A clear summary of how NoteCrunch handles information.

Welcome to NoteCrunch ("NoteCrunch", "we", "us", or "our").

This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the NoteCrunch mobile application, website, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

The data controller responsible for your personal data is:

Mohamed Allag France Email: contact@notecrunch.app

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR given the nature, scale, and scope of our processing. Data protection questions can be sent to the email address above.

Information You Provide

When you create an account or use the Service, we may collect:

• Name
• Email address
• Educational level
• School or academic information
• Learning goals and preferences
• Documents, notes, course materials, and other content you upload
• AI-generated content created through the Service
• Communications you send to us

Information Collected Automatically

When you use the Service, we may automatically collect:

• Device information
• Operating system version
• App version
• IP address
• Country or region
• Usage statistics
• Feature interaction data
• Session and diagnostic information
• Crash reports and performance data

Analytics and Session Replay Data

We use analytics tools to understand how users interact with the Service.

This may include:

• Pages and screens viewed
• Buttons clicked
• Features used
• Session replay recordings
• Performance metrics
• Error reports

Session replay technology is used solely to improve the functionality, usability, and reliability of the Service. Session replay is disabled by default for users located in the European Economic Area, the United Kingdom, and Switzerland, as it is not strictly necessary to operate the Service.

Cookies and Similar Technologies (Website)

Our website (notecrunch.app) uses cookies and similar technologies (such as local storage) to:

• Operate essential site functions (strictly necessary cookies)
• Remember your preferences
• Measure site usage through analytics (PostHog)

Strictly necessary cookies do not require consent and cannot be disabled, as they are essential to the operation of the site. Analytics cookies are only set with your consent, which you can give or withdraw at any time via the cookie banner or the cookie settings link in the website footer.

The mobile application does not use browser cookies; equivalent functionality is provided through secure on-device storage and the analytics SDK described above.

The Service allows users to upload educational documents and generate study materials using artificial intelligence.

Uploaded documents may include:

• Notes
• Course materials
• Textbooks excerpts
• Assignments
• Educational resources

These documents are stored until you delete them or request account deletion.

Generated content, including flashcards, quizzes, summaries, explanations, and study materials, may also be stored to provide the Service and allow future access.

You are responsible for ensuring that you have the right to upload any content submitted to the Service.

We use your information to:

• Provide and operate the Service
• Create and manage user accounts
• Process uploaded documents
• Generate AI-powered educational content
• Personalize your learning experience
• Improve product features
• Analyze Service usage
• Detect abuse, fraud, and security incidents
• Provide customer support
• Comply with legal obligations
• Enforce our Terms of Service

We may use your email address to send you transactional and service-related messages (for example, account, security, and billing notices) as part of operating the Service.

Where you have created an account, we may also send you similar product emails, such as feedback requests and reminders about features you have not yet used, on the basis of our legitimate interest in supporting existing users, subject to your right to object at any time. We will only send marketing newsletters unrelated to your account activity if you have opted in to receive them. You can withdraw consent or unsubscribe from any non-essential email at any time using the unsubscribe link included in the message or by contacting contact@notecrunch.app, free of charge.

To provide certain features, uploaded content may be processed using artificial intelligence services provided by third-party providers.

This processing may include:

• Content analysis
• Question generation
• Flashcard generation
• Quiz creation
• Educational content generation
• Learning assistance features

AI-generated outputs may contain inaccuracies. Users should independently verify important information.

We use third-party providers to operate the Service.

These may include:

Infrastructure and Storage

• Supabase
• Cloudflare R2

Artificial Intelligence Processing

• OpenAI
• LlamaParse

Analytics

• PostHog

Subscription Management

• RevenueCat

Payment Processing

• Apple In-App Purchases

These providers may process personal data on our behalf in accordance with their own privacy policies and applicable laws.

Under the GDPR, we rely on the following legal bases, depending on the specific processing activity:

• **Performance of a contract (Art. 6(1)(b))**: creating and managing your account, providing the Service, processing uploaded documents, generating AI content, and processing subscription payments.
• **Legitimate interests (Art. 6(1)(f))**: product analytics, session replay, crash and diagnostic data, fraud and abuse prevention, securing the Service, and sending non-essential account emails such as feedback requests and feature reminders. We balance these interests against your rights and freedoms, and you may object at any time.
• **Consent (Art. 6(1)(a))**: analytics cookies on the website and optional marketing newsletters. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• **Legal obligation (Art. 6(1)(c))**: retaining records for tax, accounting, or dispute purposes, and responding to lawful requests from authorities.

Some of our sub-processors (see Section 7) are located in, or process data in, the United States or other countries outside the European Economic Area ("EEA"), the UK, and Switzerland.

Where we transfer personal data outside the EEA, UK, or Switzerland, we rely on one or more of the following safeguards, as applicable:

• The European Commission's Standard Contractual Clauses (SCCs), incorporated into our agreements with sub-processors
• The UK International Data Transfer Addendum, where relevant
• Adequacy decisions issued by the European Commission
• Participation of the recipient in a recognized transfer framework (such as the EU-U.S. Data Privacy Framework), where applicable

You may request a copy of the relevant safeguard by contacting contact@notecrunch.app.

We retain personal data only for as long as necessary for the purposes described in this Policy. In practice, this means:

• **Account data** (name, email, profile information): retained for as long as your account is active, and deleted or anonymized within 30 days of account deletion, unless a longer period is required by law.
• **Uploaded documents and AI-generated content**: retained until you delete the specific item, or until your account is deleted, whichever is earlier.
• **Analytics, session replay, and diagnostic data**: retained for a maximum of 12 months from collection, after which it is deleted or aggregated into anonymized statistics.
• **Billing and transaction records**: retained for up to 10 years where required by French and EU tax and accounting law.
• **Support communications**: retained for up to 3 years from the last interaction, to allow us to handle follow-up questions and legal claims.

Where we no longer have a legitimate need to process your personal data, we will delete it or anonymize it, or, if this is not possible, securely store it and isolate it from further processing until deletion is possible.

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your personal data
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent where applicable

To exercise these rights, contact:

contact@notecrunch.app

We will respond to verified requests within one month, as required by Article 12 GDPR. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests; we will inform you of any such extension within the first month. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

Right to Lodge a Complaint

If you are located in the EEA, UK, or Switzerland and believe our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with your local data protection supervisory authority, or with the French supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France www.cnil.fr

This is in addition to, and does not replace, your ability to contact us directly to resolve any concern.

Automated Decision-Making

We do not use your personal data to make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing (including profiling), without human involvement. The AI features described in Section 6 generate educational study content at your request; they do not make decisions about you as an individual (for example, decisions about eligibility, pricing, or account status are not automated in this sense).

Users may request deletion of their account using the "Delete account" button in the Profile page of the app, or by contacting:

contact@notecrunch.app

Upon deletion, we will delete or anonymize personal information unless retention is required by law or for legitimate security and business purposes.

We implement reasonable technical and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, or destruction.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is not directed toward children under the age of 13.

We do not knowingly collect personal information from children under 13. If we become aware that such information has been collected, we will take reasonable steps to delete it.

Parents or guardians who believe a child has provided personal information may contact us at:

contact@notecrunch.app

If you are a resident of California, you may have rights under applicable California privacy laws, including the right to request access to, correction of, or deletion of personal information.

We do not sell personal information.

We may update this Privacy Policy from time to time.

When changes are made, we will update the "Last Updated" date and may provide additional notice where required by law.

Continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

If you have questions about this Privacy Policy or our data practices, contact:

Mohamed Allag France Email: contact@notecrunch.app