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new "last updated" date. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or your personal data, Contact. We're happy to help.