GDPR, Cookies and Sub-processors

Last updated: 2026-10-05. Effective: 2026-10-05.

This page is for Kodanote customers and for people in the European Economic Area (EEA), the United Kingdom and Switzerland. It explains, in practical terms, how Solidmatics Inc. (“Solidmatics”, “we”, “us”, “our”) meets its obligations under the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP) when it provides Kodanote (the “Service”). It covers our roles, how to exercise your rights in the Service, our Data Processing Addendum, international data transfers, cookies, complaints, and the list of our sub-processors.

This page supplements our Privacy Policy at https://www.kodanote.com/legal/privacy-policy/ and our Terms of Use at https://www.kodanote.com/legal/terms-of-use/. Where they cover the same point, the Privacy Policy and the Terms of Use govern. Capitalized terms that are not defined here, such as User Content, Connected Platform, Organization, Organization Admin, AI Features, Output and Recording, have the meaning given in the Terms of Use.

Table of Contents

  1. Our Roles
  2. Exercising Your Rights in Kodanote
  3. Data Processing Addendum
  4. International Data Transfers
  5. Cookies and Similar Technologies
  6. Complaints
  7. Representatives and Data Protection Officer
  8. Changes to This Page
  9. Contact

Also on this page: the list of Sub-processors.

1. Our Roles

1.1 When we are the controller

Solidmatics is the controller of personal data that relates to our own relationship with you: account and organization membership data, log, device and cookie data, support correspondence, billing records where we offer paid plans, and business contact and marketing data. Section 1.2 (When we are the controller) of the Privacy Policy describes this in full, and Section 3 (How We Use Information and Our Legal Bases) of the Privacy Policy sets out the purposes and legal bases.

1.2 When we are the processor

For personal data contained in User Content, in Recordings uploaded to the Service and in data received from Connected Platforms on your instruction, your Organization is the controller and Solidmatics acts as its processor. We process that data only on the Organization’s documented instructions, as given through the Service, the Terms of Use and our Data Processing Addendum. This matches Section 1.3 (When we act on behalf of a customer organization) of the Privacy Policy and Section 16.2 (Our Roles) of the Terms of Use.

1.3 Processing by AI Features

Kodanote uses artificial intelligence (AI) models, including models provided by third parties, to deliver parts of the Service. Today, every image uploaded to Kodanote is sent automatically, with its file name, to a third-party AI model that returns a written description of the image. That description is stored with the file and can include the number of people shown, a description of them and their visible traits, and any visible text. Audio and video uploaded into an idea, such as a voice note, a meeting Recording or a video clip, are also transcribed automatically. Files from the file library that are attached to an idea are not. Our servers first turn the file into plain sound, so the speech-recognition provider ElevenLabs receives only that sound: never the picture of a video, the metadata embedded in the file, its file name or any identifiers. ElevenLabs returns a transcript that records what was said, split into timed segments labeled by speaker number, and the language detected in the recording. Speaker numbers only tell voices apart within one recording and do not identify anyone. The transcript is stored with the file and deleted with it, and a video’s transcript is also shown as its captions when the video plays in Kodanote. This processing is part of the service the Organization instructs us to provide, and we carry it out as its processor. Output from AI Features is produced by software and is not reviewed by a person at Solidmatics unless the Service states otherwise for a particular feature. The AI providers involved are listed under Sub-processors below. Section 4 (Automated Processing and Artificial Intelligence) of the Privacy Policy and Section 9 (Artificial Intelligence Features) of the Terms of Use explain this in more detail.

2. Exercising Your Rights in Kodanote

Section 8 (Your Rights and Choices) of the Privacy Policy lists your rights under the GDPR, the UK GDPR and the Swiss FADP and explains how we verify requests, how quickly we respond and what it costs (nothing, in almost all cases). This section explains what you can do yourself in the Service today and what you need to ask us for.

2.1 Who answers your request

If your request concerns your own account, your organization membership, or your correspondence with us, Solidmatics is the controller and will answer it. If your personal data is in content that an Organization put into Kodanote, for example you appear in an uploaded photo or are heard in an uploaded Recording, that Organization is the controller. The same applies if you commented on an Organization’s YouTube video or reviewed its business on Google and the Organization read your comment or review in Kodanote. Please send your request to the Organization. If you send it to us and we can identify the Organization, we will forward it and help the Organization respond. Notices from Meta are the exception. If you authorized a Facebook, Instagram or Threads channel and then remove Kodanote in that platform’s settings, or ask Meta to delete the data Kodanote received, Meta notifies us and we act on that notice ourselves, as Section 2.4 (Platform-specific disclosures) and Section 6.2 (Connected Platforms and disconnection) of the Privacy Policy describe.

2.2 Deleting data

Members of an Organization can delete the following in the Service themselves:

  • Files. A file can be deleted from the file library after typing its name to confirm. Deleting a file removes it, its preview and any transcript from our storage and cancels any unsent post that uses it.
  • Ideas. An idea can be deleted after typing DELETE to confirm. Deleting an idea also deletes the files uploaded into it, with their previews, descriptions and transcripts, unless another idea or a post still uses the same file. Once no idea and no post uses a file uploaded into an idea, it is deleted automatically with its preview, description, transcript and stored copies within about an hour, but never before it is 24 hours old. So a file removed before the idea was saved goes about a day after upload, and an older file goes within about an hour of being removed from its last idea. Files from the file library that were attached to an idea stay in the library and can be deleted there. There is no separate delete action for a file uploaded directly to an idea; to have one deleted sooner, email [email protected].
  • Unsent posts. A post can be deleted as long as no part of it has been published yet.
  • Connected Platforms. Removing a channel deletes the stored record of that platform account and, once no other channel uses the same platform login, the platform connection and its access credentials, as described in Section 6.2 (Connected Platforms and disconnection) of the Privacy Policy. Removing a YouTube channel or a Google Business Profile location also deletes, within 7 calendar days, everything else Google gave us for it, including the identifiers and links of posts sent through it, any stored comments or reviews, and analytics or performance figures, as described in Section 2.4 (Platform-specific disclosures) of the Privacy Policy.

Some data cannot be deleted in the Service:

  • Published post records. Once a post has been published to any Connected Platform, Kodanote keeps its record, including the post text and the platform’s post identifier and link, and it cannot be deleted in the Service. You can ask us to delete these records by emailing [email protected]. For posts sent to YouTube or Google Business Profile, the identifier, link and status that Google gave us are deleted within 7 calendar days after the channel is removed, or within 30 calendar days of the day Kodanote’s access to it is revoked or ends without a reconnection. The text you wrote stays.
  • Content on Connected Platforms. Deleting anything in Kodanote does not delete content already published on a Connected Platform. Use the platform’s own tools for that, as described in Section 6.3 (Content published on platforms) of the Privacy Policy.
  • Organization data. You can delete your own account in your account settings, and an Organization Admin can delete an Organization in the organization settings, but neither step by itself deletes the Organization’s User Content from Kodanote, removes its Connected Platforms or cancels its scheduled posts. Remove channels and delete scheduled posts in the Service first, as Section 17.2 (Termination by You) of the Terms of Use explains. Google channels are the exception: deleting your account removes the YouTube channels and Google Business Profile locations you connected, and deleting the Organization removes all of its Google channels, with their Google data, within 7 calendar days. To have an Organization’s User Content, files, channel records and platform connections deleted, an Organization Admin emails [email protected] naming the Organization, before deleting the Organization in the organization settings, so that we can verify that the request comes from an Organization Admin. We verify the request and complete the deletion without undue delay and within 30 days, or within any shorter period that Section 2.4 (Platform-specific disclosures) of the Privacy Policy sets for data from a Connected Platform, as set out in Section 6.4 (Account and organization deletion) of the Privacy Policy.
  • Connection event log. Records of connection events that our connection-management service sends us (connection identifier, platform, event type, error text and the identifier of the user who made the connection) are kept until the Organization’s data is deleted under Section 6.4 (Account and organization deletion) of the Privacy Policy, even if the Organization has been deleted in the organization settings, and are not deleted when a channel is removed. You can ask us to delete them by emailing [email protected].
  • Content after you leave. Deleting your account does not delete content you added to an Organization. That content stays with the Organization and remains linked to your former user identifier, as described in Section 6.4 (Account and organization deletion) of the Privacy Policy.

