Privacy statement
This is an English translation, provided for your convenience. The Dutch version is legally binding: if the two differ, the Dutch text prevails.
My Notetaker records conversations, converts them into text and produces summaries, action items and analyses from them. That is sensitive data. In this privacy statement we explain which personal data we process, why, for how long, with whom we share it and what rights you have.
1. Who we are
My Notetaker is a product of My AI B.V., Colosseum 65 (unit 1.12–1.16), 7521 PP Enschede, registered with the Chamber of Commerce (KvK) under number 98317067. For questions about privacy you can reach us at info@my-ai.nl or +31 6 45110794. We have not appointed a data protection officer; your question goes directly to the management.
2. Our role: processor or controller
Under the General Data Protection Regulation (GDPR), whoever determines the purposes and means of a processing operation is the controller. With My Notetaker, that depends on how you use it:
- Business use (you use My Notetaker for your work, practice or business, including as a self-employed professional): for the conversation content, the customer (the organisation that takes out the subscription, or you as a self-employed person) is the controller. We are then the processor and process the content only on the customer's instructions, in accordance with our data processing agreement. Questions from people who have been recorded about their data belong in the first instance with the customer; we help with that.
- Private use (you use My Notetaker as a consumer): insofar as the GDPR applies, we are the controller for the processing of the conversation content in our service. We process that content only to provide the service to you.
- Account, subscription and payment data, security logs and the waiting list: for these we are always the controller.
3. What data, for what purpose and for how long
| Data | Purpose | Legal basis (Article 6 GDPR) | Retention period |
|---|---|---|---|
| Account: name, email address, password (only as an irreversible hash), profile photo (optional), role, organisation(s), choice of business/private use, acceptance of the terms (version and time), settings such as retention period and behaviour during phone calls | Creating and managing your account, logging in, providing the service | Performance of the contract | For as long as your account exists. Erased immediately after deletion; backups of our database are overwritten within 30 days. |
| Sessions and linked devices: an encrypted session key (we store only the hash), the browser or device type, links with your watch, phone app or Chrome extension | Keeping you logged in, linking and unlinking devices, preventing misuse | Performance of the contract; legitimate interest (security) | Sessions 30 days; links until you unlink them or delete your account |
| Usage data: number of minutes recorded, number of questions asked, time, duration, source and status of a recording; for each action item your choice (task or ignored), whether it has been ticked off and any deadline. The text of action items is not stored in our database. | Applying the subscription (recording limit, number of users), making the service work, resolving faults | Performance of the contract | For as long as your account exists; data about a recording until that recording is deleted |
| Conversation content: audio, transcript, title, summary, action items, sentiment analysis, keywords, contacts (names and organisations of people you speak with), the names of participants a meeting app shows when you record a meeting with the Chrome extension and the contact profiles built from them | The core of the service: recording, transcribing, summarising, making searchable and answering questions about your own conversations | Business: on the customer's instructions (see section 2). Private: performance of the contract with you; for data of others in your conversations: legitimate interest (see section 5) | Until you delete the conversation or your account, or until the retention period you choose yourself in the app expires (30 days to 1 year). If no period is chosen, we do not delete anything automatically. After a recording has been processed, we immediately erase the temporary audio copy on our own server. A recording that could not be processed is kept encrypted until you have it processed again or delete it; the automatic retention period does not delete it, so that your audio is never lost without you noticing. |
| Questions to your memory ("Ask") and the answers | Answering your question | As for conversation content | Stored at Artific (EU) so you can see your earlier questions, until you delete them and at the latest according to the retention period of your conversations. A saved answer is never used as a source for a new question. |
| Phone status (only with the phone app): whether your phone is ringing, in a call or idle | Letting your watch know when a phone call starts and ends, so that it can record (according to your choice) | Performance of the contract | Not stored. The app does not read phone numbers, contacts or call audio. |
| Subscription and payment: organisation name, administrator email address, billing address, VAT number, payment method and payment status (at our payment service Stripe), the chosen plan | Taking out subscriptions, invoicing and collecting payment; applying VAT correctly | Performance of the contract; legal obligation (statutory tax retention obligation) | Invoices and payment data 7 years (Article 52 of the General Tax Act (Algemene wet inzake rijksbelastingen)). We ourselves store only the Stripe identifiers and the status; invoices are retrieved live from Stripe. |
| Technical logs: IP address, time, requested address, error messages. Never conversation content, passwords or cookies. | Securing the service, detecting misuse and faults | Legitimate interest (security and continuity) | Maximum 30 days at our hosting provider |
| Used trial period: an encrypted code of your email address that cannot be reversed (HMAC). No readable address. | Preventing anyone from using the free trial repeatedly, including after deleting an account | Legitimate interest (preventing misuse of the free trial) | 12 months after creation; remains in place even if you delete your account |
| Waiting list: email address and (optionally) organisation | Contacting you about My Notetaker | Consent (which you can withdraw via info@my-ai.nl) | Until you unsubscribe, at most 12 months |
| Contact with us: what you email or tell us | Answering your question, handling complaints | Performance of the contract; legitimate interest | Up to 2 years after handling |
We do not process data for advertising, we do not sell data and we do not build profiles of you for marketing.
