Deep Notes — Privacy Policy

Deep Notes ("Deep Notes", "the app", "we", "us") is operated by Zoka Yazılım Teknoloji ve Ticaret Limited Şirketi ("Zoka Yazılım"), a limited liability company registered in Türkiye, with its registered office at Küçükbakkalköy Mah. Dereboyu Cad. R5 Blok No: 3A İç Kapı No: 48, 34750 Ataşehir / İstanbul, Türkiye.

We are the data controller for the personal data described in this policy — the veri sorumlusu under Türkiye's Personal Data Protection Law No. 6698 ("KVKK"), and the controller under the EU and UK General Data Protection Regulation ("GDPR") for users in those regions. Section 7 explains one important exception: the content of your recordings, where you are the controller and we act for you.

You can reach us about anything in this policy at info@deepnotesai.com.

Your stored content stays on your iPhone. Recordings, transcripts, summaries, notes, tasks and planner entries are stored on your device. They are not uploaded to our servers and we hold no copy. We cannot read them, restore them, or hand them to anyone.

What we hold is small: your account record, your minute balance and usage counters, your subscription status, and technical diagnostics.

One exception, and it is the point of the app. To turn audio into text, your recording is sent from your device to our AI provider and the result comes back to your device. It does not pass through our servers on the way. Section 6 explains this in full: who processes it, where, and how long they keep it.

Because your content is on your device, we do not back it up and it does not sync between devices. If you delete the app, lose your phone or reset it, that content is gone unless you have your own backup. Section 10 explains what to do about this.

This policy explains what we collect when you use the Deep Notes iOS app, why, who we share it with, and what you can do about it. It applies to the Deep Notes app and to deepnotesai.com. It does not apply to services we link to but do not operate, such as the App Store.

Account information. You can create an account with an email address and a password, with your Google account, or with Sign in with Apple. Depending on the method you choose, we receive your email address and, where the provider supplies it, your name. If you use Sign in with Apple and choose Hide My Email, we receive Apple's private relay address rather than your real one, and we use that as your contact address — we will not ask you for a personal address instead.

Sign-in is handled by Firebase Authentication. Where you set a password, it is stored only as a salted hash; we never see or store it in readable form, and we never receive your Apple ID or Google account password.

Content you create — held on your device, not by us. Your recordings, transcripts, summaries, titles, action items, speaker labels, imported documents, notes, tasks, reminders and planner entries are stored in the app's storage on your iPhone. They are not transmitted to our servers and we do not store them. We have no copy, no access, and no technical means of reading or recovering them.

A single recording can run for up to two hours, so that is the largest amount of audio handled at once.

If iPhone backup is switched on, iOS may include this data in your iCloud or local backup. That backup is under your control and governed by Apple's terms, not ours.

Audio sent for transcription. When you record or import an audio file and ask for a transcript, the audio is sent from your device to our AI provider. Section 6 describes this in full.

Documents you import. When you import a PDF, the text of that document is sent from your device to the AI provider described in section 6, which produces a summary, a title and action items and returns them to your device. The document itself stays on your iPhone, and nothing is sent until you start the import.

Recordings made offline. You can record without an internet connection. The audio waits on your device and is sent for transcription the next time you are online. Nothing is sent while you are offline, and you can delete an unsent recording before it ever leaves the device.

Questions you ask about a note. The "Ask Your Meeting" feature lets you put a question to a transcript or to an imported document. When you do, your question and the relevant part of that text are sent from your device to the AI provider described in section 6, and the answer is returned to your device. If you never use the feature, nothing extra is sent.

Calendar. If you turn on the calendar integration, Deep Notes reads events from the calendars you permit so it can show them alongside your notes and tasks, and it can create events and reminders in your calendar when you ask it to. All of this happens on your device through iOS. Calendar data is never sent to our servers and is never sent to our AI providers. You can revoke calendar access at any time in the iOS Settings app, and Deep Notes continues to work without it.

Usage and minute information. We record how many minutes you have used and have remaining, when recordings start and end, how long they were, and which features you use. We need this to enforce your weekly allowance and to keep your purchased balance accurate. We record how long a recording was — never what was in it.

