Privacy Policy

Notioo (“we”, “us”) is operated by Arcavora Labs Private Limited, Panaji, Goa, India, and provides an AI personal assistant you talk to over WhatsApp, Telegram and the Notioo app. For the purposes of the EU/UK GDPR we are the data controller for the personal data described here. You can reach us about anything in this notice at support@notioo.ai.

• Account & contact: your phone number, and (if you provide them) your name and email address.
• What you send us: the messages, voice notes and images you send the assistant, and the replies it generates.
• Things you ask us to remember: facts, preferences and reminders you create.
• Connected accounts (optional): if you connect Google or Microsoft, the calendar, email and file data we access on your behalf to carry out your requests. We do not bulk-copy your mailbox; we fetch what is needed, when you ask.
• Payments: handled by Razorpay. We receive confirmation and payment status, not your full card details.
• Technical & usage data: minimal operational logs (e.g. which AI model served a reply, latency), and monthly totals of how much your account used our AI models and what that cost. These never contain your message content.

• To run the assistant — understand your messages, reply, set reminders, recall what you saved. Basis: performance of our contract with you (Art. 6(1)(b)).
• Email & calendar integration — reading and acting on your connected mailbox/calendar. Basis: your explicit consent, given at the provider’s connect screen, which you can withdraw at any time by disconnecting.
• Payments & fraud prevention. Basis: contract and our legitimate interests.
• Keeping the service secure and working. Basis: our legitimate interests.

We do not sell your data, and we do not use your private messages to advertise to you. We do not knowingly solicit special-category data (e.g. health); please avoid sending it.

To generate replies, the assistant sends your message text and recent conversation context (and, when you explicitly ask it to read or act on an email, that email’s content) to third-party AI model providers listed below. We route to providers that offer no-training and short-retention terms for API data where available. Your saved memories and reminders are processed to give the assistant context. Google user data sent to these providers is used only to answer that request.

If you connect a Google account, Notioo accesses only the Google data needed to do what you ask: it reads and searches your Gmail when you ask about your mail, sends an email only after you tap Send, creates or reads calendar events when you ask, reads Drive files you ask about, and creates or edits Google Docs and Sheets you ask for.

We do not sell Google user data, use it for advertising, or let people read it except where you ask us to for support, where the law requires it, or for security. We do not use Google user data to develop, improve or train generalised AI or machine-learning models.

Notioo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time by telling Notioo “disconnect my Google account” or from your Google Account’s security settings, and we then delete the tokens we hold.

We share data only with the service providers we need to run Notioo:

Our backend and primary database are hosted on Oracle Cloud in Mumbai, India, so the bulk of your data stays in India. Files you send (photos, documents, voice notes) are encrypted before they leave our server and stored in Cloudflare R2 in the EU. If you live outside India, your data is transferred there. Some providers above (AI models in the US) process data outside India; such transfers rely on appropriate safeguards (e.g. Standard Contractual Clauses) with those providers.

• Chat history, memories & reminders are not deleted automatically. They stay with your account until you erase them or ask for permanent deletion (see below).
• Connected-account tokens are kept (encrypted) until you disconnect that account.
• Operational telemetry is deleted after 30 days, except the monthly usage and cost totals per account (which AI models were used, how much, and what it cost). Those are kept until the account is deleted.

When you erase your data or delete your account, Notioo stops using it and removes it from your account view. We keep the account record, and payment records as the law requires. To have your data permanently deleted, write to support@notioo.ai and we will do it within 30 days.

You can, at any time:

• Get a copy of your data — message the assistant “export my data” and it will give you a private, one-time link to download everything we hold on you as a file (right of access & portability).
• Delete your data — message “delete my data”. We’ll confirm first, then stop using your memories, chat history, reminders and profile, remove them from your account view and disconnect your mailboxes. For permanent deletion, write to support@notioo.ai and we will do it within 30 days. A paid period is not refunded when you delete your data. Deleting your data does not cancel a subscription by itself: cancel it on your account page first, or ask us to, so you are not charged again.
• Correct anything inaccurate, or withdraw consent for an integration by disconnecting it.
• Object or complain — contact us, or lodge a complaint with your local data-protection authority.

For any request, email support@notioo.ai. We aim to respond within one month.

Connections to Notioo use encryption in transit (HTTPS). Sensitive content — your messages, saved memories, reminders and connected-account tokens — is encrypted at rest with AES-256-GCM. The semantic search that powers your memories runs locally on our server, so that step sends nothing to third parties.

Notioo is not intended for, and should not be used by, anyone under 18.

If we make material changes we’ll update this page and the “last updated” date above, and where appropriate let you know in chat.