Notem1. Who operates Notem
Intelligent SaaS, a sole proprietorship registered in Pakistan with the Federal Board of Revenue (FBR), operates Notem. This Policy explains how Notem handles personal information through notem.live, app.notem.live, and the service. Contact support@notem.live for privacy questions or requests.
2. Information we collect
Account and settings: name, email, authentication records, assistant preferences, Notes Email Preference, and settings.
Calendar and meeting: calendar connection details; meeting title, date, time, URL, provider, and participant information supplied by a connected calendar; meeting audio or recording; transcript; speaker information; and related metadata.
Uploads and generated notes: uploaded recording, filename, title, technical metadata, Summary, Key Notes, Decisions, and Action Items.
Billing: selected plan, entitlement, subscription state, provider transaction identifiers, and Notem Balance or usage ledger records. Paddle handles raw payment-card information; Notem does not store full card numbers or CVVs.
Technical, security, and support: IP and request information, browser/session information, operational diagnostics, essential cookies, security events, and information you voluntarily send to support.
3. Where information comes from
Information comes from you, your use of Notem, calendar and meeting providers you connect, participants and meeting platforms involved in meetings you direct Notem to process, and service providers that return processing, delivery, or billing status.
Google Sign-In and Google Calendar: with your authorization, Notem accesses your Google account identifier, name, email address, and email verification status for sign-in and account identification. A Google Calendar connection accesses calendar identifiers, names and time zones, and event information such as identifiers, titles, descriptions, start and end times, meeting links, organizer details, participant names and email addresses, attendance responses, and event status to identify and manage eligible meetings. We store imported calendar and meeting information and connection metadata in our application database. We also store encrypted OAuth access and refresh tokens to maintain the connection.
Google Calendar access is read-only. Notem does not create, modify, or delete your Google Calendar events and does not request Gmail permissions or read your email inbox. Connecting a calendar authorizes calendar access; meeting capture and notes delivery follow your attendance and sharing settings.
4. Why we process information
We use information to authenticate and maintain accounts; connect calendars; discover and schedule meetings; operate meeting bots; receive uploads; transcribe audio; generate AI notes; display historical notes; create sharing links when requested; send permitted emails; process billing and administer subscriptions or Notem Balance; prevent fraud and abuse; secure, debug, and support the service; and meet applicable legal obligations.
Google user data is used to provide or improve the user-facing Notem features described here. These restrictions apply to raw Google user data and to data derived, aggregated or anonymized from it. Derived data includes meeting context and generated notes based on that context. Producing derived or aggregated information does not authorize additional Google data access or remove these restrictions; its use, transfer, protection, retention and deletion remain limited to the disclosed features and the exceptions permitted by the Google API Services User Data Policy. Notem's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data or use or transfer it for advertising, data brokerage, creditworthiness, or lending. Human access to Google user data is limited to your affirmative agreement, necessary security or legal purposes, or aggregated internal operations as permitted by that policy.
With your permission, Google Analytics measures public website page visits, section views, scroll depth and button/link clicks so we can understand traffic sources and improve the website. We do not send meeting content, account details, form entries, or private workspace/share-link URLs through this website tracking. Advertising storage, advertising personalization and Google signals are disabled.
5. Legal bases and your responsibilities
Depending on applicable law and context, processing may be necessary to perform our agreement with you, based on legitimate interests in operating and securing the service, required by law, or based on consent. Meeting owners are responsible for required participant notices, permissions, consents, and other lawful bases for recording and processing meeting information.
6. AI and transcription processing
Notem sends relevant customer content to third-party transcription and AI providers to create transcripts and notes. Notem does not train its own AI models on meeting content. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer opts in; Notem does not enable an opt-in for this purpose. Soniox states that customer audio and transcripts are not used to train its models.
Notem does not use Google Workspace APIs or data obtained through them, including raw, derived, aggregated or anonymized data, to develop, improve, or train non-personalized AI or machine-learning models. We do not transfer this data to third parties for those purposes. Processing content to create the transcripts and notes you request is separate from model training.
Provider processing and retention are governed by provider services and terms and may differ from Notem's own retention schedule. Notem does not promise that every provider follows Notem's 7-day and 90-day application periods.
7. Service providers and international processing
- Google: authentication, Google Calendar connection, and cloud application infrastructure.
- Supabase: managed application database hosting.
- Microsoft: Microsoft identity and calendar connection.
- Skribby: meeting-bot operation for supported live meetings.
- Soniox: speech-to-text processing.
- OpenAI: AI analysis and notes generation.
- Resend: transactional and permitted notes email delivery.
- Paddle: Merchant of Record, checkout, tax, invoices, subscriptions, and transaction refunds.
Google-derived account, calendar, and meeting records are stored using our application infrastructure and managed database providers. To provide capture you enable, Skribby receives the meeting link and relevant bot configuration. Soniox receives audio and processing metadata for transcription; OpenAI receives transcripts and relevant meeting context, which may include calendar-derived titles and participant information, for refinement and notes generation. Resend receives recipient addresses and email content, including notes previews and links, for delivery you permit. Shared notes are disclosed to recipients and link holders as described below. We limit these transfers to the information needed for the requested features; OAuth calendar tokens are used for the calendar connection, not sent to transcription, AI, or email providers.