Purchase information. Subscriptions and minute packs are sold by Apple, not by us. Apple does not give us your payment card details. We receive a transaction receipt and subscription status through Apple and through Adapty, the subscription infrastructure provider we use, which tells us what you bought, when, and whether it is still active.

Device and diagnostic information. Device model, operating system version, app version, language and region, crash and error reports, the app-instance identifier Firebase assigns to your installation, and the IP address your device connects from, which our infrastructure providers log as a normal part of serving requests.

Our diagnostics are configured not to capture the content of your recordings, transcripts or notes. A crash report tells us where the app failed, not what you were writing when it did.

Website. If you join the waitlist on deepnotesai.com we collect the email address you give us. Section 11 covers this.

We do not collect your contacts, your photo library, your precise location, or your health data. We do not use tracking for advertising and we do not sell personal data.

Deep Notes separates a recording into speaker turns and labels them Speaker 1, Speaker 2 and so on, by grouping segments that sound like the same voice within that one recording.

It does not build a voiceprint, it does not identify anyone from their voice, and it does not match voices across different recordings or between different users. Any real name attached to a speaker is one you type yourself, on your device, after the fact.

For that reason this is not biometric data processed for the purpose of uniquely identifying a natural person under Article 9 of the GDPR, and not özel nitelikli kişisel veri under Article 6 of the KVKK.

Deep Notes cannot produce a transcript or a summary on the device alone. To do it, your audio leaves your device and is processed by AI services operated by other companies.

AssemblyAI, Inc. (United States) is our AI provider. Your audio, and the text of any document you import, is sent from your device directly to AssemblyAI — it does not pass through Zoka Yazılım's servers, and we never receive a copy. AssemblyAI converts audio into text, separates it into speaker turns, and passes that text to a large language model to produce the summary, title and action items, and to answer questions you ask about it. The results are returned to your device. AssemblyAI acts as a processor.

Where this happens. Transcription takes place on AssemblyAI's United States infrastructure. The summary step runs on the language model provider's global infrastructure, which is not tied to any one country, so we cannot tell you the specific country in which a given summary is produced. What we can tell you is who processes it and on what terms, which is the rest of this section.

The language model. The summary, title, action items and answers are written by a large language model that AssemblyAI selects and operates on our behalf — currently Anthropic PBC's Claude or Google LLC's Gemini. They are engaged by AssemblyAI as sub-processors; your content is not sent to them by us directly, and we do not choose which one handles a given request. AssemblyAI's gateway can reach other model providers, but those are switched off on our account. If that changes, we will update this page and tell you in the app before it takes effect.

Retention at AssemblyAI. Your content is held on AssemblyAI's systems and deleted on the timetable AssemblyAI operates for our account.

Audio we send begins to be deleted 24 hours after AssemblyAI receives it and is deleted within 48 hours at the latest. The intermediate working files produced while transcribing begin to be deleted at 48 hours and are deleted within 72 hours at the latest.

Transcripts are held for thirty days and then deleted automatically. Deletion is not instantaneous: AssemblyAI removes data through a time-based mechanism in its underlying storage, and the process begins at expiry and completes subject to that mechanism's processing times.

AssemblyAI retains limited technical metadata, the length of a request and when it was made, for logging and billing. That metadata does not include the content of your recording.

AssemblyAI's current retention policy is published at assemblyai.com/docs/data-retention-and-model-training, and it governs what actually happens to your content on their systems.

No training. AssemblyAI states that it has opted out of model training with every language-model provider it routes to, so the model that writes your summary is not trained on your content. We have separately opted our account out of AssemblyAI's own model improvement programme, so your audio is not used to train AssemblyAI's speech models either. We do not use your recordings, transcripts or notes to train anything of our own.

Your agreement. Before your first recording, the app shows you a screen naming these providers and explaining what leaves your device. Nothing is uploaded until you agree, and until you do, recording and the AI features do not run. You can withdraw your agreement at any time by writing to us at info@deepnotesai.com, or by deleting your account in Settings → Account → Delete account. Withdrawing does not affect the notes already on your device. If we change which providers we use, we will tell you before your next recording.

