California Privacy Notice

Last updated: 2026-10-05. Effective: 2026-10-05.

This California Privacy Notice supplements the Kodanote Privacy Policy at https://www.kodanote.com/legal/privacy-policy/. It gives California residents the additional information required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (together, the “CCPA”). This notice is published at https://www.kodanote.com/legal/california-privacy/.

“Solidmatics”, “we”, “us” and “our” mean Solidmatics Inc. “Kodanote” or the “Service” means the Kodanote website at https://www.kodanote.com, the web dashboard, the iOS and Android apps, our APIs, and related services. Capitalized terms that are not defined here, such as User Content, Connected Platform, Organization, Organization Admin, AI Features, Output and Recording, have the meaning given in the Terms of Use at https://www.kodanote.com/legal/terms-of-use/.

In short: we collect the personal information needed to run accounts, keep the Service secure and work with our business contacts. We have not sold or shared personal information in the preceding 12 months, and we do not sell or share it. Kodanote uses artificial intelligence (AI) models, including third-party models, to process some content, as Section 3.3 (Artificial intelligence) explains. You can ask us what we hold about you, and ask us to correct or delete it, by emailing [email protected].

Who This Notice Applies To
Personal Information We Collect
How We Use and Disclose Personal Information
No Sale or Sharing of Personal Information
Retention
Your California Privacy Rights
How to Exercise Your Rights
Information We Process as a Service Provider
Notice at Collection
Other California Disclosures
Changes to This Notice
Contact Us

1. Who This Notice Applies To

1.1 California residents

This notice applies to you if you are a resident of California and we collect your personal information as a “business” under the CCPA. It applies to the extent the CCPA applies to Solidmatics and to that information. The CCPA applies to a business only when the business meets thresholds set in the law; we publish this notice so that California residents can see our practices in either case.

1.2 Business contacts and personnel of customers

Kodanote is a business service, and most people whose information we hold deal with us in a work capacity. Since 2023-01-01, the CCPA has covered personal information about people acting in a business or employment capacity. This notice therefore covers, for example:

people who use Kodanote as members of an Organization;
employees, contractors and other personnel of our customers, prospective customers, vendors and partners whose business contact details we hold;
people who visit our website or write to us.

1.3 Information we process for customer Organizations

For personal information contained in User Content, in Recordings uploaded to the Service and in data received from Connected Platforms on an Organization’s instruction, the Organization is the business and Solidmatics acts as its service provider. Section 8 (Information We Process as a Service Provider) explains what that means for requests about that information. The table in Section 2.2 (Categories collected in the preceding 12 months) includes this information so that the full picture is in one place, and marks it with the words “As a service provider”.

1.4 What “personal information” means

“Personal information” has the meaning given in the CCPA: information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not include publicly available information, deidentified or aggregate consumer information, or information that the CCPA otherwise excludes from its scope.

2. Personal Information We Collect

2.1 Sources

We collect personal information from the following categories of sources:

You, when you create an account, use the Service, or write to us.
Your Organization, when a member invites you, assigns you a role, or adds content that relates to you.
Your devices, automatically, when your browser or the mobile app communicates with the Service, including when you visit our public website.
Connected Platforms, when your Organization connects an account and publishes through it, including status events about the connection, and, if and when the Service lets you read them, the comments, reviews and performance figures of your Organization’s own accounts.
Our service providers, for example analytics providers that report on visits to our public website and, where we offer paid plans, our payment processor.
Public and business sources, for prospective customers: public professional profiles, company websites, referrals and events.

2.2 Categories collected in the preceding 12 months

The table below lists the categories of personal information, as the CCPA defines them, that we have collected in the 12 months before the “Last updated” date of this notice. For each category it gives examples, the sources, the business purposes for which we use it, and the categories of recipients to whom we disclose, or may disclose, it for a business purpose. The purposes are described in Section 3.1 (Business purposes) and the recipients in Section 3.2 (Categories of recipients). A category may include only some of the examples given. Entries marked “where we offer paid plans” or “if and when the Service lets you” describe features that did not exist in that period. We have not yet collected that information and list it so that this notice stays accurate when those features launch.

