Deep Notes — Privacy Policy

Deep Notes ("Deep Notes", "the app", "we", "us") is operated by Zoka Yazılım Teknoloji ve Ticaret Limited Şirketi ("Zoka Yazılım"), a limited liability company registered in Türkiye, with its registered office at Küçükbakkalköy Mah. Dereboyu Cad. R5 Blok No: 3A İç Kapı No: 48, 34750 Ataşehir / İstanbul, Türkiye.

We are the data controller for the personal data described in this policy — the veri sorumlusu under Türkiye's Personal Data Protection Law No. 6698 ("KVKK"), and the controller under the EU and UK General Data Protection Regulation ("GDPR") for users in those regions.

You can reach us about anything in this policy at info@deepnotesai.com.

This policy explains what we collect when you use the Deep Notes iOS app, why we collect it, who we share it with, and what you can do about it. It applies to the Deep Notes app and to deepnotesai.com. It does not apply to services we link to but do not operate, such as the App Store.

Account information. You can create an account with an email address and a password, with your Google account, or with Sign in with Apple. Depending on the method you choose, we receive your email address and, where the provider supplies it, your name. If you use Sign in with Apple and choose Hide My Email, we receive Apple's private relay address rather than your real one, and we use that as your contact address — we will not ask you for a personal address instead.

Sign-in is handled by Firebase Authentication. Where you set a password, it is stored only as a salted hash; we never see or store it in readable form, and we never receive your Apple ID or Google account password.

Recordings, transcripts and notes. When you record, we process the audio you capture, the transcript produced from it, and the summary, title and action items generated from that transcript. If you import an audio file, we process that file the same way. This is the core of the service and it is described in more detail in section 5.

Notes, tasks and planner content. Anything you type into Deep Notes — notes, tasks, reminders and planner entries — is stored in your account so that it is available across your devices. This content is not sent to the AI providers described in section 5 unless you use an AI feature on it.

Calendar. If you turn on the calendar integration, Deep Notes reads events from the calendars you permit, so it can show them alongside your notes and tasks. [CONFIRM AND STATE: are calendar events only read on your device, or are they copied to our servers? And does the app write events back to the user's calendar? The answer changes this paragraph and your App Privacy declaration.] You can revoke calendar access at any time in the iOS Settings app, and Deep Notes continues to work without it.

Usage and credit information. We record how many credits you have used and have remaining, when recordings start and end, their length, and which features you use. We need this to enforce your weekly allowance and to keep your purchased credit balance accurate.

Purchase information. Subscriptions and credit packs are sold by Apple, not by us. Apple does not give us your payment card details. We receive a transaction receipt and subscription status through Apple and through Adapty, the subscription infrastructure provider we use, which tells us what you bought, when, and whether it is still active.

Device and diagnostic information. Device model, operating system version, app version, language and region, crash and error reports, and the app-instance identifier Firebase assigns to your installation. We use these to keep the app working, to investigate faults, and to understand which features people use.

We do not collect your contacts, your photo library, your precise location, or your health data. We do not use tracking for advertising and we do not sell personal data.

We process your account information to create and secure your account and to provide customer support. We process your recordings, transcripts and notes to deliver the service you asked for — turning audio into text and text into a summary. We process usage and credit information to operate the credit system correctly and to prevent abuse. We process purchase information to give you the access you paid for and to handle billing questions. We process device and diagnostic information to maintain, secure and improve the app.

Under the GDPR, our legal basis for most of this is performance of a contract with you (Article 6(1)(b)), with legitimate interests (Article 6(1)(f)) covering security, fraud prevention and product improvement. Sending your recordings to the AI providers named in section 5 is done on the basis of your explicit consent, which you give in the app before your first recording. Under the KVKK, processing is based on the necessity of processing for the performance of a contract (Art. 5/2-c) and, for the AI transfer, on your explicit consent (açık rıza, Art. 5/1).

We do not use your recordings, transcripts or notes to train our own models, and we do not permit our AI providers to use them to train theirs.

Deep Notes cannot produce a transcript or a summary on the device alone. To do it, your content leaves the app and is processed by AI services operated by other companies:

AssemblyAI, Inc. (United States) is our AI provider. It receives your audio, converts it into text, and then passes that text to a large language model through its LLM Gateway service to produce the summary, title and action items. AssemblyAI acts as a processor on our behalf.

