PRIVACY POLICY

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you use VisualNote AI on the website or in the mobile app, including:

• Account Information: When you create an account, we collect your email address, user ID, and account settings. You sign in with a one-time code that we email to you. This information is stored in Supabase for user authentication and account management. The same account works on the website and in the app, with one plan for both.
• App Guest Mode (iOS only): On iOS you can use the app without an account. The app then identifies your phone by a device identifier, based on Apple's identifier for vendor and stored in the iOS Keychain, so it stays the same if you reinstall the app. We use it to count your free usage. A guest's notes stay on the phone. When you sign in, the notes you made as a guest are uploaded to your account and the usage counted under the device identifier is merged into your account. Once a phone has signed in, it shows only the sign-in screen after you log out. On Android the app requires an account.
• Input Text: The text you type or paste for notes, images, and other study aids is stored in our database along with associated metadata (style, aspect ratio, quality settings, timestamp).
• Uploaded Documents: Documents you upload (PDFs and other supported formats) are stored securely in our cloud storage. Documents are processed to extract text for image generation.
• Study Materials in the App: In the app you can also give us photos from your camera or library, voice recordings, audio files, and links. They are sent to our AI providers only to produce what you asked for (see Section 4 for which provider handles what).
• Notes Synced to Your Account: When you are signed in, your notes (source text, written notes, and photos), visuals with their versions, flashcard decks, mind maps, and podcast episodes are stored in your account (Supabase database and storage). They appear in the app and on the website. Deleting a note deletes it everywhere. Quizzes and the note chat in the app are not uploaded: they stay on your device.
• Shared Links: When you share a note, a folder, or a lesson, we create a link to it. Anyone who has the link can view what you shared, except the parts you chose to hide from pupils, and a signed-in visitor can save a read-only copy into their own account. We store the link, when it was created, and whether it is switched on, and you can switch it off at any time.
• Lessons for the Classroom (teachers): When you prepare a lesson to show on a classroom board, we store the lesson and its slides, the pictures you add or ask us to draw, the requests you make to our AI assistant for that lesson and its replies (the most recent 40), the class name you give a notebook (for example "4B"), and which parts of a note you hide from pupils. This data stays in your account and is deleted with it.
• Quiz Links and Pupils' Answers: When you share a quiz as a link, the people who take it do not need an account. They enter a name of their choosing and their answers, and we store that name, their answers, their score, and when they started and finished, so you can see the results. We ask them for nothing else. If you share a quiz link with pupils, use a first name or a nickname rather than a full name where you can.
• Generated Images: All images you generate are stored in our cloud storage with associated metadata including the prompt used, visual style, aspect ratio, quality settings, the AI model that drew the image, and timestamp.
• Subscription Data: If you subscribe to our premium services, we collect and store subscription information including your subscription status, plan type, billing information, and subscription history. Payments are processed by Polar (or Stripe for older subscriptions). We receive your subscription status, plan, order and refund records, and the email used at checkout, and store them in our Supabase database. For a test unlock bought before October 20, 2026, we also store which test it was bought for, so we know which test you may download, and on the free plan we store which test is your free one. We never receive your full card number.
• App Purchases: In the app, you buy through the Apple App Store or Google Play, and RevenueCat manages the purchase for us. We receive the purchase records, the app user ID linked to your device or account, and the store transaction ID. A store subscription belongs to your Apple or Google account. If you use Restore in the app, the subscription moves to the account signed in on that phone, together with the usage already spent in the current billing period.
• Feedback and Support: We collect information when you contact us for support, submit feedback, or communicate with us through our Services. This includes your email address, user ID, and the content of your messages. In the app, this includes the reason you give if you tell us why you are cancelling.
• Onboarding Preferences: When you complete our onboarding flow, we store the answers you voluntarily provide so we can personalize your experience. This includes: the language you choose, what you will use the product for (studying, teaching, work, making content, or for yourself), and, depending on that answer, your type of school or the level you teach, what you find hardest when studying, whether you have a test coming up, whether and when you want study reminders, what you want to make first or get out of the product, a starting style, whether you are 16 or older (on some paths), and how you heard about us with a referral name if you choose to give one (we never store a referral name typed by someone under 16). Answers you gave to the earlier version of our onboarding (such as your primary goal, input habits, or expected monthly volume) stay stored unless you ask us to delete them. This information is used to personalize your dashboard, default styles, and template recommendations, and for our own internal analysis to improve the product. It is not shared with third parties, not sold, and not used for advertising or profiling that produces legal or similarly significant effects. You can skip the question about how you heard about us, and you can ask us to delete this data at any time (see Section 13). In the app, the answers you give during onboarding are recorded as product analytics events with Vevee, linked to the device identifier (see Section 5.2).
• Device Permissions: The app asks for access to your camera (to take a photo of your notes), your photo library (to pick a photo and to save sketchnotes), and your microphone (to record voice notes for transcription). It asks only when you use the feature. You can turn each permission off at any time in your phone's settings.
• Crash Data: The app may send crash reports through Expo to help us fix problems. Crash reports may include your device model, operating system version, app version, and error details. We do not use crash data for advertising or profiling.

