Back to Home

Privacy Policy

Last updated: July 19, 2026

1. Who We Are

RabbitNotes AI ("we", "our", "us", or the "Service") is an AI transcription and note-taking service — available at rabbitnotesai.com and through our iOS and Android apps — operated by an independent individual developer based in India, acting as a sole proprietor. We are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the "data controller" under the EU/UK General Data Protection Regulation ("GDPR") for the personal data described in this policy.

Contact and Grievance Officer (DPDP Act): rabbitnotesai@gmail.com

2. Information We Collect

Account information

  • Name, email address, and profile picture — received from the sign-in provider you choose (Google, Microsoft, or Apple).
  • Phone number — if you sign in with phone OTP.
  • We do not offer password-based login and never receive or store your social-account passwords.

Content you provide

  • Audio and video files you upload or record, and links (including YouTube URLs) you submit for transcription.
  • The transcripts, summaries, notes, and other AI outputs generated from your content.
  • Questions you ask the AI assistant about your notes, and feedback or support messages you send us.

Meeting integrations (optional)

If you choose to connect Zoom, Google Meet / Google Drive, or Microsoft Teams / OneDrive, we receive limited OAuth access tokens and read your meeting recordings solely to list and import them into your workspace at your request. We do not read unrelated files, we never post or modify anything in your connected accounts, and you can disconnect any integration at any time from the Meetings page, which stops all further access.

Payments

Purchases are processed by Dodo Payments, our merchant of record. Your card or bank details go directly to Dodo — we never see or store your payment card information. We keep your subscription status and invoice records (plan, amount, date) to operate your account. Dodo's own privacy policy applies to the payment transaction.

Collected automatically

  • Device and app information, server logs, and error/crash reports used to keep the Service working.
  • Push notification tokens, if you enable notifications.
  • On the marketing website only: your approximate country (derived from your IP address) to display prices in your local currency. This lookup is not linked to your account.
  • Local storage / cookies limited to keeping you signed in and remembering preferences (like theme). We use no advertising trackers and no third-party ad cookies.

3. How We Use Your Data (and Legal Bases)

  • To provide the Service — transcribing your audio, generating AI outputs, storing your notes, syncing across web and mobile (contract performance; consent under the DPDP Act).
  • To manage subscriptions — enforcing plan limits, processing upgrades and cancellations, sending invoices and service emails such as payment-failure alerts (contract performance).
  • To keep the Service safe — rate limiting, fraud and abuse prevention, debugging crashes (legitimate interest).
  • To comply with law — tax, accounting, and lawful requests (legal obligation).

We do not sell your personal data. We do not use your data for third-party advertising. We do not use your audio, transcripts, or notes to train AI models — and we use our AI providers in configurations where they do not train their models on your content either.

4. AI Processing Disclosure

The Service uses artificial intelligence: your audio is transcribed using trusted speech-recognition technology, and summaries, notes, and assistant answers are generated using large language model technology from established AI providers. Content produced by these features is machine-generated: it may contain errors, omissions, or misattributions, and should be reviewed before you rely on it or share it. Where you publish AI-generated content, you are responsible for any disclosure obligations that apply to you (for example under the EU AI Act).

5. Who We Share Data With

We share personal data only with the service providers ("Data Processors") needed to run the Service, under terms that restrict their use of your data:

  • Cloud infrastructure providers — secure application hosting, databases, and encrypted file storage.
  • Speech-recognition and AI technology providers — to transcribe the audio you submit and generate AI outputs, under terms that prohibit using your content to train their models.
  • Authentication and notification providers — to operate sign-in and deliver push notifications.
  • Our payment processor (merchant of record) — Dodo Payments, which processes payments and issues invoices; it appears on your card statement.
  • Email delivery providers — to send account and service emails.
  • Diagnostics providers — error and crash reporting to keep the Service reliable.
  • Meeting platforms you connect — Zoom, Google, or Microsoft, only if you enable their integrations, and only as described above.

We may also disclose data if required by law, or to protect the rights, safety, or property of users or the Service.

6. International Transfers

Our infrastructure runs on reputable global cloud providers, and your data may be processed in countries other than your own. Where such transfers are regulated (for example under the GDPR or the DPDP Act), we rely on the safeguards offered by our providers, such as standard contractual clauses and equivalent protections.

7. Data Retention and Deletion

  • Your content and account data are retained while your account is active.
  • You can delete individual notes at any time, and you can delete your entire account from within the app or web app. Account deletion removes your personal data and content from our systems and cancels any active subscription.
  • Residual copies in backups and logs are purged on a rolling basis within 90 days. Invoice records may be retained longer where tax or accounting law requires.

8. Your Rights

If you are in India (DPDP Act, 2023)

  • Access a summary of your personal data and how it is processed.
  • Correct, complete, or update your personal data.
  • Erase your personal data (via account deletion or by writing to us).
  • Nominate another person to exercise your rights if you are unable to.
  • Withdraw consent at any time, as easily as it was given — withdrawal stops future processing but does not affect what was lawfully done before.
  • Raise a grievance with our Grievance Officer (Section 10), and escalate to the Data Protection Board of India if unresolved.

If you are in the EEA or UK (GDPR)

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Where processing is based on consent, you may withdraw it at any time.

If you are a California resident (CCPA/CPRA)

You have the right to know, correct, and delete the personal information we hold about you. We do not sell or "share" personal information as defined by the CCPA, and we do not use sensitive personal information beyond what is necessary to provide the Service.

To exercise any right, use the in-app controls or email rabbitnotesai@gmail.com. We may need to verify your identity before acting on a request.

9. Children

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal data from children, we do not carry out behavioural tracking or targeted advertising directed at children, and if we learn that a child's data was collected we will delete it. If you believe a child has used the Service, please contact us.

10. Grievance Redressal (India)

If you have any concern about how your personal data is handled, contact our Grievance Officer at rabbitnotesai@gmail.com with the subject line "Data Grievance". We will acknowledge your complaint promptly and resolve it within the timelines prescribed under the DPDP Act and Rules. If you are not satisfied with our response, you may approach the Data Protection Board of India.

11. Security

We protect your data with encryption in transit (TLS), encryption at rest on our storage infrastructure, access controls, and rate limiting. No method of transmission or storage is 100% secure, but we work to protect your data using commercially reasonable safeguards appropriate to the size of the Service. In the event of a personal data breach, we will notify affected users and the relevant authorities (including the Data Protection Board of India) as required by applicable law.

12. Recording Consent

You are responsible for ensuring that you have the legal right — including the consent of all participants where required by law — before recording, uploading, or importing any conversation or meeting into the Service. See our Terms of Use for details.

13. Changes to This Policy

We may update this policy as the Service or the law changes. We will post the updated version on this page with a new "Last updated" date, and for material changes we will notify you in the app or by email. Continued use of the Service after changes take effect means you accept the updated policy.

14. Contact

Questions about this policy or your data: rabbitnotesai@gmail.com