Privacy Policy

Who operates NotePetal

NotePetal is operated by Alexandru Grecu, an individual in Romania, using the name NotePetal ("we," "us," or "our"). The operator is the data controller for the personal information described here. Some providers, including Polar for purchases, act as independent controllers for parts of their services. This policy covers notepetal.com and the NotePetal web app.

Information we handle

• Account and authentication: your email address, display name, account identifier, password authentication data or Google identity, session information, and security settings. Supabase handles authentication. Google sign-in supplies the identity details needed to sign you in if you choose it.
• Notebooks and files: pasted text, uploaded PDFs, Word documents and images, extracted text and figures, notebook content, study cards, revisions, styles, handwriting fonts, sharing settings, and generated exports. Cloud account data and private files are stored through Supabase.
• Usage and billing: AI and OCR usage, request outcomes, model and provider identifiers, token counts and cost records, plan status, and Polar customer and subscription references. Polar handles checkout, payment details, taxes, invoices, and approved refunds. We do not store full card numbers.
• Technical and security information: network and browser information needed to serve requests, sign-in activity, rate-limit counters, and operational errors. Application diagnostics are designed to exclude source content, credentials, and model responses.
• Support: your contact details and whatever you include in a support message or attachment. Send only information needed to resolve the issue.

We do not sell personal information or use your notebook content for advertising. The current website does not load advertising trackers or optional analytics.

Why we process information

We use information to provide accounts, save and edit notebooks, process imports and requested AI or OCR actions, generate exports, manage subscriptions, answer support requests, prevent abuse, and comply with legal obligations.

Where GDPR or similar rules apply, our legal bases are performance of the service agreement, legitimate interests in operating and securing the service and responding to support requests, compliance with legal obligations, and consent where required. You can withdraw consent by contacting us; this does not affect earlier lawful processing.

Optional AI and OCR processing

AI study generation and revisions send relevant approved source text, notebook context, and instructions through OpenRouter to the configured model provider. OCR sends the submitted image or PDF to Mistral when you opt in. For a PDF, page selection tells Mistral which pages to recognize; the request can contain the full PDF file.

Ordinary text imports and "Keep my wording" do not require an AI generation request. We do not use your notebook content to train models. The AI & Upload Policy explains the processing and controls, and the Subprocessors page lists providers.

Sharing and service providers

Notebooks are private to your account by default. If you enable a share link, anyone who has that link can view the shared notebook and its associated displayed content. A recipient can keep a copy even after you revoke access. Exporting or downloading a notebook also creates a copy outside our control.

We share information with providers only as needed for the relevant service. We may also disclose information where legally required or reasonably necessary to protect rights, investigate abuse, or address a security incident. If operation of NotePetal is transferred, relevant information may transfer subject to applicable law and appropriate notice.

Retention and deletion

We keep account data, notebooks, source files, and revisions while needed to provide your account and selected features. You can delete notebooks and request account deletion in Settings. Deletion is performed through a background cleanup process, so removing files and the authentication account may not be immediate. Account cleanup also cancels an active Polar subscription.

Generated PDF exports are a temporary cache: cleanup targets files older than seven days and limits retained exports per notebook. This does not delete the notebook itself or copies you downloaded.

Provider-managed backups may retain copies until their retention cycle ends. Billing providers may retain purchase records for their legal obligations. We may retain limited records needed for fraud prevention, legal compliance, or disputes; non-identifying aggregate service-cost totals can remain after account deletion. Contact us for information about a particular record or deletion request.

International processing and security

Our providers may process information in Europe, the United States, or other countries. Where required by applicable law, international transfers require an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses. Contact us for details of the safeguards applicable to your data.

We use access controls, private storage, and technical safeguards designed to protect information. No online service can guarantee absolute security. Keep your credentials secure and independent copies of important material.

Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or obtain a copy of your information; restrict or object to processing; withdraw consent; and appeal a refused request. Settings provides notebook and account export and deletion controls. You can also send a request to [email protected]. We may need to verify your identity and will respond within the period required by applicable law.

You may complain to your local data protection authority. In Romania, this is ANSPDCP. NotePetal does not use AI to make decisions about you with legal or similarly significant effects.

Browser storage controls are explained in our Cookie Policy.

Age requirements

NotePetal is intended for people aged 18 or older. We do not knowingly collect personal data from children under 18. If you believe a child has supplied information, contact us so we can investigate and take appropriate action.

Changes to this policy

We update the date and version when this policy changes. Where required, material changes affecting existing account data will be accompanied by appropriate notice or a request for consent before the new processing starts.

Contact

Questions, privacy requests, billing concerns, and reports can be sent to [email protected], or by post to: