Privacy Policy

Last updated: 2026-10-05. Effective: 2026-10-05.

This Privacy Policy explains how Solidmatics Inc. (“Solidmatics”, “we”, “us”, “our”) collects, uses, shares and protects personal information when you use Kodanote. “Kodanote” or the “Service” means the Kodanote website at https://www.kodanote.com, the web dashboard, the iOS and Android apps, our APIs, and related services. It also covers personal information we handle in our support, marketing, vendor and partner relationships.

Kodanote is a business tool. It lets organizations plan, prepare and schedule content for publication on social media and other platforms they connect, keep ideas and files in one place, and get help preparing content, including from features that use artificial intelligence (AI) models, as described in Section 4 (Automated Processing and Artificial Intelligence). It is built for companies, agencies, freelancers and creators acting in a trade, business, craft or profession, and it is not intended for consumers.

This policy tells you what we collect, why, who receives it, how long we keep it, and what rights and choices you have. Capitalized terms that are not defined here have the meaning given in the Terms of Use at https://www.kodanote.com/legal/terms-of-use/.

Table of Contents

  1. Who We Are and the Scope of This Policy
  2. Information We Collect
  3. How We Use Information and Our Legal Bases
  4. Automated Processing and Artificial Intelligence
  5. How We Share Information
  6. Data Retention
  7. Security
  8. Your Rights and Choices
  9. International Data Transfers
  10. Children
  11. US State Privacy Notices
  12. Changes to This Policy
  13. How to Contact Us

1. Who We Are and the Scope of This Policy

1.1 The company

Solidmatics Inc. is a Delaware corporation with its address at 1111B S Governors Ave STE 25028, Dover, Delaware 19904, USA. Our parent website is https://www.solidmatics.com/. Solidmatics operates Kodanote and is the entity responsible for the processing described in this policy.

1.2 When we are the controller

Solidmatics is the controller (or, under US state laws, the “business” or “controller”) of personal information that relates to our own relationship with you. This covers:

  • account and organization membership data;
  • information collected when you visit our website or use the web dashboard and mobile apps, such as log, device and cookie data;
  • support requests and other correspondence with us;
  • billing and payment records, where we offer paid plans;
  • marketing and business-relationship data, including contact details of customers, prospects, vendors and partners.

1.3 When we act on behalf of a customer organization

Kodanote is used by organizations. Everything an organization and its members put into Kodanote is “User Content”, as defined in Section 2 (Definitions) of the Terms of Use. This includes, for example, posts, ideas and notes, and uploaded files (images, video, documents and audio), and, where the Service offers these features, drafts, content plans, brand assets, source materials, Recordings you upload and their transcripts, and chat messages with the assistant. Data, including data about third parties, that reaches Kodanote from Connected Platforms on the organization’s instruction is handled in the same way (see Section 2.3 (Information from Connected Platforms)).

For personal information contained in User Content and in data received from Connected Platforms on the organization’s instruction, the customer organization is the controller (or “business”) and Solidmatics is its processor (or “service provider”). We process that information only on the organization’s documented instructions, as given through the Service, the Terms of Use and, where data protection law requires a written contract between a controller and a processor, our Data Processing Addendum (“DPA”), which forms part of the Terms of Use, and never for our own purposes except where the law requires.

If your personal information appears in User Content or in data from a Connected Platform (for example, you are heard in a Recording uploaded to the Service, you appear in an uploaded photo, or your public profile data was pulled from a Connected Platform), please direct your questions and requests to the organization that uses Kodanote. We will support that organization in responding, and we will forward requests we receive directly to the organization concerned where we can identify it. Notices from Meta are the exception. If you authorized a Facebook, Instagram or Threads channel and then remove Kodanote in that platform’s settings, or ask Meta to delete the data Kodanote received, Meta notifies us and we act on that notice ourselves instead of forwarding it. We delete the channels on that platform that you had authorized when the notice reached us, as Section 2.4 (Platform-specific disclosures) and Section 6.2 (Connected Platforms and disconnection) describe.

Customers can get a copy of the DPA, or a copy countersigned by us, by emailing [email protected].

This policy is part of a set. The others are:

2. Information We Collect

“Personal information” means any information that relates to an identified or identifiable individual. We collect it from you, from the content you and your organization create, from the platforms you connect, and automatically from your devices. Where providing information is required to open an account or use a feature, we say so at the point of collection; if you do not provide it, that feature may not work.

2.1 Information you provide to us

Account data. Sign-in and identity are handled by an authentication provider that we use as a sub-processor. When you create an account or sign in, that provider collects your name, email address, password (stored as a hash), any multi-factor authentication settings, profile picture if you add one, and session details such as IP address, browser and device. Our own systems store your user identifier, not your password.

Organization membership. Kodanote is organized around organizations. We record which organizations you belong to, your role in each, invitations you send or receive, and the organization’s name.

Support and correspondence. When you write to [email protected] or [email protected], we keep the message, your contact details and our reply so that we can help you and keep a record.

Billing data. Where we offer paid plans, a payment processor collects and processes your payment card or other payment details under its own terms. We receive confirmation of payment, billing contact details, the last digits and type of the payment method, and invoicing records; we do not receive or store full card numbers.

Business contacts. In our customer, vendor and partner relationships we collect business contact details such as name, job title, company, email address and postal address. We obtain business contact details from you or your organization and, for prospective customers, may also obtain them from public professional profiles, company websites, referrals and events.

2.2 Content you create or upload

Members of your organization create and upload User Content while using the Service. Examples are:

  • post text, the platforms and channels each post targets, and scheduling details including your time zone;
  • ideas and notes, and files attached to them;
  • files in your library, including images, video, PDFs, documents and audio, together with their file names and metadata;
  • voice notes and meeting Recordings you upload into ideas, and the transcripts made from them;
  • brand assets, source materials, plans and rules you provide for content preparation, where the Service offers these features;
  • personas, which describe who your organization’s content is written as and how it sounds, and can include a person’s name, role and background, how they write, and samples of their writing;
  • audiences, which describe who your organization’s content is written for, such as the kind of company they work at, their job titles, the problems and goals they have, and any company or person a member chooses to name in them;
  • messages you exchange with the assistant in Kodanote, where it is available.

Some content is processed automatically after upload. For example, we generate previews of images, read the duration of audio files, and send every uploaded image, with its file name, to a third-party AI model that produces a structured written description (see Section 4 (Automated Processing and Artificial Intelligence)). That description may include a summary and alt text, keywords, the number of people shown and what they appear to be doing, visible traits of the main subject (for a person, for example apparent age group, hair color, skin tone and clothing), visible text and brands, quality scores, and a suitability flag. We instruct the model not to guess ethnicity, religion or health, but visible traits can still reveal or suggest characteristics that data protection laws treat as sensitive, so your organization should consider this before uploading images of people. The description is stored with the file, is visible to members of your organization, and is a standard part of the file library that cannot currently be switched off for an organization. We do not use these descriptions to identify anyone.