4. How we handle conversation content
- Only in the EU. Speech recognition, analysis and storage of conversation content take place via our AI platform Artific in Google Cloud, region europe-west4 (Eemshaven, the Netherlands). Our application server runs in Frankfurt (Germany), where audio is stored temporarily and encrypted during processing.
- As little as possible with us. Our own database contains no transcripts, summaries, titles or names of your contacts, only technical identifiers and metadata (such as time and duration). The content is stored in a shielded, personal knowledge base per user at Artific.
- Only for you. No one else can open your conversations: no teammate, no administrator of your organisation and also no employee of ours via the app. An administrator sees only your name, email address, role and the number of minutes recorded, because that is needed for the subscription. Employees of ours or of our processors can access data only if that is necessary to resolve a fault or if the law requires it and are bound to confidentiality.
- Not for training. We do not use your conversations to train or improve AI models. The language models run via Google Cloud Vertex AI, which according to its terms does not use customer data to train models.
- Summary by email is your choice. By default none of our emails contain conversation content. If you turn on the summary by email in Settings, after a conversation we email the parts you choose (such as the summary and action items, never the transcript) to your own, confirmed email address. That email is also kept outside My Notetaker, for example by your email provider, even if it is outside the EU. You can turn it off at any time.
- Deleting means deleting. If you delete a conversation, we erase the transcript, the analysis and the original audio, including at Artific. If that does not succeed immediately at some point, we automatically try again.
5. People you record
Other people also speak in a conversation. Their voice, what they say and their name are personal data. Therefore:
- Tell the other person. You yourself are obliged to tell the people you speak with that you are recording the conversation and for what purpose and, where necessary, to ask for consent. My Notetaker reminds you of this on the recording screen. Business customers must inform the people they speak with as the GDPR requires (Articles 13 and 14), for example with a short notice at the start of the conversation and a reference to their own privacy statement.
- Only record conversations you take part in yourself. Recording a conversation you do not take part in is a criminal offence in the Netherlands (Articles 139a to 139c of the Dutch Criminal Code (Wetboek van Strafrecht)) and is prohibited in our terms.
- Special categories of data. Conversations may contain health data or other special categories of personal data, for example in healthcare. A business customer must itself have a valid exception to the processing prohibition for this (Article 9 GDPR and the GDPR Implementation Act (Uitvoeringswet AVG)) and, where necessary, carry out a data protection impact assessment (DPIA). We help with this by providing information about our security and processors.
- Private use. Anyone who uses My Notetaker as a consumer processes data of the people they speak with on their own behalf. Insofar as we are responsible for this, we rely on the legitimate interest of the user in having their own record of conversations in which he or she takes part. We limit the impact on the other person: only the user can see the content, everything stays in the EU, there is no other use and the content is deleted as soon as the user deletes it.
- Have you been recorded and do you want to exercise your rights? Contact the person who recorded you. If that does not work, or if that person used My Notetaker privately, email info@my-ai.nl. Because we cannot view conversations without the user's cooperation, we forward your request to that user or the customer and help where we can.
6. AI and automated processing
My Notetaker uses AI (large language models) to convert speech into text, summarise conversations, find action items and keywords, describe the tone of a conversation (sentiment analysis), build contact profiles and answer questions about your own conversations. What AI produces is marked as such in the app.
- The sentiment analysis is based on the text of the transcript. We do not analyse voice characteristics, we do not recognise emotions from voice or face and we do not create voice profiles.
- Contact profiles are summaries of what has been discussed with someone in your conversations. They are visible only to you.
- My Notetaker does not take decisions about people. There is no automated decision-making with legal effects or other significant effects within the meaning of Article 22 GDPR. AI output may contain errors; check important information in the transcript.
