Privacy Policy · Eventnote

Effective: October 20, 2026

1 Controller and contact

Mohamed Ali Masmoudi, sole trader trading as Eventnote, is responsible for the processing described in this policy.

Postal address: Kittlerstr. 33, 64289 Darmstadt, Germany

Please send security reports about Eventnote to security@eventnote.app.

Telephone: +49 1520 2575857

We are the controller within the meaning of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other data protection law.

Data protection officer: none is required and none has been appointed.

This policy covers the Eventnote mobile app and its associated account and support services. Section 10 covers visitors to our website eventnote.app.

Age. Eventnote is for people who are at least 16 years old. Do not create an account if you are younger. If we learn that an account belongs to someone under 16, we delete it.

2 Account and service operation

We process your name, email address, password hash, optional profile photo, account identifier and settings to create and manage your account, authenticate you and synchronise your content. We also process device and session identifiers, device name, IP address, user agent, access times, subscription status and feature-usage counts to operate sessions, enforce plan limits and protect the service.

You can sign in in three ways:

Email and password. You give us your name, email address and a password. We store the email address, name and a password hash (never the password itself) and send a verification email through Brevo.
Sign in with Apple. Apple sends us a signed identity token with your Apple account identifier (specific to our app), your email address (or a private relay address if you hide it) and, the first time only, your name. We store the resulting Apple token in encrypted form and use it only to cancel the link with Apple when you delete your account.
Google Sign-In. Google sends us your account identifier, name, email address (and whether it is verified) and profile-picture URL. We request only the basic profile and email permissions.

If you use more than one method with the same verified email address, we link them to one account. We never link accounts with different or unverified email addresses. Apple and Google process your data under their own privacy policies when you sign in with them.

The legal basis for providing the service is Article 6(1)(b) GDPR. Security processing is based on Article 6(1)(f) GDPR; our legitimate interest is preventing unauthorised access, fraud and misuse.

Account details required by the registration form are necessary to create an account. Optional profile information is voluntary. If you sign in with Google, we store the URL of your Google profile picture and show it in the app as your profile photo, until you upload a different photo. Photos you upload are kept in our file storage.

3 Your content and AI features

We process the content you add, including event and talk details, slide photos and capture dates, extracted text, notes, voice recordings and transcripts, saved links, company and contact details, business-card photos, reminder dates, questions and AI-generated answers and summaries.

We use this content for storage, synchronisation, organisation, search, transcription, AI answers, summaries and reports. For your own personal data processed as necessary to provide these functions, the legal basis is Article 6(1)(b) GDPR. Providing content is voluntary; functions requiring that content cannot work without it. We do not use your content to train AI models, sell it, or show advertising in the app.

Text recognition initially takes place on your phone. Photo dates and available location metadata are used on the phone to suggest event groups. Slide photos are uploaded for account storage and synchronisation.

For AI-assisted search, extracted slide text, eligible saved notes and search queries are processed through OpenRouter and the model providers it routes to. AI answers and summaries use your question, relevant saved content, event and talk details and relevant conversation history. When Advanced OCR is enabled, slide photos may also be sent for text recognition; voice transcription sends your voice recording. No AI provider may train on your content. Requests to Claude models from Anthropic, used for AI answers, summaries, LinkedIn drafts and Advanced OCR, run on our own Anthropic account: Anthropic stores their inputs and outputs for up to 30 days and then deletes them, and keeps content flagged for a breach of its usage policy for up to 2 years. Claude requests can also run at Google Cloud or Amazon Web Services, which do not store them. All other AI requests, including voice transcription and search indexing, run with zero data retention, so those providers must not store them. Because OpenRouter and some model providers are US companies, a transfer to the USA or other third countries must be assumed unless a provider confirms otherwise. Recipients, processing countries and retention are described in sections 6, 7 and 11.

Disabling Advanced OCR stops AI photo recognition, but not photo uploads or AI processing of text. Notes saved under People are included in AI processing only after you enable that option in Settings; you can switch it off there.

People notes (name, company, notes and an optional business-card photo) are stored on our servers so they sync across your devices; they stay private to you, also inside shared events, and Ask and Related read them only after you agree once in Settings, under the AI rules described above. LinkedIn drafts use only the people you pick, after the same agreement. We never use them for advertising, analytics or AI training, and they are deleted with your content (section 7). The basis is our and your legitimate interest in professional networking notes (Article 6(1)(f) GDPR; purely private contacts fall under the household exemption), and we do not inform the people named one by one because that would take disproportionate effort (Article 14(5)(b) GDPR); this policy is the public information, and they can use their rights through hello@eventnote.app.