CCPA category	Examples	Sources	Business purposes	Categories of recipients
Identifiers	Name, email address, user identifier, Organization identifier, IP address, and the session and device identifiers used to keep you signed in; postal address of business contacts; online identifiers such as cookie identifiers on our public website. As a service provider: the identifier, display name, username or handle of accounts connected from Connected Platforms, identifiers that appear in User Content, and, if and when the Service lets you read comments and reviews, the display names of people who commented on your YouTube videos or reviewed your business on Google, and the channel links of the commenters.	You; your Organization; your devices; Connected Platforms; public and business sources	Providing the Service; support and communications; security; debugging and improvement; marketing to business contacts; managing business relationships; legal compliance	Authentication provider; hosting and storage providers; AI providers, where the information forms part of a request to an AI Feature; error monitoring and logging providers; analytics and cookie-consent providers; web font service (IP address); Connected Platforms, at your direction; members of your Organization; authorities and legal recipients
Customer records described in Cal. Civ. Code § 1798.80(e)	Name, postal address, telephone number and employer, where you give them to us; where we offer paid plans, billing contact details and the type and last digits of a payment method (we do not receive or store full card numbers).	You; your Organization; public and business sources; payment processor, where we offer paid plans	Support and communications; managing business relationships; marketing to business contacts; billing; legal compliance	Authentication provider (name); hosting and storage providers; payment processor, where we offer paid plans; authorities and legal recipients
Commercial information	None collected in the preceding 12 months, because Kodanote has not offered paid plans. If and when we offer paid plans and your Organization buys one: the plan purchased, subscription, invoice and payment history.	You; your Organization; payment processor	Billing; support and communications; legal compliance	Payment processor; hosting and storage providers; authorities and legal recipients
Internet or other electronic network activity information	Log data such as the pages and endpoints requested, timestamps, browser or app type and version, operating system and error details; error reports that include recent in-app actions; records of connection events for Connected Platforms, including the identifier of the user who made the connection. On our public website: pages viewed, referring page, approximate location derived from your IP address, device and browser details, cookie identifiers set by our analytics providers if you accept analytics cookies in the website’s cookie banner, and your cookie choices, recorded by our cookie-consent provider. As a service provider, if and when the Service lets you read them: comments on your YouTube videos and reviews of your business on Google, and the totals Google reports for your channel or Business Profile.	Your devices; Connected Platforms; our service providers	Providing the Service; security; debugging and improvement; marketing to business contacts; legal compliance	Hosting and storage providers; error monitoring and logging providers; authentication provider (session details); analytics and cookie-consent providers; web font service (browser details); AI providers, where you ask for a suggested reply to a comment or review; members of your Organization (comments, reviews and totals); authorities and legal recipients
Audio, electronic, visual or similar information	Your account profile picture, if you add one. As a service provider: images, video and audio files uploaded to the Service, their previews, the written descriptions that an AI model produces for every uploaded image, transcripts of audio and video uploaded into ideas, profile pictures of connected accounts, Recordings you upload into ideas, and, if and when the Service lets you read comments and reviews, the profile pictures of the people who wrote them.	You; your Organization; Connected Platforms	Providing the Service, including generating previews, image descriptions, transcripts and video captions, and publishing what your Organization schedules	Authentication provider (profile picture); hosting and storage providers; AI providers (every uploaded image, with its file name, and the sound of audio files and videos uploaded into ideas, without the file name, the metadata embedded in the file or the picture of a video); Connected Platforms, at your direction; members of your Organization
Professional or employment-related information	Business contact details such as job title, company and business email address; your membership and role in each Organization in the Service.	You; your Organization; public and business sources	Providing the Service; support and communications; managing business relationships; marketing to business contacts	Authentication provider (membership and role); hosting and storage providers; members of your Organization; authorities and legal recipients
Sensitive personal information	Account log-in: the email address and password, and any multi-factor authentication settings, you use to sign in.	You	Signing you in and securing your account	Authentication provider

2.3 Categories we do not collect for our own purposes

We do not collect precise geolocation; the mobile apps do not access your location (see Section 2.6 (Mobile apps) of the Privacy Policy). We do not collect biometric information, and we do not use Recordings, videos or images to identify anyone by voice or face. We do not collect characteristics of protected classifications or non-public education information for our own purposes. We do not draw inferences from personal information to create a profile about anyone’s preferences, characteristics, predispositions, behavior or attitudes.

