Privacy policy

Your notes are often personal. This policy explains what we collect, why, where it is stored and what rights you have. In short: we collect only what Palintonotes needs to work, store it in the European Union, and never sell it or use it for advertising.

Who is responsible

The controller for your personal data is the operator named in our legal notice. You can reach us about anything privacy-related at [privacy contact email]. [If you appoint a data protection officer, add their contact details here]

What we process and why

Your account

Your email address, and your name and profile picture if you sign in with Google or Microsoft. We use them to sign you in and to contact you about your account. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Your notes

The messages you send to a Palintonotes bot from a chat you have paired, the notes made from them, and how you organise them (folders, tags, links, routing rules). We store and process them only to provide Palintonotes to you. Messages from chats you have not paired are refused and not stored. Legal basis: Art. 6(1)(b) GDPR.

Billing

Your plan, payment status and the invoicing details required by law. Card details are handled by our payment provider and never reach our servers. Legal basis: Art. 6(1)(b) GDPR, and our legal obligations to keep accounting records (Art. 6(1)(c) GDPR).

Security and operations

Technical data such as IP address, browser user agent and timestamps of sign-ins and requests, kept in short-lived logs to keep the service secure and working. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Where your data is stored

Your notes and account data are stored on servers in the European Union. We use the following service providers, each bound by a data processing agreement:

• Hosting: [hosting provider, legal entity and data centre location]
• Sign-in: Zitadel, our identity provider, in its EU region [legal entity]
• Payments: [payment provider and legal entity]

If you choose to sign in with Google or Microsoft, or to capture from a chat app such as Telegram, that company processes your data under its own privacy policy as part of the service you use with it.

Cookies and local storage

We use no advertising or analytics cookies and no third-party trackers, so we don't ask for cookie consent. We only store what is strictly necessary for the service you request:

• A session cookie that keeps you signed in, set when you sign in and removed when you sign out or it expires.
• A short-lived cookie (10 minutes) that secures the sign-in process itself.
• Your theme and colour preferences, kept in your browser's local storage so the app looks the way you chose.

How long we keep it

We keep your account and notes for as long as you have an account. When you delete your account, we delete your notes and account data within [number] days, including from backups within [number] days. Invoices are kept for [number] years, as tax law requires. Security logs are kept for [number] days.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• restrict or object to how we process it;
• receive it in a portable, machine-readable format;
• lodge a complaint with a data protection authority, such as [your national supervisory authority].

To exercise any of them, write to [privacy contact email]. We answer within one month.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email before the change takes effect.