Privacy Policy

Information We Collect

• when you use the transcription and notes tools: the audio extracted from the video you choose — your video is read and the audio is extracted in your browser, and only the compressed audio is sent, along with basic details such as the file name, duration, and the time range you selected, to be transcribed and turned into notes; your original video file is not uploaded unless you choose the optional server upload on the website or in the Chrome extension (paid plans, see below); Paid transcription recovery also keeps account-bound transcript results temporarily, as explained under retention below.
• when you use the Chrome extension on a YouTube video: the video's address and title and its publicly available transcript, which are used to generate the notes you request; no audio is uploaded for YouTube videos, and we do not store the transcript or notes on our servers; the extension may retain them locally in your browser until you clear its data
• when you paste a YouTube link on the website: the link, which our backend uses to fetch the video's public captions and title and to generate the notes you request; no audio is uploaded for YouTube links (see “YouTube Links on the Website” below)
• a record of each notes request (see “Feature Usage Records” below)
• a pseudonymous device identifier kept in your browser's local storage to apply usage limits and for basic abuse prevention
• when you upload a file for transcription: a one-way fingerprint of the file (a SHA-256 hash computed in your browser from the file's size, its duration and its first and last megabyte), sent with each transcription request; for uploads without sign-in we store it, together with the minutes used that day, and daily counters per IP address for uploads and YouTube notes, for at most 48 hours, only to apply the Free access — never the file or its name
• basic operational logs such as timestamps, error details, and technical request metadata, and the IP address of your requests, which we use for rate limiting and abuse prevention
• technical diagnostics about AI requests, which never include your audio, transcripts, or notes
• when you press an extension-install button: a minimal click event without a persistent visitor identifier with the page, its language, the button placement, timestamps, the referring site's hostname when available, and any marketing campaign parameters (such as utm_source, utm_medium, utm_campaign) present in the page's address; we do not store an IP address, account identifier, browser identifier, or user-agent string with this event
• if you create an account or sign in: the email address you register with and account identifiers, processed through Amazon Cognito
• if you subscribe to a plan: your Lemon Squeezy subscription, customer and order identifiers, the plan, its status and its start, renewal and end dates, refunds we request when you cancel, and your plan usage, so we can provide and meter your plan; payment details such as card numbers are collected by Lemon Squeezy, not by us (see Payments below); links to the Lemon Squeezy customer portal are requested fresh each time you open them and are not stored; when you tick the box to start a plan immediately before checkout, we also store when you ticked it, the version of the wording you saw and the plan, as evidence of that request for as long as it may be needed for the contract or legal claims

You can use the core notes tool without an account and without providing your name, email, or payment details.

Local-Only Tools

The website also offers utility tools that run entirely in your browser: the video converter, video compressor, video trimmer, mute-video tool, GIF maker, frame extractor, audio extractor, and audio converter. Files you open in these tools are processed on your device and are never uploaded — nothing you open there is sent to our servers or to any AI provider. Only the transcription and notes tools send audio for processing as described in this policy.

Extension-Interest Events

Pressing an extension-install button sends one minimal first-party event to Video to Notes. The event has no persistent visitor identifier: it is not saved in a cookie or local storage and is not used to recognize you across visits.

These events are aggregated so we can count requests and compare pages, languages, and button placements. The aggregate report does not contain account identifiers, IP addresses, user-agent strings, query strings, or page fragments.

Feature Usage Records

When you create notes on the website or with the Chrome extension's hosted modes, our backend keeps one record per request: your account identifier or pseudonymous guest identifier, your plan, the tool and page you used, the type of source (file or YouTube link), the language, the length of the recording, the AI model, token counts, an estimated cost and the result (for example success or an error code). The record never contains your audio, transcript, notes, file name, video title, link or IP address. We use these records to run and improve the service, control costs and prevent abuse, based on our legitimate interests (Article 6(1)(f) GDPR). They are deleted automatically 30 days after the request, and an account deletion request also covers them.

Contact Form

When you contact us, we process your email address, message and any name or subject you provide to answer your enquiry. For contractual enquiries the basis is Article 6(1)(b) GDPR; otherwise it is our legitimate interest in responding under Article 6(1)(f). Email delivery and storage involve Amazon Web Services for contact-form delivery, Cloudflare for incoming email routing, and Google Gmail for the support mailbox. We keep correspondence until the enquiry and follow-up are resolved, or longer where required for legal claims or statutory record keeping.

