Privacy Policy

1. Information we collect

We collect the following information when you use Anotta.me:

• Account data: name, email and profile photo provided by the authentication provider (Google or email/password);
• Media files: audio and video files uploaded for transcription;
• Usage data: interaction events used to improve the service (e.g., transcription type, selected language);
• Payment data: processed directly by our payment provider — we do not store card data.

1.1. Beta waitlist and interest in the Team and Enterprise plans

If you join the waitlist through our website, without creating an account, we only keep the name and email you entered, the text of the consent you accepted, the date and time you accepted it, and the page where you signed up. We also keep a code derived from your IP address, generated by an irreversible calculation and used solely to limit automated signups: the address itself is not stored. If you ask to be notified about Team or contacted by sales about Enterprise, we keep your email, the plan you chose, the text of the consent, the date and time you accepted it and the same IP-derived code.

We use this data to let you know when a beta spot opens up or when the plan you asked about launches, to answer sales requests and to send you product news, based on your consent (Art. 7, I, of the LGPD, Brazil's data protection law). You can withdraw your consent and request deletion at any time through the email address in this policy, and we will remove your signup from the list. This data is stored on Supabase and passes through Vercel, which hosts the website.

2. How we use your information

• To provide and improve the transcription service;
• To process payments and manage your subscription;
• To send relevant communications about the service;
• To ensure the security and integrity of the platform.

3. Audio and video files

Uploaded files are processed solely to generate the requested transcript. After processing, the files are stored in your account for later access. You can delete your files at any time. We do not use your content to train AI models without explicit consent.

Temporary recording backup (optional): when recording through the app, you can turn on, by explicit consent, a temporary backup of the recording in our secure cloud. When it is on, the recording is kept for up to 7 days and is automatically deleted if you don't use it. You can turn this option off at any time — which also immediately deletes the recordings already kept by this feature.

4. Data sharing

We do not sell your data. We only share information with:

• AI providers to transcribe the audio (AssemblyAI) and to generate summaries, minutes and other analyses (OpenAI). OpenAI does not use data sent through its API to train its models and retains it for up to 30 days solely for abuse monitoring. Processing by AssemblyAI follows the contract in force between us and them;
• Infrastructure — Supabase (database, authentication and media storage), Railway (application server) and Vercel (website hosting);
• Security and reliability — Cloudflare (Turnstile, anti-fraud protection on the login screen) and Sentry (application error logging);
• Payments — Stripe, when you subscribe to a paid plan (subscriptions taken out earlier through Mercado Pago are still processed by it). We do not receive or store your card details;
• Communication and social login — Resend (transactional emails) and Google (sign-in with a Google account and, if you authorize it, Google Drive import);
• Legal authorities when required by law.

4.1. International data transfer

The processors listed above process data on servers outside Brazil, mainly in the United States. By using Anotta.me, your data may be transferred to and processed in those countries.

This transfer is based on Art. 33 of the LGPD and supported by data protection contractual clauses signed with each processor, which require security standards compatible with Brazilian law.

5. Cookies and tracking

We use cookies and the browser's local storage to: keep your session signed in, remember preferences (theme, language), protect the login screen against abuse (Cloudflare Turnstile) and log application errors (Sentry).

We also keep an anonymous identifier in your browser to measure how the product is used (for example, how many people open the login screen and complete sign-up). This identifier is not linked to your name or to the content of your meetings.

We do not use advertising cookies, we do not sell your data, and we do not use the content of your meetings for marketing.

6. Data retention

We keep your data while your account is active. After your account is closed, your data is deleted within 30 days, except where retention is required by law.

7. Your rights (LGPD)

Under Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD), you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request the deletion of your data;
• Withdraw consent you have previously given;
• Portability of your data in a structured format.

To exercise these rights, contact us at the email address below.

8. Security

We adopt technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, role-based access control and security monitoring.

9. Data Protection Officer (DPO)

Anotta.me has a Data Protection Officer, in accordance with Art. 41 of the LGPD, responsible for receiving communications from data subjects and from the ANPD (Brazil's National Data Protection Authority). For questions, requests or to exercise your rights (access, correction, portability, deletion and withdrawal of consent), write to privacidade@anotta.ai. We respond within 15 days.