We use Supabase for data storage, user authentication, and database management. Polar sells and bills website subscriptions and credit packs (and sold test unlocks until October 20, 2026) as our merchant of record (older subscriptions may still be billed through Stripe). In the app, the Apple App Store or Google Play sells the subscription and RevenueCat manages it. We use Anthropic (Claude), OpenAI, and Google Gemini AI, through our server endpoints, to generate notes, sketchnote images, and study aids from your text, documents, photos, recordings, and links. See Section 4 for which provider handles which request and what it receives.

Sensitive Information. We do not process sensitive information. Please do not include health data or other sensitive personal information in your study materials. If you do, it is processed only to produce the output you asked for.

Children. The Services are intended for users aged 13 and over (16 where local law requires it). If you tell the app during onboarding that you are under 16, we stop logging your prompts and the AI's replies with our metering provider and do not use your data for product analytics or AI personalization. Usage counts are still kept to enforce plan limits.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. Specifically, we process your text, documents, photos, recordings, and links to generate notes, sketchnote images, and study aids using Anthropic (Claude), OpenAI, or Google Gemini AI through our server endpoints. We also process subscription information through Polar (or Stripe for older subscriptions) on the website, and through RevenueCat for App Store and Google Play purchases in the app, to manage your premium features and access. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To provide and maintain our Services: We process your account information, input text, uploaded documents, study materials, and generated content to provide you with access to our Services, to store your content, and, when you are signed in, to keep it in step between the app and the website.
• To manage subscriptions: We process your subscription data through Polar (or Stripe for older subscriptions) and, for purchases in the app, through RevenueCat, to manage billing, renewals, cancellations, restores, and access to premium features.
• To meter usage and enforce plan limits: We count your use of AI features under your account identifier, or under the device identifier if you use the iOS app as a guest, so we can apply the free and paid limits of your plan (see Section 5.1).
• To communicate with you: We process your contact information and feedback to respond to your inquiries, provide customer support, and send you service-related communications. This includes sending you emails to ask about your experience with our product, gather feedback, or conduct satisfaction surveys. These are service communications, not unsolicited commercial email (spam). You may opt out at any time by contacting us at s.castellitti.dev@gmail.com.
• Marketing emails, only if you ask for them: If you say yes when you create your account, answer yes on the card in the app, or switch on "Sales and new styles by email" in your account, we email you about sales, new styles, study tips, and a checkout you started but did not finish. The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code). We keep a record of when and how you gave or withdrew it. You can withdraw at any time with the unsubscribe link in every such email, with the switch in your account, or by writing to us; withdrawing does not affect emails already sent. Without consent we never send these emails. Inside the app we may still show you a reminder about a checkout you left open; that is not an email.
• To personalize your experience: We use the answers you provide during onboarding (what you use the product for and the follow-up answers described in Section 1, and how you heard about us) to tailor your dashboard, suggest relevant templates and default styles, and surface the features most useful to you.
• To improve our Services: We may analyze usage patterns, onboarding answers, and feedback in aggregate or pseudonymous form for internal research, product analytics, and roadmap decisions. This analysis stays internal. We do not share it with third parties, sell it, or use it for advertising or third-party profiling.
• For security and fraud prevention: We process your information to detect, prevent, and address security issues, fraud, and abuse.
• To comply with legal obligations: We may process your information to comply with applicable laws, regulations, and legal processes.
• To save or protect an individual's vital interest: We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

Automated decisions. We use AI to generate content from the materials you give us. We do not use AI or any automated process to make decisions about you that have legal or similarly significant effects. Quizzes and tests are for self-study only and are not used to evaluate you.

