Politique de confidentialité

1. Introduction

notefield is a product published and operated by Y SAS ("we," "our," or "us"). Y SAS is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the notefield website and service. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the service.

2. Information We Collect

We collect information that you provide directly to us and information that is automatically collected when you use our service:

2.1 Information You Provide

• Email address - Used for account creation and communication
• Name - Used to personalize your experience
• Phone number - Used for account verification and notifications
• Contacts - Used for app functionalities such as sending emails and adding notes
• Recordings, transcripts, notes, attachments and tasks - Content you capture or add to create summaries and next steps
• Connection credentials - OAuth access and refresh tokens used to maintain integrations you explicitly connect

2.2 Automatically Collected Information

• IP Address - Collected for security and analytics purposes
• Usage Analytics - Information about how you interact with our service
• Device Information - Browser type, operating system, and device identifiers

2.3 Google account and Google Workspace data

Signing in with Google shares your basic profile, including your name, email address and profile image, to authenticate your notefield account. Connecting Google Workspace is a separate, optional action. We access only the Google services covered by the permissions you grant.

Depending on the features you authorize, notefield can read Gmail messages and metadata, create drafts, send messages and update messages; read and manage Google Calendar events and attendees; read Google Contacts; and access Google Drive files created with or explicitly opened through notefield. These permissions support your requested email, scheduling, contact and note workflows. Connecting Google Workspace does not give notefield unrestricted access to all of your Drive files.

Google data relevant to a feature or a request may be included in the context sent to our AI processing providers, such as Microsoft Azure, to generate the response, summary or next step you requested. OAuth tokens and the resulting content are retained as needed to operate the connected feature and your account, subject to the retention and deletion provisions below. We do not sell Google user data, use it for advertising or use it to train generalized AI models.

You can disconnect Google Workspace in the notefield connector settings and revoke access at https://myaccount.google.com/connections. Revoking access stops future authorized access; it does not automatically delete notes or other content already saved in your notefield account. To request deletion of stored data, contact rafik@notefield.work.

notefield's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

3. How We Use Your Information

We use the information we collect solely for the following purposes:

• To provide and maintain our service
• To send emails and notifications
• To enable app functionalities such as adding notes, taking notes, and managing your workflow
• To improve and optimize our service
• To analyze usage patterns and trends
• To ensure the security and integrity of our service

Our data commitment

We do NOT sell your data, train AI models on your data, or use your data for any purpose other than providing you with our service.

4. Third-Party Services

We use the following third-party services to operate our service:

4.1 Analytics and Tracking

These services may collect information about your use of our service. Please review their privacy policies to understand how they handle your data.

• Google Analytics - Used to understand how users interact with our service
• PostHog - Used for activity tracking and product analytics

4.2 AI and Authentication Services

Recordings are collected when you use the microphone; text and images are collected when you enter or attach them; connected-service context is retrieved through the permissions you grant. We send only the content relevant to the requested feature. Content may contain personal information about you or people mentioned in your recordings or connected services.

Before the mobile app starts AI processing or resumes queued uploads, it explains the data and recipients above and asks for your permission. We store your decision, the disclosure version and its timestamp in your account. If you decline, no AI upload starts and you return to sign-in. You can withdraw permission in Settings → Appearance & language; this stops future sharing from the updated mobile app and Apple Watch. Withdrawing permission does not recall data already processed or delete saved notes. You can delete notes or your account using the controls described below.

We require third-party processors to provide the same or an equivalent level of protection for personal data as described in this policy, including confidentiality, appropriate security, limited use for the contracted service, and applicable data protection and deletion obligations. We do not authorize them to use your content for their own advertising. Provider terms and safeguards are available at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA, https://elevenlabs.io/terms-of-use, https://ai.google.dev/gemini-api/terms and https://aws.amazon.com/compliance/data-privacy-faq/.

• Microsoft Azure OpenAI (Microsoft) - Receives recordings and voice messages for speech recognition, and transcripts, messages, attached images, relevant notes and data from integrations you connect to produce summaries, tasks and assistant answers.
• ElevenLabs - Receives recordings and live voice audio for transcription, and assistant reply text to synthesize speech during voice conversations.
• Google Gemini (Google) - May receive transcripts and relevant conversation context to correct speech recognition. This processing is separate from Google OAuth authentication.
• Amazon Web Services - Stores uploaded recordings and application data and hosts our backend infrastructure.
• Google OAuth - Used for user authentication

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We only share your information with third-party service providers who assist us in operating our service, and only to the extent necessary for them to provide their services to us.

6. Data Retention

We retain your personal information for as long as you use our service. You can delete your account and request deletion of your data at any time. Upon receiving a deletion request, we will delete your personal information within a reasonable timeframe, except where we are required to retain it by law or for legitimate business purposes.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have certain data protection rights under the General Data Protection Regulation (GDPR):

• Right to Access - You can request copies of your personal data
• Right to Rectification - You can request that we correct any inaccurate personal data
• Right to Erasure - You can request that we delete your personal data
• Right to Restrict Processing - You can request that we restrict the processing of your personal data
• Right to Object to Processing - You can object to our processing of your personal data
• Right to Data Portability - You can request that we transfer your data to another service

Exercising your rights

To exercise any of these rights, please contact us at rafik@notefield.work

8. Data Deletion

You have the right to request deletion of your personal data at any time. You can delete your account directly through the app, or you can contact us at rafik@notefield.work to request deletion. We will process your deletion request within a reasonable timeframe.

9. Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our service and store certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact Y SAS, the company operating notefield, at: rafik@notefield.work