2.3 Getting a copy of your data

Kodanote does not currently offer a bulk export. You can download individual files from the file library one at a time. To receive a copy of the personal data we hold about you, or a copy in a portable format, email [email protected] and we will provide it within the period set out in Section 8.3 (How to exercise your rights) of the Privacy Policy.

2.4 Correcting data

You can correct your name, email address and profile in your account settings in the Service. For anything else we hold about you that is inaccurate, email [email protected].

2.5 Restriction, objection and other requests

To restrict processing, object to processing based on legitimate interests, withdraw consent, or exercise any other right, email [email protected] from the address linked to your account and tell us which right you are exercising. To stop marketing emails, use the unsubscribe link in the email or write to [email protected], as described in Section 8.5 (Marketing communications) of the Privacy Policy.

3. Data Processing Addendum

Where data protection law requires a written contract between a controller and a processor, our Data Processing Addendum (“DPA”) applies to the processing we carry out for your Organization. As set out in Section 16.3 (Data Processing Addendum) of the Terms of Use, the DPA forms part of the Terms of Use and binds you and Solidmatics automatically when you accept the Terms of Use, without a separate signature. If the DPA conflicts with the Terms of Use, the DPA prevails for the processing it covers.

The DPA includes, where applicable, the transfer clauses described in Section 4 (International Data Transfers) of this page. You can get a copy of the DPA, or a copy countersigned by us, by emailing [email protected].

4. International Data Transfers

4.1 Where data is processed

Solidmatics is based in the United States. We and our sub-processors process personal data in the United States and in other countries where they operate, which may not have data protection laws equivalent to those in the EEA, the UK or Switzerland. The sub-processors, and the countries where they are established, are listed under Sub-processors below.

4.2 Transfer mechanisms

When personal data is transferred from the EEA to Solidmatics or its sub-processors in a country without an adequacy decision, we rely on the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, using the module that fits the relationship:

  • Module 2 (controller to processor) between a customer Organization, as controller, and Solidmatics, as processor. These clauses are part of the DPA.
  • Module 3 (processor to processor) between Solidmatics, as processor, and the sub-processors we contract with, whose terms in turn cover the providers they engage.
  • Module 1 (controller to controller) where personal data is transferred to Solidmatics for purposes for which we are an independent controller, as applicable.

For transfers from the United Kingdom, we rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner. For transfers from Switzerland, we rely on the Standard Contractual Clauses adapted for the Swiss FADP. Where another lawful transfer mechanism applies, we may rely on it instead. We require the sub-processors we contract with to protect personal data originating in the EEA, the UK or Switzerland under a transfer mechanism recognized by the applicable law, including when it reaches the providers they engage.

4.3 Supplementary measures

In addition to the contractual clauses, the measures that protect transferred data include those described in Section 7 (Security) of the Privacy Policy, in particular:

  • encryption in transit using HTTPS/TLS between your browser or app and the Service, and on connections from the Service to third-party providers over the public internet;
  • row-level security in the database that limits each request to a single Organization’s data, with narrow exceptions for automated maintenance tasks such as removing expired files and starting scheduled posts;
  • storage of platform access credentials in a dedicated connection-management service rather than in our main database;
  • time-limited signed links for access to uploaded files;
  • settings that send requests from AI Features that go through our AI routing provider only to model providers that, under the routing provider’s published data policies, do not collect request content for their own purposes, as described in Section 4.3 (Training and retention at model providers) of the Privacy Policy;
  • for transcription, sending ElevenLabs only plain sound that our servers take from the file, so it receives neither the picture of a video nor the metadata embedded in any file, and no file name, identifier or link to our storage, as described in Section 4.2 (Where inputs go) of the Privacy Policy.