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Contractual Obligations. We may process your information to fulfill our contractual obligations to you, such as providing the Services you have requested, sending your study materials to our AI providers to produce what you asked for, managing your subscription, metering your plan, and storing and syncing your content (Art. 6(1)(b) GDPR).
• Legitimate Interests. We may process your information when we believe it is necessary to achieve our legitimate business interests, such as improving our Services, analyzing usage patterns, and preventing fraud. This includes metering guest usage in the app by device identifier to enforce free limits, prevent abuse, and control costs, and keeping usage records linked to a store subscription after you delete your account, as described in Section 5.1 (Art. 6(1)(f) GDPR).
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations

We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Service Providers: We share your information with third-party service providers who perform services on our behalf, including:
  • Supabase: For user authentication (including the one-time sign-in codes), data storage (including the notes and files synced to your account), and database management
  • Apple App Store and Google Play: Sell and bill subscriptions bought in the app. They handle your payment under their own privacy policies, and the subscription belongs to your Apple or Google account.
  • RevenueCat: Manages purchases made in the app for us. RevenueCat receives the purchase records, the app user ID linked to your device or account, and the store transaction ID.
  • Vercel and Expo (hosting): Our website and the server endpoints the app calls run on Vercel; a few app endpoints run on Expo (EAS Hosting). Your requests pass through them to reach our database and our AI providers.
  • Expo (crash reports): May receive crash reports from the app, as described in Section 1.
  • Polar (Polar Software, Inc., United States): Our merchant of record for subscriptions and credit packs, and for the test unlocks it sold until October 20, 2026. Polar is the seller of each purchase, processes the payment through its partner Stripe, and handles sales tax and VAT. At checkout Polar collects your email address, billing address, payment card details, and a tax number if you provide one, and handles that information under its own privacy policy. Polar is based in the United States, so purchase data is processed there.
  • Resend (Resend Inc., United States): Sends our emails, including the marketing emails described above (only to people who agreed to receive them). Resend receives your email address and the content of the message. Transfers outside the EU/EEA are covered by Standard Contractual Clauses under Resend's Data Processing Addendum.
  • Stripe: For billing subscriptions started before we moved to Polar, and as the payment processor Polar uses
  • Anthropic (Claude Haiku, Anthropic PBC, United States): For the text features of the product: writing and revising notes, chat replies and the note assistant, quizzes, tests, flashcards, mind maps, podcast scripts, step-by-step lessons, oral exam practice, note titles, splitting a long source into sections, lessons for the classroom board and their AI assistant, and reading what you give us to work from: documents and photos you upload, and the text of a web page when you paste a link (our server fetches the page and sends Anthropic its text). Anthropic receives the text you submit, the files it needs to read, and, for some features, the visual of the note. We do not send Anthropic your email address or your account ID.
  • Google Gemini AI: For drawing sketchnote images when OpenAI cannot (see "How we choose the image provider" below), watching a YouTube video when you paste one (the address you paste is sent to Google so it can fetch the video), transcribing your voice recordings and the audio files you upload, and reading the script of an audio episode aloud when you make a podcast (Google receives the script text and the voice names, nothing else). Before some requests run, we also send their content to Google's token counting service to measure their size. We do not send Google your email address or your account ID.
  • OpenAI (GPT Image): For drawing sketchnote images, revising existing visuals, redrawing test pages, and drawing pictures for classroom lessons. OpenAI receives the prompt for the visual (built from your note), the image size, and, when the visual is based on them, the photo you uploaded, the page being redrawn, or your personal style reference image. We do not send OpenAI your email address or your account ID.
  • Vevee: An EU-based processor (Italy) used to meter your use of paid features, analyze product usage, and generate personalized in-product content. To generate personalized content, Vevee uses Google (Gemini API) as a sub-processor.
  • Telegram: Only if you take part in Creator Rewards. When you submit a video or claim a views bonus, we send ourselves a private Telegram message with your account email, your plan, and the links you submitted, so we can review it. Nothing else about you is sent to Telegram.
  These service providers are contractually obligated to protect your information and may only use it for the purposes we specify.
• Creator Rewards: If you join Creator Rewards, we store the links to the videos you submit, the date, the review status, any reason we give when we decline a video, and the credits granted. We review your public posts by hand, and we read each platform's public page for a short link (for example vm.tiktok.com) to find the full video address. On your Creators page, and on our review page, your videos play through the embedded player of the platform they were posted on (TikTok, Instagram, YouTube, Facebook or X); that platform receives the usual information a browser sends when it loads its player, such as your IP address, and handles it under its own privacy policy. We keep this information while your account exists and delete it with your account.
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Legal Requirements: We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