User Content can contain any kind of personal information an Organization chooses to upload. For example, the automatic description of an uploaded image may note the apparent age group, hair color or skin tone of a person shown. Files may also contain location metadata, such as GPS coordinates in a photo’s EXIF data. We do not read or use that metadata, but we store the original file and may send it unchanged to a Connected Platform when you publish, as Section 2.2 (Content you create or upload) of the Privacy Policy explains. When we send the sound of an audio file or video for transcription, that metadata is left out. We process all of this information only as a service provider for the Organization, we do not use it to identify or profile anyone, and the Organization is responsible for it as described in Section 8 (Information We Process as a Service Provider).

2.4 Sensitive personal information

The only sensitive personal information we collect for our own purposes is your account log-in credentials. Our authentication provider holds them to sign you in; your password is stored as a hash, and our own systems store your user identifier, not your password. We use and disclose these credentials only to sign you in and secure your account, which are purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), and we do not use sensitive personal information to infer characteristics about you. Sensitive personal information contained in User Content is processed as a service provider for the Organization concerned.

2.5 Deidentified information

Where we use deidentified information, for example aggregated information about how features are used as described in Section 9.5 (Use of Your Content with AI) of the Terms of Use, we keep it in deidentified form, do not attempt to reidentify it, and require anyone we disclose it to not to reidentify it.

3. How We Use and Disclose Personal Information

3.1 Business purposes

We use personal information for the following business purposes, which correspond to the purposes in Section 3 (How We Use Information and Our Legal Bases) of the Privacy Policy:

Providing the Service: creating and managing accounts and Organizations, signing you in, enforcing access controls, storing content, generating previews, image descriptions and transcripts, scheduling and publishing to Connected Platforms, reporting results, showing comments, reviews and performance figures from Connected Platforms and sending replies to them, and keeping platform connections working.
Support and communications: answering questions and requests, and sending service announcements, security notices and notices of changes to our terms.
Security: authenticating users, detecting and preventing security incidents, abuse, fraud and unauthorized access, keeping logs, and investigating incidents.
Debugging and improvement: identifying and repairing errors, maintaining the Service, and measuring usage in aggregate to improve it.
Marketing to business contacts: telling business contacts about Kodanote, and measuring visits to our public website and how our own marketing performs. You can opt out at any time as described in Section 8.5 (Marketing communications) of the Privacy Policy.
Managing business relationships: dealing with customers, vendors and partners.
Billing: charging and collecting payment and keeping invoicing records, where we offer paid plans.
Legal compliance: complying with law, responding to lawful requests, enforcing our agreements, and establishing, exercising or defending legal claims.

Personal information may also be transferred as part of a merger, acquisition or similar transaction, as described in Section 5.5 (Business transfers) of the Privacy Policy. We do not use personal information for purposes that are incompatible with those described here without telling you first.

3.2 Categories of recipients

We disclose personal information for a business purpose to the following categories of recipients:

