NotesLM Secured

Privacy Policy — NotesLM

Last Updated: January 3, 2026

This instrument (the “Privacy Policy”) is promulgated by NotesLM (hereinafter “NotesLM”, “we”, “us” or “our”) to declare, with maximal particularity and supervening comprehensiveness, the modalities, vectors, contingencies, and contingents under which we collect, process, preserve, disseminate, or otherwise act upon personal data, machine-readable artefacts, content-substantive captures, telemetry, and derivative artifacts (collectively, “Information”) in connection with the NotesLM browser extension and ancillary services (collectively, the “Service”). By electing to install, access, activate, run, or otherwise engage with the Service you assent to and are thereby bound by the terms herein, inclusive of every proviso, qualifier, caveat and subordinated clause set forth below.

1. Ontology of Collected Information — Enumerations, Taxonomies, and Sources

1.1 Information Proffered Volitionally by the User (Directly Furnished Data)

We may subsume within our operational purview certain categories of data that you voluntarily furnish, including but not limited to:

Authentication Identifiers. Email address, OAuth-provided profile metadata (for example, profile photograph, display name) provisioned when you authenticate via Google Authentication, which we consume to canonically identify accounts and to orchestrate synchronization of preferences across ephemeral sessions and persistent storage.
User-Curated Content. The specific textual extracts, images, and web-sourced artefacts that you electively capture via the “Universal Copy” or “Save to Notebook” affordances. Such captured content is retained only insofar as you have instigated the capture or the Service has been commanded to transmit same to the destination services enumerated below.

1.2 Information Collected Automatically (Passive & Instrumental Data)

In the course of operating the Service we may, by technical necessity or analytic design, collect:

Usage Telemetry. Aggregated and/or pseudonymized counts and metrics (e.g., number of notes saved, error rates, feature usage frequency, extension-version identifiers) used to calibrate, debug, and optimize Service performance.
Technical Artefacts. Local storage tokens, transient authentication tokens, browser storage keys, extension-state manifests, and similar ephemeral artifacts necessary for seamless operation, caching, and session continuity.

1.3 Exclusions and Non-Collections

We do not, as a matter of default operation, harvest the entirety of your browsing history, nor do we conduct surreptitious, continuous crawling of the web on your behalf. Data transfer to third-party processors occurs only pursuant to the explicit or implicit commands you issue within the Service (e.g., instructing the Service to save or transmit captured content).

2. Purposes of Processing — Use-Cases and Functional Imperatives

We deploy, analyze, transform, store, and otherwise process Information for the following articulated, and occasionally overlapping, purposes:

To instantiate, sustain, and render the core functionality of saving, formatting, and delivering web-derived content into your NotesLM notebook.
To effect authentication, authorization, and account integrity, preventing unauthorized access and enabling account recovery mechanisms.
To enact integrations (for example, transmission to Google NotebookLM) precisely at your behest, and only to the extent explicitly requested.
To facilitate quality assurance, telemetry-driven improvement, and stability engineering — we analyze aggregated telemetry to iterate upon product quality and reliability.
To conduct processing via AI providers (e.g., formatting, text-cleaning, summarization) under limited-scope transmission solely for processing and not for model training absent separate explicit contractual provision.

3. Third-Party Processors, Subprocessors, and Recipients (Interfacing Entities)

We engage discrete third-party services as processors to fulfill specific operational functions, subject to their respective policies and contractual safeguards:

Google Firebase — employed for secure authentication streams, Firestore-hosted database persistence, and hosting primitives.
Google NotebookLM — the external destination service to which your saved notes may be transmitted upon your explicit instruction; data transfer to NotebookLM is never automatic absent your command.
OpenRouter and Other AI Providers — utilised to perform discrete processing tasks (e.g., cleaning, paraphrase, formatting); content transmitted for such processing is limited to what you instruct and, unless otherwise notified, is not used to train models.

We may disclose or transfer Information to comply with lawful requests (e.g., subpoenas, court orders) or where reasonably necessary to prevent imminent harm, fraud, or other illicit activity; such disclosures are made only in accordance with applicable law and internal policy.

4. Retention, Minimization, and Deletion Protocols

We retain Information only for the duration necessary to satisfy the purposes delineated herein or as required by law. We employ minimization practices: only data strictly necessary for a given purpose is retained. You retain the unilateral ability to request deletion of your account and associated data; upon such request we shall delete or irreversibly anonymize stored data subject to technical and legal constraints (for example, immutable backups or legal holds), in which case we shall indicate the nature, scope, and persistence of any residual data.