How we choose the image provider. Visuals are drawn by OpenAI first, and by Google Gemini if OpenAI declines the request, is unavailable, or your OpenAI allowance is used up. Some requests go to Google Gemini directly: a visual built from two or more photos (unless we have read every page to text first), a file format OpenAI does not take, a banner more than three times wider than it is tall (or taller than it is wide), or a very long prompt. Revisions to an existing visual and redraws of a test page are also tried on OpenAI first and fall back to Gemini. In the app you can choose Gemini in the image setting, and the request is then drawn by Gemini. Pictures for a classroom lesson are drawn by OpenAI only. OpenAI does not use data sent through its API to train its models, and may keep it for up to 30 days to detect abuse before deleting it. OpenAI processes data in the United States; where personal data is transferred outside the EU/EEA, the transfer is covered by Standard Contractual Clauses under OpenAI's Data Processing Addendum.

How we choose the text provider. Anthropic (Claude Haiku) writes and reads the text in the product: the notes it drafts, chat replies, quizzes, tests, flashcards, mind maps, podcast scripts, lessons, and the text we read from a document, photo, or web page you give us before turning it into a note or a visual. Google Gemini is used for three tasks only: watching a YouTube video when you paste one, transcribing voice recordings and audio files, and speaking a podcast script in synthetic voices. Anthropic does not use data sent through its API to train its models, and may keep it for up to 30 days to detect abuse before deleting it. Anthropic processes data in the United States; where personal data is transferred outside the EU/EEA, the transfer is covered by Standard Contractual Clauses under Anthropic's Data Processing Addendum.

In the app. The app uses the same providers in the same way. Typed or pasted text, the photos you add to a note, and the pages behind the links you paste go to Anthropic, which writes the note, chat replies, quizzes, flashcards, mind maps, and podcast scripts. Voice recordings and audio files go to Google Gemini for transcription. Sketchnote drawings go to OpenAI first and to Google Gemini if OpenAI cannot draw them. Podcast episodes are written by Anthropic and spoken by Google Gemini.

International transfers. Some of our service providers (including Anthropic, OpenAI, Google, Polar, Resend, RevenueCat, Expo, and Vercel) are based in the United States and may process your information there. When we transfer personal information from the EEA, UK, or Switzerland, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses in our data processing agreements with them.

We do not sell your personal information to third parties. We do not share your onboarding answers, feedback, or product usage data with third parties for their own purposes. We do not display advertisements on our Services.

We use Vevee S.r.l. ("Vevee"), an Italian company, as a data processor (Art. 28 GDPR, under a Data Processing Agreement) for three distinct purposes: metering your use of paid features, analyzing how the product is used, and generating personalized in-product content. Vevee identifies and meters you by your account identifier, the same on the website and in the app. If you use the iOS app as a guest, it uses the device identifier described in Section 1 instead. When a guest signs in, the guest's usage is merged into the account. Vevee's sub-processor list is available at https://vevee.org/sub-processors.

5.1 Service usage and entitlements (metering)

We use Vevee to track your usage of paid features (for example, AI image generations) and to enforce your subscription limits.

• What is collected. Counters of feature use and, for each AI request, the request (your prompt and settings), the model's reply, usage counts, and timestamps, linked to your account identifier, or to the device identifier for an app guest. If you tell the app during onboarding that you are under 16, prompts and replies are no longer logged; only the counts are kept.
• Legal basis. Performance of the contract (Art. 6(1)(b) GDPR). This processing is necessary to provide the paid features you have subscribed to.
• Retention. For the duration of your subscription plus 12 months for billing and contestation purposes.
• When you delete your account. Your content, analytics and identifiers are deleted, including your prompts and the model's replies. We keep only usage and cost records (which features were used, how many times, at what cost, on which plan and day), with no text and no identifier, for our own cost accounting. If you still have an active App Store or Google Play subscription, these records stay linked to that store subscription while its paid period is still running, so the quota already used carries over if you restore the subscription on a new account (legitimate interest in preventing abuse of paid plans, Art. 6(1)(f) GDPR). After that they are fully anonymous.
• Sub-processor. Vevee acts as Data Processor (Art. 28 GDPR).