A meeting recording contains other people's voices and words. Those people are not our users, they have no account with us, and we never see what was recorded.

For the content of your recordings, you decide who is recorded, why, and what happens to the result. To the extent that this makes you the controller of that content — which will usually be the case where you record for work, and may not be where you record purely for yourself — we act on your behalf when arranging its transcription. We remain the controller for your own account data, your usage records and diagnostics, which is what the rest of this policy describes.

This is not a way of moving our obligations onto you. It reflects that we have no access to the content and no ability to act on it. What it does mean is that the duty to tell the people in the room that they are being recorded is yours. Section 17 covers this.

• AssemblyAI, Inc. — transcription and the AI features (section 6).
• Apple Inc. — authentication (Sign in with Apple), app distribution, and payment processing for all in-app purchases.
• Adapty Tech Inc. — subscription and purchase management.
• Google LLC (Firebase) — authentication, hosting of your account record and minute balance, app analytics, crash reporting, and remote configuration.

Your account record and minute balance are held in Firestore in Google's eur3 European multi-region, which replicates the data across Google data centres in Belgium and the Netherlands, with a witness region in Finland. Firebase Authentication, Analytics and Crashlytics run on Google's own infrastructure and are not confined to that region; the transfer safeguards in section 12 cover them.

Firebase does not store your recordings, transcripts or notes. Those never leave your device.

Firebase Analytics and Crashlytics collect usage events, an app-instance identifier and crash diagnostics. We use them only to understand how the app performs and to fix faults. We do not enable Google's advertising or ad-personalisation features, and we do not use this data to track you across other companies' apps or websites.

We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.

We process your account information to create and secure your account and to provide support. We arrange the transcription of your audio and the summarisation of documents you import by the providers in section 6 because that is the service you asked us for. We process usage and minute information to operate the allowance correctly and to prevent abuse. We process purchase information to give you the access you paid for and to handle billing questions. We process device and diagnostic information to maintain, secure and improve the app.

Under the GDPR, our legal basis for the account, the transcription service, minutes and purchases is performance of a contract with you (Article 6(1)(b)). Security, fraud prevention, diagnostics and product improvement rest on our legitimate interests (Article 6(1)(f)). The waitlist rests on your consent (Article 6(1)(a)).

Under the KVKK, processing is based on its being necessary for the performance of a contract to which you are a party (Art. 5/2-c) and, for security and diagnostics, on our legitimate interests (Art. 5/2-f). The waitlist is based on your explicit consent (Art. 5/1). Transfers abroad are covered in section 12.

We still ask for your agreement in the app before the first recording, so that no audio leaves your device without you having seen where it goes.

Because your recordings, transcripts and notes live on your device rather than on our servers, we cannot restore them for you. If your phone is lost, damaged or reset, or you delete the app, that content goes with it.

Keep your iPhone backup switched on (Settings → [your name] → iCloud → iCloud Backup), or export the notes that matter to you from within the app. If you contact us after losing a device, there is nothing we can recover — not because we will not, but because we do not have it.

deepnotesai.com collects an email address if you choose to join the waitlist. We use it for one thing: to tell you when Deep Notes is available. The legal basis is your consent, you can withdraw it by replying to any message we send or by writing to info@deepnotesai.com, and we delete waitlist addresses once the waitlist closes or on request, whichever comes first. The addresses are held by the platform that hosts the site, which acts as our processor.

The site uses only the cookies and local storage necessary to serve the page. We do not run advertising cookies and we do not track you across other websites.

We are based in Türkiye, and your data is processed outside Türkiye, so it is transferred internationally.

Your account record and minute balance are held in the European Union, in Firestore, as described in section 8.

Your recordings, imported documents and transcripts are processed in the United States by AssemblyAI, and the summary step runs on the model provider's global infrastructure, which is not tied to any one country (section 6). Apple and Adapty process your purchase and subscription information in the United States, and Firebase Authentication, Analytics and Crashlytics run on Google's own infrastructure.