Audio and video you upload into an idea, such as a voice note, a meeting Recording or a video clip, are also processed automatically after upload. Our servers take the sound out of the file and send only that sound to ElevenLabs, a speech-recognition provider we contract with directly, which returns a written transcript (see Section 4.2 (Where inputs go)). For a video, that is its sound track and never its picture. A video with no sound track is not sent anywhere, and its transcript shows that no speech was found. Other files are not transcribed. That includes audio and video kept in the file library, even when you attach them to an idea. The transcript is split into segments with start and end times, and each segment is labeled with a speaker number (Speaker 1, Speaker 2 and so on) in the order the voices are first heard. A speaker number only tells voices apart within that one recording: it does not say who is speaking, and voices are not matched across recordings. The transcript also records the language detected in the recording, with a confidence score, and marks recognized sounds such as laughter. We store the transcript and a short excerpt of it with the file. Members of your organization can read the transcript, and for audio the excerpt is shown on the idea. For a video, the transcript is also shown as captions when the video plays in Kodanote. The captions are not added to the video file or to anything you publish. Transcription is a standard part of ideas that cannot currently be switched off for an organization, and it also covers audio and video uploaded into ideas before transcription was introduced. When a file is deleted, its transcript is deleted with it. Deleting an idea deletes the files uploaded into it, and their transcripts, unless another idea or a post still uses them (see Section 6.1 (How we decide)).

Files you upload are sent to platforms as you uploaded them when you publish, unless a platform requires us to resize or re-encode them. We do not strip metadata (such as EXIF data in images) from your files, so check what your files contain before you publish.

2.3 Information from Connected Platforms

Connected Platforms, as defined in the Terms of Use, are third-party services that you connect to Kodanote so that Kodanote can act on your account there: for example, social networks, video and image platforms and business listing services. The platforms supported at any time are shown in the Service; we add and remove platforms over time.

When you connect a platform, you authorize that platform to share information with Kodanote through the platform’s API. Depending on the platform, the permissions you grant and the features you use, this may include, for example:

  • profile and account identifiers: the identifier, display name, username or handle, and profile picture of the account, page or channel you connect;
  • access credentials: the OAuth access and refresh tokens that let Kodanote act on your behalf. These are held by a connection-management service that we operate or obtain from a sub-processor listed at https://www.kodanote.com/legal/gdpr/#sub-processors; our main database stores only a connection identifier, not the tokens. A Facebook Page has its own access token: we ask Facebook for it each time a post goes out to that Page, keep it in memory only while the post is sent, and never store it;
  • publishing results: the identifier and public URL of each post published through Kodanote, and any error message the platform returns;
  • posts, media, metrics and other account data: where a feature needs it and your permissions allow, information about your published content, engagement metrics, comments, audiences or messages. For most platforms today, Kodanote reads profile data only when an account is connected or first registered, and otherwise checks only whether the connection is still valid; we do not import your published posts, media, metrics, comments, followers or messages from them. YouTube and Google Business Profile are different. Where those features are offered and you use them, Kodanote reads the status of what it published for you, the comments on your videos or the reviews of your business, and performance figures for your channel or profile, as Section 2.4 (Platform-specific disclosures) describes. If we add features like these for another platform, we will describe them in the Service and in this policy before they are used.

We use platform data only to provide the Service to the organization that connected the platform: to show which accounts are connected, to publish what your organization has scheduled, to report the result, to keep the connection working and, where the Service offers it, to show your organization the comments, reviews and performance figures of its own accounts and to send the replies its members write or approve. We do not use it for advertising, to build profiles of individuals, to make eligibility decisions, for surveillance, or for any purpose the platform’s developer terms prohibit. We do not sell platform data or use it to train AI models.

Publishing to a platform sends the content, files and settings of that post to the platform. A reply to a comment or a review is sent the same way and appears publicly under the name of the connected account. Some platforms fetch media from us through a time-limited signed link rather than receiving the bytes directly. Once published, the content is governed by that platform’s terms and privacy policy, and it may be public. On some platforms, posts are published as the connected person or profile with public visibility.

2.4 Platform-specific disclosures

Some platforms require specific statements in our privacy policy. They are collected here so that new platforms can be added without changing the rest of this policy. Where a platform is not listed, the general description in Section 2.3 (Information from Connected Platforms) applies.

Google (YouTube and Google Business Profile). Kodanote connects to two Google services, YouTube and Google Business Profile. Each has its own connect step and its own Google consent screen. Connecting one does not give Kodanote access to the other, or to anything else in your Google Account such as Gmail, Drive, Calendar or contacts. The Google Privacy Policy at https://policies.google.com/privacy describes how Google handles your data. Kodanote’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy at https://developers.google.com/terms/api-services-user-data-policy, including the Limited Use requirements. In practice that means the following. We use Google data only to provide the features described below, which you can see in the Service, to the organization that connected the account. When you connect a Google account to an organization, you allow every member of that organization to see its data in Kodanote and to publish and reply through it. No other customer can see it. We pass it on only to our sub-processors (Section 5.1 (Sub-processors and service providers)) so that they can run the Service for us, and to authorities or others only where the law requires it or where we need to investigate abuse or a security incident. If Solidmatics or Kodanote is merged, acquired or sold, Google data moves to the new owner only if you give your explicit consent first. We do not sell Google data, give it to advertising platforms or data brokers, use it for advertising, use it to judge anyone’s creditworthiness, or use it to train AI models. Where the Service offers a suggested reply to a comment or a review and you ask for one, the text of that comment or review, without the name of the person who wrote it, is sent to the AI providers described in Section 4 (Automated Processing and Artificial Intelligence) to draft it, and nothing is posted until you send the reply yourself. Where the assistant chat is available, it can see the name, handle and connection status of your connected channels, including a YouTube channel or a Business Profile location, as part of your workspace information. It does not read comments, reviews, analytics or performance figures, and it does not publish or reply for you. Our staff do not read Google data unless you ask us to look at something specific, for example in a support request, or we need to investigate a bug, abuse or a security incident, or the law requires it. The Service shows which of the features below are available to you. Before Kodanote uses Google data in a way this policy does not describe, we will update this policy and ask you to agree to the new version.

YouTube. Kodanote uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service at https://www.youtube.com/t/terms. When you connect a channel, Kodanote reads its identifier, title, custom URL and thumbnail, and stores them to show the channel in Kodanote. What else it reads and sends depends on what you use:

  • Publishing. You add a video, set its title, description, privacy status (public, unlisted or private) and audience (whether it is made for kids), and choose when it goes out. At that time Kodanote sends the video file and those settings to YouTube as you set them. YouTube returns the video’s identifier, and Kodanote reads the video’s upload and processing status so that it can show whether the video went live and link to it. We store the identifier, the link and the status with the post.
  • Comments. Kodanote reads the comments on your videos from YouTube to show them to you: each comment’s identifier and text, when it was posted, how many likes it has, and the display name, channel link and profile picture of the person who wrote it, together with the title and thumbnail of the video it belongs to. When you write a reply and send it, Kodanote posts it to YouTube, where it appears publicly under your channel’s name.
  • Analytics. Kodanote reads the reports YouTube provides for your channel and videos, such as views, watch time, likes and subscriber changes, and the titles and thumbnails of the videos they refer to, to show them to you. These are totals and do not identify individual viewers. We show the figures as YouTube reports them, for each channel separately. We do not combine them with other customers’ figures or calculate our own metrics from them.