5.2 Product analytics

We use Vevee to analyze how our users interact with our product. This helps us identify usability issues, measure adoption of features, and improve the overall experience.

• What is collected. For visitors who have not signed up yet: anonymous, aggregate events (pages visited, actions taken). No persistent identifier is stored in your browser for this purpose. For users who have signed up: events linked to your account identifier (an internal code, not your email address). In the app before you sign in, events, including your onboarding answers, are linked to the device identifier.
• How you found us. On the website we record where a visit came from: the campaign tags in the link you followed (such as utm_source or utm_campaign), the website that sent you (its domain only), the first page you opened, your approximate location (country, and for visits also region and city), and your device type, browser and operating system. This is kept only in the page's memory while you browse: no cookie or other storage is used, your IP address is not stored, and ad click identifiers (such as fbclid or gclid) are removed. Visits are counted anonymously. When you create an account, that first visit's source, campaign, first page, country and device type are saved with your account, so we can tell which channels bring people who sign up and subscribe; your purchases (product, amount and date) are linked to the same record for that purpose. We do not link your account to the pages you viewed before signing up.
• Legal basis. Legitimate interest of the Controller (Art. 6(1)(f) GDPR) in improving the service. Recognized by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) under Cookie Guidelines Provv. 231/2021 as falling within statistical purposes when implemented with data minimization.
• Your rights / opt-out. You can opt out of product analytics at any time from your dashboard, under "Privacy & data → Product analytics," or by contacting us at s.castellitti.dev@gmail.com. When you opt out, we stop linking your activity to you: it is recorded under a random, non-reversible code so we can keep aggregate product statistics, but it is no longer tied to your identity. You can also request access to or deletion of your data using the same contact. If you tell the app during onboarding that you are under 16, the app opts you out of product analytics automatically.
• Retention. Events are retained for 24 months from collection.
• Data location. EU (Frankfurt, Germany).
• Sub-processor. Vevee acts as Data Processor (Art. 28 GDPR). A Data Processing Agreement is in place.

5.3 AI-assisted personalization

We use Vevee to generate personalized in-product content, for example a tailored onboarding step or a relevant upgrade message, based on how you use our product.

• What is used. Your profile attributes, feature-usage history, and in-app activity linked to your account are used to compose the personalized text. We do not use special categories of personal data (Art. 9 GDPR) for this purpose.
• How it works. The relevant data is sent to an AI model provider, which generates the text. This is automated processing (profiling) used solely to tailor content shown to you; it does not make decisions that produce legal or similarly significant effects about you (Art. 22 GDPR does not apply).
• Legal basis. Legitimate interest of the Controller (Art. 6(1)(f) GDPR) in providing a relevant, personalized experience. You have the right to object to this processing at any time (Art. 21 GDPR).
• Your rights / opt-out. You can object to, or disable, AI personalization at any time from your dashboard, under "Privacy & data → AI personalization," or by contacting us at s.castellitti.dev@gmail.com. Disabling it stops any further use of your data for this purpose. You can also request access to, or deletion of, the data and generated content using the same contact. If you tell the app during onboarding that you are under 16, the app opts you out of AI personalization automatically.
• Sub-processors. Vevee acts as Data Processor (Art. 28 GDPR). To generate the content, Vevee uses Google Ireland Ltd. (Gemini API) as a sub-processor. Where the AI provider processes data outside the EU/EEA, the transfer is covered by Standard Contractual Clauses.
• Retention. The generated content and the inputs used to produce it are retained for 12 months; you can request earlier deletion at any time.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

Generated sketchnote images, along with their associated prompts, styles, timestamps, and metadata, are stored in our cloud storage. Your input text and uploaded documents are also stored in our systems. When you are signed in, the notes, photos, visuals, flashcard decks, mind maps, and podcast episodes you make in the app are stored there too. Your account information, subscription data, and feedback are stored in our database.

