1. Introduction and Scope

This Privacy Policy explains how Notari Labs Inc. ("Notari Labs," "Notari," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information through notarilabs.com, Notari applications, Notari-branded devices, online stores, support channels, and related services (collectively, the "Services"). It applies to the current United States launch.

Notari is the controller or business responsible for the personal information covered by this Policy, except where we act solely on documented instructions under a separately signed business agreement. This Policy does not apply to a third-party website, app store, marketplace, integration, or service governed by that party’s own privacy notice.

2. Information We Collect

2.1 Account and Profile Information

We collect information such as your name, email address, authentication data, subscription status, preferences, profile labels, consent records, and communications settings. We do not need or upload your phone contact list for the current Services.

2.2 User Content

Depending on the feature you use, we process audio recordings, transcripts, speaker separation and labels, summaries, notes, prompts, corrections, files, images, photographs, and other content you submit or create. Content may include information about other people.

2.3 Voice and Speaker Information

By default, Notari may distinguish speakers within a single recording using generic labels without creating a persistent identity profile. If an eligible account holder separately opts in to “Remember this voice across recordings,” we create a persistent voice profile as described in the Biometric Data Notice and Consent. At launch, users cannot create a persistent voice profile for another person.

2.4 Device, Network, and Usage Information

We collect device and app identifiers, hardware model and serial number, operating system, app version, firmware, language, IP address, approximate region inferred from IP, connection and synchronization status, diagnostic and crash data, security events, feature use, timestamps, and interactions with the Services. We do not continuously collect background GPS location.

2.5 Permissions and Integrations

If you choose a feature that needs device permission, we may access the microphone, camera, photo library, files, notifications, Bluetooth, or calendar within the scope you authorize through the operating system. Photos are captured or selected by you; library access depends on whether you grant limited or full access. You can change permissions in device settings, but a feature may stop working.

Notari supports Google Calendar and Apple Calendar. Calendar access is used only if you enable the integration to schedule, associate, or organize recordings and meetings. Access is read-only by default and limited to calendars and events you select. If you expressly ask Notari to create or modify an event, we request write permission for that function at that time. We do not upload your complete contact list. We send only the event information reasonably necessary for the cloud feature you request. If you disconnect a calendar, we stop future access and ordinarily delete cached calendar information from active systems within 30 days and from backups through rotation within 90 days, subject to legal exceptions.

If Notari receives information from Google APIs, Notari’s use and transfer of that information will comply with the Google API Services User Data Policy, including its Limited Use requirements. We use connected calendar information only to provide and secure user-requested features, do not use it for advertising, and do not allow people to read it except with the user’s affirmative agreement, for security or support when necessary, or as permitted by that policy and applicable law.

2.6 Purchases, Shipping, and Support

We collect order, product, warranty, billing status, shipping address, delivery, return, fraud-screening, support, and customer-service records. Payment-card details are generally collected by Shopify or another payment provider rather than stored directly by Notari.

2.7 Website Cookies, Analytics, and Advertising

Our website and online store use cookies, pixels, SDKs, and similar tools to operate the site, remember settings, measure performance, attribute sales, prevent fraud, and advertise. Providers may include Shopify, Google, Meta, and Triple Whale. These website tools may collect identifiers, IP address, device/browser information, pages viewed, interactions, purchases, and advertising data. The Notari app does not currently use behavioral advertising.

3. Sources of Information

We collect information:

• directly from you, including when you create an account, record, upload, purchase, connect a service, contact support, or grant permission;
• automatically from devices, apps, cookies, logs, and security systems;
• from a person whose recording, upload, or other content includes information about you, subject to that person’s legal obligations; subject to that person’s legal obligations;
• from connected services you authorize, such as a calendar, app store, or sign-in provider; and
• from sales channels, payment providers, fulfillment partners, carriers, advertising partners, fraud-prevention providers, and public or lawful sources.

4. How We Use Information

We use personal information to:

• provide, synchronize, transcribe, summarize, organize, search, label, and otherwise operate requested features;
• create and manage accounts, subscriptions, credits, purchases, shipping, returns, and warranty service;
• authenticate users, connect devices, maintain security, prevent fraud and abuse, and investigate incidents;
• respond to support requests and communicate service, policy, security, retention, and transaction notices;
• maintain compatibility, diagnose failures, and improve the quality and safety of the Services using operational metrics, user-directed feedback, and de-identified or aggregated information;
• conduct website analytics, measure advertising, and market Notari, subject to your choices;
• comply with law, enforce agreements, protect rights and safety, and establish or defend legal claims; and
• carry out another purpose disclosed when information is collected or that you authorize.

