TalkNote Privacy Policy

This Privacy Policy explains how personal data is processed when you use the TalkNote web app (app.talknote.net), the TalkNote mobile apps (Android and iOS), the TalkNote desktop app, the TalkNote meeting bot and the talknote.net website (together, the “Service”). TalkNote is operated by Seze Tekstil Sanayi ve Ticaret Limited Şirketi, Türkiye (“TalkNote”, “we”, “us”).

The Turkish version of this policy, KVKK Aydınlatma Metni ve Gizlilik Politikası, is our official privacy notice under the Turkish Personal Data Protection Law No. 6698 (“KVKK”). This English version describes the same practices.

1. Google user data

This section explains how TalkNote accesses, uses, stores, shares, protects, retains and deletes data it receives from Google APIs (“Google user data”). It applies when you sign in with Google and when you give TalkNote access to your Google Calendar. The rest of this policy covers all other personal data.

1.1 What Google user data we access

When we ask. When you sign in with Google, Google’s consent screen asks for your basic profile and, on the same screen, for read-only access to your Google Calendar. Calendar access is optional: you can untick it on Google’s screen and still use TalkNote, and connect your calendar later in Settings › Calendar. If you do not grant calendar access, we receive no calendar data and store no calendar token. TalkNote never creates, edits or deletes calendar events, and it does not use or store event descriptions or attachments. TalkNote does not request access to Gmail, Google Drive, Google Contacts or any other Google service.

1.2 How we use Google user data

• Account and sign-in. We use your Google profile to create your TalkNote account, sign you in and show your name and picture. We use your email address to identify your account and to send you service emails (for example purchase receipts, the meeting summaries you ask for and important notices about the Service).
• Your meetings in the app. We show the events of your selected calendars on TalkNote’s home screen, calendar views and daily agenda.
• Reminders. If you allow notifications, we send you a reminder a few minutes before an online meeting starts. The notification does not contain the meeting title or any other event details.
• Automatic bot join. Automatic bot join is on by default for new accounts. While it is on, the TalkNote meeting bot joins the online meetings on your selected calendars that you have not declined, records them and creates your notes. To join, the bot uses the meeting’s video-meeting link; when it joins, it posts a recording notice in the meeting chat. You can turn automatic bot join off for all meetings in Settings, turn the bot on or off for a single meeting in your meeting list, and choose which calendars TalkNote uses.
• Notes of a recorded calendar meeting. When a meeting from your calendar is recorded (by you or by the bot), we save its title, attendees (names and email addresses) and meeting link with that meeting’s notes. We use them as the title and participant list of your notes, to add the attendees to your private People & Companies list in TalkNote (which you can edit or delete), and, only if you choose “send to everyone”, to email the meeting summary to the attendees.
• AI features. The title and attendee names of a recorded meeting are part of that meeting’s content, which our AI provider processes only to create your summary, decisions and action items and to answer your questions in TalkNote’s chat. TalkNote’s chat does not read your calendar.

We use Google user data only to provide these user-facing features and to keep them working (for example, to troubleshoot an error you report). We do not use Google user data for advertising, including personalized, retargeted or interest-based advertising. We do not sell it, we do not transfer it to advertising platforms, data brokers or information resellers, and we do not use it to determine credit-worthiness or for lending purposes.

1.3 How we store Google user data

• Your Google profile (Google Account ID, name, email address, profile picture) is stored with your TalkNote account in our authentication and database provider, Supabase, in Frankfurt, Germany (EU).
• Calendar access in the web and mobile apps. To read your calendar when the app is closed (for reminders and automatic bot join), we keep the refresh token that Google gives us. It is encrypted with AES-256-GCM before it is saved in our database, with a key that is kept only on our own server, separately from the database. Together with it we store the email address, name and picture of the connected Google account and the list of calendars you selected. Only our server can read these records; the apps cannot. Short-lived access tokens are kept only in our server’s memory, for at most one hour, and are never written to disk.
• Calendar access in the desktop app. The desktop app reads your calendar directly from Google on your computer. Its refresh token is stored on your computer, encrypted with your operating system’s secure storage.
• Calendar events. We do not copy your calendar. We read events from Google when they are needed (when you open TalkNote’s calendar views, and every few minutes for the next 24 hours for reminders and automatic bot join) and process them in memory. We keep event data only in these cases:
  • a meeting that was recorded or that the bot was sent to: its title, attendees, meeting link and Google event ID are stored with that meeting’s record; the title and the attendee list are encrypted with your personal key (see 1.5);
  • a meeting for which you turned the bot on or off yourself: its Google event ID, together with your choice;
  • a reminder we sent: a one-way hash (SHA-256) of the event ID and start time, so that the same reminder is not sent twice.

