Privacy Policy

This Privacy Policy explains how innernote ("innernote," "we," "us," or "our") collects, uses, shares, stores, and protects your information when you access or use the innernote platform, website, applications, and related services (collectively, the "Service"). It also explains the rights and choices available to you in relation to your personal data.

innernote is operated as a sole proprietorship based in Bengaluru, Karnataka, India(the "Proprietor"). For the purposes of the Digital Personal Data Protection Act, 2023 and the rules made under it (the "DPDP Act"), and the Information Technology Act, 2000 together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), the Proprietor is the entity that determines the purpose and means of processing your personal data and is the data fiduciary (and, where applicable, the body corporate) responsible for your personal data.

Please read this Policy carefully. By creating an account, accessing, or using the Service, you confirm that you have read and understood this Policy. Where the law requires your consent for a particular processing activity, we will rely on the consent you provide, and you may withdraw that consent as described in Section 11. This Policy forms part of, and should be read together with, our Terms of Service.

1. A Quick Summary

This summary is for convenience only and does not replace the full Policy below.

• We collect the information you give us (such as your name, email, professional profile, writing samples, voice recordings, and the content you create), information we collect automatically (such as usage and device data), and information from services you connect (such as Google sign-in and LinkedIn).
• We use this information to operate the Service, build a personalized writing voice for you, generate and refine content, prevent repetition across your posts, publish to LinkedIn when you ask us to, process payments, keep the Service secure, and comply with law.
• We use third-party artificial intelligence ("AI") providers to process your content. We do not sell your personal data, and we do not permit your personal content to be used to train general-purpose AI models that serve other users.
• You have rights over your data, including access, correction, erasure, grievance redressal, and nomination. To exercise them, contact our Grievance Officer using the details in Section 18.

2. Information We Collect

2.1 Information You Provide to Us

• Account information. When you create an account, we receive your name, email address, profile picture, and a unique identifier from your authentication provider (for example, when you sign in with Google).
• Professional and profile details. Your first and last name, occupation or role, industry, experience level, the URL or details of your professional profile, and similar information you choose to provide to personalize the Service.
• Onboarding answers. Your responses to onboarding questions and interviews, including written answers, the questions shown to you, and your progress through the onboarding flow.
• Writing samples and voice inputs. Text samples, drafts, ideas, notes, prompts, preferences, banned words, signature phrases, beliefs, tone settings, and other inputs you provide so that we can analyze and reproduce your writing style.
• Voice recordings and audio. If you use voice features (such as spoken onboarding interviews, idea capture, or spoken feedback), we collect the audio you record, the transcript produced from that audio, and related metadata such as timestamps. See Section 4 for how we handle voice data.
• Content you create or import. Posts, drafts, ideas, campaigns, and any files or content you upload or import, including documents you export from LinkedIn (such as a profile export or an analytics workbook) and links to articles or posts you ask us to analyze.
• Payment information. When you subscribe to a paid plan, our third-party payment processor collects and processes your billing details, such as your payment method, billing address, and transaction history. We do not receive or store your full card number; we receive limited information such as a subscription identifier, payment status, billing period, amount, and currency.
• Communications and feedback. Information you provide when you contact us for support, report a grievance, submit feedback, respond to a survey, or tell us how you heard about us.

2.2 Information We Collect Automatically

• Usage data. Information about how you interact with the Service, such as features used, actions taken, pages and screens viewed, content generated, timestamps, and frequency and duration of use.
• Device and connection data. Device type, operating system, browser type and version, language settings, and similar technical information.
• IP address. Your Internet Protocol address and approximate location derived from it. We use this for security, abuse prevention, fraud detection, rate limiting, and to prevent the creation of duplicate or fraudulent accounts.
• Attribution data. When you first arrive, we may record limited information about how you found us, such as referring website, landing page, campaign parameters in the link you followed, and an advertising click identifier. This is recorded once at signup and is used to understand which channels bring users to the Service.
• Cookies and similar technologies. We use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand usage. See Section 9.
• Diagnostic and error data. When something goes wrong, we may collect error reports and diagnostic information, which can include a request identifier, the route involved, and the type of operation, so that we can find and fix problems.

2.3 Information from Connected Services and Third Parties

• Authentication providers. When you sign in through Google or another supported provider, we receive your name, email address, profile picture, and a unique identifier as authorized by you.
• LinkedIn. If you connect your LinkedIn account, we receive, with your authorization and as permitted by LinkedIn, your LinkedIn identifier, name, email, profile image, access credentials needed to publish on your behalf, and (if you ask us to import or analyze your content) profile information, posts, and engagement metrics. See Section 5 for more on the LinkedIn integration.
• Payment processor. Our payment processor provides us with subscription and transaction information needed to manage your plan, such as status, billing period, and payment events.
• Analytics and infrastructure providers. We may receive aggregated or technical information from the analytics, monitoring, and infrastructure providers that help us run the Service.

3. How and Why We Use Your Information

We use your information only for the purposes described below, and we limit collection to what is necessary for those purposes.