The permission Google shows when you connect a channel is broader than what Kodanote does with it, because YouTube offers no narrower permission that covers replying to comments. Kodanote uses it only for the actions above. It does not edit or delete your videos, change a video’s privacy status after it is uploaded, delete comments, or change your playlists, subscriptions or channel settings. Every upload and every reply is one that you or a member of your organization created or approved. Section 2.5 (Information collected automatically) describes the cookies and similar storage Kodanote uses on your device. Apart from the third-party resources described there, Kodanote does not let third parties serve content, including advertisements, in the Service.

Google Business Profile. When you connect Google Business Profile, Kodanote reads the list of Business Profile accounts and locations your Google sign-in manages so that you can choose which ones to add. We do not store that list. For each location you add, we keep the identifiers and names of the location and of its account, to show the connection in Kodanote. What else Kodanote reads and sends depends on what you use:

  • Posts. You write an update, an offer or an event, with an optional photo and button, and choose when it goes out. Kodanote sends it to Google at that time and stores the identifier, link and status that Google returns with the post.
  • Reviews. Kodanote reads the reviews of that location from Google to show them to you: each review’s identifier, star rating, text and date, any reply already given, and the display name and profile photo of the reviewer. We show reviews and ratings as Google provides them and do not combine or recalculate them. When you write a reply and send it, Kodanote posts it to Google, where it appears publicly as the reply of the business.
  • Performance. Kodanote reads the figures Google reports for that location, such as how many people viewed the profile, called, asked for directions or visited the website, to show them to you. These are totals and do not identify individual people. We show them as Google reports them and do not combine or recalculate them.

The permission Google shows when you connect lets an app manage your business listings. Kodanote uses it only for the actions above. It does not create, claim, verify, edit or delete business listings, add or remove managers, or touch a location you have not added. Every post and every review reply is one that you or a member of your organization wrote or approved. You can stop using Kodanote with your Business Profile at any time, as described next, and doing so changes nothing on the profile itself. If you own a business location that someone else connected to Kodanote and you want that to stop, email [email protected]. We will remove the location from Kodanote, and give up our access to it, within seven business days.

Keeping and deleting Google data. These rules apply to YouTube and Google Business Profile. They are stricter than the general rules in Section 6 (Data Retention) and take priority over them.

  • While the channel is connected. Kodanote checks with Google at least once a day that it still has your authorization. Any copy of a comment or a review that we keep so that pages load quickly is deleted no later than 30 calendar days after we read it, and so is a stored Business Profile performance figure. Everything else we store from Google (the channel or location record, and the identifiers, links and status of what was published) is refreshed from Google at least every 30 calendar days or deleted. We also check at least every 30 calendar days that each published video or post still exists on Google, and delete what we stored about one that does not, including its figures. YouTube analytics figures are the one exception, which YouTube’s policies allow: we may keep them longer so that you can see history, for as long as the channel stays connected and authorized.
  • You remove the channel in Kodanote. We delete the stored channel or location record at once. Once no other channel in your organization uses the same Google sign-in, we also delete the connection and its access credentials. When nothing else in Kodanote relies on the same Google authorization, we tell Google to revoke it. Everything else Google gave us for that channel is deleted as soon as possible and within 7 calendar days: the identifiers, links and status of the videos or posts published through it, any stored comments or reviews, and analytics or performance figures. What your organization wrote and uploaded in Kodanote, such as a post’s title, description and text and the files in your library, is its own content. Posts stay in the post history until you ask us to delete them or your organization’s data is deleted, and files in your library stay until you delete them.
  • You revoke Kodanote in your Google Account. In addition to removing the channel in Kodanote, you can revoke Kodanote’s access to your Google data at any time on the Google security settings page at https://security.google.com/settings/security/permissions. Revoking Kodanote on that page ends its access to both YouTube and Business Profile for that Google account. Kodanote finds out at its next daily check, or sooner if it uses the connection, and marks the channel as disconnected. Unless you reconnect it, we delete all Google data stored for that channel, as listed above, as soon as possible and within 30 calendar days of the revocation. The same applies when Google ends or expires our access for any other reason.
  • You ask us. Email [email protected] naming the channel or location, and we delete the Google data stored for it within 7 calendar days. When an Organization Admin asks us to delete an organization’s data under Section 6.4 (Account and organization deletion), its Google data is deleted within 7 calendar days.
  • You delete your account or the organization. If the member who connected a Google channel deletes their Kodanote account, or an Organization Admin deletes the organization in the organization settings, we treat that as removing the Google channels concerned. Videos and posts still scheduled for them are not sent, and their Google data is deleted within 7 calendar days, as described above. If the organization still exists, another member can connect the channel again with their own Google sign-in.

Deleting data in Kodanote does not delete or change anything on YouTube or on your Business Profile. Videos, comments, posts, reviews and replies stay on Google until they are removed there. The deadlines above cover our live systems. A backup copy made by our hosting provider can still hold deleted data until that copy expires (Section 6.1 (How we decide)), and a comment or review sent to AI providers for a suggested reply is handled by them as Section 4.3 (Training and retention at model providers) describes. Questions or complaints about how Kodanote handles Google data go to [email protected], and Section 13 (How to Contact Us) has our postal address.

Meta platforms (for example Facebook, Instagram and Threads). When you connect a Meta platform, Kodanote receives the identifier, name, username and profile picture of the connected account, and it sends the posts and media you publish through it. On Facebook, each channel is a Facebook Page. When you connect Facebook, we read the list of Pages your Facebook login manages so that you can choose which ones to add. We read it again whenever that login is reconnected, to update each Page’s name and picture and to check which Pages it can still post to. We do not store that list. Facebook’s list of Pages can leave out a Page you did share, so to build the list we also ask Facebook which Pages you shared when you logged in. We make that request with the credentials of our Facebook app, which our connection-management service holds, and with your login’s access token, which we read from that service for this one request. The token stays in memory while the list is built and is never stored. From the person who connects Facebook we read only the identifier Meta gives them, not their name or picture. For each Page you add, we keep its identifier, name, username and picture. For every Meta channel we also keep the identifier Meta gives the person or account that authorized the connection, and the time they did so, so that we can match a deletion request from that person to the channels it concerns. We fetch a Page’s access token from Facebook only when a post goes out, keep it in memory for that post alone, and never store it. If you connect Facebook and add no Page within an hour, we delete that connection and its access credentials. We process Meta platform data only to provide the Service to your organization, on its behalf, and we keep each organization’s data separate. We do not sell Meta platform data, use it for advertising or profiling, or share it with anyone other than your organization, our sub-processors and, where the law requires, authorities.