1.4 How we share, transfer or disclose Google user data

We do not sell Google user data, and we do not share it with anyone for their own purposes. Google user data is transferred only in the cases below, and only to provide the features described in 1.2:

These service providers act on our behalf, under contract, and may use the data only to provide their service to us. Push notification services (Firebase Cloud Messaging, Apple Push Notification service) receive no calendar data: a reminder contains only a general text and the one-way hash described above. We may also disclose data where required by applicable law or a legally binding request from a competent authority, or where necessary to protect the security of the Service (for example to investigate abuse). See section 7 for all our service providers.

People at TalkNote. Our team does not read your Google user data. We allow a person to read it only (1) with your explicit permission for specific data, for example when you turn on support access for a meeting (limited to that meeting and to 48 hours), (2) when necessary for security purposes, such as investigating abuse, or (3) when necessary to comply with applicable law.

1.5 How we protect Google user data

• Encryption in transit. All connections between the apps, our servers, Google and our service providers use TLS (HTTPS).
• Encrypted tokens. Calendar refresh tokens are encrypted with AES-256-GCM using a dedicated key that is not stored in the database. In the desktop app, the token is protected by your operating system’s secure storage.
• Encrypted meeting records. The titles and attendee lists of your recorded meetings are encrypted with AES-256-GCM using a key unique to you. Your key is itself encrypted with a master key that is kept only on our own server, separately from the database and file storage, so the database alone cannot be read.
• Access control. Each user can access only their own data. Calendar tokens can be read only by our server. Administrator accounts require two-step verification, and every administrator action is written to a log that cannot be changed. Meeting content, including titles and attendees, is not shown in our admin panel.
• Secure sign-in and minimal access. Sign-in and calendar connection use Google’s OAuth 2.0 flow with anti-forgery checks. We request only read-only calendar access and read only the events the features need.
• Incidents. If a security breach affects your data, we act immediately to contain it and notify you and the Turkish Personal Data Protection Authority as described in section 10.

1.6 Retention and deletion of Google user data

How to delete your Google user data.

• Disconnect your calendar at any time in Settings › Calendar. We immediately delete the stored token and revoke TalkNote’s access at Google.
• Delete your account in Settings › General › Account › Delete account, or as described at talknote.net/hesap-silme. We revoke Google access, destroy your encryption key and delete your account data and content. Because the key is destroyed, copies in backups can no longer be read; backups are deleted automatically within 30 days.
• Remove TalkNote’s access yourself at any time at myaccount.google.com/permissions.
• Ask us to delete your data by writing from your account’s email address to destek@talknote.net. We respond within 30 days, free of charge.

1.7 Google API Services User Data Policy (Limited Use)

TalkNote’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

TalkNote does not use Google Workspace API data, including Google Calendar data, to develop, improve or train generalized or non-personalized artificial intelligence or machine-learning models. Our AI provider processes meeting content only to produce your own summaries and answers and does not use it to train its models.

2. Who is responsible for your data

The data controller for your TalkNote account is Seze Tekstil Sanayi ve Ticaret Limited Şirketi. Address: Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul Sitesi C1 Blok No: 2B İç Kapı No: 376, Ataşehir / İstanbul, Türkiye · Tax ID: 7671058042 · Email: destek@talknote.net

Meeting content. For the data of other participants in the meetings you record (their voices, names and what they say), the user who starts the recording is the data controller and TalkNote is the data processor. Informing participants and, where required, obtaining their consent is the responsibility of the user who records (see Terms of Use, section 4, in Turkish). Our obligations as a processor are set out in the Data Processing Addendum (in Turkish).

