Legal
Privacy Policy
Last updated: 2026-08-25
This policy explains how NoteLumo collects and uses personal data, who receives it, how long it is kept, and the choices available to you. It applies to the NoteLumo website, accounts, study-generation features, support, and subscriptions.
1. Who is responsible for your data
The data controller for NoteLumo is NoteLumo ("NoteLumo", "we", "us"). The controller decides why and how personal data is processed.
- Controller: NoteLumo
- Postal address: The operator must publish its full legal postal address here before production launch. Until then, request it using the privacy email below.
- Privacy email: victorandras48@gmail.com
2. The short version
- We use account and study data to provide the service you request.
- We do not sell personal data, run behavioural advertising, or use study content to decide grades, admissions, employment, credit, or other legal rights.
- Study text or images may be sent to OpenAI when AI generation, AI image-text extraction, moderation, or web research is enabled.
- You can ask for access, correction, deletion, restriction, portability, or object to certain uses by emailing us.
3. Personal data we process and where it comes from
| Category | Examples | Source |
|---|---|---|
| Account and profile | Email address, display name, password hash, language, verification status, account dates, and plan. | You |
| Study content | Titles, pasted or extracted source text, selected subject and level, generated explanations, summaries, flashcards, quizzes, answers, source links, and quality warnings. Uploaded image files are processed for text extraction and are not saved by NoteLumo after that request; extracted text may be saved in a study pack. | You and generated results |
| Usage and technical data | Internal user or visitor ID, feature events, generation/OCR/export counts, feedback, session and request identifiers, IP address used briefly for rate limiting, server logs, timestamps, request path, status, and timing. | Collected automatically from your device and use of NoteLumo |
| Safety and quality-review data | Moderation result, report reason, ratings, review notes, and a snapshot of a reported generation, which can include its source text and output. | You, automated checks, and authorised reviewers |
| Subscription and billing data | Stripe customer and subscription IDs, plan, subscription status, renewal/end date, and billing events. Card and bank details are entered directly into Stripe and are not stored by NoteLumo. | You and Stripe |
| Communications | Support email, subject, message, ticket status, transactional email type, delivery status, provider message ID, and redacted delivery errors. | You and the email provider |
Account email and authentication data are required to create and secure an account. Study content is required to generate a pack. Billing data is required only if you buy a subscription. If you do not provide required data, the corresponding feature cannot be supplied.
4. Why we use personal data and our legal bases
| Purpose | Data used | GDPR legal basis |
|---|---|---|
| Create and manage accounts; generate, save, display, share, regenerate, and export study packs; apply plan limits. | Account, study content, settings, and usage counts. | Contract — Article 6(1)(b), including steps requested before entering a contract. |
| Authenticate users, maintain sessions, prevent abuse, rate-limit requests, moderate risky input, and protect the service. | Account, session, technical, and moderation data. | Contract — Article 6(1)(b); and legitimate interests — Article 6(1)(f), namely service security, fraud prevention, and protecting users and NoteLumo. |
| Measure reliability, diagnose errors, respond to feedback, and review reported generations. | Usage events, feedback, provider diagnostics, and flagged-generation snapshots. | Legitimate interests — Article 6(1)(f), namely maintaining and improving a reliable learning service. You may object based on your situation. |
| Provide paid subscriptions, reconcile billing state, prevent payment fraud, and keep required financial records. | Account and subscription data; Stripe billing events. | Contract — Article 6(1)(b); legal obligation — Article 6(1)(c) for accounting and tax records; and legitimate interests — Article 6(1)(f) for fraud prevention and claims. |
| Verify email, reset passwords, send service notices, and answer support requests. | Account, email-delivery, and support data. | Contract — Article 6(1)(b); legitimate interests — Article 6(1)(f) for reliable delivery and support; and legal obligation — Article 6(1)(c) where a response or notice is legally required. |
| Comply with law, respond to lawful requests, and establish, exercise, or defend legal claims. | Relevant records from the categories above. | Legal obligation — Article 6(1)(c); and legitimate interests — Article 6(1)(f) for legal claims. |
Core NoteLumo processing is not based on consent. If we introduce an optional feature that relies on consent, we will ask separately; refusal will not affect unrelated features, and consent may be withdrawn at any time without affecting earlier lawful processing.
5. Study content, AI, and sensitive information
Depending on deployment settings, NoteLumo may use OpenAI for generation, image-text extraction, moderation, and web research. The relevant study text, image, instructions, selected settings, and limited technical metadata are sent to the provider to return the requested result or safety decision. Local generation, local moderation, and local Tesseract OCR do not send content to OpenAI.
OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in. Under its default API controls, relevant customer content may appear in abuse-monitoring logs retained for up to 30 days, subject to limited safety or legal exceptions. NoteLumo sends store=false for generation and image-text requests so Responses API application state is not intentionally stored. NoteLumo does not opt study content into model training without first updating this policy and establishing a lawful basis.
Do not include information that identifies you or another person unless it is genuinely necessary. NoteLumo is not designed for medical records, biometric identifiers, political or religious beliefs, sexual-life information, criminal allegations, government identifiers, payment-card details, or other highly sensitive personal data. Do not upload confidential school records or another person's private material without authority.
When web research is used, a topic or query derived from the study request may be sent through OpenAI's web-search service. Returned public source links may be saved with the pack.
6. Who receives personal data
Access inside NoteLumo is limited to authorised people who need it for support, security, billing, or quality review. We also use the following main service providers for the current production architecture:
| Recipient | Purpose and data | Transfer information |
|---|---|---|
| Render Services, Inc. | Application and managed-database hosting, backups, and infrastructure logs; potentially all data stored or transmitted through NoteLumo. | US provider with global subprocessors; safeguards include the EU-US Data Privacy Framework where applicable and EU Standard Contractual Clauses. |
| OpenAI Ireland Ltd. | AI generation, image-text extraction, moderation, and web research when enabled; submitted content, instructions, results, and limited request metadata. | EEA contracting entity with affiliates and subprocessors outside the EEA; adequacy decisions or EU Standard Contractual Clauses are used as applicable. |
| Plus Five Five, Inc. (Resend) | Transactional email; recipient address, verification or reset message, service notice, and delivery metadata. A different named email provider must be disclosed here if deployment settings change. | US provider and subprocessors; EU Standard Contractual Clauses are used where required. |
| Stripe Payments Europe, Limited and Stripe group companies | Checkout, subscription management, fraud prevention, invoices, and payments when billing is enabled; account email, internal user ID, plan, customer/subscription identifiers, and payment information entered directly with Stripe. | EEA and global Stripe entities and subprocessors; Stripe uses approved transfer mechanisms for relevant international transfers. |
We may also disclose the minimum necessary data to professional advisers, auditors, insurers, courts, regulators, law enforcement, or a buyer or successor in a genuine corporate transaction, when lawful. Some providers act as processors on our instructions; Stripe and infrastructure providers may also act as independent controllers for their own fraud, security, compliance, or account operations, as described in their notices.
We do not sell or rent personal data and do not disclose it for third-party behavioural advertising.
7. International transfers
Some providers and their subprocessors process data in the United States and other countries outside the European Economic Area. Where a country does not benefit from an EU adequacy decision, we use an applicable safeguard such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. A provider may instead rely on an adequacy framework, including the EU-US Data Privacy Framework, only while the recipient and transfer are covered by it.
Email the privacy contact to request more information or a copy of the relevant transfer safeguards. Commercial details may be redacted.
8. How long we keep data
The following is NoteLumo's retention schedule. We delete or anonymise data at the end of the stated period, unless a longer period is required for law, an unresolved dispute, security investigation, or legal claims. In that case, access is restricted and the data is deleted when the hold ends.
| Record | Retention period |
|---|---|
| Account, profile, study packs, pack settings, usage counts, and ordinary feedback | While the account is active; deletion within 30 days after a verified account-deletion request, except records listed below. Encrypted backups expire on their normal cycle within 90 days. |
| Uploaded images used for text extraction | Processed only for the extraction request and not intentionally persisted by NoteLumo after the request completes. The extracted text is retained as study content if you use it in a saved pack. |
| Verification codes and password-reset tokens | Codes expire after 10 minutes, verification links after 24 hours, and reset links after 60 minutes; token records are deleted within 30 days after expiry or use. |
| Cookies and account-session records | The account-session cookie expires after 14 days and the language cookie after 12 months. Expired or revoked server-side session records are deleted within 12 months. |
| Operational analytics and server/security logs | Event-level analytics for 12 months; routine server logs for 90 days. Fully anonymised aggregate statistics may be kept indefinitely. |
| Transactional email delivery records | 12 months after the delivery attempt. |
| Support requests | 24 months after the request is closed. |
| Flagged-generation review records | Pending reports for up to 90 days; reviewed records for up to 24 months. A case promoted to an evaluation fixture is first de-identified, after which the non-personal fixture may be kept indefinitely. |
| Billing, invoice, tax, and accounting evidence | For the statutory period that applies to the controller. Where Romanian accounting law applies, generally 5 years calculated from 1 July of the year following the relevant financial year; longer only where another specific law or active claim requires it. |
9. Cookies and similar storage
NoteLumo uses an essential session cookie for sign-in, CSRF protection, security, and an internal visitor identifier, plus a language-preference cookie. These are used to provide the service and remember your choice, not for third-party advertising. You can block or delete them in your browser, but sign-in and protected forms may stop working.