The model that writes the summary is operated by Google LLC (Gemini) or Anthropic PBC (Claude), both in the United States. They are engaged by AssemblyAI as sub-processors — we do not send your content to them directly. We choose which model handles this step and can change that choice; if we do, we will update this page and ask for your consent again in the app before the change takes effect.

These companies may use your content only to carry out the task we send it for, and are not permitted to use it to train their models. [VERIFY AGAINST YOUR ASSEMBLYAI AGREEMENT AND ITS PUBLISHED SUB-PROCESSOR LIST BEFORE PUBLISHING.]

Before your first recording, the app shows you a consent screen naming these providers and explaining what is sent. Nothing is uploaded until you agree. You can withdraw that consent at any time in Settings → Privacy → AI processing; recording and AI features stop working while it is off, and your existing notes stay in your account. If we ever change which providers we use, we will ask you again before your next recording.

Alongside the AI providers above, we rely on Apple Inc. for authentication, app distribution and payment processing; Adapty Tech Inc. for subscription and purchase management; and Google LLC (Firebase) for hosting our backend and storing your recordings, notes and tasks, and for app analytics, crash reporting and remote configuration. Firebase data is stored in [FIREBASE REGION — e.g. europe-west1; this is fixed when the project is created and cannot be changed afterwards].

Firebase Analytics and Crashlytics collect usage events, an app-instance identifier and crash diagnostics. We use them only to understand how the app performs and to fix faults. We do not enable Google's advertising or ad-personalisation features, and we do not use this data to track you across other companies' apps or websites.

We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.

We are based in Türkiye and the providers named above are largely based in the United States, so your data is transferred internationally. For transfers out of the EU and UK we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the technical measures described in section 9. For transfers abroad under the KVKK we rely on your explicit consent and, where applicable, on standard contracts notified to the Turkish Data Protection Authority.

We keep your recordings, transcripts and notes for as long as your account is open, because they are the content you came to the app for. Deleting a note removes it from your account and it is purged from our systems within [RETENTION — e.g. 30] days. Deleting your account removes your recordings, transcripts, notes and account record within [RETENTION — e.g. 30] days, except where we must keep transaction records longer to meet Turkish tax and commercial law obligations, which is generally ten years.

On AssemblyAI's systems, the audio we send begins to be deleted 24 hours after it is received and is fully deleted within 48 hours. Transcripts are deleted after the retention period configured on our account, which is [TTL — SET THIS ON YOUR ACCOUNT AND STATE THE REAL VALUE; AssemblyAI keeps transcripts indefinitely if no TTL is configured]. AssemblyAI has opted out of model training with the providers its LLM Gateway routes to, and model training is disabled on our account.

Your data is encrypted in transit using TLS and encrypted at rest. Access to production systems is restricted to the people who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as required by the GDPR and the KVKK.

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data deleted, to object to or ask us to restrict certain processing, to receive your data in a portable format, and to withdraw consent — including your consent to AI processing — at any time without affecting processing already carried out. Under the KVKK you additionally have the right to learn whether your data has been processed, to know the third parties it has been transferred to, and to request that any automated analysis producing an unfavourable result be reviewed.

Most of these you can exercise directly in the app: notes can be deleted individually, AI processing can be switched off in Settings, and your account can be deleted in Settings → Account → Delete account. For anything else, write to info@deepnotesai.com and we will respond within 30 days.

If you are in the EU or UK you may complain to your local data protection authority. If you are in Türkiye you may apply to us first and then complain to the Kişisel Verileri Koruma Kurumu.

Deep Notes records whatever your microphone captures, which may include people other than you. You are responsible for having the legal right to make that recording. Many countries and several US states require every participant's consent, and in Türkiye recording a private conversation without consent is a criminal offence under Article 133 of the Turkish Penal Code. The app reminds you of this before you record, but the obligation is yours, not ours.

Deep Notes is not directed at children. You must be at least 16 to use it, or older if the law where you live sets a higher age for consenting to data processing. We do not knowingly collect data from children below that age; if we learn we have, we delete it.

We will update this page when our practices change and revise the date at the top. If a change is significant — a new AI provider, a new purpose for your data — we will tell you in the app and, where the law requires it, ask for your consent again before the change takes effect.

info@deepnotesai.com
deepnotesai.com · zokaapps.com