Privacy Policy
Notavite is published by Blue Jay Systems. This policy explains what personal data we collect, why, with whom we share it, and your rights under GDPR and applicable data protection law.
1. Data Controller
Blue Jay Systems
E-mail: privacy@notavite.com
2. Data We Collect
| Category | Data | Purpose |
|---|---|---|
| Account | Email address, user identifier (UUID) | Authentication, cross-device sync |
| Content | Text, URLs, voice notes (audio), images, PDF files you capture | Storage and AI analysis of your notes |
| AI output | Titles, summaries, tags, vector embeddings (1,536 dimensions) | Semantic search, automatic organisation |
| Preferences | Language preference (locale), timezone | Personalisation; delivering Brief and reminders at the correct local time |
| Subscription | Anonymous RevenueCat subscriber ID, Apple/Google transaction identifiers, subscription status; Stripe customer ID for legacy web subscriptions | In-app purchase management and Pro access |
| Session | JWT authentication token (stored locally on device) | Session persistence |
| Learned facts | Durable personal facts the AI infers from your notes (e.g. names of close contacts, stable preferences, recurring projects) | Assistant personalisation — viewable and individually deletable in "What Notavite knows about me" |
| Briefs | Generated daily/weekly digests (today's agenda, open tasks, resurfaced note) | "The Brief" feature (opt-in, toggleable in profile) |
| Imported content | Notes imported from Google Keep or Markdown files (titles, content, labels, original dates) | Import feature — processed like your other notes |
| Notifications | Device push token (Expo/FCM/APNs) | Scheduled reminders and daily Brief |
We do not collect in the app: the Notavite application uses no advertising identifiers (IDFA/GAID), no behavioural analytics, and no third-party tracking cookies.
Website audience measurement: the notavite.com marketing site uses Google Analytics 4 to measure its audience, only with your consent — no measurement cookie is set before you agree, and declining restricts nothing. Your choice is remembered for at most 13 months and can be changed at any time via "Manage cookies" in the footer. Google LLC is US-based; this transfer is governed by Standard Contractual Clauses (see section 5).
3. How We Use Your Data
- Authenticate your account and sync notes across devices
- Process captured content through AI to extract title, summary, and tags
- Transcribe voice notes to text
- Describe image content
- Generate vector embeddings for semantic search
- Power the AI Chat feature (Q&A over your notes)
- Segment your voice debriefs into distinct notes and actions (Debrief feature)
- Compose your daily/weekly Brief and deliver it as a push notification (if enabled)
- Remember durable personal facts extracted from your notes to personalise the assistant (viewable and deletable in-app)
- Import and process notes you transfer from other apps
- Manage your subscription and enforce free-plan limits
- Send transactional emails (account confirmation, renewal)
4. Third-Party Services and Data Sharing
Notavite uses the following providers, strictly required to operate the service: Supabase (hosting), OpenAI (AI processing), RevenueCat (in-app purchases), Firebase Cloud Messaging & Apple Push (notifications), Apple App Store / Google Play (mobile billing) and Stripe (legacy web payments). No data is sold or shared for advertising purposes.
Supabase (hosting & database)
All your data is hosted on Supabase (AWS eu-north-1 — Stockholm, EU). Every database row is protected by Row-Level Security (RLS) — no user can access another user's data. Supabase is SOC 2 Type II certified. Supabase Privacy Policy →
OpenAI (AI processing)
Your note content is sent to OpenAI for processing. Specifically:
| Content type | Data sent | Model |
|---|---|---|
| Text / URL | Raw content (text: up to 4,000 characters; web pages: up to 3,000 extracted characters) | gpt-4o-mini |
| Voice note | Full audio file | Whisper (transcription) |
| Voice debrief | Full audio file, then transcript for segmentation into notes and actions | Whisper + gpt-4o-mini |
| Image | Base64-encoded image | gpt-4o-mini (vision) |
| Extracted text (up to 4,000 characters) | gpt-4o-mini | |
| AI Chat | Message + history + note excerpts (up to 1,500 chars/note, 30 notes max) | gpt-4o-mini |
Under OpenAI's API usage policies, data submitted via API is not used to train their models. Notavite has executed a Data Processing Agreement (DPA) with OpenAI compliant with GDPR. OpenAI is based in the United States; transfers are governed by EU Standard Contractual Clauses.
