Privacy Policy

1. Information we collect

We collect information you provide, information generated when you use the Service, and information from third parties you connect. Specifically, we collect:

Account and profile information: your name, email address, password or authentication identifiers, organization name, role, profile details, and preferences.

Meeting and workspace content: audio and video from meetings you record, transcripts, summaries, action items, notes, tasks, boards, documents, and messages you create or that the Service generates for you.

Integration data: information from services you connect, such as Google or Microsoft calendars and email, and video-conferencing platforms like Zoom, and collaboration tools like Slack, limited to the scopes and data you authorize.

Billing information: your plan, transaction history, and limited payment details. Payments are processed by Stripe, and we do not store full payment card numbers.

Usage, device, and cookie data: how you interact with the Service, including pages and features used, actions taken, log data, IP address, browser and device type, and identifiers collected through cookies and similar technologies.

Communications: the content of messages you send us, such as support requests and survey responses.

2. How we use information

We use information to: provide, operate, secure, and maintain the Service; join meetings and generate transcripts, summaries, action items, answers, and project updates; sync with the tools you connect; authenticate you and protect against fraud, abuse, and security incidents; process payments and manage subscriptions; provide customer support and respond to your requests; send administrative, security, billing, and (where permitted) product communications; understand, analyze, and improve the Service, including developing new features; and comply with legal obligations and enforce our agreements. We may create and use aggregated or de-identified information, which cannot reasonably be used to identify you, for analytics and to improve the Service.

Consent-based uses you control. With your permission, we also use your information to (a) improve Noots and diagnose problems using your activity and diagnostic data, (b) personalize your experience and show you relevant sponsored content, and (c) share your data with vetted partners (see “How we share information”). These permissions are turned on by default, but each is optional and separate: you can turn any of them off at any time, individually, from Settings → Data & Compliance. Turning one off applies going forward. On paid plans, organization administrators can set the defaults for their members and can turn any category off for their entire organization — useful for confidential teams that prefer everything off. We are transparent about which categories are on, and we honor your choice.

3. Legal bases for processing

Where data-protection laws such as the EU or UK GDPR apply, we process personal data on the following bases: to perform our contract with you and provide the Service you request; for our legitimate interests in operating, securing, analyzing, and improving the Service and communicating with you, balanced against your rights; to comply with our legal obligations; and with your consent where we ask for it, such as for certain cookies or optional features. Where we rely on consent, you may withdraw it at any time, which will not affect processing already carried out.

4. AI and meeting content processing

The Service uses automated systems, including our own models and third-party AI and transcription providers, to process meeting and workspace content and to generate transcripts, summaries, action items, and answers to your questions. We share with these providers only the content needed to perform the requested task, under contracts that restrict their use of it. We do not use the private content of your meetings or workspace to train general-purpose AI models, and we do not permit our AI providers to use it to train their general-purpose models. AI output can be inaccurate or incomplete, and you are responsible for obtaining any recording or transcription consent required by law before capturing a meeting, as described in our Terms of Service.

5. How we share information

We disclose information as described below. Sharing for personalization, sponsored content, and with partners happens only when you allow it: those permissions are on by default but you can turn each off at any time in Settings → Data & Compliance, and organizations on paid plans can control or disable them for their members. When you have turned a category off, we do not share your information for that purpose. Any partner that may receive your data is screened for security and is contractually required to protect it and to use it only ethically and for the permitted purpose. We disclose information as follows:

Service providers and subprocessors: vendors that help us run the Service, such as cloud hosting and infrastructure, Stripe for payment processing, transcription and AI providers, analytics, and email delivery, under contracts that limit their use of the information to providing services to us.

Your organization and collaborators: where you use the Service within an organization or share content, we make information available to other members and to administrators of your workspace as needed for collaboration and administration.

Integrations you enable: third-party services you connect, to provide the features you request.

Vetted partners (only with your permission): where you have left partner sharing on, we may share your information with security-screened partners for personalization, sponsored content, and related purposes. We never share the private content of your meetings or workspace for these purposes, and we never share the data of any user, or any organization, that has turned this off. You can opt out at any time in Settings → Data & Compliance.

Legal and safety: when we believe disclosure is required by law, regulation, legal process, or governmental request, or is reasonably necessary to protect the rights, property, or safety of Cartex, our users, or the public, or to enforce our agreements.

Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the information may be transferred subject to this Policy.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

6. Your data choices and consent

You are in control of the optional, consent-based uses of your data. From Settings → Data & Compliance you can independently turn each of these on or off at any time:

Help improve Noots — lets us use your activity and diagnostics to fix bugs and improve the product.