Where the law allows, we tell the affected Organization about requests from public authorities for its User Content, as described in Section 5.4 (Legal requirements and protection of rights) of the Privacy Policy.

4.4 Copies of the clauses

You can request a copy of the transfer clauses that apply to your personal data by emailing [email protected]. We may redact commercial terms that are not needed to understand the protections.

5. Cookies and Similar Technologies

5.1 What these technologies are

Cookies are small text files that a website stores in your browser. Similar technologies include local and session storage in the browser and storage areas on a mobile device that an app uses to keep information between sessions. Placing or reading any of these on your device is regulated by the ePrivacy Directive in the EEA and by the Privacy and Electronic Communications Regulations (PECR) in the UK.

5.2 Web dashboard

The Kodanote web dashboard uses only the cookies below. It does not use analytics cookies, advertising cookies, tracking pixels or other marketing technologies, and our own code does not store information in the browser’s local storage, session storage or IndexedDB.

CookieSet byPurposeDuration
Authentication session cookiesOur authentication provider, Clerk, Inc. (listed under Sub-processors below)Keep you signed in, maintain your session, and protect your account against misuseSet by the provider. Some last longer than a single browser session so that you stay signed in
sidebar_stateKodanoteRemembers whether you collapsed the navigation sidebar7 days

When you connect a Connected Platform, a connection window served by our own connection-management service opens and then takes you to that platform’s sign-in and authorization pages. The platform’s pages are operated by the platform, which may set its own cookies under its own cookie and privacy policies.

5.3 Mobile apps

The Kodanote iOS and Android apps do not use cookies for tracking and include no analytics or advertising software. They keep your sign-in session in the device’s secure storage (on iOS, the Keychain), store your Recordings and their details on the device until you delete them, and on Android keep a note of whether the microphone permission has already been requested.

5.4 Web fonts

The web dashboard and our public website load their fonts from Google’s font service. When a page loads, your browser connects to Google’s servers, which receive your IP address and browser details, such as the browser type and the page that requested the font, in order to deliver the fonts. Google acts as an independent controller of that information under its own privacy policy at https://policies.google.com/privacy. It is not one of our sub-processors. We rely on our legitimate interest in presenting the web dashboard and the website consistently and legibly (Article 6(1)(f) of the GDPR and the UK GDPR) for this disclosure.

5.5 Our public website

Our public website at https://www.kodanote.com uses tools that the web dashboard does not:

  • Cookie consent. The Cookiebot consent-management service shows the website’s cookie banner and stores your choices in a cookie, so that the website can respect them on later visits. That cookie is strictly necessary to record your consent.
  • Analytics. Google Analytics, loaded through Google Tag Manager (both provided by Google), measures visits to the website and the performance of our own marketing. Analytics cookies are placed only after you accept them in the cookie banner. Until you do, the website tells Google that consent has not been given, and Google’s tools may still send Google basic details of the visit, such as the page viewed, the time, your browser details and your IP address, without setting or reading cookies.
  • Cookieless analytics. Ahrefs Web Analytics, also loaded through Google Tag Manager, counts visits and shows which pages and referring sites bring visitors. It does not set cookies. It receives basic details of each visit, such as the page viewed, the referring page, your browser details and your IP address, and reports them to us only in aggregated form.

We use this information to measure visits and our own marketing, not for targeted advertising. The cookie declaration on this page lists the cookies the website uses, with their provider, purpose and duration. You can change or withdraw your consent at any time, as easily as you gave it, with the links in that declaration or by deleting the website’s cookies in your browser, after which the banner asks you again.

