Privacy Notice

This Privacy Notice explains how AlphaNote (“AlphaNote,” “we,” “us,” or “our”) handles personal information when you visit our websites, create an account, subscribe, upload content, use AI features, contact support, or otherwise use the AlphaNote service.

AlphaNote is responsible for the personal information described in this notice. Questions and privacy requests may be sent to team@alphanote.ca.

Account and profile information. Name, email address, authentication and verification status, account identifiers, workspace preferences, and information you choose to add to your profile.

Subscription information. Plan, subscription status, billing interval, Stripe customer and subscription identifiers, trial status, and transaction-related records. Payment card details are collected and processed by Stripe rather than stored by AlphaNote.

User Content. Notes, notebooks, semesters, courses, assignments, research logs, protocols, methods, formula sheets, study sets, prompts, messages, files, images, document text, tables, figures, metadata, and other material you submit or create.

AI and usage information. Prompts, selected source material, generated responses, model and feature usage, token or resource counts, feedback, and information needed to enforce plan limits and improve reliability.

Technical and security information. IP address, browser and device information, session and request identifiers, timestamps, route and error information, security events, diagnostic logs, and cookie or similar-technology data.

Communications. Support requests, privacy requests, feedback, and other messages you send us.

We use information to provide and authenticate the Service; store and organize User Content; process documents and images; produce requested AI responses; operate subscriptions; provide support; enforce usage limits; secure, debug, monitor, and maintain the Service; communicate service and account information; comply with law; and establish, exercise, or defend legal claims.

Legal bases where required. Depending on where you live and the activity involved, we process personal information to perform our contract with you, pursue legitimate interests such as securing and improving the Service, comply with legal obligations, or act with your consent. Where processing is based on consent, you may withdraw it at any time without affecting processing already completed.

No AI training. AlphaNote does not use User Content, prompts, uploaded files, or AI responses to train AlphaNote or third-party AI models. AlphaNote uses commercial API services to generate requested responses and embeddings, and has not opted in to provider model-training programs. When you use an AI feature, only the content reasonably needed to perform that request is sent to the applicable AI provider. A provider may temporarily retain limited API data for abuse prevention, security, or legal compliance under its commercial API terms.

We do not sell personal information or User Content, and we do not disclose personal information for cross-context behavioural advertising.

We disclose information only as reasonably necessary to operate the Service, follow your instructions, protect AlphaNote and its users, complete a business transaction, or comply with law. The following subprocessors and service providers process information for defined functions under their applicable contractual and security commitments:

• Supabase — authentication, database, and file storage.
• Vercel — application hosting, delivery, monitoring, and deployment infrastructure.
• Stripe — checkout, subscriptions, payment processing, fraud prevention, and billing records.
• Anthropic — generation of AI responses when an Anthropic-powered feature is used.
• OpenAI — embeddings and other configured AI functions when used.
• Tavily — web-search retrieval when you use a feature that searches the web.
• Resend — transactional and account email delivery.
• Sentry — application error and performance monitoring.
• PostHog and Vercel Analytics — product and website analytics, where enabled.

A provider receives only the information reasonably needed for its function. We do not authorize providers to sell User Content or use it for unrelated purposes. Providers may use their own subprocessors as described in their published subprocessor notices.

We may also disclose information when you direct us to do so; to professional advisers bound by confidentiality; to investigate abuse or protect rights, safety, and security; in connection with a financing, merger, acquisition, reorganization, or sale; or when required by law.

AlphaNote is available to users in supported countries worldwide. Global availability does not mean all information remains in the country where you use AlphaNote.

AlphaNote currently configures its primary Supabase database and storage infrastructure in the Canada Central region where applicable. Other providers—including application hosting, AI, billing, email, monitoring, analytics, web-search, and optional object-storage providers—may process information in the United States and other countries where they or their subprocessors operate.

Information processed outside your province or country may be subject to different data-protection laws and may be accessible to courts, law-enforcement, or national-security authorities in accordance with local law. We use contractual, technical, and organizational safeguards appropriate to the processing. Contact us if you need current information about the processing location for a particular service.

Our current retention settings and practices are organized by category:

• Account information and User Content: retained while your account is active and until you delete the content or request account deletion, subject to the backup and legal exceptions below.
• Deleted content: removed from active AlphaNote systems after the deletion request is processed. Residual copies may remain temporarily in encrypted backups until the applicable provider backup cycle expires.
• AI requests and responses: retained by AlphaNote only when needed to provide account history, saved content, security, usage accounting, or support. Commercial AI providers may retain API data temporarily for abuse monitoring or legal compliance; standard provider periods are generally up to 30 days unless a different feature, agreement, or legal requirement applies.
• Security, diagnostic, and application logs: retained for the period available under the applicable provider plan and for as long as reasonably needed to investigate reliability, fraud, abuse, or security incidents.
• Billing and transaction records: retained for as long as required for accounting, tax, fraud prevention, dispute handling, and other legal obligations. Stripe retains payment information under its own policies.
• Support and privacy communications: retained while the request is active and afterward for as long as reasonably needed to document the response, resolve disputes, and meet legal obligations.
• Analytics: retained according to the configured analytics-provider settings, where analytics is enabled, and deleted or de-identified when no longer reasonably needed.

You can delete individual content through available product controls and can request account deletion. When an account is deleted, we begin removing account-linked content from active systems, subject to reasonable technical processing time.

We may retain limited information longer when required to comply with law, preserve transaction or tax records, prevent fraud or abuse, maintain suppression lists, resolve disputes, or establish, exercise, or defend legal claims. We delete or de-identify information when it is no longer reasonably required for these purposes. Provider retention periods and product settings may change; contact us for the current setting that applies to a particular category.

You may review and update certain account and workspace information through AlphaNote. You may also ask us to provide access to personal information we hold about you, correct inaccurate or incomplete information, explain how it has been used or disclosed, export available User Content, withdraw consent where processing depends on consent, or delete your account and associated information.

Send a request to team@alphanote.ca from the email associated with your account. Include the type of request and enough detail to identify the information involved. Do not send your password or unnecessary sensitive information. We may need to verify your identity before completing a request. We will respond within the period required by applicable law and explain any lawful limitation or refusal.

Your rights vary by location and may include restricting or objecting to certain processing and lodging a complaint with your local data-protection authority. If you are in Canada, you may contact the Office of the Privacy Commissioner of Canada or your provincial or territorial privacy regulator. If you are elsewhere, you may contact the regulator responsible for data protection where you live.

AlphaNote uses cookies and similar technologies that are necessary for authentication, security, session continuity, preferences, and deployment protection. We may also use analytics technologies to understand feature usage, reliability, and website performance. Browser controls can restrict some cookies, but blocking required cookies may prevent sign-in or other features from working.

We use administrative, technical, and physical safeguards designed to protect information, including encrypted transport, managed authentication, access controls, tenant isolation, private storage, logging, and monitoring. No storage or transmission system can be guaranteed completely secure.

Keep your credentials confidential, use a unique password, sign out of shared devices, and notify us promptly of suspected unauthorized access. Do not upload identifiable patient health information, controlled technical data, classified material, or regulated clinical records unless AlphaNote has expressly agreed in writing to the required safeguards.

AlphaNote is not intended for children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We may update this notice when our Service, providers, or legal obligations change. We will post the revised notice and update the effective date. We will provide additional notice when a material change requires it.

Privacy questions and requests: team@alphanote.ca.