Authentication provider: the service that handles sign-in, sessions, Organizations and memberships, and sends account emails such as verification codes and invitations.
Hosting and storage providers: cloud hosting, databases, queues, object storage for uploaded files, and networking.
Business email and office software providers: the hosted email and office software we use to correspond with you and run our business.
Connection-management service: the service that holds access credentials for Connected Platforms and carries requests to them, where we obtain it from a provider instead of running it ourselves. Today we run it on our own hosting, so no separate connection-management company hosts it for us or holds the access credentials.
AI providers: the runtime that hosts our AI features, which may be operated by a sub-processor, the AI routing service, the third-party AI model providers it sends requests to, and the speech-recognition provider that transcribes audio uploaded into ideas and the sound of videos uploaded into ideas.
Error monitoring and logging providers: services that receive error reports and application logs, where enabled.
Analytics and cookie-consent providers: services that measure visits to our public website, and the service that shows its cookie banner and records your cookie choices.
Web font service: the service the web dashboard and our public website load their fonts from, which receives your IP address and browser details when a page loads and handles them under its own terms, as Section 2.5 (Information collected automatically) of the Privacy Policy explains.
Payment processor: where we offer paid plans.
Connected Platforms, at your direction: when your Organization connects an account or publishes, the platform receives the connection details, the content, media and settings of each post, and each reply you send to a comment or review. These are disclosures that you or your Organization intentionally direct; the platform then handles the information under its own terms and privacy policy.
Members of your Organization: other members can see content, files, channels and posts in the Organization, including who created or uploaded them, and any comments, reviews and performance figures the Service reads from its Connected Platforms, and Organization Admins can see membership details.
Authorities and legal recipients: courts, regulators, law enforcement and parties to legal process, where Section 5.4 (Legal requirements and protection of rights) of the Privacy Policy allows.

Our service providers may use personal information only to provide their services to us, under contracts that restrict other uses. The current list of our sub-processors, with each one’s role and location, is at https://www.kodanote.com/legal/gdpr/#sub-processors.

3.3 Artificial intelligence

Kodanote uses artificial intelligence (AI) models, including models provided by third parties, to deliver parts of the Service. Every image uploaded to the Service is sent, with its file name, through the runtime that hosts our AI features and the AI routing service to a third-party AI model, which returns a written description that is stored with the file and shown to members of the Organization. Audio and video uploaded into an idea are transcribed automatically. Files from the file library that are attached to an idea are not. Our servers turn the file into plain sound and send only that sound directly to a speech-recognition provider, without the file name, the metadata embedded in the file or any identifiers, and for a video without its picture. The provider returns a transcript that is stored with the file and shown to members of the Organization, and a video’s transcript is also shown as its captions. The transcript tells voices apart by speaker number and records the detected language; speaker numbers only separate voices within one recording and do not identify anyone. Where the Service offers other AI Features and you use them, the content you submit is processed by AI models in the same way as images. Output is produced by software and is not reviewed by a person at Solidmatics before you see it, unless the Service states otherwise for a particular feature. We do not use your content to train AI models, as described in Section 4.3 (Training and retention at model providers) of the Privacy Policy. We do not use automated decisionmaking technology to make significant decisions about you, as described in Section 4.5 (Automated decisions) of the Privacy Policy. Section 4 (Automated Processing and Artificial Intelligence) of the Privacy Policy and Section 9 (Artificial Intelligence Features) of the Terms of Use give the details.

We have not sold or shared personal information in the preceding 12 months, and we do not sell or share it. Under the CCPA, to “sell” means to disclose personal information to a third party for money or other valuable consideration, and to “share” means to disclose it to a third party for cross-context behavioral advertising. We do not serve third-party advertising in the Service, and the web dashboard and mobile apps use no advertising cookies, analytics trackers or marketing pixels. Our public website at https://www.kodanote.com uses analytics tools and a cookie-consent tool. It places analytics cookies only after you accept them in its cookie banner, and some analytics tools may record basic details of a visit, such as the page viewed, without cookies. We use this information to measure visits and the performance of our own marketing, not for cross-context behavioral advertising. Publishing content to a Connected Platform at your direction is not a sale or sharing.

We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age. Kodanote is a business service for people aged 18 or over and is not directed to children.