To delete the data Kodanote obtained from a Meta platform, do any of the following: (1) remove the channel in Kodanote (open Channels, choose Remove channel and confirm), which deletes the stored account record and, once no other channel uses the same Meta login, the platform connection and its access credentials (records of posts already published stay in your organization’s post history, and removing one Facebook Page leaves the Facebook login connected while another Page from it is still a channel); (2) email [email protected] naming the account you connected, and we will delete the stored account record and, if you ask, the identifiers and links of posts published to that account, and confirm to you without undue delay and within 30 days; or (3) remove Kodanote in the connected apps or business integrations settings of your Facebook, Instagram or Threads account, or send a data deletion request for Kodanote there. With option (3), Meta notifies Kodanote, and we delete the channels on that platform that you had authorized when Meta’s notice reached us, in any organization on Kodanote, together with the platform connection and its access credentials once no remaining channel uses that connection. A channel you connect again after that is a new authorization, and it stays. This runs in the background, and no one has to confirm it. It normally finishes within a few minutes of Meta’s notice. If the deletion cannot be completed at first, for example because our connection-management service cannot be reached, we keep the request and try again at growing intervals. As with option (1), records of posts already published stay in the post history of the organization concerned, and posts still waiting to go out to a deleted channel fail and are not sent.

When you send a data deletion request, Meta shows you a confirmation code and a link to a Kodanote page where you can see whether the request is done. Anyone who has the link can open that page, so it does not show the platform or your account. For each notice Meta sends us, whether you removed Kodanote or asked for deletion, we keep a record of the platform, which of the two it was, the confirmation code, and when we received the notice and when we completed it. The record also holds the identifier Meta gives you, but only until we have processed the request. Then we erase that identifier. We keep the rest of the record, which for a data deletion request keeps the status page working. If Meta’s notice never reaches us, or does not say which person it concerns, nothing is deleted automatically: we mark the channel as disconnected the next time our access to it fails, and you can still delete it with option (1) or (2).

X. Kodanote receives the identifier, name, username and profile picture of the connected X account, sends the posts and images you publish, and stores the identifier and public URL of each post it publishes for you. We do not use X content for surveillance, to infer sensitive characteristics, for advertising outside X, or to train AI models. Kodanote does not monitor X for deletions, so deleting a post on X does not by itself remove Kodanote’s record of it. If you ask us to by emailing [email protected], or X notifies us that content or an account has been deleted or made private, we update or delete the copy we hold, including the text, identifier and link of posts published to X through Kodanote, as soon as reasonably possible and within 24 hours of the request or notice.

LinkedIn. Kodanote receives the identifier, name and profile picture of the connected LinkedIn member, read when you connect the account, and publishes the posts and images you schedule as that member, with public visibility. This policy explains what we collect from LinkedIn (the data above), how we use and share it (Section 2.3 (Information from Connected Platforms), Section 5.1 (Sub-processors and service providers) and Section 5.2 (Connected Platforms)), how to withdraw consent (remove the channel in Kodanote or revoke Kodanote in your LinkedIn settings, after which we no longer access LinkedIn for that channel), and how to request deletion (Section 8 (Your Rights and Choices)). We delete the stored LinkedIn account record when you remove the channel, without undue delay after you ask us to at [email protected], and when your organization’s data is deleted under Section 6.4 (Account and organization deletion).

TikTok. Kodanote receives the identifier, display name, username and avatar of the connected TikTok account. We delete the stored TikTok account record when you remove the channel, without undue delay after you ask us to at [email protected], and when your organization’s data is deleted under Section 6.4 (Account and organization deletion). Your data belongs to you, and we do not share it with anyone other than your organization, our sub-processors and, where Section 5.4 (Legal requirements and protection of rights) or Section 5.5 (Business transfers) applies, the recipients described there.

Pinterest. Kodanote stores only the account record needed to show your connected Pinterest account (identifier, username, business name and profile picture) and the results of publishing; we do not cache other Pinterest data and call the Pinterest API when we need information. We delete the stored Pinterest account record when you remove the channel, and without undue delay and no later than 30 days after you ask us to at [email protected] or your organization’s data is deleted under Section 6.4 (Account and organization deletion).

Other platforms. As we add platforms, any statement their developer terms require will be added to this subsection.

2.5 Information collected automatically

Log data. When you use the Service, our servers record information your browser or app sends, such as IP address, browser or app type and version, operating system, the pages and endpoints requested, timestamps, and error details, together with the identifiers of the organization, files and posts involved and, in some entries, file names. We also keep records of connection events that our connection-management service sends us about Connected Platforms (connection identifier, platform, event type, error text and the identifier of the user who made the connection) to diagnose connection problems. Logs redact authentication headers and cookies.

Device and app data. Requests from the mobile apps carry the app version and operating system in the same way as browser requests, and are covered by Log data above. The apps do not otherwise report device information to us.

Cookies and similar technologies. The web dashboard uses only cookies that are strictly necessary for it to work: session cookies set by our authentication provider to keep you signed in, and a preference cookie that remembers layout choices such as whether the sidebar is collapsed. The web dashboard and mobile apps do not use advertising cookies, analytics trackers or marketing pixels. The mobile apps store your session in the device’s secure storage and keep recordings and settings on the device. Our public website uses a cookie banner and places analytics cookies only if you accept them there; those cookies, the tools that set them and the controls available to you are described at https://www.kodanote.com/legal/gdpr/.

Third-party resources. Some resources, such as web fonts and the authentication provider’s scripts, load from third-party servers when you open the web dashboard, and our public website also loads its web fonts from the same font service. Those servers receive your IP address and browser information to deliver the resource. The profile pictures and thumbnails of connected accounts, and of people whose comments or reviews the Service shows you, load from the platform’s own servers in the same way. The font service receives only what is needed to deliver the font and acts under its own terms; the authentication provider is listed at https://www.kodanote.com/legal/gdpr/#sub-processors.

Error monitoring. Where error monitoring is enabled, an error-monitoring service receives reports of errors in the web dashboard and our servers, including the error message, the page or request involved, browser and operating system, and recent in-app actions. We configure it not to record session replays or default personal identifiers, and in the web dashboard we remove the signature part of signed file links before a report is sent.

2.6 Mobile apps

Microphone. The iOS and Android apps use the microphone only while you are recording a note or a meeting. Recording continues in the background if you leave the app, and Android shows an ongoing notification while a recording is running. Recordings, and a small manifest with your organization and user identifiers and timestamps, are stored on your device until you delete them in the app. A recording is uploaded to Kodanote only when you attach it to an idea. The uploaded copy is then handled like any other file uploaded into an idea, including the transcription described in Section 2.2 (Content you create or upload), and deleting the recording in the app does not delete that copy. On iOS, recordings are included in any device backup you have enabled (for example iCloud Backup) and are handled by Apple under its terms; on Android, the app excludes its data from system backups.

Push notifications. Where the app offers push notifications and you enable them, we store a device push token to deliver them through the operating system’s notification service. You can turn notifications off in your device settings.

Crash and error data. The apps do not include third-party analytics or advertising software. Apple and Google may collect crash and diagnostic data under their own terms and share aggregated diagnostics with us. If we add crash reporting to the apps, it will be listed at https://www.kodanote.com/legal/gdpr/#sub-processors.

Permissions. We ask for microphone access when you first start a recording, and on Android for notification permission so the recording notification can be shown. We do not access your contacts, location, photos or camera unless a feature that needs them is added and you grant that permission.