Legal Bases

Under Article 6(1)(b) GDPR, we process the content and account information needed to provide the service you request. Article 6(1)(f) covers our legitimate interests in security, abuse prevention, technical reliability, improving the service and controlling its costs, and measuring extension demand. Article 6(1)(c) covers statutory record keeping. Optional Google Analytics requires consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. Necessary device storage for requested functions is based on § 25(2) TDDDG.

You do not have to provide personal data by law. Without the data needed for a requested function, we cannot process that request, create an account or credit a purchase. You can decline analytics and still use the service.

Infrastructure Providers

Amazon Web Services processes hosting, sign-in, account, subscription, usage and operational data on our behalf. The backend is configured in Ireland; website delivery uses a global network. If you choose Google sign-in, Google also processes the login and supplies account details such as your email address. See AWS privacy information and Google privacy information.

Payments (Lemon Squeezy)

Lemon Squeezy handles checkout, payment, subscriptions, invoices, renewal reminders and taxes as Merchant of Record and an independent controller. The seller is identified at checkout and on your receipt; its privacy policy applies. We receive subscription, order, product, customer/account, payment-status and refund information to provide and manage your plan, but not full payment-card details. When you cancel in our product, we ask Lemon Squeezy to cancel the subscription and, where our terms provide for it, to refund unused months. If you use our cancellation form (“Cancel contracts here”), we use your name, the email address you used for the purchase, any order number, the type of cancellation, any reason and the desired end date to find your subscription at Lemon Squeezy and cancel it (legal basis: Article 6(1)(b) and (c) GDPR). The request is sent to our support mailbox and kept there as evidence of the cancellation for up to three years after the end of the year in which you cancelled.

Third-Party AI Services (AWS Bedrock, Google Gemini)

On the website and in the Chrome extension, Free audio transcription and notes use Gemma models hosted by AWS Bedrock in Frankfurt, Germany. Paid plans use Google Gemini for transcription and notes. We send the selected audio, transcript or public YouTube captions and basic video details, with our instructions, to the relevant provider. The original video remains on your device unless you choose the optional Server Upload described below. Unsupported Free languages are omitted with a notice rather than sent to a paid transcription model. Paid requests may also use AWS Bedrock for transcription recovery.

• Google terms apply: data sent to Gemini is subject to the Gemini API Additional Terms and Google Privacy Policy. We use the Gemini API as a paid service; under these terms, Google does not use the prompts or responses of paid services to train its models.
• Processing only: we use Gemini to generate the notes you request, not to train our own models.

Transcription recovery with Amazon Transcribe

If Free transcription with Gemma still cannot transcribe part of your audio after retrying it in smaller pieces, only that part is sent to Amazon Transcribe in Ireland. Each such part becomes a batch job there. Their selected audio and provider output are stored temporarily in private AWS storage without the original filename, and deleted after completion. A recoverable result is kept for one hour; minimal polling and settlement metadata for 24 hours. Abandoned objects are scheduled for deletion under a one-day rule; deletion can take longer. Leaving the page does not cancel an existing batch job.

Chat with your notes

If you are signed in, you can ask questions on the website about a result in your History. To answer a question, your browser sends our backend that result (its transcript and notes), the check code our service added to it, your question and up to six earlier questions and answers from the same conversation. Our backend sends them, with our instructions, to an AI model that Amazon Web Services runs for us through Amazon Bedrock in the EU, and returns the answer to your browser. We do not store the result, your questions or the answers; according to AWS, Amazon Bedrock does not store them either or use them to train models. The conversation is kept only in your browser's History until you clear it or delete the entry. To apply the question limits and prevent abuse, we keep question counters for your account (daily counters for up to two days; the counter for your plan's allowance period as long as the other plan allowance records), the number of refused questions for up to 31 days and, if chat is switched off for your account, a marker until it is switched on again. Each question also creates a feature usage record as described above, without the text of the question, the answer, the transcript or the notes. Legal basis: performing the service you request (Article 6(1)(b) GDPR) and, for the limits and abuse prevention, our legitimate interests (Article 6(1)(f) GDPR).