7. Recipients and transfers outside the EU
We engage the following parties. With each of them a data processing agreement has been concluded or their standard data processing terms apply. The current list, including changes, is on Sub-processors.
| Party | What | Where |
|---|---|---|
| Artific B.V. (Enschede) | AI platform: speech recognition, language models, knowledge base and storage of conversation content and original audio | Google Cloud, region europe-west4 (the Netherlands) |
| Google Cloud (via Artific) | Infrastructure and AI models (Vertex AI) for Artific | europe-west4 (the Netherlands) |
| LangChain, Inc. (LangSmith, via Artific) | Monitoring of AI calls to resolve incidents; sees conversation content in doing so, kept for at most 30 days | EU environment (Google Cloud, EU); parent company in the US |
| Vercel Inc. | Hosting of the website and the application server; technical logs | Frankfurt region (Germany) |
| Neon, Inc. (part of Databricks) | Database with accounts and metadata; temporary, encrypted audio during processing | AWS Frankfurt region (Germany) |
| Stripe Payments Europe, Ltd. | Payments, subscriptions and invoices. Stripe never receives conversation content. | EU (Ireland); Stripe may also process data in the US |
| Sendinblue SAS (Brevo) | Sending service emails: your email address and the text of the email. Never conversation content, except the summary by email if you turn it on (the parts you choose, never the transcript). Brevo counts anonymously whether an email has been opened and whether a link has been clicked (not linked to your email address); we do not use this. | EU (France) |
Vercel, Neon, Google and Stripe are (part of) American companies. Data is stored in the EU regions mentioned. Insofar as these companies can access data from the US, or Stripe processes payment data in the US, this takes place on the basis of the EU-U.S. Data Privacy Framework and/or the standard contractual clauses of the European Commission. Conversation content is not transferred to the US for storage or processing.
Otherwise, we provide data to others only if the law requires us to, for example by order of a court. Stripe processes part of the payment data as an independent controller for its own legal obligations (such as fraud prevention); Stripe's privacy statement applies to that processing.
8. Security
We take appropriate technical and organisational measures (Article 32 GDPR), including:
- encrypted connections (HTTPS with HSTS) and encrypted storage; temporary audio is additionally encrypted (AES-256-GCM) in our database;
- separation per user at multiple levels: row-level database security, a separate knowledge base per user and an ownership check on every search query;
- passwords only as a strong hash (scrypt), session cookies that cannot be read by scripts, protection against cross-site attacks and limits on login attempts;
- no third-party scripts, fonts or trackers on our pages;
- access to production systems only for those who need it.
Encryption per component. In transit: all connections between your browser, Chrome extension, phone or watch and our application server (Vercel, Frankfurt) use HTTPS with TLS 1.2 or 1.3; plain HTTP requests are redirected to HTTPS. Our server communicates with Artific in Google Cloud via HTTPS (TLS 1.3) and with our database (Neon, Frankfurt) only via an encrypted TLS connection. At rest: Google Cloud (europe-west4, the Netherlands), where Artific stores audio, transcripts, summaries, action items and contacts, encrypts all stored data by default with AES-256. Neon encrypts the database at rest with AES-256; audio that is stored temporarily in that database during processing is additionally encrypted by us with AES-256-GCM, using a key that is not stored in the database. Vercel encrypts data on disk with AES-256. Before uploading, recording fragments are stored temporarily on your own device (in your browser, in the Chrome extension or in the watch app); the security of that device applies there. If you use the Chrome extension on Windows to record a meeting in a desktop app, the extension records the system audio: all sound your computer plays at that moment, including notifications and music. The image of your screen is not stored and not sent. If you turn on Recognize meetings in the extension, the extension looks at the address of Google Meet, Microsoft Teams and Zoom tabs on your computer to recognize a meeting; that address is not stored or sent.
If we detect a personal data breach, we act in accordance with the GDPR: we inform business customers without undue delay and, where we are the controller, report it within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where necessary, to you.
9. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can always withdraw consent you have given. You can do much of this yourself in the app:
- Access and portability: Settings > Privacy > Download all my data (a JSON file with your account and all your conversations).
- Rectification: you can change your name and email address under Settings > Profile; contacts and conversation titles in the app itself.
- Erasure: delete individual conversations in the app, or your entire account under Settings > Privacy. Everything is then erased, including at Artific.
For other requests, email info@my-ai.nl. We respond within one month. We may ask you to prove your identity, but we will never ask for a copy of your identity document with your citizen service number (BSN) visible. If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch DPA. Of course, we would like to hear about it ourselves first.
If you use My Notetaker through an organisation (business use), that organisation is the controller for the conversation content. You can also submit your request to it; we help it with that.
10. Cookies
We use only one necessary session cookie to keep you logged in, and local storage in your browser for features you use yourself. No analytics or tracking cookies. We count visits to the website without cookies and without anything that recognises you: only numbers per day and page, and the name of the site you came from. See Cookies and local storage.
11. Minimum age
My Notetaker is intended for persons aged 18 and over. We do not knowingly process data of children as users.
12. Changes and contact
We amend this privacy statement when our service or the law changes. In the event of important changes, we will let you know in advance in the app. The date at the top shows which version applies. Questions? Email info@my-ai.nl or call +31 6 45110794. Our postal address is My AI B.V., Colosseum 65 (unit 1.12–1.16), 7521 PP Enschede.