5. Cloud Processing and AI Providers

Audio must be uploaded to the cloud when you request cloud-based transcription, summarization, or other AI processing. You may disable cloud synchronization, but features that require cloud processing will not function for content that is not uploaded.

Notari uses enterprise or API offerings and approved infrastructure providers for functions such as hosting, speech-to-text, summarization, and inference. These may include AWS, Google Cloud, OpenAI, Anthropic, Google, xAI, ElevenLabs, AssemblyAI, and approved infrastructure that hosts open-weight models. Current providers, roles, regions, and verification status appear in the Data Residency and Subprocessor List.

No AI training without a separate opt-in: Notari does not use your recordings, transcripts, persistent voice profiles, or other User Content to train Notari’s or any third party’s general-purpose or foundation AI models unless you first receive a separate, specific, clear notice and provide explicit, informed consent. Consent to this Privacy Policy or to use the Services is not consent to AI training.

We configure no-training and zero-data-retention controls where supported and contractually available. A provider may nevertheless retain limited information for security, abuse monitoring, legal compliance, or service operation under its applicable enterprise/API terms. We disclose material provider retention settings in the Subprocessor List after operational verification. Persistent voice profiles are not sent to general-purpose language-model providers.

6. User Responsibility for Recordings

You must provide any required notice and obtain all permissions before recording, uploading, transcribing, identifying, or analyzing another person or content about them. Laws governing recording, wiretapping, biometric data, confidentiality, employment monitoring, and privacy vary and may require every participant’s consent. Notari does not determine whether your recording is lawful.

6.1 No Public Sharing in the Initial Release

The initial public release of the Services does not provide public sharing links or public posting of User Content. Notari does not make recordings, transcripts, summaries, notes, images, or other User Content publicly accessible through the Services. If Notari introduces a sharing feature in the future, we will update this Privacy Policy and provide any additional notice or choices required before the feature becomes available.

7. How We Disclose Information

We may disclose personal information to:

• cloud, AI, transcription, security, analytics, customer-support, e-commerce, payment, fulfillment, delivery, and professional-service providers that process it for contracted purposes;
• Apple, Google, Shopify, Amazon, PayPal, or another platform when you use that platform or purchase channel;
• a third-party integration at your direction, subject to its privacy practices;
• advertising and analytics partners for website measurement and cross-context behavioral advertising, subject to the choices below;
• law-enforcement, regulators, courts, counterparties, or advisers when reasonably necessary to comply with law, protect safety, enforce rights, or handle a dispute;
• a buyer, investor, lender, adviser, successor, or other participant in a merger, financing, reorganization, sale, bankruptcy, or similar transaction, with appropriate protections; and
• another person when you direct us or give consent.

We do not sell personal information for money. However, some website advertising and analytics disclosures may be considered a “sale” or “sharing” under California or similar state law. We do not sell or share recordings, transcripts, summaries, or persistent voice profiles for cross-context behavioral advertising.

8. Cookies and Privacy Choices

You can use our website privacy controls and browser settings to manage nonessential cookies. Where required, our website honors a qualifying Global Privacy Control or other recognized opt-out preference signal as a request to opt out of sale or sharing for the browser or device that sends it. California users may also use：You can use available website privacy controls and browser settings to manage nonessential cookies. To submit a privacy request, including an applicable request to opt out of sale, sharing, or targeted advertising, contact support@notarilabs.com. We may provide additional online privacy controls as they become available.

Blocking cookies may affect site functions. Advertising opt-outs are device- and browser-specific unless we can associate the choice with your account. We may still use contextual advertising and measure activity in ways permitted by law.

9. Data Retention

The initial public beta does not offer paid subscriptions or paid digital credits. The free-account retention periods below apply to public-beta users. Provisions addressing paid accounts apply only if paid plans are introduced.

Paid account recordings and text

While the paid account is active, until the user deletes content, closes the account, or the Service is terminated, subject to legal exceptions.

Free account original audio

30 days from upload or processing.

Free account transcripts and summaries

One year from creation or processing.

After a paid plan expires

Audio enters a 30-day deletion period; transcripts and summaries may be retained for up to one year from expiration.

User deletion or account deletion

Content becomes unavailable promptly; ordinarily deleted from active production systems within 30 days and backup rotation within 90 days.

Persistent voice profile

Use stops and profile becomes unavailable immediately; active-system deletion ordinarily within 7 days and backup rotation within 90 days, subject to the Biometric Notice.

Transactions, tax, fraud, disputes, and legal records

Longer when reasonably necessary for accounting, warranty, security, compliance, claims, or applicable retention law.

We plan to notify a paid user when a plan expires and again approximately 7 days before expiration-related audio deletion. Retention periods are maximum ordinary periods, not promises that every item will be kept for the full period. De-identified or aggregated information that cannot reasonably identify a person may be retained.