The cookies and device storage described in Section 5.2 (Web dashboard) and Section 5.3 (Mobile apps) are strictly necessary to provide the Service you have asked for: signing you in, keeping your session secure, remembering a layout choice you made, and keeping your Recordings on your device. They are therefore exempt from the consent requirement under Article 5(3) of the ePrivacy Directive, its national implementations in the EEA, and Regulation 6 of PECR in the UK. Any personal data they involve is processed on the legal bases set out in Section 3 (How We Use Information and Our Legal Bases) of the Privacy Policy. The consent cookie on our public website described in Section 5.5 (Our public website) is strictly necessary to record your choice and is exempt on the same basis. We place the website’s analytics cookies only with your consent (Article 6(1)(a) of the GDPR and the UK GDPR), and we will rely on your consent for any other cookies or similar technologies that are not strictly necessary where the law requires it. The cookieless measurement described in Section 5.5 (Our public website), by Ahrefs Web Analytics and by Google’s tools before you give consent, does not set or read cookies. We rely on our legitimate interest in measuring visits to our website and the performance of our own marketing (Article 6(1)(f) of the GDPR and the UK GDPR) for it, and you can object as described in Section 2.5 (Restriction, objection and other requests).

5.7 How to control cookies

You can see, block and delete cookies in your browser settings. Help pages for common browsers:

If you block or delete the authentication cookies, you will not be able to sign in to the web dashboard or will be signed out. If you delete the sidebar_state cookie, the sidebar returns to its default layout. On mobile, signing out ends your session, and you can delete Recordings in the app at any time.

6. Complaints

If you have a concern about how we handle your personal data, please contact us first at [email protected] so that we can try to resolve it. We acknowledge privacy complaints within 30 days and aim to resolve them without undue delay, as stated in Section 8.4 (Appeals and complaints) of the Privacy Policy.

You also have the right to lodge a complaint with a data protection supervisory authority at any time:

If your complaint concerns content that an Organization put into Kodanote, the Organization is the controller and may be the right party to complain to, as described in Section 2.1 (Who answers your request) of this page.

7. Representatives and Data Protection Officer

Solidmatics has not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or the UK GDPR, or a representative in Switzerland under the Swiss FADP, and has not designated a data protection officer. If we appoint a representative, we will publish their contact details on this page and in Section 13 (How to Contact Us) of the Privacy Policy, and, where the Digital Services Act requires a legal representative in the European Union, in Section 26 (Contact) of the Terms of Use. Until then, please send all data protection questions, requests and complaints to [email protected].

8. Changes to This Page

We update this page when our practices, our sub-processors or the law change, and we change the “Last updated” date at the top when we do. Changes to the list of sub-processors follow the process described under Changes to this list below. Where a change also affects the Privacy Policy or the Terms of Use, we give the notice those documents provide.

9. Contact

  • Data protection questions, data-subject requests, complaints and requests for copies of the DPA or the transfer clauses: [email protected]
  • Account help and general questions: [email protected]
  • Postal address: Solidmatics Inc., 1111B S Governors Ave STE 25028, Dover, Delaware 19904, USA

Sub-processors

Sub-processors are third-party companies that process personal data on our behalf to provide Kodanote. We contract directly with Clerk, Railway, OpenRouter, LangChain, ElevenLabs and Sentry, under terms that limit their use of personal data to providing their service to us and require appropriate security, as described in Section 5.1 (Sub-processors and service providers) of the Privacy Policy and Section 16.5 (Sub-processors) of the Terms of Use. Tigris Data is engaged by Railway, and the AI model providers we reach through OpenRouter (Anthropic and Google) are engaged by OpenRouter. They process personal data under the terms those providers have with them.

“Company location” is the country where the company is established. Each sub-processor, and the providers it relies on, may process personal data in other countries where they operate. Section 4 (International Data Transfers) of this page explains how those transfers are protected.