The app uses the camera, selected photos and microphone when you use the corresponding capture functions. It stores login information, settings, drafts, content caches and pending synchronisation work on the device to provide the functions you request. Necessary device storage and access are based on section 25(2)(2) TDDDG; personal-data processing for these functions is based on Article 6(1)(b) GDPR.

If you enable push notifications, we process your push token, device and account association, and notification settings to deliver service messages through Expo and Apple or Google. Follow-up reminders are scheduled locally; their dates are stored with your account. The legal basis for requested service notifications and reminders is Article 6(1)(b) GDPR. You can disable notifications in the app or phone settings.

If you make or join a shared event, every member of that event sees everything added to it, including talks, slides, notes, voice note transcripts, links, companies and the event summary, together with the name of the member who added each item. Members also see each other’s names in the member list. People you save are never shared. When a member uses Ask (in the event or across all their events), Search, Related or the summary, the content of all members of the shared events they belong to is processed as described in section 3. Your content in a shared event is visible to everyone who is a member of it, including people who join after you. The owner of the event decides who can join by sharing its invite link, QR code or code; anyone who has it can join until the owner resets it. Anyone with the code can see the event name, dates, the owner’s first name and the number of members before joining. When you leave a shared event, are removed from it, or sharing stops, each member keeps what they added as a normal event and loses access to what the others added. The event owner keeps the shared summary, and members keep their own Ask chats; both may contain text based on other members’ content. The legal basis is Article 6(1)(b) GDPR; processing other members’ content for Ask, Search, Related and the summary is part of the shared-event service you joined. Each member controls the content they add.

When you export or share a report or save a person to your phone’s Contacts app, the selected information is passed to the destination you choose. Eventnote opens the system contact-creation form without reading your address book. When a saved web address has no title, our server requests the page title from that website; the request includes the saved address and our server’s network information.

5 Subscriptions and support

For paid subscriptions, Apple or Google processes the purchase. RevenueCat processes your app account identifier, transaction and product identifiers, purchase and renewal dates, and subscription status to manage access and restore purchases. We do not receive your card or account details, only information that confirms or denies the purchase. The legal basis is Article 6(1)(b) GDPR.

For support, we process your message, name, email address and account identifier. If you attach diagnostics, these include app version, device or operating-system details and plan information. Account-related support is based on Article 6(1)(b) GDPR; other enquiries are based on Article 6(1)(f) GDPR, with the legitimate interest of answering the enquiry. Brevo (Sendinblue GmbH, Berlin, Germany; privacy policy) delivers account and support emails (verification, password reset and support messages). We keep the address and message data while your account exists and then delete it. Brevo keeps its delivery records for one month. The support mailbox hello@eventnote.app and the security mailbox security@eventnote.app use Cloudflare Email Routing. Incoming mail is stored with Cloudflare in the EU.

6 Recipients and processing countries

The following providers receive the data needed for their functions:

Cloudflare, Inc. (USA): API hosting, technical request data, uploaded files (photos and voice recordings, stored in the EU), short-lived “last changed” markers for shared events, and mail sent to hello@ and security@ (section 5). Transfer: Cloudflare is certified under the EU-US Data Privacy Framework, and its processing agreement adds standard contractual clauses.
Neon (Databricks, Inc., USA): account and application database, including content, settings and service records. It runs on AWS in Frankfurt, Germany. Transfer: Neon’s parent is certified under the Data Privacy Framework, and its processing agreement adds standard contractual clauses.
OpenRouter, Inc. (USA) and the model providers it routes to: the AI inputs and outputs in section 3 and technical usage data. The models run at Anthropic, OpenAI, Perplexity, ElevenLabs and their hosting partners, mainly in the US; OpenRouter picks the host for each request. Provider data collection is denied on every request, so no provider may train on your content. Requests to Claude models run on our own Anthropic account (see Anthropic below); every other request is sent with zero data retention, so those providers must not store your content. Transfer: OpenRouter is not on the Data Privacy Framework list; our processing agreement with it uses standard contractual clauses.
Anthropic, PBC (USA): requests to Claude models (AI answers, summaries, LinkedIn drafts and Advanced OCR), sent through OpenRouter on our own Anthropic account. Anthropic does not train on this content and keeps it for up to 30 days (section 7). Transfer: Anthropic’s processing agreement uses standard contractual clauses.
Brevo (Sendinblue GmbH, Berlin, Germany): account and support emails, addresses and message contents. No transfer outside the EEA on our side.
RevenueCat, Inc. (USA): subscription administration. Transfer: standard contractual clauses in its processing agreement (it is not on the Data Privacy Framework list). We delete your record there when you ask at hello@eventnote.app.
Expo (USA), Apple and Google: push tokens and delivery of service notifications. Transfer: Expo and Google are certified under the Data Privacy Framework; Apple relies on standard contractual clauses.
PostHog (EU cloud, Frankfurt, Germany): usage statistics if you opt in, and crash reports (section 9). Data stays in the EU cloud; PostHog Inc. is certified under the Data Privacy Framework.
Apple and Google: purchases in the stores and sign-in, if you use them (section 2), each under its own privacy notice.