10. Security

We use reasonable administrative, technical, and physical safeguards designed for the nature of the information, including access controls, encryption in transit and at rest where appropriate, monitoring, provider review, and deletion procedures. No method of transmission or storage is completely secure. You are responsible for protecting your account credentials and promptly reporting suspected unauthorized access.

11. Data Location and International Processing

Notari primarily hosts its current production systems in the United States. As we expand, we may establish regional hosting environments or allow certain customers to select or be assigned a service region. Data residency generally refers to storage of designated customer content at rest; it does not necessarily mean that all processing, support, security operations, billing, analytics, or third-party AI processing occurs exclusively in that region.

Information may be processed or accessed from other jurisdictions subject to applicable law and appropriate contractual safeguards. Before formally offering the Services in another country, we will update applicable notices and regional terms. See the Data Residency and Subprocessor List for current operational details.

12. Your Controls and Requests

Depending on your account and applicable law, you may access, correct, export, or delete certain account data and User Content; disconnect integrations; change app permissions; disable cloud synchronization; manage a persistent voice profile; unsubscribe from marketing; or close your account. Contact support@notarilabs.com if a self-service control is unavailable.

We may verify your identity and authority before completing a request. We may retain or decline to delete information when permitted or required for security, transactions, warranties, legal obligations, claims, or other lawful exceptions. An authorized agent may submit a request where applicable, subject to verification of the agent’s authority and the consumer’s identity.

13. U.S. State Privacy Disclosures

Where a U.S. state privacy law applies, residents may have rights to know or access personal information; obtain a portable copy; correct inaccuracies; delete information; opt out of sale, targeted advertising, or certain profiling; limit certain uses of sensitive information; appeal a denial; and receive nondiscriminatory treatment. Rights and exceptions vary by state. Submit a request to support@notarilabs.com or through available account or website controls. If we deny an appealable request, our response will explain how to appeal.

13.1 California Notice at Collection and Rights

The categories of personal information we may collect are identifiers; customer records; commercial information; internet or electronic-network activity; approximate geolocation; audio, visual, and similar information; professional information you include in content; inferences; and sensitive personal information such as account credentials, communications content, or biometric information used for identification when you opt in. We collect and retain these categories for the purposes and periods described in Sections 4 and 9.

Identifiers, commercial information, internet activity, approximate location, and related inferences

Disclosed for business purposes: Cloud, commerce, payment, security, analytics, support, fulfillment, and professional providers

Sold/shared for cross-context advertising: Website advertising/analytics partners, subject to opt-out

Recordings, transcripts, summaries, photos, and calendar content

Disclosed for business purposes: Approved cloud, AI, transcription, security, and integration providers needed for requested features

Sold/shared for cross-context advertising: No

Persistent voice profiles / biometric information

Disclosed for business purposes: Restricted infrastructure or specialist processors under the Biometric Notice

Sold/shared for cross-context advertising: No

Payment credentials

Disclosed for business purposes: Payment processors; Notari generally does not receive full card details

Sold/shared for cross-context advertising: No

California residents may request to know, access, correct, or delete covered information; opt out of sale or sharing; limit use or disclosure of sensitive information where the right applies; and receive equal treatment. We use sensitive information only for reasonably expected Services, security, quality, compliance, and other permitted purposes unless we provide a right to limit. Use the website privacy link above or a qualifying GPC signal to opt out of sale/sharing.

If the California Consumer Privacy Act applies to Notari’s processing, we will confirm receipt and respond within the periods required by law. Notari does not knowingly sell or share personal information of consumers under 16. The Services are not offered to anyone under 18.

14. Children and Eligibility

The Services are intended only for people who are at least 18 years old or the age of legal majority where they live, whichever is higher. We do not knowingly offer accounts to or collect personal information directly from children. If you believe a child provided information, contact us so we can investigate and delete it where appropriate.

15. Health and High-Risk Information

Notari is not currently offered as a HIPAA-compliant service, does not offer a Business Associate Agreement, and is not intended to receive protected health information or to provide medical care. Do not submit information requiring HIPAA, regulated child-data, or similarly specialized handling unless Notari has executed an appropriate written agreement for that use.

16. Changes to This Policy

We may update this Policy as the Services, providers, or law change. We will post the updated version and effective date and provide additional notice or obtain consent when required. A material provider change will also be reflected in the Data Residency and Subprocessor List.

17. Contact

Privacy requests and questions: support@notarilabs.com. Postal address: Notari Labs Inc., 1209 ORANGE STREET, Wilmington, DE 19801, United States.

United States

Effective date: August 12, 2026

Company: Notari Labs Inc.

Website: notarilabs.com

Contact: support@notarilabs.com