Privacy Policy
The short version
Your meeting data never reaches us. Transcripts and notes are fetched with your own authorization, processed only locally in your browser, and saved to your own computer. We have no server that stores meeting data. The only server we operate is the license proxy, which never receives meeting content. The extension does not send transcript content to us.
The only thing that leaves your machine on our behalf is your license key and activation information, which we send through our license service at /api/license/* on this site (which checks it with Creem) at activation and on periodic re-checks to confirm that your purchase is valid. Meeting content is never part of that request.
1. Who this policy is from
This policy explains how ZHONG WENKANG ("we", "us", "our") handles personal data in connection with the NoteHaul Chrome extension (the "Extension") and the website at notehaul.yuemishuma.com (the "Site"). We are the controller for the personal data described in Sections 3 and 4 below.
NoteHaul is an independent product and is not affiliated with, endorsed by, or sponsored by Read AI, Inc. "Read.ai" and other third-party names are trademarks of their respective owners and are used only to describe compatibility.
2. Meeting data is processed locally and never uploaded to our servers
This is the core of how NoteHaul works, and it is the most important statement in this policy:
- Transcripts, notes, meeting titles, dates, participants, and every other part of the content you export are processed only locally, inside your browser.
- They are never uploaded to our servers. We do not transmit meeting content to any server we operate. The only server we operate is the license proxy, which never receives meeting content.
- We have no server that stores meeting data. The only server we operate is the license proxy, which never receives meeting content. There is no copy of your transcripts in our possession, and no account with us that holds them.
- Your data goes only two places: from Read.ai's official API into your browser, and from your browser into the ZIP file you download to your own device.
- We cannot access, read, recover, or delete your exports. They live on your machine, under your control.
Because we never receive your meeting content, we cannot process it, sell it, share it, or use it for any purpose — and no third party receives it from us.
3. What we do collect and handle
We keep collection to the minimum needed to sell and activate a paid license.
a) License key verification through our license service. When you activate the Extension, and on periodic re-checks, the Extension sends your license key and activation information (such as whether activation succeeded, an installation/instance identifier, and basic technical details needed to complete the check) to our license proxy at /api/license/* on this site. The proxy forwards that request to Creem, our payment provider and Merchant of Record, and returns the result. The proxy sees the license key, a device/instance ID, and the requester's IP address. It never receives meeting content. Each license can be activated on at most 3 devices. We also see the resulting activation state. This request never contains meeting content, transcript text, meeting titles, or participants. Our license proxy keeps access logs of these requests for 30 days, for abuse prevention and troubleshooting, and then deletes them.
b) Purchase data, handled by Creem under its own policy. Your purchase — including your email address, payment details, billing information, tax information, and order ID — is collected and processed by Creem as Merchant of Record. Creem handles the payment transaction as an independent controller under Creem's own privacy policy, and we do not control Creem's processing. We receive limited order information from Creem (for example, that an order was completed and an order identifier) so we can provide support and process refunds. We do not receive or store your full payment card details.
Please review Creem's privacy policy for how Creem handles your purchase data, including international transfers and retention.
c) Support correspondence. If you email support@notehaul.yuemishuma.com, we receive your email address and whatever you choose to include in the message — for example, an order ID and a description of the problem. Please do not send us transcripts or other meeting content; we do not need it to help you, and we would rather not hold it. Support email is stored in our email provider's mailbox.
d) Site hosting data. The Site is served over the web, and our hosting provider may process standard technical data (such as IP address, user agent, and request timestamps) in server logs for security and to keep the Site online. This is ordinary web-server operation and is not used to build a profile of you.
4. Data stored locally in your browser
The Extension stores the following locally on your device, in the browser's extension storage:
- Your Read.ai authorization — the OAuth token you supplied, used to fetch your own transcripts;
- Your license key and activation state, so the Extension knows it is activated;
- Your Extension settings, such as format and export preferences.
This data stays in your browser's extension storage on your machine. It is not synced to us. If you remove the Extension, this local storage is deleted by the browser; you can also clear extension data at any time from your browser's extension settings. Keep in mind that anyone with access to your device or browser profile may be able to read locally stored credentials — use the normal device security you would use for any logged-in app.
5. What we do NOT collect
- We do not collect your meeting transcripts, notes, titles, participants, or calendar data.
- We do not operate a server that stores meeting data. The only server we operate is the license proxy, which never receives meeting content.
- We do not sell your personal data.
- We do not use your data for advertising, profiling, or ad targeting.
- We do not use third-party advertising trackers.