Optional Server Upload (Website or Chrome Extension, Paid Plans)

With a Basic or Plus plan, the website or Chrome extension offers an optional server upload. It is off unless you choose it; by default your video is read and its audio extracted in your browser. If you choose it, the browser or extension uploads the video file you selected, without its file name, to our storage at Amazon Web Services (AWS) in Ireland. We use it only to extract the audio of the time range you selected; that audio is then transcribed as described above. We aim to delete uploaded source files within 24 hours of upload. Deletion may take longer. Extracted audio is removed after processing; result retention is described below. A technical job record (for example file size, format, duration, processing state and errors; never the file name) is kept for up to 7 days to operate and secure the service. Legal basis: performing the service you request (Article 6(1)(b) GDPR). If someone reports an uploaded file as illegal, we process the report (the notifier's name, email address and explanation, and the file and job concerned) to handle it under the Digital Services Act (Article 6(1)(c) GDPR) and keep it as long as needed for that and for related legal claims.

YouTube Links on the Website

When you paste a YouTube link into one of the website's notes or transcript tools, your browser sends the link to our backend. Our backend fetches the video's public captions, title and channel from YouTube, either directly or through technical service providers. YouTube and these providers receive only the video's address or ID and the requested caption language, never your IP address or an account or device identifier. The captions and title are then sent to AWS Bedrock or Google Gemini, depending on your plan to generate your notes. So that the same video does not have to be fetched again, we keep its public captions, title and channel for up to 7 days per video and language; this cache does not record who requested the video. Our operational logs may contain the video ID for up to 14 days.

Bring-Your-Own-Key Mode (Groq)

The Video to Notes Chrome extension also offers a bring-your-own-key mode that uses Groq, Inc. (groq.com) as an AI provider under your own Groq account. It is available only to users who saved their own Groq API key in an earlier version of the extension. You supply your own Groq API key:

• Your key stays on your device: the Groq API key you enter is stored only in your browser's local extension storage. It is never sent to our backend, never synced to other devices, and never logged.
• Audio goes straight to Groq: in this mode the compressed audio is sent directly from your browser to Groq using your own key — it does not transit our backend, and neither the audio, the transcript, nor the notes pass through or are stored on our servers.
• Groq terms apply: data you send to Groq with your own key is subject to Groq's terms and Groq's privacy policy, and to the account you hold directly with Groq.
• Processing only: Groq is used to transcribe your audio and turn the transcript into the notes you request.

International Data Transfers

AWS, Google, email providers and Lemon Squeezy may process data outside the EU/EEA, including in the United States. An EU adequacy decision applies to eligible transfers, including transfers to participating US organizations under the EU–US Data Privacy Framework. Where no adequacy decision applies, the AWS and Google processing terms provide EU Standard Contractual Clauses. You can request a copy of the applicable safeguards from us. Direct Groq processing uses your own provider account and its terms. Transfers to the United Kingdom are covered by the European Commission’s adequacy decision.

What We Do Not Do

• we do not sell or transfer user data to third parties except for the approved uses described in this policy that are necessary to provide the service, comply with law, or protect against abuse
• we do not use or transfer user data for purposes unrelated to Video to Notes' single purpose
• we do not use or transfer user data to determine creditworthiness or for lending purposes
• we do not use user data for personalized advertising or build browsing profiles

Local Storage and Cookies

Necessary browser storage holds your language preference, a pseudonymous guest identifier, usage information and work in progress. The website's secure sign-in cookies last up to 10 minutes for login setup, one hour for access and 30 days for keeping you signed in; signing out clears these cookies. The consent-choice cookie, v2t_analytics_consent, lasts up to 12 months. We do not set advertising cookies.

Only after you accept analytics do we load Google Analytics, provided by Google Ireland Limited, to measure website use. Google receives page addresses, referrers, interactions, device/browser details, cookie identifiers and the connection IP address; Google states that GA4 does not log or store individual IP addresses from EU, Swiss or UK visitors. Analytics cookies (_ga and _ga_*) normally last up to two years, subject to shorter browser limits. See Google's cookie information. You can withdraw consent through “Cookie settings”; earlier lawful processing is unaffected.

The Chrome extension stores input metadata, time ranges, processing state, a pseudonymous guest identifier, optional sign-in tokens, an optional Groq API key, and transcript and notes history in local extension storage. IndexedDB holds selected video, prepared audio and result caches so work can resume. Clear this data through the extension or browser controls, or remove the extension.