RevenueCat (mobile in-app purchases)
Subscriptions purchased in the mobile app go through the App Store (Apple) or Google Play and are managed via RevenueCat. Notavite never sees your payment details — Apple or Google process the payment; RevenueCat only receives an anonymous subscriber identifier and subscription status. RevenueCat is US-based; transfers are governed by SCCs. RevenueCat Privacy Policy →
Firebase Cloud Messaging & Apple Push (notifications)
Push notifications (reminders, daily Brief) are delivered via the Expo Push service, which relies on Firebase Cloud Messaging (Google) on Android and APNs (Apple) on iOS. Only a technical device token passes through these services — never your note content (notification bodies contain only the reminder title or a count). Google and Apple are US-based; transfers governed by SCCs.
Stripe (legacy web payments)
Subscriptions purchased on the web are handled by Stripe. Notavite never sees your card details. We only store your Stripe customer ID to link your account to your subscription. Stripe is PCI DSS Level 1 certified. Stripe Privacy Policy →
5. International Data Transfers
OpenAI, RevenueCat, Stripe, Google (Firebase) and Apple (APNs) are based in the United States. These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) under GDPR Article 46. Data hosted on Supabase remains in the EU (eu-north-1, Stockholm).
6. Data Retention
| Data | Retention period |
|---|---|
| Notes, media files, embeddings | Until manually deleted by you or account deletion |
| Voice debrief audio | Automatically deleted as soon as transcription completes |
| Sent/cancelled reminders and past events | Automatically purged after 90 days |
| Generated daily/weekly briefs | Automatically purged after 60 days |
| Archive exports (ZIP) | Each new export deletes previous ones; download link (signed URL) valid for 1 hour |
| Push notification tokens | Until account deletion; stale tokens are purged automatically |
| Account data (email, UUID) | Until account deletion |
| Billing data (Stripe — legacy web subscriptions) | 10 years (legal accounting obligation) |
| Session tokens | Stored locally on device — cleared on sign-out |
Account deletion triggers an immediate cascade deletion of all your data: database rows (notes, embeddings, preferences, learned facts, briefs, imported content, conversations, push tokens) and stored files (audio, images, PDFs, archive exports). Files are purged first; if that purge fails, the deletion is aborted rather than leaving orphaned data.
7. Your Rights (GDPR)
- Right of access (Art. 15): obtain a copy of all data we hold about you.
- Right to rectification (Art. 16): correct inaccurate or incomplete data.
- Right to erasure (Art. 17): request deletion — use "Delete Account" in the app or contact us.
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format — exportable directly from the app (Markdown, PDF, JSON, or a full archive including attachments).
- Right to object (Art. 21): object to certain processing.
- Right to restriction (Art. 18): request temporary suspension of processing.
- Right to lodge a complaint: with your national data protection authority (e.g. CNIL in France, ICO in the UK).
To exercise your rights: privacy@notavite.com. We respond within 30 days.
8. Security
- All communications are encrypted in transit via TLS (HTTPS)
- Authentication tokens are stored in the device's secure enclave (
expo-secure-store) - Every database table is protected by Row-Level Security — no cross-user data access is possible
- API keys (OpenAI, Stripe webhook secret) are never exposed client-side
- Rate limiting is enforced: 10 captures/min, 20 Chat messages/min
9. Children
Notavite is not intended for children under 13 (or 16 in EU member states where applicable). We do not knowingly collect personal data from minors. If you believe a child has submitted data to us, contact privacy@notavite.com.
10. Changes to This Policy
For material changes, we will notify you by email or in-app notification at least 14 days before the changes take effect. The current version is always available at the publication URL of this document. The "Last updated" date at the top of this page is authoritative.
11. Contact
Blue Jay Systems
E-mail: privacy@notavite.com
For data rights requests, please include "GDPR Request" or "Data Request" in the subject line.