Analytics and tracking: the Extension contains no analytics or tracking by default. If we add product analytics in the future, this policy will be updated before it ships to describe exactly what is collected, why, and on what legal basis, and we will keep it to the minimum necessary for the Extension to function and improve. As of the effective date above, there is none.
6. Why we process this data (legal bases)
Where the GDPR or a similar law applies, we rely on:
- Performance of a contract (Art. 6(1)(b)) — to deliver the Extension, activate your license, verify your purchase, provide support, and process refunds;
- Legitimate interests (Art. 6(1)(f)) — to keep the Extension working, prevent license abuse and fraud, secure the Site, and respond to support requests;
- Legal obligation (Art. 6(1)(c)) — to keep records where tax, accounting, or consumer-protection law requires it;
- Consent (Art. 6(1)(a)) — where we ask for it (for example, if you opt in to something optional), which you may withdraw at any time.
7. Sharing and third parties
We share personal data only as needed, and never meeting content:
- Creem — payment processing, Merchant of Record services, license key issuance, and license verification, under Creem's own privacy policy;
- Our license service — we operate the license proxy at
/api/license/*on this site. It receives the license check from the Extension, sees the license key, a device/instance ID, and the requester's IP address, and forwards the check to Creem. It never receives meeting content. Its access logs are kept for 30 days and then deleted. - Read.ai — your browser talks to Read.ai's official API using your own authorization via Read.ai's official OAuth. That exchange is between you and Read.ai and is governed by Read.ai's privacy policy and terms, not ours. We do not receive that data;
- Hosting and email providers — for serving the Site and receiving support email;
- Legal and safety — if required by law, valid legal process, or to protect rights, safety, and security.
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
8. International transfers
We are based in the People's Republic of China, and our service providers (including Creem and our hosting and email providers) may process data in other countries. License checks are forwarded by our license service to Creem, which may process them in another country. Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses. Creem is responsible for the transfer safeguards for the purchase data it controls. You can contact us for more information about the safeguards we use.
9. Retention
- License key and activation data: kept while your license is active and for a reasonable period afterwards, as needed for support, accounting, and abuse prevention.
- License proxy logs: kept for 30 days for abuse prevention and troubleshooting, then deleted.
- Purchase records: retained by Creem under Creem's own retention policy; we retain the limited order information we need for support, refunds, and legal/tax obligations.
- Support email: kept only as long as needed to resolve your request and meet legal obligations, then deleted.
- Local browser data: retained on your device until you remove the Extension or clear its data.
- Meeting content: never retained by us, because we never receive it.
10. Security
We take reasonable technical and organizational measures to protect the limited data we handle, and the Extension is designed so that the sensitive data — your transcripts — stays on your machine. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for the security of your own device, browser profile, and provider credentials.
11. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate personal data;
- delete personal data (note: we cannot delete local data on your device, or data held by Creem or the provider as independent controllers — contact them directly for that);
- restrict or object to certain processing;
- port personal data you provided to us;
- withdraw consent where processing is based on consent;
- not be discriminated against for exercising your rights (including under the CCPA/CPRA, where you also have the right to know what is collected and to opt out of sale/sharing — we do not sell or share personal data as defined by that law);
- lodge a complaint with your local data protection authority.
To exercise any right, email support@notehaul.yuemishuma.com. We will respond within the timeframe required by applicable law, typically within 30 days. We may need to verify your identity — usually by confirming the email address or order ID connected to your purchase — before acting. Note that for purchase data, Creem is the controller; we will point you to Creem where that is the right route.
12. Chrome Web Store Limited Use statement
NoteHaul's use of information received from Chrome extension APIs and from the third-party provider's API complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:
- We use the data solely to provide and improve the Extension's single stated purpose: exporting your own meeting transcripts and notes to Markdown, TXT, and/or JSON files on your device.
- We do not transfer this data to third parties except as necessary to provide or improve that purpose, to comply with applicable law, or as part of a merger or acquisition (with notice).
- We do not use or transfer this data for advertising, for creditworthiness, or for lending purposes.
- We do not allow humans to read this data, except (a) with your affirmative consent for specific content, (b) as necessary for security purposes or to investigate abuse, or (c) as required by law.
- Meeting content is processed locally in your browser and is never transmitted to us.
13. Children
The Extension is a business and productivity tool and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time, for example to reflect new features or legal requirements. We will update the "Effective date" above, and where changes are material we will provide a more prominent notice. If we ever change how we handle meeting content — for example, if a future version were to introduce any server-side processing — we will say so explicitly, and we will not do it silently or apply it retroactively to data we never had.
15. Contact
Privacy questions, requests, or complaints: