Privacy Policy
Last Updated: 16 February, 2024
Scope of This Policy
This Privacy Policy explains how Noto AI, Inc. (“Noto,” “we,” or “us”) collects, uses, and discloses information in connection with the Service, as defined in our Terms of Service. This Policy should be read together with the Terms of Service; in the event of a direct conflict between the two specifically regarding the handling of personal information, this Privacy Policy governs.
This Policy covers two distinct categories of data, described further below: (a) information about our business Customers and their authorized users, which Noto collects directly and controls for its own purposes (Section 2.1), and (b) data that Customers submit to or generate through the Service about their own clients — including client contact information and session notes — which Noto processes solely on the Customer’s behalf and does not own or control (Section 2.2).
Information We Collect
2.1 Information About You and Your Organization
When you or your organization sign up for and use Noto, we collect:
• Account and contact information: name, email address, phone number, business name, and role.
• Payment and financial information: bank account or card details, transaction history, and related settlement data, processed on our behalf by our payment processing partner (currently Finix Payments, Inc.) as described in our Terms of Service.
• Identity verification (KYC/KYB) information: information about your business entity and its significant owners or controllers, collected to comply with Know Your Business, Know Your Customer, and Anti-Money Laundering regulations.
• Google user data: if you connect a Google account, basic profile information (name, email address) and Gmail data (email content, recipients, attachments) necessary to compose emails from your inbox and recreate your inbox within Noto.
• Usage and device data: log data, IP address, and information about how you interact with the Service.
2.2 Client Data Processed on Behalf of Customers
If you use Noto to manage your own clients — for example, to send them notification or invoice emails, or to record session notes — Noto processes that client data (“Customer Data,” as defined in our Terms of Service) solely as instructed by you, the Customer. Customer Data remains your property under our Terms of Service. If you are an individual whose information appears in Customer Data (for example, as a client of one of our business Customers), and you have questions about that data, please contact the Customer directly; Noto acts on the Customer’s instructions with respect to this data and is not able to independently respond to such requests.
Google API Services User Data Disclosure
Noto’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features described in this Policy, is not used for serving advertisements, and is not transferred to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets as described below.
How We Use Information
We use the information described in Section 2 to:
• Provide, operate, and maintain the Service, including sending and managing email communications, scheduling, and combining email with text messages into a single communication platform.
• Facilitate and verify payment transactions and comply with KYB, KYC, and AML obligations.
• Provide smart inbox suggestions and similar features, such as proposing meeting times.
• Improve and secure the Service and prevent fraudulent activity.
• Communicate with you about your account or the Service.
We will not use your data for purposes other than those described in this Policy without your explicit consent.
Data Sharing and Disclosure
We do not sell your personal information to third parties. We may share information with:
• Service providers who help us deliver the Service, including cloud hosting providers and our payment processing partner (currently Finix Payments, Inc.), each bound by contractual obligations to keep information confidential and use it only for the purposes for which we disclose it to them.
• Law enforcement or other government entities when required by law or to protect our rights.
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this Policy or a policy providing comparable protections.
Data Retention and Deletion
We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. When a retention period expires for a given type of data, we securely delete or destroy it.
You may request deletion of your personal information at any time by contacting us at aj@withnoto.com. We will process your request within 30 days, subject to any legal obligations to retain certain data. This individual deletion right is separate from a business Customer’s right to export its Customer Data upon termination, which is governed by Section 4.3 of our Terms of Service.
Data Access and Control
You have the right to access, correct, or delete your personal information. To exercise these rights, contact us at aj@withnoto.com. We will respond to your request within 30 days.
You can also use Google’s security settings and tools to control the data you share with Noto, including revoking Noto’s access to your Google account at any time.
Data Security
We implement technical and organizational measures designed to protect personal information, including:
• Encryption of data in transit and at rest.
• Regular third-party security assessments and penetration testing.
• Access controls and authentication mechanisms.
• Employee training on data protection and privacy.
Noto has not yet completed a SOC 2 audit and does not currently hold a SOC 2 report or other formal third-party security certification; we may pursue formal certification in the future. While we use commercially reasonable means to protect personal information, no method of transmission or storage is completely secure, and we cannot guarantee its absolute security.
Breach Notification
If we become aware of a breach affecting your personal information, we will notify you without undue delay, consistent with the Security Incident notification commitments described in our Terms of Service, and in compliance with applicable law.
Children's Privacy
The Service is intended for use by businesses and their authorized adult users. We do not knowingly collect personal information directly from children under 13. To the extent Customer Data submitted by a business Customer includes information about a minor (for example, as a client of that Customer), Noto processes that information solely on the Customer’s behalf as described in Section 2.2.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date.
Contact Us
If you have any questions about this Privacy Policy, please contact us at aj@withnoto.com.