Generated images, uploaded documents, note photos, podcast audio, and style reference files are kept for as long as your account exists, so they are available on the website and in the app wherever you sign in. They are deleted when you delete them (deleting a note deletes its files on every device) or when you delete your account.

What stays on your phone is not on our servers. Notes you make as an app guest, and quizzes and note chats in the app, are stored only on your device until you delete them or remove the app. Our AI providers do not use the study materials we send them to train their models. Anthropic, OpenAI, and Google may keep them for up to 30 days to detect abuse, then delete them. Metering, analytics, and personalization data held by Vevee are kept for the periods in Section 5. When you delete your account, usage and cost records are kept without text or identifier for cost accounting, as described in Section 5.1.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

You can request the deletion of your account and all associated data at any time through your profile/dashboard page or in the app Settings. Account and data deletion requests are processed within 7-14 business days.

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. These measures include:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security assessments and updates
• Secure cloud storage with Supabase
• Secure payment processing through Polar and Stripe on the website, and through the Apple App Store or Google Play in the app; we never store your full card number

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

If you have questions or comments about your privacy rights, you may email us at s.castellitti.dev@gmail.com.

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

In Short: If you are a resident of California, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category. For a comprehensive inventory of all personal information we process, please refer to the section "WHAT INFORMATION DO WE COLLECT?"

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels
• Participation in customer surveys or contests
• Facilitation in the delivery of our Services and to respond to your inquiries

Sources of Personal Information

Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?"

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers. We do not display advertisements on our Services.

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending upon the state where you live, you may also have the following rights:

• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)

How to Exercise Your Rights

To exercise these rights, you can contact us by submitting a data subject access request through your profile/dashboard page, by emailing us at s.castellitti.dev@gmail.com, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

California "Shine The Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

If you have questions or comments about this notice, you may email us at s.castellitti.dev@gmail.com or contact us by post at:

Salvatore Castellitti
Via Sannio 1
Petrella Tifernina, Molise 86024
Italy
VAT number (partita IVA): 01945740700

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

To request to review, update, or delete your personal information:

• Access your profile/dashboard page
• Navigate to the account settings or data management section
• Submit a data subject access request or deletion request through the provided interface
• In the app, open Settings to delete your account
• Alternatively, contact us directly at s.castellitti.dev@gmail.com with your request

Account and data deletion requests are processed within 7-14 business days of receiving your request. Upon processing your request, we will:

• Delete your user account and authentication information
• Delete all generated images and associated metadata from our storage
• Delete all input text and uploaded documents from our storage
• Delete the notes, photos, visuals, flashcard decks, mind maps, and podcast episodes synced from the app
• Delete your analytics and identifiers held by Vevee, including the device identifier of a phone you used as a guest
• Cancel any active subscription with Polar or Stripe, then delete your subscription records
• Delete your feedback and support request history
• Delete your onboarding answers (persona, primary goal, input habits, volume intent, attribution, referral name, and pain point)
• Delete all other personal data associated with your account

Please note that some data may be retained for a limited period as required by law or for legitimate business purposes (such as fraud prevention or legal compliance). Usage and cost records are kept without text or identifier for our cost accounting; while the paid period of an App Store or Google Play subscription is still running, they stay linked to that store subscription so the used quota carries over if it is restored on a new account, then they become fully anonymous (see Section 5.1). Data stored only on your phone (guest notes, quizzes, and note chats) is not on our servers; remove it by deleting it in the app or removing the app. Once your data is deleted, it cannot be recovered. We recommend downloading any content you wish to keep before submitting a deletion request.

If you delete your account from your dashboard or in the app while you have an active website subscription, we cancel that subscription with Polar or Stripe as part of the deletion, so you will not be charged again. The cancellation takes effect immediately: premium access ends at once, the unused part of the current billing period is not refunded (except where applicable law requires otherwise), and any unused pack credits are lost. If you ask us to delete your account by email instead, we cancel the subscription when we process your request.

Deleting your account, in the app or on the website, does not cancel an App Store or Google Play subscription. That subscription belongs to your Apple or Google account, so cancel it in your phone's subscription settings. Credits you bought are lost when you delete your account.