If you open Stripe Checkout or the billing portal, Stripe may set its own cookies under Stripe's privacy and cookie notices.
10. Your GDPR rights
Depending on the circumstances, you may have the right to:
- receive information and access a copy of your personal data;
- correct inaccurate or incomplete data;
- have data erased when the legal conditions apply, including data provided while you were a child;
- restrict processing in specified cases;
- receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where processing is automated and based on contract or consent;
- object, for reasons relating to your situation, to processing based on legitimate interests;
- withdraw consent at any time for any future optional processing that relies on consent; and
- not be subject to a solely automated decision that produces legal or similarly significant effects, except where the law allows it with safeguards.
To exercise a right, email victorandras48@gmail.com from your account address and describe the request. A parent or guardian may submit a request for a child. We may ask only for information reasonably needed to verify identity and authority.
We normally respond without undue delay and within one month. A complex request may be extended by up to two further months, in which case we will explain the extension within the first month. Requests are normally free, subject to the GDPR rules for manifestly unfounded or excessive requests. Rights are not absolute; if we refuse or limit a request, we will explain why and describe complaint and court options.
You may complain to the supervisory authority where you live or work, or where the alleged infringement occurred. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 Gheorghe Magheru Blvd., District 1, Bucharest 010336, Romania. ANSPDCP complaint information.
11. Children and students under 18
NoteLumo is a learning service and may be used by children. Children receive special protection, so this section is especially important:
- If you are under 18, ask a parent or guardian to review this policy and the Terms and to authorise and supervise your use, especially when AI features are enabled. If you are under 16 in Romania, do not create an account on your own. Other countries may set a consent age between 13 and 16 for consent-based online services.
- Core processing is based on providing the requested service, not consent. If an optional feature relies on consent and is offered directly to a child below the applicable age, we will require authorisation from the holder of parental responsibility and take proportionate steps to verify it.
- We do not ask for a date of birth in the current account flow. Because NoteLumo cannot reliably determine age from an email address, children and parents must follow the rule above. Contact us before signup if you are unsure.
- Do not put your full name, address, school ID, health information, private photos, or personal information about classmates or teachers into study text or images.
- We do not use children's data for behavioural advertising, marketing profiles, or commercial data sales.
- A parent or guardian may contact us to access, correct, or delete a child's data. If we learn that data was collected without required authorisation, we will restrict the account and delete the data unless law requires retention.
Child-friendly summary: NoteLumo needs your email and the notes you choose to send so it can make study materials. Your notes may go to an AI provider. Do not share secrets or private details. Ask a trusted adult for help, and email us if you want to see, fix, or delete your information.
12. Automated processing
NoteLumo automatically generates learning content, extracts text, applies plan limits, rate-limits requests, and may classify or moderate input. These operations affect whether a request is processed or which features are available, but they do not make decisions that produce legal or similarly significant effects. NoteLumo does not assign official grades or make admissions, employment, credit, or disciplinary decisions. You can report a result or contact support for human review.
13. Security
We use measures designed to protect personal data, including password hashing, one-time tokens, CSRF protection, signed cookies, access controls, provider secret management, HTTPS in production, database and transport protections, logging controls, and backups. No online service can guarantee absolute security. Contact us promptly if you believe your account or data has been compromised.
14. Changes to this policy
We may update this policy when the service, providers, or law changes. We will update the date above and provide a prominent in-service or email notice before a material change takes effect when required.
15. Contact
For privacy questions or requests, email victorandras48@gmail.com.