5. Retention

We keep each category of personal information for as long as needed for the purposes in Section 3.1 (Business purposes), and then delete or deidentify it, unless the law requires us to keep it longer. In summary:

Identifiers, log-in credentials, profile picture and Organization membership are held by our authentication provider while your account exists and are deleted when you delete your account. Content you added to an Organization that still exists stays with that Organization and remains linked to your former user identifier, as Section 6.4 (Account and organization deletion) of the Privacy Policy explains.
Business contact details and correspondence are kept for as long as the business relationship or the correspondence requires, and afterwards only as needed to meet legal obligations, resolve disputes and enforce our agreements.
Internet and network activity information in logs and error reports is removed on our hosting and error-monitoring providers’ schedules, and information about visits to our public website is kept under our analytics providers’ retention settings. The log of connection events for Connected Platforms is kept until the Organization’s data is deleted under Section 6.4 (Account and organization deletion) of the Privacy Policy, even if the Organization has been deleted in the organization settings, and you can ask us to delete it sooner by emailing [email protected].
Commercial information, where we offer paid plans, is kept for as long as tax and accounting laws require.
Personal information in User Content and in data from Connected Platforms is kept as the Organization directs and as Section 6.2 (Connected Platforms and disconnection) and Section 6.4 (Account and organization deletion) of the Privacy Policy describe. Data from YouTube and Google Business Profile follows the shorter periods in Section 2.4 (Platform-specific disclosures) of the Privacy Policy: stored comments, reviews and Business Profile performance figures are deleted no later than 30 calendar days after we read them, and the rest is refreshed or deleted at least every 30 calendar days (YouTube analytics figures may be kept while the channel stays connected and authorized). All of it is deleted within 7 calendar days after the channel is removed or you ask us to, and within 30 calendar days of the day our access is revoked in the Google Account or otherwise ends.

The criteria we apply are set out in Section 6 (Data Retention) of the Privacy Policy. The current retention periods by category are in the Data Retention Notice at https://www.kodanote.com/legal/data-retention/.

6. Your California Privacy Rights

Subject to the limits in the CCPA, California residents have the rights below.

6.1 Right to know and access

You can ask us to tell you the categories of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, the categories of third parties to whom we disclosed it, and the categories we disclosed for a business purpose, and to give you a copy of the specific pieces of personal information we hold about you. Your request can cover information collected on or after 2022-01-01, unless providing it proves impossible or would involve disproportionate effort.

6.2 Right to delete

You can ask us to delete personal information we have collected from you. When we delete it, we also direct our service providers to delete it. We may keep information where the CCPA allows, for example to complete a transaction you asked for, to keep the Service secure, to fix errors, to comply with a legal obligation, or to establish, exercise or defend legal claims. Deleting your information does not delete content already published on a Connected Platform (see Section 6.3 (Content published on platforms) of the Privacy Policy), and deleting your account does not by itself delete an Organization’s User Content (see Section 6.4 (Account and organization deletion) of the Privacy Policy).

6.3 Right to correct

You can ask us to correct inaccurate personal information we hold about you. You can also correct your name, email address and profile yourself in your account settings in the Service.

You have the right to opt out of the sale or sharing of your personal information. Because we do not sell or share personal information, there is nothing to opt out of. We honor browser opt-out preference signals such as Global Privacy Control: where the law treats such a signal as a valid request to opt out of sale or sharing, we treat it that way for that browser, as Section 8.8 (Global Privacy Control and Do Not Track) of the Privacy Policy explains. Because we do not sell or share, the signal does not change how we process your data.

6.5 Right to limit use of sensitive personal information

You have the right to limit our use and disclosure of sensitive personal information to the purposes the CCPA permits. We use sensitive personal information only for those purposes (see Section 2.4 (Sensitive personal information)), so this right does not change how we process your data and we do not offer a separate way to exercise it.

6.6 Right to non-discrimination

We will not discriminate against you for exercising any of these rights. We will not deny you the Service, charge you a different price, or give you a different level or quality of service because you exercised a right. We do not offer financial incentives or price or service differences in exchange for personal information.

7. How to Exercise Your Rights

7.1 Submitting a request

Kodanote operates online and has a direct relationship with its users, so we accept requests by email. Email [email protected], preferably from the address linked to your account, and tell us which right you are exercising and, if relevant, which Organization you belong to. You may also write to us at the postal address in Section 12 (Contact Us).