3. Personal data we collect

• Identity and contact: name, email address and profile picture; job title and company if you add them. If you sign in with Google, the data described in section 1.1. If you sign in with Apple on iOS, the name and email address Apple shares. If you create an account with email, your password is stored only as an irreversible hash; email verification codes are also stored only as a hash and for at most 15 minutes.
• Meeting content: audio recordings, transcripts, summaries, action items, notes, meeting title and time, and participant names and email addresses.
• AI chat history: the questions you write in the chat, the AI’s answers and chat titles, stored so that you can reopen your chats on all your devices.
• Calendar data: event title, time, attendees and meeting link from the calendars you connect (read-only). For Google Calendar, see section 1.
• Preferences: summary language, templates and rules, and the names and terms you enter for transcription.
• Subscription and usage: plan, monthly recording time and payment status. Card details are processed by iyzico and are not stored by us. If you subscribe through Google Play or the App Store, the store’s purchase token, product, status and order number; your payment details stay with the store.
• Mobile app: if you allow notifications, your device’s notification token, platform (Android or iOS) and app version. If you sign in with Apple on iOS, an encrypted refresh token used to disconnect Apple when you delete your account.
• AI content reports: when you report an answer or summary, the report type, your reason, your note and, if you choose to include it, the reported text.
• Technical logs: IP address, request ID, app version and error logs; for the talknote.net website, visit statistics that do not identify you (page viewed, referring site, browser type).
• Access and security logs: the meetings you gave support access to, the duration of those permissions, and the log of administrator actions on your account.
• Feedback and support requests.

4. Why we use your data and our legal bases

• Providing the Service (recording, transcription, summaries, storage, calendar reminders, mobile notifications, summary emails, the meeting bot, verifying store subscriptions): performance of a contract (KVKK art. 5/2-c).
• Support with your permission (reviewing a meeting you opened support access for): performance of a contract (art. 5/2-c) and your instructions as data controller.
• Billing, accounting and legal obligations: required by law and legal obligation (art. 5/2-a, art. 5/2-ç).
• Legally binding requests from competent authorities: legal obligation (art. 5/2-ç).
• Security, preventing abuse and fraud, fixing errors: legitimate interest (art. 5/2-f).
• Protecting our rights in disputes and proving consent records: establishment, exercise or protection of a right (art. 5/2-e).

We do not use your content for advertising, we do not sell it, and we do not use it, or let others use it, to train AI models.

5. How we protect your data

Encryption of meeting content. Your audio recordings, transcripts, summaries, decisions, action items, notes, meeting titles, participant details and AI chat history (your questions, the answers and chat titles) are encrypted with AES-256-GCM, using a key unique to you, before they are saved on our servers. Only the encrypted form of this content is in our database and file storage.

Separate keys. Your personal key is itself stored encrypted. The master key that unlocks it is kept only on our own server, separately from the database and file storage. Even if the database or file storage were obtained on its own, the content could not be read.

Encryption in transit. All connections between the apps, the website, our servers and our service providers are encrypted with TLS.

Access control. Each user can access only their own records. Files can be reached only through time-limited, signed links. Administrator accounts require two-step verification, and every administrator action is written to a log that cannot be changed.

Payments. Card details are processed on iyzico’s payment page. TalkNote never sees or stores card numbers, expiry dates or security codes.

Limits. Because transcripts and summaries are produced on our servers, your content is briefly decrypted in memory while it is processed. For this reason we do not offer end-to-end encryption. See our Security page (in Turkish) for details.

6. Our team’s access to your data

What we can see. To run the Service, bill you and fix problems, we can see your account details (name, email, plan, payment status), the recording time you have used and technical details of your meetings (date, duration, status, error code).

What we cannot see. We cannot see the content of your meetings. Audio, transcripts, summaries, notes, action items, meeting titles and participant details are not shown in our admin panel and cannot be read because they are encrypted. Your AI chat history is not shown in our admin panel either; support access covers meetings only, not chats.

Three exceptions:

1. Your permission. If you want us to look into a problem, you turn on “Support access” for that meeting in the app. The permission covers only that meeting and closes automatically after 48 hours; you can close it earlier. You can see in the app who looked at the meeting and when.
2. Legal obligation. If there is a legally binding request such as a court or prosecutor’s order, we share only what is requested. We inform you unless the law prevents it.
3. Security incident. In a documented investigation of an attack on or abuse of the Service, only what is necessary is reviewed, and the review is logged.

Everyone on our team has agreed to these rules in writing.

7. Service providers and international transfers

To provide the Service, we share your data with the following service providers, only to the extent needed for the stated purpose:

Payments you make through Google Play or the App Store are processed by the store under its own terms and privacy policy; we only learn the status of your subscription. Notification providers (Firebase Cloud Messaging, APNs) do not see meeting content.

Our own meeting bot. The meeting bot runs on our own server first. Bot recordings are kept on our server for at most 24 hours and deleted after processing. If our own bot is unavailable, the backup provider is used.

International transfers. Transfers to providers abroad are based on KVKK art. 9. We are signing the standard contracts announced by the Turkish Personal Data Protection Board with these providers and notifying the Authority within five business days after signing; this section will be updated when the process is complete. For these transfers we also ask for your explicit consent in a separate text (explicit consent for service providers abroad, in Turkish). Without that consent, recording, transcription, summary and chat features do not work; you can withdraw your consent at any time. Data may be shared with competent authorities in response to legally binding requests.