2.7 Information about people who are not our users

User Content can contain personal information about people who have no relationship with Solidmatics: participants in a meeting whose Recording is uploaded to the Service, people who speak in an uploaded video, people shown or named in uploaded files, and, where a feature reads it, people who interact with your organization on a Connected Platform, such as someone who comments on its YouTube videos or reviews its business on Google. Their display names, profile pictures and what they wrote reach Kodanote only when your organization uses the comments or reviews features, and are handled as Section 2.4 (Platform-specific disclosures) describes. When a recording or a video in which several people speak is uploaded into an idea, what each of them says is transcribed and their voices are told apart by speaker number, as described in Section 2.2 (Content you create or upload). A speaker number only separates the voices in that one recording or video. It does not name anyone and is not linked to a user account, a contact or any other recording. We process that information as the organization’s processor. The organization is responsible for having a lawful basis and for giving those people any notice the law requires, including telling them, before a meeting is recorded or a video is filmed, that they are being recorded and that what they say will be transcribed if the recording or video is attached to an idea. We do not use recordings, videos or images to identify individuals by their voice or face.

We use personal information for the purposes below. For people in the EEA, the UK and Switzerland, each purpose has a legal basis under the GDPR, the UK GDPR or the Swiss FADP.

PurposeInformation usedLegal basis
Creating and managing accounts and organizations, signing you in, and enforcing access controlsAccount data, organization membership, log dataPerformance of a contract (Art. 6(1)(b)); for members of a customer organization, our legitimate interest in providing the Service the organization contracted for (Art. 6(1)(f))
Providing the Service: storing content, preparing previews, descriptions and transcripts, scheduling and publishing to Connected Platforms, reporting results, showing comments, reviews and performance figures from Connected Platforms and sending replies to them, and keeping connections healthyUser Content, platform data, publishing resultsWhere the information is User Content or data from Connected Platforms, we act as processor on the customer organization’s documented instructions and that organization is responsible for the legal basis; for data about your own account and use of the Service, performance of a contract (Art. 6(1)(b))
AI-assisted features described in Section 4 (Automated Processing and Artificial Intelligence)User Content you submit to those features, uploaded images, audio uploaded into ideas, the sound of videos uploaded into ideas and, where you ask for a suggested reply, the comment or review it answersAs processor, on the customer organization’s documented instructions, which include the automatic processing described in Section 2.2 (Content you create or upload); the organization is responsible for the legal basis. For your own use of the feature, performance of a contract (Art. 6(1)(b))
Support and communication about the Service, including service announcements, security notices and changes to termsAccount data, support correspondencePerformance of a contract; legal obligation for required notices (Art. 6(1)(c))
Billing and collecting payment, where we offer paid plansBilling data, account dataPerformance of a contract; legal obligation for tax and accounting records
Securing the Service: authentication, detecting abuse, fraud and unauthorized access, keeping logs, investigating incidentsLog data, device data, account dataLegitimate interest in the security and integrity of the Service (Art. 6(1)(f)); legal obligation where security measures are required
Operating, maintaining, debugging and improving the Service, including error monitoring and aggregated usage measurementLog data, error reports, device dataLegitimate interest in running and improving the Service (Art. 6(1)(f))
Marketing to business contacts about Kodanote, including product news, and measuring interest in itBusiness contact details, account emailLegitimate interest in promoting our services to businesses (Art. 6(1)(f)), with the right to object at any time; consent where the law requires it (Art. 6(1)(a))
Managing customer, vendor and partner relationshipsBusiness contact details, correspondencePerformance of a contract; legitimate interest in running our business
Complying with law, responding to lawful requests, and establishing, exercising or defending legal claimsAny category, as relevantLegal obligation (Art. 6(1)(c)); legitimate interest in protecting our rights (Art. 6(1)(f))
Business transfers, as described in Section 5.5 (Business transfers)Any category, as relevantLegitimate interest in conducting a corporate transaction (Art. 6(1)(f))

Where we rely on legitimate interests, we have assessed that the processing is necessary and that your interests and rights do not override ours in the circumstances, and you can object as described in Section 8 (Your Rights and Choices). Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. We do not use personal information for purposes incompatible with those described here without telling you first.

4. Automated Processing and Artificial Intelligence

Kodanote uses artificial intelligence (AI) models, including models provided by third parties, to deliver parts of the Service. This section explains what that means for your information.

4.1 What AI is used for

AI models are used for tasks such as:

  • describing uploaded images, so that members of your organization can see what each picture shows, including a summary, alt text, keywords and quality and suitability notes (this happens automatically for every image you upload, and the description is stored with the file);
  • analyzing files and documents you provide as source material, where the Service offers this and you use it;
  • drafting or editing text and images for posts and ideas, where the Service offers these features and you use them;
  • suggesting a reply to a comment or a review from a Connected Platform, where the Service offers this and you ask for one (the reply is posted only when you send it);
  • transcribing audio uploaded into ideas, such as voice notes and meeting recordings, and the sound of videos uploaded into ideas, with speaker numbers that tell the voices apart and the detected spoken language (this happens automatically for every audio and video file uploaded into an idea, but not for files from your library that you attach to one; the transcript is stored with the file, and a video’s transcript is shown as its captions when it plays in Kodanote);
  • answering questions and carrying out tasks in the assistant chat, where offered.

This policy and Section 9 (Artificial Intelligence Features) of the Terms of Use identify the features that rely on AI, whether or not a feature is labeled as using AI in the Service. The assistant, where it is available, is an automated system and not a person, and it will not claim to be a person if you ask.

4.2 Where inputs go

Except for transcription, described in the next paragraph, content you submit to an AI feature (for example, the text of a draft, an uploaded image, a chat message, or a comment or review you want a suggested reply to), together with the instructions we add, passes through the runtime that hosts our AI features, which may be operated by a sub-processor, and is sent from there through an AI routing service under contract with us to third-party AI model providers.

Audio and video uploaded into ideas take a different path. Before anything leaves our servers, we turn each file into plain sound. For a video, that means its sound track alone, never the picture. For every file, the tags embedded in it, such as a title, cover art, comments or a recorded location, stay behind. Our servers then send that sound for transcription directly to ElevenLabs (Eleven Labs Inc.), a speech-recognition provider we contract with, and it does not pass through the runtime or the routing service. We send only the audio, under a generic file name. We do not send the file’s name, identifiers of your organization, its members or the idea, or a link to where the file is stored. We prepare the sound from a temporary copy of the file and delete both as soon as that transcription attempt ends. The file you uploaded is not changed and keeps its metadata, as Section 2.2 (Content you create or upload) explains.

We may change the runtime, the routing service, the speech-recognition provider and the models and providers over time. The current model providers, the routing service, the speech-recognition provider and the runtime are listed at https://www.kodanote.com/legal/gdpr/#sub-processors. The outputs (descriptions, drafts, transcripts, answers) are stored in Kodanote as part of your organization’s content, and records of AI runs, such as chat threads and usage logs, may be kept by the runtime that hosts our AI features.