For transfers out of the EU and UK we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the technical measures described in section 13 and the retention and no-training commitments described in section 6.

For transfers abroad under the KVKK we currently rely on your explicit consent (açık rıza), which you give when you create your account and, for recordings, on the screen shown before your first upload. We are working to put the standard contract (standart sözleşme) issued by the Personal Data Protection Board in place with the providers named above, and we will update this section when that is done.

Where a provider acts as our processor, our contracts require it to protect your data to a standard consistent with this policy, to process it only for the agreed purposes, and to be bound by appropriate confidentiality and security obligations. Apple processes your purchase through its own payment infrastructure as a seller in its own right, not on our instructions, and its handling of that data is governed by Apple's privacy policy.

Data in transit — between your device and our servers, and between your device and AssemblyAI — is encrypted using TLS. Your account record and minute balance are encrypted at rest, and access to production systems is restricted to the people who need it.

On your device, recordings and notes are written using iOS file protection, so they are encrypted with your device passcode and are not readable while the device is locked.

Because your content is on your device, its security depends substantially on your device's security: use a passcode or Face ID, and keep iOS up to date.

No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as required by the GDPR and the KVKK.

We do not make decisions about you by automated means that produce legal effects or similarly significant effects. The AI features in Deep Notes generate text for you to read; they do not decide anything about you.

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data deleted, to object to or ask us to restrict certain processing, to receive your data in a portable format, and to withdraw consent at any time without affecting processing already carried out. Under the KVKK you additionally have the right to learn whether your data has been processed, to know the third parties it has been transferred to, and to request that any automated analysis producing an unfavourable result be reviewed.

Because most of your content is on your device and not in our hands, you exercise most of these rights directly and immediately: notes are deleted in the app, and your account is deleted in Settings → Account → Delete account. To withdraw your agreement to AI processing, write to us at info@deepnotesai.com. A request to us to delete your recordings is one we cannot act on, for the simple reason that we do not have them.

For the data we do hold — your account record, usage history, purchase records or diagnostics — write to info@deepnotesai.com and we will respond within 30 days.

If you are in Türkiye, the KVKK sets out specific ways to make a formal application ( veri sorumlusuna başvuru): in writing to the address in section 20; by registered electronic mail (KEP); using a secure electronic signature or mobile signature; or by email from the address you registered with us. Applications are answered free of charge within thirty days, unless the response requires a separate cost, in which case the tariff set by the Authority applies. If you are not satisfied, you may complain to the Kişisel Verileri Koruma Kurumu.

If you are in the EU or UK, you may complain to your local data protection authority.

Deep Notes records whatever your microphone captures, which may include people other than you. You are responsible for having the legal right to make that recording. Many countries and several US states require every participant's consent, and in Türkiye recording a private conversation without consent is a criminal offence under Article 133 of the Turkish Penal Code. The app reminds you of this before you record, but the obligation is yours, not ours.

If you record meetings for work, your employer's own data-protection obligations may also apply, and it is worth checking before you rely on the app for that purpose.

Deep Notes is a general-audience productivity app and is not specifically directed to children.

If you are under the age at which you can legally consent to the processing of your personal data where you live, you may use Deep Notes only with the permission and involvement of a parent or legal guardian. Where applicable law requires parental or guardian consent for particular processing, that consent must be provided before the relevant feature is used.

We do not knowingly process a child's personal data in circumstances where legally required parental or guardian consent has not been provided. If you believe that a child has used Deep Notes without consent required by applicable law, contact us at info@deepnotesai.com and we will take appropriate steps.

We will update this page when our practices change and revise the date at the top. If a change is significant — a new AI provider, or a new purpose for your data — we will tell you in the app and, where the law requires it, ask for your consent before it takes effect.

On syncing. Deep Notes currently stores your content only on your device. If we introduce synchronisation between devices or a web version, sending your content to our servers will be something you switch on, not something that happens to you. We will explain what changes and update this policy before it becomes available.