5. Security Posture and Protective Measures (Non-Exhaustive)

Notwithstanding the theoretical impossibility of absolute security, we implement administrative, technical, and physical safeguards appropriate to the sensitivity of the Information, including but not limited to TLS/HTTPS for in-transit protection, access controls, Firestore security rules, and encryption at rest where supported. You acknowledge that no method of transmission or storage is infallible; we disclaim liability for breaches resulting from extraordinary or unforeseeable vectors outside our reasonable control.

6. Rights Afforded to Data Subjects — Access, Portability, Rectification, Erasure

Subject to applicable legal constraints, you possess rights including:

Access. A right to obtain a copy of the personal data we hold about you.
Portability. A right to export your data via the extension interface in commonly used, machine-readable formats.
Rectification. A right to correct inaccurate personal data.
Erasure. A right to request deletion of your account and associated records; see Section 4 for caveats regarding immutable backups and legal obligations.

Requests may be submitted to our support channel (see Section 12). We may require reasonable verification measures to validate identity prior to effectuating certain requests.

7. Data Transfers, Cross-Border Considerations, and Jurisdictional Nuances

By utilizing the Service you consent to potential cross-border transfers of your Information to jurisdictions where our hosting, processing, or third-party processors operate. Where applicable, we endeavour to employ contractual safeguards or adequacy mechanisms; nevertheless, transaction-specific protections may vary by locale.

8. Special Categories, Minors, and Age-Related Restrictions

The Service is not intended for use by individuals who have not attained the age of majority in their jurisdiction. We do not knowingly solicit or retain information from minors. If you believe we have collected data from a minor, contact us and we will expeditiously take steps to delete such data.

9. Cookies, Local Storage, and Client-Side Persistence

The Service utilises client-side storage (e.g., browser localStorage, extension storage APIs) for caching preferences, temporary tokens, and to preserve state across sessions. These mechanisms are essential for functionality; disabling them may impair Service operation.

10. Automated Decision-Making and AI-Driven Processing

Where you elect to use processing features powered by AI providers (e.g., summarization, formatting), the Service will transmit only the content you designate. Outputs generated by AI are provided for user convenience and are not guaranteed to be infallible; they should be validated by you. We do not, absent explicit separate agreement, use user content to train third-party models.

11. Limitation of Liability; Indemnification

To the maximum extent permitted by law, NotesLM disclaims liability for indirect, incidental, consequential, special, or exemplary damages arising from your use of the Service. You agree to indemnify and hold us harmless from claims arising from your misuse of the Service, violation of law, or breach of this Privacy Policy.

12. Amendments, Notice, and Acceptation

We reserve the unilateral right to amend this Privacy Policy at our discretion; material changes will be posted on this page with an updated “Last Updated” date. Your continued use of the Service following notice of modifications constitutes your acceptance of said modifications. For questions or administrative concerns regarding this Privacy Policy or to submit data subject requests, contact us at:

Email: imsovikde@gmail.com

Please include sufficient detail to enable us to accurately locate the relevant records and to authenticate the requestor’s identity.

13. Miscellany — Interpretation, Severability, Governing Law

This Privacy Policy shall be interpreted in accordance with the rules of statutory construction appropriate to contracts and policies of this genre. If any provision herein is adjudicated to be invalid or unenforceable, such invalidity shall not vitiate the remainder. Except where precluded by mandatory local law, disputes arising out of or related to this Privacy Policy shall be governed by the law of the jurisdiction in which NotesLM principally operates, subject to any mandatory protections afforded by the user’s local law.

14. Comprehensive Recapitulation (Concluding Summation in Peremptory Form)

In brief, and notwithstanding the prolixity of the foregoing: NotesLM collects the authentication and content data you supply, collects limited telemetry and ephemeral technical artifacts for operational purposes, transmits content to third-party processors only at your express command, protects data with industry-appropriate safeguards, affords you access, deletion, and portability rights, and may update this Privacy Policy from time to time. For all operational inquiries, rights requests, or security concerns, the designated contact point is imsovikde@gmail.com.

Glossary (Selected Terms)

“Processing” — any operation performed on personal data, whether or not by automated means.
“Pseudonymized” — data rendered non-directly-identifying via technical measures, while still potentially re-identifiable with additional information.
“Controller/Processor” — roles ascribed per applicable data protection law; NotesLM may act as controller for certain processing activities and as a processor for others depending on context.

If you require an intelligible, pared-down, layman’s summary of any clause above, contact us at imsovikde@gmail.com and specify the policy section you wish simplified; we will respond in due course.