Personalization and sponsored content — lets us tailor your experience and show you relevant sponsored content.

Partner sharing — lets us share your data with vetted, security-screened partners.

Each is on by default and can be switched off individually; turning one off takes effect going forward and does not affect processing already completed. If you are part of an organization, administrators on a paid plan can set these defaults for members and can switch a category off for the whole organization, in which case it stays off for everyone in that organization. We are committed to being transparent about what is collected and how it is used, to keeping your data secure, and to sharing only with partners who meet our security and ethics requirements — and only when you have allowed it.

7. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, and afterward as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. You can delete individual content, and you can export your data and delete your account at any time from Settings. When you delete your account, we begin deleting your associated personal data from our active systems, and complete that deletion within approximately thirty (30) days, except for information we are required or permitted to retain by law or for legitimate business purposes such as security, fraud prevention, and financial records. Deleting your account also deletes organizations you created and their associated content. Residual copies may persist in backups for a limited period before being overwritten.

8. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption of data in transit and at rest, scoped access controls, signed and expiring sessions, and monitoring and logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for the security of the devices you use. If we become aware of a security breach that affects your personal information, we will notify you and applicable authorities as required by law.

9. Your rights and choices

Subject to applicable law, you may access, correct, update, export, or delete your personal information, object to or restrict certain processing, and withdraw consent where processing relies on it. You can export your data and delete your account directly from Settings, and you can update most account and profile details there. You may also contact us at asherpark@cartexdata.com to make a request, and we will respond within the timeframes required by law. We will not discriminate against you for exercising your rights. If an authorized agent submits a request on your behalf, we may require verification of your identity and of the agent’s authority.

10. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand and measure how the Service is used. Some cookies are strictly necessary for the Service to function; others help us analyze performance and improve features. You can control cookies through your browser or device settings, and where required we ask for your consent to non-essential cookies. Disabling some cookies may limit functionality. We do not use cookies for cross-context behavioral advertising.

11. California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know and access the categories and specific pieces of personal information we have collected, the sources and purposes of collection, and the categories of third parties to whom we disclose it; to correct inaccurate personal information; to delete personal information, subject to exceptions; to obtain a portable copy of your information; and to opt out of the “sale” or “sharing” of personal information and of certain uses of sensitive personal information. To the extent our consent-based personalization, sponsored content, or partner sharing constitutes a “sale” or “share” of personal information under California law, we treat it as such and honor your right to opt out: you can opt out at any time from Settings → Data & Compliance, and we apply your choice going forward. We do not sell or share the private content of your meetings or workspace, and we do not use or disclose sensitive personal information beyond the purposes permitted without an opt-out. You may exercise these rights through Settings or by contacting us at asherpark@cartexdata.com, and you may appeal a decision by replying to our response. We will not discriminate against you for exercising these rights.

12. Texas and other U.S. state privacy rights

If you are a resident of Texas or of another U.S. state with a comprehensive privacy law (such as Colorado, Connecticut, Virginia, Oregon, or Montana), you may have the right, subject to that law, to confirm whether we process your personal data and to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and certain profiling. To the extent our consent-based personalization, sponsored content, or partner sharing constitutes targeted advertising or a sale of personal data under your state’s law, you can opt out at any time from Settings → Data & Compliance, and we honor that choice going forward; you can also contact us at asherpark@cartexdata.com. We do not sell or use for targeted advertising the private content of your meetings or workspace. If we decline a request, you may appeal by replying to our response; if your appeal is denied, you may be able to contact your state attorney general.

13. Children’s privacy

The Service is intended for workplace and business use and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age of consent applies). If you believe a child has provided us with personal information, contact us at asherpark@cartexdata.com and we will take steps to delete it.

14. International data transfers

Cartex is based in the United States, and we and our service providers process and store information in the United States and in other countries. Data-protection laws in these countries may differ from those where you live. Where required, we use appropriate safeguards for international transfers, such as the European Commission’s standard contractual clauses. By using the Service, you understand that your information may be transferred to, stored in, and processed in the United States and other jurisdictions.

15. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will revise the effective date above and provide additional notice where appropriate, such as by email or an in-product notice. Your continued use of the Service after an update takes effect means you accept the revised Policy.

16. Contact us

If you have questions, requests, or concerns about this Policy or our handling of your information, contact Cartex Data, LLC at asherpark@cartexdata.com. This Policy is governed by the laws of the State of Texas and applicable U.S. federal law. Noots.ai is a product of Cartex Data, LLC, based in Texas, USA.