When you are signed in, the website keeps a History of your recent results in this browser's IndexedDB: notes and transcripts, with their titles, file names and YouTube video IDs, up to 20 per account. History, including your chat conversations about these results, stays in this browser and is not synced to other devices. Only when you ask a question about a result are that result and your question sent to us to answer it (see Chat with your notes). It is hidden when you sign out and shown again when the same account signs in. Delete single entries or the whole History in the History panel, or clear it through your browser's site-data controls.

Data Retention

• Except for the Transcribe recovery described above, our backend processes content for your request without keeping audio, transcripts or notes at rest, except for temporary video and audio storage in the optional paid server upload, the account-bound results kept by paid transcription recovery (see below), and background processing and result emails on paid plans. For background jobs we keep the selected audio until processing ends, and the source filename, transcripts, notes, your account email and job state until result access ends 24 hours after job creation for Browser uploads, or after completion for Server uploads. We also cache public YouTube captions fetched for a link you paste on the website for up to 7 days per video, without recording who requested them. This does not mean AI providers retain nothing: Google may temporarily log prompts and responses for security and abuse prevention under its terms. Direct Groq processing is subject to Groq's retention rules and your account settings.
• Paid transcription recovery is an exception: to return completed parts after interruption and reconcile usage, we temporarily retain the available transcript, language, source time ranges and technical recovery state linked to your account. This recovery store contains no audio or video and no generated notes. Access is restricted to your account. Content is deleted automatically. Billing records and non-content usage metadata are deleted 30 days after the operation is settled; an unsettled charge or refund is kept until it is resolved. After that, only a marker without content, amounts or plan details remains for up to 400 days from the start of the operation, so that a repeated request for the same operation is never charged again. You can request deletion through the contact below. Legal basis: providing the service you request (Article 6(1)(b) GDPR). Recovery access ends after 48 hours; automatic deletion follows expiry and may take longer during a service interruption. Billing metadata contains no transcript content.
• Other operational records are deleted automatically after these periods:
  • backend operational logs: 14 days;
  • feature usage records: 30 days after the request;
  • daily usage history: 30 days after the day it records;
  • plan allowance records, including the chat question counter for the allowance period: 30 days after the allowance period ends (yearly plans also have monthly allowance periods);
  • extension-interest click events: 30 days after receipt; aggregated statistics do not identify individual visitors;
  • the public YouTube caption cache: 7 days after the captions are fetched;
  • short-term usage and request-reservation records, including short-lived YouTube abuse counters: three days; file fingerprints and the per-IP counters for use without sign-in: 48 hours; rate-limit records: the applicable security window.
  Automatic deletion can take a few more days after a period ends. Deleted records can remain in restricted database backups for up to 35 days; a restored backup is cleaned up again before it is used.
• Account details and subscription records (plan, status and dates) remain until no longer needed for the account or service relationship. Account deletion can be requested below. Purchase or support records needed for statutory retention or legal claims are retained for the applicable period and then deleted.
• Local browser data remains until cleared, replaced or expired as described above.

Free identity, allowance and operation records, including records that prevent the same operation from being counted twice, use a persistent browser or account identifier and have no automatic expiry. They prevent repeated grants and duplicate usage deductions. These records are exceptions to the temporary usage and request-reservation retention periods above. Daily file and network counters remain separate abuse controls.

Controller & Contact

The controller is Ivan Gushchin, at the address in the Legal Notice. For privacy requests, contact support@video-to-notes.com.

Your Rights

Under the GDPR, you may request access, correction, erasure, restriction and data portability where the relevant conditions apply. You may object to processing based on legitimate interests on grounds relating to your situation, and withdraw consent at any time. You may complain to a supervisory authority, especially in the EU country where you live, work or where an alleged infringement occurred. We do not make decisions with legal or similarly significant effects on you solely through automated processing.

Deleting your data. Clear locally stored files, results and keys through your browser or extension controls. For account deletion and associated records, email support@video-to-notes.com. We may need information to verify your identity. Statutory retention and other lawful exceptions may limit deletion.

Children

Video to Notes is not directed to children and is intended for users who are at least 18 years old, consistent with the Gemini API terms.