New providers. At least 30 days before adding a new provider that processes meeting content, we update this table and notify you at your account’s email address.

If you send the summary email with the “send to everyone” option, the summary goes from TalkNote’s email address (through Resend) to the attendees in the calendar, and replies come back to you; you start this transfer. The email contains your name, the meeting title, the summary, decisions and action items; the audio recording is not sent.

8. How we collect data

We collect data from the information you enter in the app; from Google or Microsoft when you connect those accounts; from recordings made through your computer’s or phone’s microphone, system audio or the meeting bot; and automatically while you use the Service. The mobile app accesses the microphone only when you start a recording, and a persistent notification is shown on the phone while recording.

9. Retention and deletion

• Meeting content: until you delete it. Deleted meetings stay in the trash for 30 days and are then permanently deleted together with their files.
• AI chat history: until you delete it. You can delete chats one by one or all at once in the app, and deleted chats are removed permanently right away. Chats are deleted automatically 12 months after their last message.
• Account deletion: when you delete your account, your personal encryption key is destroyed first, and then all your content and account data are deleted. Because the key is destroyed, copies that are in backups at that time can no longer be read; these backups are deleted automatically by the provider’s backup cycle within 30 days.
• Meeting bot recordings: deleted from the bot provider after processing; temporary copies on our server are kept for at most 24 hours.
• Invoices and payment records: for the period required by law (for example 10 years).
• Technical logs: at most 1 year.
• Administrator action logs and support access logs: 2 years.
• AI content reports: 90 days.
• Notification token: deleted when you sign out of the app or delete your account.
• In the web app, audio chunks are kept temporarily in your browser’s storage during a recording and deleted after they are uploaded to the server.
• In the mobile app, audio is kept during a recording in the app’s private storage on the phone and deleted after processing; if a recording is interrupted, the app recovers it the next time it opens.
• Local audio files that the desktop app keeps on your computer (Documents\TalkNote) are under your control; we do not delete them when your account is deleted.

For Google user data, see section 1.6. Data whose retention period has ended is deleted in periodic destruction carried out at least every 6 months under our Personal Data Retention and Destruction Policy.

10. Data breaches

If we learn of a security breach affecting your data, we act immediately to contain it. We notify the Turkish Personal Data Protection Board within 72 hours and the affected users as soon as possible. The notice explains when the breach happened, which data it affected, its possible consequences and the measures we took.

11. Your rights

Under article 11 of KVKK you have rights, including the right to learn whether your data is processed and to whom it is transferred, to request information, to request correction or deletion, to object to a result against you arising from automated analysis, and to claim compensation for damage.

You can send your request from the email address registered to your TalkNote account to destek@talknote.net, to the same address with a secure electronic or mobile signature, or with a signed letter to our address above. State your name, contact details and request clearly. We respond free of charge within 30 days at the latest. A request template is on our KVKK request page (in Turkish). If your request is rejected, you find our answer insufficient or you do not receive an answer in time, you can complain to the Personal Data Protection Board.

You can see, export, correct and delete most of your data yourself in the app.

12. Cookies

We do not use advertising, marketing or tracking cookies. Only cookies that are technically necessary for session management and for network security through Cloudflare (for example bot and attack blocking) are used.

• talknote.net website: we set no cookies of our own; the dark/light theme you choose is stored only in your browser. Cloudflare may set cookies required for network security. Visit statistics (Cloudflare Web Analytics) are collected without cookies and without identifying you.
• Web app (app.talknote.net): necessary cookies and browser storage to keep you signed in.
• Mobile app: no cookies; your session is kept in the phone’s secure storage.
• Desktop app: no cookies.

13. Children

TalkNote is intended for users aged 18 and over, as stated in our Terms of Use, and is not directed to children.

14. Changes to this policy

We may update this policy. For material changes, the version of the policy changes, and the app shows you the new text and asks for your consent before you continue. If our use of Google user data changes, we update section 1 before the change takes effect. Adding a new service provider is announced in advance as described in section 7.

15. Contact

Questions about this policy or your data: destek@talknote.net · Seze Tekstil Sanayi ve Ticaret Limited Şirketi, Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul Sitesi C1 Blok No: 2B İç Kapı No: 376, Ataşehir / İstanbul, Türkiye.

Other documents

Gizlilik politikası (Türkçe) Terms of Use (Turkish) Data Processing Addendum (Turkish) Security (Turkish) Delete your account All legal documents