Politika tal-Privatezza

Version 2.0. Last updated: 28 October 2026. Effective from: 28 October 2026.

This is an English convenience translation. The Polish version is binding and prevails in case of any discrepancy.

Controller

The controller is AIZA NET Sp. z o.o., Azalii 8, 45-940 Opole, Poland. Contact: [email protected]. This policy covers the Noteway website and apps. Information for people included in recordings is available on the page for lecturers and class participants.

Data and purposes

Recording duration and study profile data help us plan service limits and capacity; optional feedback and information about how you found Noteway help us improve quality and assess acquisition channels. We rely on our legitimate interests.

Optional analytics technologies that store or access data on your device, and marketing messages, require your consent, which you may withdraw at any time.

We receive data from you and your device, from uploaded content and, when used, from login and purchase providers. Login details are needed to create an account and your study level to complete its setup. Without these you cannot use the service. Billing details are needed for a purchase. Other information is optional.

The service is intended for people aged 13 and over, and aged 16 and over in countries with a higher digital age of consent, such as Poland. It is not intended to process personal data about a person's health, beliefs or other specially protected information. Do not upload such data.

AI and recipients

AI converts audio to text, produces materials and answers questions. Before you enable AI, the consent screen shows what we send and to whom. Without your consent we send nothing to AI providers. You can withdraw consent in Settings → Account → Consents.

Any change of providers or purposes requires new consent before the next AI task. You choose whether to enable or disable AI; your choice does not replace a legal basis for processing other people's data.

We do not use content to train our own models. For content processing we select AI services that do not use that data to train models. We do not establish people's identities from their voices.

Recipients may include providers of hosting, file storage, network services, AI, login, email, notifications, updates, diagnostics and payments. We also use professional advisers and accounting services. Authorities receive data where there is a legal basis. Login providers and app stores process some data as independent controllers. The recipient list identifies current providers, countries, data involved and transfer safeguards.

Processing may include transfers outside the EEA, particularly to the USA. We use a valid adequacy decision, including the DPF for a covered US recipient, or concluded standard contractual clauses with the required safeguards. Contact [email protected] for details and a copy of the applicable safeguards.

Retention

We retain your account, profile and materials until you delete them or delete your account. For audio in the free plan, the retention deadline is the earlier of 30 days after transcription and 60 days after upload. For paid plans, it is the earlier of 365 days after recording and 90 days after the plan ends. You can choose deletion after transcription or extend retention of a selected recording while a paid plan remains active. For automatic deletion following a retention deadline, we allow at least 3 days after notice.

Deleted lectures are permanently removed after 7 days. Data export files are available for 7 days, ordinary inbox notifications for 90 days, and security logs and abuse prevention keys for up to 12 months; the key recording previous use of a welcome package remains for up to 12 months after account deletion. Backups expire within 28 days.

We retain billing documents for the period required by applicable law, generally 5 years from the end of the year in which tax payment was due; OSS records, where applicable, for 10 years from the end of the transaction year. Records of acceptance, consent and case handling remain only as needed to demonstrate compliance or until applicable claims expire. Data relating to a specific dispute remain until it is resolved and the relevant time limits expire.

When switching providers under the Terms of Use, data designated for retrieval remain available for at least 30 days after the transition period to comply with a legal obligation. This is separate from the ordinary export available for 7 days.

We delete files held by transcription providers after the task. Their additional logs and AI providers' retention are described on the recipient list.

Your rights

You may request access, a copy, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interest for reasons relating to your situation. Withdrawing consent does not affect the lawfulness of earlier processing. Use account settings or contact [email protected]. We respond without undue delay, normally within one month; we will notify you of any justified extension within that period.

You may complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl, Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

We automatically adapt materials and review schedules to your profile and results. This may constitute profiling. We do not make decisions with legal or similarly significant effects solely by automated means. You may ask for human review of a refused welcome package.

Cookies and device storage

Noteway uses cookies and similar technologies for sign-in, service security, settings, and offline recording and study. Storage necessary for a service you request works without additional consent. Other technologies require prior consent. The inventory below and “Cookie settings” list names, providers, purposes and durations.

Optional purposes are off by default. You can accept, reject or select them separately. Change or withdraw consent through “Cookie settings”. Refusing does not block basic features, but may disable the optional feature concerned.

We apply your choice in this browser for 365 days, unless you change it earlier or a change of purposes requires fresh consent. The stored choice remains until replaced or deleted. You can delete or block cookies and site storage in your browser; this may sign you out, delete recordings not yet uploaded or prevent some features from working.

The mobile apps store sign-in data, settings, recordings and synchronisation data on your device. You can also manage microphone access and notifications in your system settings.

Data portability and infrastructure

This part describes data export and switching to another provider under section 11 of the Terms of Use.

• How to get your data: in Settings → Your data or through [email protected]. We prepare a ZIP archive and send an e-mail with a link to a page where you download it after signing in. The file is available for 7 days.
• Contents and formats: a README.txt file describing the archive; account, profile, consent and document acceptance, usage, notification, timetable and folder data in JSON files; for each lecture, the lecture data and the transcript with all its versions (JSON), a readable transcript (TXT), notes (Markdown), quizzes, bookmarks, AI conversations and text read from PDF documents (JSON), and files: the audio recording (M4A) and photos; flashcards and review history in CSV files; your own notes in Markdown and JSON together with attached files. File and field names are stable, and the formats are open and described in README.txt.
• Where the infrastructure runs: the application servers and database run in Poland (OVHcloud, Warsaw). Recordings, photos, documents, export archives and backups are stored in Cloudflare R2 with EU jurisdiction, that is in data centres in the European Union. The storage and network provider is Cloudflare, Inc., based in the USA; traffic to Noteway passes through the Cloudflare network, including outside the EEA. The recipient list identifies providers that process data outside the EEA.
• Protection measures: connections are encrypted; backups are encrypted; sensitive fields, such as integration keys, are encrypted with a key assigned to the account, which we destroy when the account is deleted. Each account sees only its own data, which the database enforces. Files are kept in private storage and you download them through short-lived links. Staff access to content is an exception and is logged. Requests from authorities, including those of third countries, are reviewed with two approvers; we disclose data only where there is a legal basis and only to the extent necessary.

Policy changes and language

The version and effective date are stated at the start of this policy. We notify you of changes in the app and, for changes material to your data, also by e-mail. A change of AI providers also triggers a new consent request before further AI processing.

This policy is drawn up in Polish and the Polish version is binding. The English version is a convenience translation; in case of any discrepancy, the Polish version prevails.