Privacy Policy

NoteStead is a product owned and operated by The Intentional Company. The Intentional Company is the legal entity responsible for the service, including account administration, subscriptions, invoicing, and billing (“NoteStead,” “we,” “us,” or “our”).

This Privacy Policy explains what information NoteStead collects, how we use it, where it goes, how long we keep it, and the choices you have about your information.

We believe privacy policies should be understandable. If something here is unclear, contact us at sal@theintentional.co.

1. What we collect

The information NoteStead collects depends on how you use the service.

Account information

We collect information needed to create and manage your account, such as:

• your name;
• your email address;
• your account and authentication identifiers; and
• your subscription plan and account status.

If you sign in using Google or Microsoft, we receive the account information needed to authenticate you, based on the permissions requested and approved during the sign-in process.

We do not receive your Google or Microsoft password.

Content you create

We store the information you create, save, or organize in NoteStead, which may include:

• drafts;
• posts;
• notes;
• todos;
• frameworks;
• voice and writing preferences;
• content calendars;
• scheduled content;
• research materials; and
• other content you choose to add to the service.

Prompts, instructions, and AI-generated content

When you use NoteStead’s AI features, we process:

• the prompts and instructions you provide;
• relevant NoteStead content needed to perform your request;
• research materials or sources associated with the request; and
• the AI-generated responses returned to NoteStead.

Research sources

When you add a URL or other supported research source, NoteStead may process:

• the source URL;
• the content retrieved from that source; and
• information generated from analyzing or summarizing that content.

Only add sources that you are permitted to access and use.

Usage and operational information

We collect limited information needed to operate, secure, and manage the service, such as:

• sign-in activity;
• account activity;
• AI usage associated with your account;
• plan and usage limits;
• operational logs;
• error and debugging information; and
• information needed to detect abuse, fraud, or security problems.

As NoteStead develops, we may collect additional technical information that is reasonably necessary to operate, secure, measure, or improve the service. When our data practices materially change, we will update this Privacy Policy.

Payment and subscription information

Payments are processed by Stripe.

NoteStead does not directly store your full payment-card number. We may receive and store limited billing and subscription information, such as:

• a Stripe customer reference;
• subscription status;
• plan information;
• payment status; and
• transaction-related information needed to manage your account and maintain business records.

2. How we use your information

We use information collected through NoteStead to:

• create and manage your account;
• authenticate you and keep your account secure;
• provide the features and services you request;
• save, organize, and retrieve your content;
• generate AI responses and perform AI-assisted tasks;
• fetch and process research sources you provide;
• manage subscriptions, billing, trials, and plan limits;
• measure AI usage and service costs;
• provide customer support;
• troubleshoot errors and maintain service reliability;
• detect, investigate, and prevent abuse, fraud, and security problems;
• understand overall product engagement;
• analyze how NoteStead is used in order to improve existing features and develop new ones;
• maintain aggregate or statistical information about service usage;
• communicate with you about your account or the service; and
• comply with applicable legal obligations.

When we analyze overall engagement or product usage, we aim to use aggregated or summarized information where reasonably practical.

We do not sell your personal information.

We do not use your personal information to operate an advertising business.

3. AI processing

NoteStead uses third-party artificial intelligence providers to provide AI-powered features.

Anthropic

When you use an AI feature powered by Anthropic, NoteStead may send Anthropic:

• your prompt or instruction;
• relevant content from your NoteStead account;
• relevant research material;
• contextual information needed to perform the request; and
• other information necessary to generate the requested response.

Anthropic processes that information to generate a response, which is then returned to NoteStead.

NoteStead uses Anthropic’s commercial API rather than a consumer Claude account.

Anthropic states that, by default, it does not use inputs or outputs from its commercial products, including the Anthropic API, to train its models unless the commercial customer has separately chosen to participate in a program that allows such use.

Anthropic may maintain its own limited records in accordance with its commercial terms, data-retention practices, legal obligations, and abuse-prevention requirements.

NoteStead’s own retention of prompts and AI activity is separate from any retention performed by Anthropic.

4. Service providers and other companies that process information

We use a limited number of third-party services to operate NoteStead.

The information each provider receives depends on the service it provides and the features you use.

Render

Render provides infrastructure used to host NoteStead’s application and database.

NoteStead account information, user content, application data, and operational information may be stored or processed on infrastructure provided by Render.

Supabase

Supabase provides authentication and identity-management services.

Supabase processes the authentication information needed to:

• create and manage your login identity;
• authenticate your account;
• maintain authentication sessions; and
• help control access to your NoteStead account.

Google

If you choose to sign in using Google, Google provides authentication services and shares the account information authorized through the sign-in process.

NoteStead will request only the permissions needed for the functionality being provided.

Using Google to sign in does not give NoteStead your Google password.

Microsoft

If you choose to sign in using Microsoft, Microsoft provides authentication services and shares the account information authorized through the sign-in process.

NoteStead will request only the permissions needed for the functionality being provided.

Using Microsoft to sign in does not give NoteStead your Microsoft password.

Anthropic

Anthropic processes prompts, relevant content, research materials, and other context when you use AI features powered by Anthropic.

Stripe

Stripe processes payments and related billing information.

NoteStead receives limited information needed to identify your Stripe customer record and understand your subscription and payment status.

Stripe may also process and retain information for its own legal, regulatory, security, fraud-prevention, and payment-processing purposes.