You can get a copy of the safeguards through hello@eventnote.app (section 11).

7 Retention and deletion

Account and saved content: kept while your account exists and you retain the content. Account deletion removes the account and associated content from the active Eventnote database and file storage. This includes the items you added to shared events; if you made a shared event, sharing stops and each other member keeps what they added. Summaries and Ask answers that other members already hold may still contain text based on your items.
Trashed events, talks, slides and notes, including People entries: the items, their photos, extracted text, search indexes and AI summaries are permanently deleted in the first daily cleanup after seven days.
Deleted chats and messages: a deleted chat is hidden from you and is permanently deleted, with its messages, in the first daily cleanup after seven days.
Technical records: synchronisation replay records are deleted after 30 days; invite-lookup rate-limit records after one minute.
Accounts that never verify their email: deleted by the daily cleanup 24 hours after sign-up, provided the account has never had a session. This applies in production, where email verification is required.
Request logs: Cloudflare keeps Workers Logs for up to seven days, and every request is logged.
Sessions and device registrations: a sign-in stops working 7 days after you last used the app and is removed when you sign out of that device or delete your account. A device registration (name, platform, push token) stays until you remove the device in the app or delete your account.
Support and security emails (hello@ and security@): deleted once the request is solved, unless a law requires keeping them. You can ask for earlier deletion. Email delivery records held by Brevo: one month.
Usage statistics and crash reports in PostHog: kept for at most 90 days; IP addresses are discarded.
Backups: kept for at most 30 days; deleted data leaves the backups within that time. AI providers do not keep your content (zero data retention), except Anthropic for Claude requests: up to 30 days, or up to 2 years for content flagged for a breach of its usage policy. RevenueCat deletes your record on request; backups there follow its standard practice. Deleting your account in the app does not delete your RevenueCat record, so write to hello@eventnote.app for that.
Records we must keep under tax and commercial law (section 147 AO, section 257 HGB), such as booking vouchers (8 years) and business letters (6 years), which may contain your name and email address. The legal basis is Article 6(1)(c) GDPR.

If your photo and audio storage exceeds the allowance of your plan, original slide photos and voice audio may be removed after a thirty-day warning period. Slide previews, extracted text and saved transcripts remain while you retain that content.

8 Your rights

If we process your personal data, you are a data subject under the GDPR and have the rights below, subject to their conditions.

8.1 Access (Art. 15 GDPR). You can ask us to confirm whether we process personal data about you and, if so, obtain a copy and the information listed in Art. 15: purposes, categories, recipients, storage period, your rights including the right to complain, the source of data we did not collect from you, automated decision-making and the Art. 46 safeguards for third-country transfers.

8.2 Rectification (Art. 16). You can have inaccurate or incomplete data about you corrected or completed without undue delay.

8.3 Restriction (Art. 18). You can ask us to restrict processing in the cases of Art. 18(1): while you contest accuracy, if processing is unlawful and you prefer restriction to erasure, if you need the data for legal claims, or while we check your objection under Art. 21(1). Restricted data is, apart from storage, processed only as Art. 18(2) allows. We tell you before a restriction is lifted.

8.4 Erasure (Art. 17). You can ask us to erase data about you without undue delay where one of the grounds in Art. 17(1) applies, for example the data is no longer necessary, you withdraw consent, you object successfully or the processing was unlawful. The exceptions in Art. 17(3) apply, for example legal obligations and legal claims.

8.5 Notification of recipients (Art. 19). If you have had data rectified, erased or restricted, we tell the recipients we disclosed it to, unless this is impossible or needs disproportionate effort. On request we tell you who they are.

8.6 Data portability (Art. 20). Where we process data you gave us on the basis of consent or a contract and by automated means, you can receive it in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible. The export in Privacy settings serves this right: it is one JSON file of records and text, and it lists your photos and voice recordings with download links that are valid for 7 days. It does not adversely affect the rights and freedoms of others.

8.7 Objection (Art. 21). On grounds relating to your particular situation, you can object at any time to processing based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. We then stop processing unless we show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves legal claims. You can object at any time to processing for direct marketing; we do not use your data for direct marketing today.