4.3 Training and retention at model providers

We do not use your content to train AI models, and we do not permit our sub-processors to train models on it on our behalf. We configure our requests to the routing service so that they are sent only to model providers that, under the routing service’s published data policies, do not collect the content of requests for their own purposes, such as training. Model providers may still retain inputs and outputs for a limited period to detect abuse and comply with law under their own terms. We cannot control a provider’s internal retention beyond what its terms and our contracts require, and we do not make promises about it that we cannot verify.

ElevenLabs’ standard terms let it use the content it receives to train and improve its models unless the customer turns that off in its account settings, and ElevenLabs states that content received after the setting is turned off is not used for training. We send audio for transcription only from an ElevenLabs account where that setting is off. ElevenLabs keeps the audio it receives, including the sound of videos, and the transcripts it returns under its own terms, which do not state a fixed period for transcription requests, and it may review them, and share them with the providers it uses for content moderation, to detect abuse. When ElevenLabs sends a transcript back, we ask it to delete its stored copy of that transcript about a minute later, because it stores that copy a few seconds after it answers. We also ask when saving the transcript on our side fails. If the request fails, we retry it a few times over the next few minutes. If every attempt fails, ElevenLabs’ own terms apply to its copy. ElevenLabs offers a mode that keeps neither audio nor transcripts once a request is complete, but only on its enterprise plans. We will use that mode for transcription whenever our plan with ElevenLabs includes it. Until then, we do not promise that ElevenLabs deletes audio as soon as the transcript is returned.

Please avoid submitting information to AI features that you would not want a model provider to process, and keep in mind that every audio and video file you upload into an idea is transcribed.

4.4 Human review and your responsibility

AI output is produced by software. A person at Solidmatics does not review it before you see it, unless the Service states otherwise for a particular feature (for example, a managed content service that includes review by our editors, if we offer one). Your organization decides what is published and remains responsible for reviewing content, for its accuracy and lawfulness, and for applying any disclosure or labeling that a Connected Platform or the law requires for AI-generated or altered content.

4.5 Automated decisions

We do not make decisions about you that produce legal effects or similarly significant effects based solely on automated processing, including profiling. The AI features described above help prepare content; they do not decide whether you may use the Service, what you pay, or what you may publish. Any suitability flag produced for an uploaded image is informational and does not block anything. If we introduce automated decision-making of that kind in the future, we will update this policy and provide the safeguards the law requires, including the right to obtain human intervention and to contest the decision.

5. How We Share Information

We share personal information only as described here. We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.

5.1 Sub-processors and service providers

We use third-party companies to run Kodanote. They process personal information on our behalf, under contracts that limit their use of it to providing their service to us and that require appropriate security. By category, they include, for example:

  • authentication and identity management, which also sends account emails such as verification codes and invitations;
  • cloud hosting, databases, queues, object storage for uploaded files, and networking;
  • connection management for Connected Platforms, which holds platform access credentials, where we obtain it from a provider rather than running it ourselves;
  • AI routing services and AI model providers, and the runtime that hosts our AI features;
  • error monitoring and logging;
  • analytics and cookie consent for our public website;
  • business email and office software we use to correspond with you;
  • payment processing, where we offer paid plans.

The current list of the sub-processors that process personal information in the Service, with each one’s role and location, is maintained at https://www.kodanote.com/legal/gdpr/#sub-processors. The analytics and cookie-consent tools used on our public website, and the business email and office software we use to correspond with you, process information only for our own purposes and do not receive User Content, so they are not on that list; the website tools are described in Section 5.5 (Our public website) of that page. We update that list when we add or replace a sub-processor and, for customers under our DPA, give the notice the DPA provides. Our sub-processors are required to protect personal information to a standard at least equivalent to this policy.

Some third parties provide resources we use but act under their own terms as independent controllers rather than as our sub-processors. For example, Apple and Google distribute the mobile apps and handle your app-store account under their own terms, and the web font service that the web dashboard and our public website load fonts from receives what is needed to deliver the font, as described in Section 2.5 (Information collected automatically). Their own privacy policies apply to what they receive.

5.2 Connected Platforms

When your organization publishes through Kodanote, we send the content, media and settings of that post to the Connected Platform you selected. A reply your organization sends to a comment or a review goes to the platform in the same way. The platform then processes it under its own terms and privacy policy. Platforms also receive your connection details when you authorize Kodanote, and they may send us the results of a publish and status updates about the connection. Platforms are independent controllers of what they receive, not our sub-processors.

5.3 Members of your organization

User Content is controlled by your organization. Other members of your organization can see content, files, channels and posts in that organization, including who created or uploaded them, subject to the roles and controls the Service offers. Where the Service shows comments, reviews and performance figures read from the organization’s Connected Platforms, every member can see those too. Organization Admins (as defined in the Terms of Use) can manage members and, through the authentication provider’s tools, see membership details.

We may disclose personal information when we believe in good faith that it is necessary to comply with a law, regulation, subpoena, court order or other legal process; to respond to a lawful request from a public authority; to enforce our Terms of Use or other agreements; to investigate and prevent fraud, abuse, security incidents or illegal activity; or to protect the rights, property or safety of Solidmatics, our users or the public. Where the law allows, we will tell the affected organization about requests for its User Content and give it the chance to respond.

5.5 Business transfers

If Solidmatics is involved in a merger, acquisition, financing, reorganization, sale of assets, or insolvency, personal information may be transferred to the successor or acquirer as part of that transaction, subject to this policy and applicable law. We will notify you, by email or a notice in the Service, before your personal information becomes subject to a materially different privacy policy. Data received from Google APIs moves to a successor or acquirer only with your explicit prior consent, as Section 2.4 (Platform-specific disclosures) explains.

We share personal information for any other purpose with your consent or at your direction, for example when you ask us to share something with a third party. Data received from Google APIs is shared only as Section 2.4 (Platform-specific disclosures) describes.

5.7 What we do not do

We do not sell personal information or platform data. We do not share personal information for cross-context behavioral advertising. We do not serve third-party advertising in the Service. We do not use platform data to build or supplement profiles of individuals, to decide anyone’s eligibility for credit, housing, insurance, employment or similar benefits, for surveillance or intelligence purposes, or to match users with other data sources without their consent. We do not use your content or platform data to train AI models.

6. Data Retention

6.1 How we decide

We keep personal information for as long as needed for the purposes described in Section 3 (How We Use Information and Our Legal Bases), and then delete or anonymize it, unless the law requires us to keep it longer. Some records are not deleted automatically today and are kept until your organization’s data is deleted under Section 6.4 (Account and organization deletion), even after the organization itself has been deleted in the organization settings, for example records of posts that have been published (which cannot be deleted in the Service) and the log of connection events we receive from the connection-management service. You can ask us to delete them by emailing [email protected]. Data from YouTube and Google Business Profile is the exception: it follows the shorter periods in Section 2.4 (Platform-specific disclosures). The criteria we apply are: whether you or your organization still has an active account; whether the data is needed to provide a feature you use; whether a Connected Platform’s developer terms set a shorter period; legal retention duties such as tax and accounting rules; the limitation periods for legal claims; and the needs of security investigations. Temporary files that are uploaded but never confirmed, and files marked as temporary, are removed automatically after a short period. Deleting an idea also deletes the files that were uploaded into it, with their transcripts, previews and image descriptions, unless another idea or a post still uses the same file. Files from your library that you attached to the idea stay in the library. Once no idea and no post uses a file that was uploaded into an idea, it is deleted automatically with its transcript, preview and stored copies within about an hour, but never before it is 24 hours old. A file you removed before saving the idea goes about a day after upload, and an older file goes within about an hour after you take it off the last idea that had it. Backup copies and logs are removed on our providers’ schedules. The Data Retention Notice at https://www.kodanote.com/legal/data-retention/ gives the current periods by category and is updated when they change.

