Privacy Policy

Effective 17 September 2026. Last updated 17 September 2026.

This policy explains what Leo Notes collects, why, where it is kept, who else is involved in handling it, and what you can ask us to do about it. Leo Notes is a sole proprietorship based in Canada and handles personal information under the federal Personal Information Protection and Electronic Documents Act.

1. The short version

• Your transcripts and the audio behind them are private to your account.
• We do not sell personal information, we do not run advertising, and we set no tracking cookies.
• We do not use your material to train machine learning models, and our providers are instructed not to either.
• Your data is stored in Canada. Some processing happens at providers outside Canada; they are named in section 5.
• You can delete any transcript, or your entire account, at any time.

2. What we collect

What	Why
Email address	To identify your account, sign you in, and contact you about billing or service changes
Password	Stored only as a cryptographic hash. We cannot read it and cannot tell you what it is
Audio and video you submit	To transcribe it, and to let you play it back alongside the transcript
Links you submit	To retrieve the material you asked us to transcribe
Transcripts, translations and your questions	They are the product; they are stored so you can come back to them
Usage records	What was processed, when, which provider, and what it cost, so your allowance and balance are accurate and auditable
Payment records	Amounts, dates and status. Card numbers are handled by Stripe and never reach us
Server logs	IP address, request time and path, kept briefly for security and to diagnose faults

We do not collect location data, contacts, device identifiers, or anything from other sites. There is no analytics script on this site or in the app.

3. Cookies

One cookie, set after you sign in, which keeps you signed in. It carries no profile and no tracking identifier. Deleting it signs you out. There are no third-party cookies and no cookie banner, because there is nothing to consent to beyond the one that makes signing in work.

4. Where your data lives

Accounts, transcripts, audio and usage records are stored on servers located in Canada, and any backups are held in Canada. Access is limited to the operator of the service, and only where necessary to run it, investigate a fault you have reported, or comply with a legal obligation.

5. Who else handles it

Running the service requires sending parts of your material to specialist providers. Each receives only what that task needs.

Provider	What it receives	Where
Speech recognition provider	The audio you submitted, to convert it to text	United States
AI model providers, currently including Anthropic, OpenAI, Google and DeepSeek	The transcript text involved in a clean-up, translation or question you start	United States, and other countries depending on the provider
Stripe, Inc.	Your email, payment details you enter on their form, and transaction amounts	United States and Canada
Hosting and backup provider	Hosts the servers and stores backups	Canada
Cloudflare, Inc.	Routes web traffic to the service	Global network

This means some of your information is processed outside Canada, and while it is there it may be accessible to the courts and authorities of that country under their law. We use providers that contractually commit not to train models on customer content and not to use it for their own purposes. Which AI provider handles a given request is shown in the app, and you choose it.

Nothing is sent to any of these providers unless you start an action that requires it. A transcript that sits in your library untouched goes nowhere.

6. How long we keep it

• Transcripts and audio: until you delete them, or 30 days after your account is closed.
• Account record: until you close the account.
• Usage and payment records: seven years after the transaction, because Canadian tax law requires it. These records show amounts and dates, not the content of what you transcribed.
• Server logs: 30 days.
• Backups: deleted material disappears from backups within 30 days as older backups age out.

7. Your rights

You can, at any time:

• See what we hold about you, and get a copy.
• Correct anything inaccurate.
• Export your transcripts from the app, as Markdown, plain text or subtitle files.
• Delete individual transcripts, or your entire account and everything in it.
• Withdraw consent and stop using the service. Some records are kept where the law requires, as set out in section 6.
• Complain. Write to us first. If you are not satisfied you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy regulator.

Write to hello@leonotes.ca. We complete requests within 30 days, as PIPEDA requires.

8. Security

Traffic is encrypted in transit. Passwords are stored only as salted hashes. Repeated failed sign-in attempts from an address are rate limited. Each account's transcripts are stored separately and access is checked on every request.

No system is perfectly secure. If a breach affects you in a way that creates a real risk of significant harm, we will notify you and the Privacy Commissioner as PIPEDA requires.

9. Children

Leo Notes is not intended for people under the age of majority where they live, and we do not knowingly collect their personal information. If you believe a child has created an account, tell us and we will remove it.

10. Changes

If we change this policy in a way that materially affects you, we will email you at least 30 days beforehand. The effective date at the top always reflects the current version.

11. Contact

Questions, access requests, or a privacy complaint:
hello@leonotes.ca
Leo Notes, Ontario, Canada.