• To provide and operate the Service. To create and maintain your account, deliver the features you use, process your transactions, and respond to your requests.
• To build your personalized writing voice. To analyze your writing samples, onboarding answers, voice recordings, imported content, and preferences in order to construct a profile of your writing style, and to use that profile to generate and refine content for you.
• To generate and improve your content. To produce drafts and suggestions, convert spoken or rough ideas into written posts, score and improve quality, and reduce repetition by remembering the topics and themes you have already covered.
• To publish and schedule on your behalf. To publish or schedule posts to your connected LinkedIn account when you instruct us to, and to retrieve engagement metrics for posts you have published, where you have authorized this.
• To process payments. To manage your subscription, process billing through our payment processor, handle renewals and cancellations, and keep records required for accounting, tax, and audit purposes.
• To communicate with you. To send service and transactional messages (such as account, security, and billing notices) and, where permitted, occasional messages about features, tips, and offers. You can opt out of non-essential messages at any time.
• To keep the Service secure and prevent abuse. To detect, investigate, and prevent fraud, abuse, security incidents, duplicate or fraudulent accounts, and other harmful or unlawful activity, including through rate limiting and verification checks.
• To understand and improve the Service. To analyze usage in aggregate, diagnose technical issues, measure performance, and develop new features.
• To comply with law. To meet our legal and regulatory obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We will not use your personal data for a new purpose that is incompatible with the purposes above without informing you and, where required, obtaining your consent.

4. Voice Recordings and Audio Data

Some features allow you to speak instead of type. When you use these features:

• What we collect. We collect the audio you choose to record, a text transcript generated from that audio, and related metadata such as timestamps and segment boundaries.
• How we use it. We use your audio and its transcript to convert your speech into text, to build and refine your writing voice, and to let you review what you recorded. Recording is always initiated by you.
• Transcription providers. Audio is sent to third-party AI providers solely to produce a transcript. These providers act on our behalf under contractual obligations and are not permitted to use your audio for their own purposes.
• No voiceprints. We use audio only to capture what you said. We do not use your audio to create a biometric voiceprint to identify you, and we do not use it for biometric identification or authentication.
• Your control. You can choose not to use voice features and type instead. You may request deletion of stored audio as described in Section 11.

5. The LinkedIn Integration

The Service lets you connect your LinkedIn account so that you can publish and schedule posts, and optionally import and analyze your own LinkedIn content. The integration works only with your authorization:

• Authorization. When you connect LinkedIn, you grant the Service permission to act on your behalf for the limited purposes you approve, such as publishing content you have created and retrieving the metrics of posts you have published.
• Credentials. We store the access credentials needed to maintain the connection and to act on your behalf, and we protect them as described in Section 8.
• Use limited to the integration.We use LinkedIn data only to provide the features you have requested. We do not sell LinkedIn data, share it outside the purposes you have authorized, or use it in any way that is inconsistent with LinkedIn's applicable terms.
• Disconnecting.You can disconnect LinkedIn at any time. Once published to LinkedIn, your posts are governed by LinkedIn's own policies and are no longer within our control.
• LinkedIn's policies.Your use of LinkedIn through the Service is also governed by LinkedIn's user agreement and privacy policy. We are not responsible for LinkedIn's practices.

6. How We Use AI With Your Content

The Service relies on artificial intelligence to analyze your style and generate content. We want to be clear about how this works:

• Processing to serve you. Your content, writing samples, and voice transcripts are processed by AI systems to build your voice profile, generate drafts and suggestions, and reduce repetition across your posts. This processing exists to deliver the Service to you.
• Third-party AI providers. We use reputable third-party AI providers to perform analysis, generation, transcription, and similarity processing. We share with them only what is needed to perform the task. These providers act on our instructions under contractual obligations and are not permitted to use your content for their own purposes.
• No training on your content. We do not use your personal content, drafts, writing samples, or voice recordings to train general-purpose AI models that serve other users, and we instruct our AI providers not to do so.
• Aggregated and de-identified data. We may use aggregated or de-identified information that cannot reasonably be linked back to you to operate, secure, and improve the Service.
• AI outputs require your review. AI can make mistakes. Content generated for you may be inaccurate, incomplete, or unsuitable, and may resemble content produced for others. You are responsible for reviewing and editing all AI-generated content before you publish or rely on it. See our Terms of Service for details.

We deliberately do not disclose the specific AI models, vendors, or internal infrastructure we use, both for security reasons and because these may change over time. This does not reduce the protections described in this Policy.

7. How We Share Your Information

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share information only in the limited circumstances below.

• Service providers and processors. With trusted vendors who process data on our behalf to run the Service, such as cloud hosting and database, file and media storage, AI processing and transcription, content extraction, email delivery, scheduled-delivery, error monitoring, analytics, and payment processing. They are bound by contract to protect your data and use it only as we instruct.
• Connected services you authorize. With services you choose to connect, such as LinkedIn, to deliver the features you have requested.
• Legal and safety. When required by applicable law, regulation, legal process, or a lawful governmental or regulatory request, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of innernote, our users, or the public, or to detect or prevent fraud, security, or technical issues.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, in which case your information may be transferred subject to this Policy, and we will notify you of any material change in how your information is handled.
• With your consent. When you direct us to share your information, or otherwise consent to its sharing.