8.8 Withdrawal of consent (Art. 7(3)). You can withdraw consent at any time, without form, by email or post to the address in section 1 or, for usage statistics, in Privacy settings. Withdrawal does not affect processing before it. We then stop that processing unless another legal basis applies; otherwise we erase the data.

8.9 Complaint (Art. 77 and 78). Without prejudice to any other remedy, you can complain to a supervisory authority, in particular in the EU country of your habitual residence, workplace or the alleged infringement, if you think our processing breaches the GDPR. The authority must tell you the progress and outcome of the complaint, including the possibility of a judicial remedy under Art. 78. Our competent German authority is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, HBDI), Wilhelmstraße 7, 65185 Wiesbaden, Germany, poststelle@datenschutz.hessen.de, https://datenschutz.hessen.de (complaint form: https://datenschutz.hessen.de/service/beschwerde-uebermitteln).

8.10 Automated decisions (Art. 22). We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. AI answers and summaries are suggestions for your own use (Terms, section 10.4).

How to use your rights. Contact us at hello@eventnote.app (postal address in section 1). You can edit account information and content in the app, export your data in Privacy settings, and request account deletion there. These functions do not limit your statutory rights.

We are established in Germany, so no EU representative is needed. Where the law of your country gives you additional rights that cannot be waived, they stay unaffected. Eventnote is offered worldwide through the app stores and is not aimed at customers in any one country.

9 Usage statistics, crash reports, tracking signals and policy changes

Usage statistics are off until you say yes. On the screen shown before sign-in you can accept or decline. If you accept, the app sends product events (for example that an import finished or failed and why), screen views, app and device details and your plan to PostHog, linked to your account identifier and never to your name or email. We never send slide text, summaries, chat text or search text. This processing and the related device access are based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw consent at any time in Privacy settings, without losing any app function. We do not record sessions.

Crash reports are off until you say yes; the screen before sign-in asks for them together with usage statistics, and Privacy settings has a separate switch. Until you accept, the app sends nothing to PostHog and installs no crash handler. Reports contain the error, app version, phone model and operating system, never your content, and carry a random identifier (your account identifier while usage statistics are on). The basis is your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG, which you can withdraw at any time without losing any app function. PostHog discards IP addresses and keeps reports for at most 90 days.

Eventnote does not track you across other companies’ apps or websites, does not sell personal data and includes no advertising or attribution SDK. PostHog is the only analytics provider and acts for us. The only other services that receive data from the app are those named in sections 2, 5 and 6.

We publish changes at https://eventnote.app/privacy and notify you of material changes in the app and by email to your account address. For material changes we do this 30 days before they apply.

10 Website visitors (eventnote.app)

The website is a static site hosted by Cloudflare. We set no cookies, use no analytics or advertising tools and load no third-party fonts or scripts. When you open a page, Cloudflare processes your IP address, the requested address, time, browser and device information and similar request data to deliver the site, keep it secure and defend against abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and working website. Cloudflare may process this data in countries outside the EEA (certified under the Data Privacy Framework, see section 6). We do not store these logs ourselves; Cloudflare keeps them under its privacy policy.

If you email us, we process your email address and message to answer you (Article 6(1)(b) or (f) GDPR) and delete it once your request has been solved, unless a law requires keeping it. Mail to hello@ and security@ is handled as described in section 5.

11 Legal bases, security and transfers

This section applies to all processing described above.

Legal bases. Each section states the basis for its processing: consent (Art. 6(1)(a) GDPR), contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) or legitimate interests (Art. 6(1)(f)), the last only where your interests do not override them.

Security. We take appropriate technical and organisational measures for a level of security that fits the risk (Art. 32), including access control, separation of users’ data and procedures for data subject rights, erasure and breach response.

Processors. We choose external service providers with care. Where a provider acts as our processor under Art. 28 GDPR, it is bound by our instructions and by a processing agreement that meets Art. 28.

Transfers to third countries. A transfer to a country outside the EU or EEA happens only in line with Chapter V GDPR (Arts. 44 to 49): on an adequacy decision of the European Commission (Art. 45), or, if there is none, on the EU Standard Contractual Clauses together with further technical measures, or on another safeguard the GDPR allows. For companies in the USA that are certified under the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023, list at https://www.dataprivacyframework.gov/), transfers rely on that decision. Information page of the Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en. You can obtain a copy of the safeguards via hello@eventnote.app. Section 6 says which applies to each provider.

Erasure and blocking. Where we cannot erase because of a retention duty, legal claims or another person’s rights, we restrict the data to that purpose (section 7).

Hosting and server logs. Each request to our API and files creates server log data (such as the requested resource, date and time, app or browser type and usually the IP address). We use it for security and stability. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service.