6.2 Connected Platforms and disconnection

Three things can end a platform connection, and they have different effects.

  • You remove the channel. A member of your organization removes a platform on the Channels page of the Service after confirming the action by typing the channel name. We then delete the stored record of that platform account. If no other channel in your organization uses the same platform login, we also delete the platform connection and its access credentials at the connection-management service. One Facebook login can carry several Pages, so removing one Page keeps the login while another Page from it is still a channel in Kodanote, even a disconnected one, and the login is deleted with its last Page. Records of posts already sent through that channel, including the platform’s post identifier and public URL, remain in your organization’s post history; posts still waiting to go out to that channel will fail and are not sent. For a YouTube channel or a Google Business Profile location, the identifiers, links and status that Google gave us for those posts are deleted within 7 calendar days, and only what your organization wrote stays, as Section 2.4 (Platform-specific disclosures) explains.
  • The person who authorized a Meta channel ends it at Meta. If the person or account that authorized a Facebook, Instagram or Threads channel removes Kodanote in that platform’s settings, or asks Meta to delete the data Kodanote received, Meta notifies us. We then delete the channels on that platform that the person or account had authorized when Meta’s notice reached us, in any organization, and the platform connection and its access credentials once no remaining channel uses it. A channel they connect again after that is a new authorization, and it stays. This runs in the background, without anyone in your organization confirming it, and normally finishes within a few minutes of Meta’s notice. If the deletion cannot be completed at first, for example because our connection-management service cannot be reached, we keep the request and try again at growing intervals. As when you remove a channel, records of posts already sent through a deleted channel remain in your organization’s post history, and posts still waiting to go out to it fail and are not sent. If Meta’s notice never reaches us, or does not say which person it concerns, nothing is deleted automatically and the next point applies. Section 2.4 (Platform-specific disclosures) describes the record we keep of each notice and the page where a person can check a data deletion request.
  • The connection stops working on its own. If a platform revokes or expires Kodanote’s access, or reports the connection dead, we mark the channel as disconnected and keep its records so that you can reconnect without losing your history. We do the same when publishing to a channel shows that the platform no longer accepts our access, when a channel is reconnected with a login that cannot post to it or that opens a different account, and when a Facebook channel turns out to be a personal profile rather than a Page, because Facebook only lets us post to Pages. Nothing is deleted automatically in this case, with two exceptions. A YouTube channel or Google Business Profile location that is disconnected and not reconnected is deleted, with the data Google gave us for it, within 30 calendar days of the day our access ended, as Section 2.4 (Platform-specific disclosures) explains. A disconnected Facebook, Instagram or Threads channel is deleted as the previous point describes if Meta tells us that the person or account that authorized it removed Kodanote or asked for deletion. Otherwise, to delete the stored account record, remove the channel in the Service or email [email protected].

6.3 Content published on platforms

Deleting a post, file, channel, organization or account in Kodanote does not delete content that was already published on a Connected Platform. To remove published content, use the platform’s own tools. Kodanote does not delete posts on platforms on your behalf.

6.4 Account and organization deletion

When you delete your account, our authentication provider deletes your identity and membership data, and you leave every organization you belonged to. Content you or other members added to an organization that still exists is controlled by that organization and stays with it after you leave or delete your account. It remains linked to your former user identifier. Deleting your account does not by itself delete an organization or its User Content. An Organization Admin (as defined in the Terms of Use) can delete the organization in the organization settings, which removes its membership and workspace at our authentication provider, but this does not by itself delete the organization’s User Content from Kodanote. It also does not remove the organization’s Connected Platforms or cancel its scheduled posts, which can still be published; remove channels and delete scheduled posts in the Service first, as Section 17.2 (Termination by You) of the Terms of Use explains. Google channels are the exception. Deleting your account removes the YouTube channels and Google Business Profile locations you connected, and deleting the organization removes all of its Google channels, with their Google data, within 7 calendar days, as Section 2.4 (Platform-specific disclosures) explains. If you want the organization’s data deleted from Kodanote, send the request described below before you delete the organization in the organization settings, so that we can verify that you are an Organization Admin. To have the organization’s User Content, files, channel records and platform connections deleted from Kodanote, an Organization Admin emails [email protected] naming the organization. We verify the request and complete the deletion without undue delay and within 30 days, or within any shorter period that Section 2.4 (Platform-specific disclosures) sets for data from a Connected Platform. Deletion covers our database, our file storage, and the platform connections and access credentials held by the connection-management service. We keep only information we must retain to meet a legal obligation, resolve a dispute or enforce our agreements, isolated and kept only for as long as that purpose requires, and backup copies until they expire on our providers’ schedules. See Section 8.7 (Deleting your account) for how to delete.

7. Security

We apply technical and organizational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. They include, for example: encryption in transit using HTTPS/TLS between your browser or app and the Service, and on connections from the Service to third-party providers over the public internet; row-level security in the database that limits each request to a single organization’s data, with narrow exceptions for automated maintenance tasks such as removing expired files and starting scheduled posts; storage of platform access credentials in a dedicated connection-management service rather than in our main database, with Facebook Page tokens fetched only when a post goes out and held in memory, never stored; time-limited signed links for uploaded files; verification of signatures on inbound webhooks; redaction of credentials and signed file links from our application logs (the request logs of the connection-management service can still show a signed file link sent to a platform, but the link stops working once it expires); typed confirmations for destructive actions taken in the Service; and application logs that record who performed a deletion, or which notice from Meta caused it (those log entries never contain the identifier Meta gives the person). Our security page at https://www.kodanote.com/legal/security/ explains how to report a vulnerability.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and any authority as required by applicable law, without undue delay, and will tell affected customer organizations so that they can meet their own obligations.

8. Your Rights and Choices

8.1 Rights under the GDPR, the UK GDPR and the Swiss FADP

If you are in the EEA, the UK or Switzerland, you have the right to: access the personal information we hold about you and receive a copy; have inaccurate information corrected; have your information erased in the circumstances the law provides; restrict processing; object to processing based on legitimate interests, including profiling, and object at any time to direct marketing; receive personal information you provided to us in a portable format; withdraw consent where processing is based on consent; and not be subject to a solely automated decision with legal or similarly significant effects. These rights are subject to the limits in the law.

Where we process your information as a processor for a customer organization, please send your request to that organization, which is responsible for answering it. We will help the organization respond.