8. Data Security

We maintain reasonable security practices and procedures designed to protect your information, taking into account the nature of the data and the risks involved. These include:

• Encryption of data in transit using industry-standard transport security.
• Encryption of particularly sensitive secrets at rest.
• Access controls, authentication requirements, and limiting access on a need-to-know basis.
• Rate limiting, abuse detection, and input safeguards to protect the Service and your data.
• Use of reputable cloud infrastructure and service providers that maintain their own security programs.

Despite these measures, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for activity under your account. If we become aware of a breach of your personal data that is likely to affect you, we will notify you and the relevant authorities as required by applicable law, including the DPDP Act.

9. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies for the following purposes:

• Essential. Required for the Service to function, including keeping you signed in, maintaining sessions, and protecting against security threats. These cannot be switched off through the Service.
• Preferences. Remember your settings and choices to give you a smoother experience.
• Analytics. Help us understand how the Service is used so that we can improve it. Where required by law, we will request your consent before using non-essential analytics technologies.

You can manage cookies through your browser settings. Disabling some cookies may affect how the Service works. Some browsers send a "Do Not Track" signal; because there is no common industry standard for these signals, we do not currently respond to them, but we honor the choices described in this Policy.

10. Data Retention

We keep your personal data only for as long as it is needed for the purposes described in this Policy, or for as long as required or permitted by law.

• While your account is active. We retain your account information, content, voice profile, and related data to provide the Service to you.
• After account closure. After you delete your account, we will delete or anonymize your personal data, including stored audio recordings, within ninety (90) days, except where we must retain certain information for legal, regulatory, accounting, tax, dispute-resolution, fraud-prevention, or audit purposes.
• Transaction and compliance records. We may retain payment and transaction records, and security and audit logs, for longer periods where required to meet legal and regulatory obligations.
• Published content. Content you have published externally, such as posts on LinkedIn, is not within our control after publication and is subject to the policies of those platforms.

11. Your Rights and Choices

Subject to applicable law, including the DPDP Act, you have the following rights in relation to your personal data:

• Right to access. Obtain a summary of the personal data we process about you and the processing activities we undertake.
• Right to correction. Request correction of inaccurate or misleading data and completion or updating of incomplete data.
• Right to erasure. Request deletion of your personal data, subject to legal exceptions and our retention obligations.
• Right to grievance redressal. Raise a grievance about how we process your data with our Grievance Officer (Section 18), who will respond within the timelines required by law.
• Right to nominate. Nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent. Where we rely on your consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and may limit your ability to use parts of the Service.
• Right to opt out of non-essential messages. Unsubscribe from promotional communications at any time using the link in those messages or by contacting us.

To exercise any of these rights, contact our Grievance Officer using the details in Section 18. We may need to verify your identity before acting on a request. If you are not satisfied with our response, you may have the right to complain to the Data Protection Board of India or another competent authority.

You also have a duty under the DPDP Act not to provide false particulars, impersonate another person, or file frivolous or false grievances or complaints.

12. Legal Bases for Processing

We process your personal data on the following legal bases, as applicable:

• Consent. Where we ask for and you give your consent to a specific processing activity.
• Performance of a contract. Where processing is necessary to provide the Service you have requested under our Terms of Service.
• Legitimate uses and interests. Where processing is necessary for purposes such as security, fraud prevention, and improving the Service, and is consistent with applicable law.
• Legal obligation. Where processing is necessary to comply with applicable law.

13. International and Cross-Border Data Transfers

We are based in India, and the Service relies on service providers that may store or process data in India and in other countries. As a result, your information may be transferred to, stored in, or processed in countries other than your own, where data protection laws may differ from those in your jurisdiction. Where we transfer personal data across borders, we do so in accordance with applicable law and use appropriate safeguards, such as contractual protections with the recipients. By using the Service, you understand that your information may be processed in this way.

14. Children

The Service is intended for adults and is not directed to children. You must be at least 18 years old to use the Service. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a person under 18 without appropriate consent, we will take steps to delete it. If you believe a person under 18 has provided us with personal data, please contact our Grievance Officer (Section 18).

15. Information for Users in the European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you may have rights under the General Data Protection Regulation or equivalent local law, including the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to lodge a complaint with your local supervisory authority. We process your personal data on the legal bases described in Section 12. To exercise these rights, contact us using the details in Section 18.

16. Information for Users in California and Other US States

If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know what personal information we collect, to access and delete it, to correct it, and to opt out of its sale or sharing for cross-context behavioral advertising. We do not sell your personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights. To exercise these rights, contact us using the details in Section 18.

17. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy on the Service and update the "Last updated" date above, and, where appropriate or required, notify you by email or through the Service. Your continued use of the Service after the changes take effect indicates your acceptance of the updated Policy.

18. Grievance Officer and Contact

In accordance with the DPDP Act and the Information Technology Act, 2000 and the rules made under it, you may contact our Grievance Officer with any question, concern, request, or grievance relating to your personal data or this Policy. We will acknowledge and resolve grievances within the timelines required by applicable law.

If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India or another competent authority under applicable law.