7.2 Verification

We verify requests before acting on them, so that we do not disclose, change or delete someone else’s information. If you have an account, we usually verify by matching the request to the email address on your account and, where needed, by asking you to confirm the request from within your signed-in account. If you do not have an account, we match information you give us with information we already hold; for a request for specific pieces of personal information, we may ask for more, including a signed declaration under penalty of perjury that you are the person the request is about. We use the information you give us for verification only to verify and process your request. If we cannot verify a request, we will tell you and explain why.

7.3 Authorized agents

You may use an authorized agent to make a request for you. We will ask the agent for proof of your signed permission, and we may ask you to verify your identity directly with us or to confirm directly with us that you gave the agent permission. These steps do not apply where the agent holds a power of attorney under California Probate Code sections 4121 to 4130.

7.4 Response times and cost

We confirm receipt of a request to know, delete or correct within 10 business days and tell you how we will process it. We respond to a verified request within 45 calendar days of receiving it. If we need more time, we may extend that period once by up to 45 more calendar days; if we do, we will tell you within the first 45 days and explain why. Requests are free unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, as the law allows.

7.5 If we decline

If we decline all or part of a request, we will tell you why. You can ask us to reconsider as described in Section 8.4 (Appeals and complaints) of the Privacy Policy. You can also contact the California Privacy Protection Agency at https://cppa.ca.gov or the California Attorney General.

8. Information We Process as a Service Provider

For personal information contained in User Content, in Recordings uploaded to the Service and in data received from Connected Platforms on an Organization’s instruction, the Organization that uses Kodanote is the business, and Solidmatics acts as its service provider, as described in Section 16.2 (Our Roles) of the Terms of Use and Section 1.3 (When we act on behalf of a customer organization) of the Privacy Policy. We process that information only to provide the Service to the Organization and on its instructions.

If your personal information appears in that content, for example because you are shown in an uploaded photo, were recorded in a meeting, or connected an account on a Connected Platform for your Organization, please send your request to the Organization. If we receive a request directly, we will forward it to the Organization concerned where we can identify it, and we will help the Organization respond. Notices from Meta are the exception. If you authorized a Facebook, Instagram or Threads channel and then remove Kodanote in that platform’s settings, or ask Meta to delete the data Kodanote received, Meta notifies us and we act on that notice ourselves instead of forwarding it to the Organization. We delete the channels on that platform that you had authorized when the notice reached us, as Section 2.4 (Platform-specific disclosures) and Section 6.2 (Connected Platforms and disconnection) of the Privacy Policy describe.

9. Notice at Collection

This notice, together with the Privacy Policy, is our notice at collection for California residents. It sets out the categories of personal information we collect, including sensitive personal information, the purposes for which we collect and use it, that we do not sell or share it, and how long we keep it. We collect personal information only for the purposes described here and in the Privacy Policy.

10. Other California Disclosures

Shine the Light. California Civil Code § 1798.83 lets California residents ask for information about disclosures of personal information to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

Do Not Track. How we respond to “Do Not Track” and other browser signals is described in Section 8.8 (Global Privacy Control and Do Not Track) of the Privacy Policy.

11. Changes to This Notice

We review and update this notice at least once every 12 months, and sooner when our practices change. When we update it, we post the new version at https://www.kodanote.com/legal/california-privacy/ and change the “Last updated” date at the top. Section 12 (Changes to This Policy) of the Privacy Policy explains how we give notice of material changes.

12. Contact Us

Solidmatics Inc. is the business responsible for the personal information described in this notice.

California privacy requests and privacy questions: [email protected]
Account help and general questions: [email protected]
Postal address: Solidmatics Inc., 1111B S Governors Ave STE 25028, Dover, Delaware 19904, USA

For more on how we handle personal information, see the Privacy Policy at https://www.kodanote.com/legal/privacy-policy/, in particular Section 13 (How to Contact Us) of the Privacy Policy.