8.2 Rights under US state privacy laws

Depending on where you live, US state privacy laws may give you the right to: confirm whether we process your personal information and access it; correct inaccuracies; delete it; obtain a portable copy; opt out of the sale of personal information, its sharing for targeted or cross-context behavioral advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and appeal a refusal. Most of these laws do not treat people acting in a commercial or employment context as consumers, and the rights available to you depend on your state. We do not sell personal information, share it for targeted advertising, or profile in furtherance of significant decisions, so there is nothing to opt out of on those points. California residents should also read Section 11 (US State Privacy Notices).

8.3 How to exercise your rights

Email [email protected] from the address linked to your account, or write to Solidmatics Inc. at the address in Section 13 (How to Contact Us). Tell us which right you are exercising and, if relevant, which organization you belong to. You can also correct your name, email and profile through your account settings in the Service.

Identity verification. To protect you, we verify requests before acting. We usually do this by matching the request to the email address on your account and, where needed, by asking you to confirm from within your signed-in account or to provide additional information. We only use what you provide to verify and process the request.

Authorized agents. Where the law allows, an authorized agent can submit a request on your behalf. We will ask for proof of the agent’s authority, such as a signed permission, and may ask you to confirm your identity directly.

Timing and cost. We respond within the period the applicable law sets (one month under the GDPR and UK GDPR, extendable where the law permits; generally 45 days under US state laws, extendable once by a further period where the law permits). Requests are free unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, as the law allows. We do not discriminate against you for exercising your rights.

8.4 Appeals and complaints

If we decline all or part of a request, we will tell you why and how to appeal. To appeal, reply to our response within 30 days of receiving it, and we will review the appeal and respond in writing within the time your state’s law allows (generally 45 or 60 days, depending on the state), with an explanation and, where relevant, the contact details of your state attorney general.

If you have a complaint about how we handle personal information, please contact us first at [email protected]. We acknowledge privacy complaints within 30 days and aim to resolve them without undue delay. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EEA member state where you live, work or where you believe an infringement occurred; in the UK, with the Information Commissioner’s Office; and in Switzerland, with the Federal Data Protection and Information Commissioner.

8.5 Marketing communications

You can opt out of marketing emails at any time by using the unsubscribe link in any marketing message or by emailing [email protected]. We process opt-outs within 10 business days. Marketing emails include our postal address. Opting out of marketing does not stop service messages such as security notices, billing information and changes to our terms, which we send because they are part of running your account.

8.6 Revoking platform access

You can stop Kodanote from accessing a Connected Platform at any time by removing the channel in the Service (Section 6.2 (Connected Platforms and disconnection)) or by revoking Kodanote’s access in the platform’s own security or connected-apps settings. For Google, which covers both YouTube and Google Business Profile, use https://security.google.com/settings/security/permissions. Revoking access on the platform side stops Kodanote from reading from or publishing to that channel. On Facebook, Instagram and Threads, removing Kodanote in your account settings, or sending a data deletion request for Kodanote there, also makes us delete the channels you had authorized on that platform by the time Meta notifies us. The effect on stored data is described in Section 6.2 (Connected Platforms and disconnection) and Section 2.4 (Platform-specific disclosures).

8.7 Deleting your account

You can delete your account from the account settings in the Service. Organization Admins (as defined in the Terms of Use) can delete an organization in the organization settings. Deleting the organization there does not by itself delete its content from Kodanote; see Section 6.4 (Account and organization deletion). If you cannot access your account, email [email protected]. To have your organization’s data deleted from Kodanote, an Organization Admin emails [email protected] as described in Section 6.4 (Account and organization deletion); other requests to delete personal data under data protection law also go to [email protected]. We will verify the request before acting on it, and we act within the periods in Section 6.4 (Account and organization deletion). Section 6.4 (Account and organization deletion) describes what is deleted and what we may keep, and Section 6.3 (Content published on platforms) explains that published content stays on the platforms.

8.8 Global Privacy Control and Do Not Track

Because we do not sell personal information or share it for cross-context behavioral or targeted advertising, a browser opt-out preference signal such as Global Privacy Control does not change how we process your data; where the law treats such a signal as a valid opt-out request, we honor it. Our website and Service do not respond to “Do Not Track” browser signals, as there is no common standard for them; our cookie use is described in Section 2.5 (Information collected automatically).

9. International Data Transfers

Solidmatics is based in the United States, and we and our sub-processors process personal information in the United States and in other countries where they operate. Those countries may not have data protection laws equivalent to those of your country.

When we transfer personal information from the EEA, we rely on the European Commission’s Standard Contractual Clauses adopted under Decision (EU) 2021/914; for transfers from the UK, on the UK International Data Transfer Addendum to those clauses; and for transfers from Switzerland, on the Standard Contractual Clauses adapted for the Swiss Federal Act on Data Protection; or on another lawful transfer mechanism, together with supplementary measures where needed. Where a sub-processor receives personal information that originated in the EEA, the UK or Switzerland, we require that it be protected by a transfer mechanism recognized by the applicable law. You can request a copy of the transfer clauses that apply to your information by emailing [email protected]. Our GDPR page at https://www.kodanote.com/legal/gdpr/ lists our sub-processors and where they are based.

10. Children

Kodanote is a business service for people aged 18 or over. It is not directed to children, we do not knowingly allow anyone under 18 to hold an account, and we do not knowingly collect personal information from anyone under 18 for our own purposes. User Content that an organization uploads or records may include information about minors, for example a photograph; the organization is responsible for that content as controller, as described in Section 2.7 (Information about people who are not our users). If you believe a child has provided personal information to us, or that we hold a child’s information without authority, email [email protected] and we will delete it.

11. US State Privacy Notices

If you are a California resident, our California Privacy Notice at https://www.kodanote.com/legal/california-privacy/ provides the additional disclosures the California Consumer Privacy Act requires, including the categories of personal information we have collected in the preceding 12 months, the sources, purposes and recipients, and your California rights. We have not sold or shared personal information in the preceding 12 months and do not sell or share it. The only sensitive personal information we collect for our own purposes is your account log-in credentials, which our authentication provider holds to sign you in; we use them only for that purpose and do not use sensitive personal information to infer characteristics about you. Sensitive information contained in User Content is processed as a service provider for the organization concerned. Residents of other US states with comprehensive privacy laws have the rights described in Section 8.2 (Rights under US state privacy laws) and can exercise them as described in Section 8.3 (How to exercise your rights).

12. Changes to This Policy

We may update this policy as the Service, the platforms we support, our sub-processors or the law change. When we do, we will post the new version at https://www.kodanote.com/legal/privacy-policy/ and change the “Last updated” date at the top. If a change materially reduces your rights or changes how we use personal information we already hold, we will give notice in advance by email to the address on your account or by a prominent notice in the Service, and, where the law requires, seek your consent. Each version applies to information collected while it was in effect. We review this policy at least once every 12 months.

13. How to Contact Us

Solidmatics Inc. is responsible for the processing described in this policy.

  • Privacy questions, data-subject requests and complaints: [email protected]
  • Account help, billing and general questions: [email protected]
  • Postal address: Solidmatics Inc., 1111B S Governors Ave STE 25028, Dover, Delaware 19904, USA

If we appoint a representative in the European Economic Area or the United Kingdom, we will publish their contact details in this section.