We may disclose information where necessary for security or to comply with applicable law, within Google's Limited Use requirements where Google user data is involved. These providers may process information outside your country. We do not promise Pakistan-only storage or processing. Provider privacy terms also apply to their activities.
8. Notes email and sharing
Notes email delivery follows the owner's email settings and selected Notes Email Preference: Only me, Organization, or All participants. Participant delivery uses known eligible participant email addresses supplied by a connected calendar, including when a pasted meeting link matches a calendar event. Organization delivery is limited to eligible addresses matching the owner's organization email domain; common personal email domains do not establish an organization. We exclude declined participants and do not infer email addresses from names. Standalone links, Audio Upload, and Live Notes without known participant addresses deliver notes to the owner only.
When an owner enables Share Notes, or permits participant notes delivery, Notem creates bearer links to the generated notes. Participant emails contain a revocable notes-only link for each recipient. Anyone with an active link can view the shared generated notes; the private transcript is excluded from the public shared view. Signed-in readers may save a reference to the shared notes in their account. The owner can revoke the link to stop future access, including through saved references. Revocation cannot recall an email or copies already saved by a recipient.
Optional setup reminders, product news and tips are off by default. You can opt in during onboarding and change your marketing email preference in Account Settings. Recovery emails include an unsubscribe link. We record delivery status, consented reminder-link visits and later setup or activation milestones to understand whether reminders help; these associations do not prove that an email caused an action. We do not include meeting content in recovery emails or use an open-tracking pixel. Unsubscribing does not stop essential account or permitted meeting emails.
9. Retention
Audio and recordings: Notem's application lifecycle retains source audio or recordings for no more than 7 days and may delete them earlier after successful processing.
Transcripts: retained for no more than 90 days.
Generated notes: Summary, Key Notes, Decisions, and Action Items are retained so users can access historical notes, until account deletion or another lawful deletion event applies.
Google account, calendar, and connection data: account identifiers, imported calendar metadata, meeting details, participant information, and connection records are retained to maintain your account, calendar integration, and meeting history until account deletion or an applicable deletion request. The 90-day transcript period does not automatically delete these records or generated notes. OAuth tokens are stored encrypted. Disconnecting Google Calendar stops further syncing, clears stored OAuth access and refresh tokens, and attempts to revoke authorization at Google, including when the access token has expired. Provider-side revocation can fail; you can also revoke access in your Google Account. Disconnecting does not automatically erase previously imported meetings, notes or non-credential connection metadata. Those records remain until account deletion or an applicable deletion request. Account deletion removes the stored connection credentials and associated customer calendar and meeting data, and attempts provider-side access revocation. You can also revoke Notem's access in your Google Account and contact support@notem.live to request deletion of retained data.
Assistant conversations: Ask Zoro stores your questions, answers and selected source references until you delete the conversation or account. Saved answers may contain quoted meeting information that remains after the original transcript expires. For a response, OpenAI receives your question, bounded conversation history and selected authorized meeting excerpts. Chat deletion removes this content; minimized credit and payment records are retained separately. These include credit grants, usage deductions, expiry dates, subscription status and payment references, used to operate billing, prevent duplicate charges and handle support or refunds.
Other records: operational, security, and diagnostic records may follow separate schedules. Financial and payment records may be retained for accounting, taxation, fraud prevention, disputes, Paddle requirements, and legal obligations. External providers control their own applicable retention.
11. Security
We use reasonable technical and organizational safeguards designed to protect information, including access controls, secure session handling, encryption in transit, provider authentication, and operational monitoring. Stored calendar OAuth access and refresh tokens are encrypted, and server-side authorization limits access to private calendar and meeting information. No service can guarantee absolute security. Contact support@notem.live if you believe your account or information has been compromised.
12. Your privacy choices and rights
Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information; withdraw consent where processing relies on it; and complain to an appropriate authority. These rights are not identical everywhere and may be subject to lawful exceptions.
You can update available settings in Notem or send a request to support@notem.live. We may need to verify your identity. To request account deletion, contact support@notem.live. After verifying your identity, we remove stored connection credentials and associated customer calendar and meeting data and attempt provider-side access revocation. Some financial, security, legal or operational records may be retained where required or permitted.
13. International users and children
Notem is offered globally. Pakistan law governs our Terms, but mandatory privacy and consumer rights that apply in your location remain available. Notem is a general productivity service not directed to children, and users must be legally capable of using the service. If you believe a child has provided information contrary to applicable law, contact us.
14. Policy changes and contact
We may update this Policy as the service, providers, or law changes. The current version will show its Last Updated date. We will notify affected users of changes to how Notem uses Google user data. Before accessing previously undisclosed types of Google data, or using Google user data for a new purpose, we will update this Policy and request renewed consent. Other material changes will be communicated through an in-app notice or account email, as appropriate. Contact support@notem.live with questions or requests.