NameService providedPersonal data involvedCompany location
Clerk, Inc.Authentication and account management: sign-in, sessions, multi-factor authentication, organizations, memberships and invitations. Sends account emails such as verification codes and invitationsName, email address, password (stored as a hash), multi-factor authentication settings, profile picture, session details (IP address, browser and device), organization names, memberships and invitationsUnited States
Railway Corp.Cloud hosting of our application servers, database, job queues and connection-management service, and object storage through Railway BucketsAll personal data the Service stores or processes, including account and organization identifiers, User Content (posts, ideas, content plans, file details, image descriptions and transcripts), channel records, data read from Connected Platforms where the Service offers it (such as comments, reviews and performance figures from YouTube and Google Business Profile), platform access credentials held by the connection-management service, uploaded files, and server logsUnited States
Tigris Data, Inc.Object storage infrastructure behind Railway BucketsUploaded files (images, video, documents and audio) and their generated previewsUnited States
OpenRouter, Inc.Routing of requests from AI Features to AI model providersContent sent to AI Features: uploaded images and their file names and, where the relevant features are available, prompts, chat messages and workspace information the assistant uses (such as the organization name and the names and usernames of connected channels), the text of a comment or review you ask for a suggested reply to, and the Output returnedUnited States
Anthropic, PBCAI models reached through OpenRouter, used for text-based AI Features such as the assistant where those features are availableContent sent to those AI Features, such as prompts, chat messages, workspace information and the text of a comment or review you ask for a suggested reply to, and the Output returnedUnited States
Google LLCAI models reached through OpenRouter, used to describe uploaded images and, where offered, to generate imagesUploaded images and their file names, and the Output returned, which can describe people shown in an image and transcribe visible textUnited States
LangChain, Inc.Runtime that hosts our AI FeaturesContent passing through AI Features, including uploaded images and their file names and, where the assistant is available, chat threads and records of AI runs, and, where you ask for a suggested reply, the text of the comment or review it answers, together with organization and user identifiersUnited States
Eleven Labs Inc.Speech recognition: transcribes audio uploaded into ideas and the sound of videos uploaded into ideas, tells the speakers apart and detects the spoken language. We send the sound to it directly, not through OpenRouter or LangChainThe sound of audio files and videos uploaded into ideas, sent as a plain sound file under a generic file name, which contains the voices of the people recorded and what they say, and the transcript returned, with speaker numbers and the detected language. The picture of a video, the metadata embedded in a file, file names and organization, member and idea identifiers are not sentUnited States
Functional Software, Inc. d/b/a SentryError monitoring for the web dashboard and our serversError messages and technical details, the page or request involved, browser and operating system, and recent in-app actions, which can include identifiers or text contained in an errorUnited States

OpenRouter may route a request to another company that hosts the chosen model, such as a cloud provider, under OpenRouter’s data policies. We configure our requests as described in Section 4.3 (Training and retention at model providers) of the Privacy Policy.

ElevenLabs relies on its own affiliates and providers, including cloud hosting, database and content-moderation services, which may process data in the United States, the European Union, Singapore and other countries where they operate. ElevenLabs publishes its current list at https://compliance.elevenlabs.io/subprocessors. Its training and retention terms are described in Section 4.3 (Training and retention at model providers) of the Privacy Policy.

Not sub-processors:

  • Connection-management service. Platform connections and access credentials are handled by connection-management software that we run ourselves on our own hosting, listed above under Railway Corp. The developer of that software does not host it for us or hold the access credentials it stores, so it is not a sub-processor.
  • Connected Platforms. Social networks and other Connected Platforms, including YouTube and Google Business Profile, receive content at your direction when you connect an account, publish or send a reply, and process it under their own terms as independent controllers. They are not our sub-processors, as described in Section 5.2 (Connected Platforms) of the Privacy Policy.
  • Providers that serve only our own purposes. Google Analytics, Ahrefs Web Analytics and Cookiebot, described in Section 5.5 (Our public website), and the business email and office software we use to correspond with you, process personal data only for purposes for which Solidmatics is the controller. They do not receive User Content or other data from the Service, so they are not sub-processors for our customers and are not listed above.
  • App stores and web fonts. Apple and Google distribute the mobile apps and handle your app-store account, and Google’s font service delivers the fonts of the web dashboard and the website. Each acts as an independent controller under its own terms and privacy policy.

When we launch paid plans, we will add the payment processor we use to this list.

Changes to this list

Before a new or replacement sub-processor begins processing personal data that we process on behalf of customers, we update this list, change the “Last updated” date at the top of this page, and give customers under the DPA notice of the change and the opportunity to object before it takes effect, as the DPA provides. Questions about a sub-processor can be sent to [email protected].