Resend

Resend delivers service-related email communications, such as:

• account emails;
• welcome messages;
• trial reminders;
• service notices; and
• other lifecycle or transactional communications.

Resend receives the information needed to deliver those messages, such as your email address and the contents of the message being sent.

5. Research sources you ask us to process

When you add a research source, NoteStead fetches or processes the source you provide in order to perform the research, analysis, or content task you requested.

Depending on the feature:

• the source URL may be stored in NoteStead;
• content retrieved from the source may be stored in NoteStead;
• retrieved content may be analyzed or summarized; and
• relevant source content may be sent to an AI provider to perform the requested task.

NoteStead does not control the privacy practices, availability, accuracy, or terms of third-party websites and sources.

You are responsible for making sure you have the right to provide and use the sources you add to NoteStead.

6. Where your information is stored and processed

NoteStead’s application and primary database are hosted using infrastructure provided by Render.

Authentication information is processed through Supabase.

Depending on the features you use, information may also be processed by the other providers identified in this Privacy Policy, including Anthropic, Stripe, Resend, Google, and Microsoft.

These providers may process information in the United States or other locations where they or their service providers operate.

We do not promise that all information will remain in a single geographic location.

7. How long we keep information

We keep information for different periods depending on what the information is and why we need it.

Account and user content

We generally keep your account information and user content while your account remains active.

When your account is deleted, we delete the associated account data and user content from NoteStead’s active systems, subject to the exceptions described in this Privacy Policy.

AI prompts and operational AI logs

NoteStead may keep its own logs of AI prompts, AI activity, and related operational information for up to 90 days for purposes such as:

• debugging;
• service reliability;
• abuse prevention;
• security;
• AI usage measurement; and
• cost accounting.

At the end of the applicable retention period, these logs are deleted or de-identified unless we need to retain specific information for a legitimate legal, security, fraud-prevention, or dispute-resolution purpose.

Third-party AI providers may have their own separate retention periods.

Backups

NoteStead uses backups and recovery systems to protect against accidental data loss and service failures.

When information is deleted from NoteStead’s active systems, copies of that information may remain temporarily in backups until those backups expire or are replaced through the normal backup and recovery cycle.

We do not use backup copies as active production records except when reasonably necessary to restore or recover systems.

Financial and transaction records

We may retain limited billing, subscription, transaction, tax, accounting, or payment-related records for as long as reasonably necessary to:

• maintain accurate business records;
• comply with legal or tax obligations;
• resolve payment disputes;
• prevent fraud; or
• enforce our agreements.

Stripe may separately retain information according to its own legal and operational requirements.

Security, fraud, and abuse-prevention records

We may retain limited information when reasonably necessary to:

• protect NoteStead and its users;
• investigate security incidents;
• prevent fraud or abuse;
• enforce service restrictions; or
• establish, exercise, or defend legal claims.

8. Free-trial abuse prevention

NoteStead may offer a free trial without requiring a payment card.

To prevent repeated use of a one-time free trial, NoteStead keeps a one-way cryptographic record derived from the normalized email identity used to claim the trial.

The email address itself is not stored in readable form in this trial-abuse record.

We use this record only to determine whether the same email identity has previously received a trial.

This record is retained after account deletion because otherwise deleting and recreating accounts could be used to repeatedly claim new free trials.

We retain the record for as long as we continue to enforce the applicable one-trial-per-email policy or as otherwise reasonably necessary to prevent trial abuse.

9. Exporting your information

You may request an export of the personal information and user content associated with your NoteStead account.

To request an export, email: sal@theintentional.co

We may need to verify your identity before providing an export.

As NoteStead develops, we may add a self-service export feature to account settings.

10. Deleting your account and information

You may request deletion of your NoteStead account and associated personal information by contacting: sal@theintentional.co

We may need to verify your identity before completing a deletion request.

When an account is deleted, we delete the associated account data and user content from NoteStead’s active systems, subject to the exceptions described below.

Certain information may remain for a limited period in backups until those backups expire through the normal backup cycle.

We may also retain limited information where reasonably necessary to:

• comply with legal, tax, accounting, or regulatory obligations;
• maintain required transaction records;
• prevent fraud, security incidents, or abuse;
• enforce our agreements;
• resolve disputes; or
• establish, exercise, or defend legal claims.

The trial-abuse record described in this Privacy Policy is retained after account deletion.

Authentication identity

NoteStead currently uses Supabase to manage authentication identities.

Until NoteStead provides fully automated deletion across all systems, deletion of your NoteStead application data and deletion of your Supabase authentication identity may occur as separate steps.

When you request complete account deletion, we will process the deletion of the associated authentication identity as part of the request.

Information held by third-party providers

Deleting your NoteStead account does not necessarily cause every third-party provider to immediately delete every record it independently maintains.

For example, payment processors and other service providers may retain limited information when required or permitted for legal, regulatory, security, fraud-prevention, or operational purposes.

11. Accessing or correcting your information

You may contact us to request access to or correction of personal information associated with your NoteStead account.

Email: sal@theintentional.co

We may need to verify your identity before completing certain requests.

Your rights may vary depending on where you live.

12. Cookies, authentication, and tracking

NoteStead may use technically necessary browser storage, session information, or similar technologies to:

• sign you in;
• maintain your authenticated session;
• protect your account; and
• provide requested service functionality.

NoteStead does not currently use analytics or advertising technologies to track users for targeted advertising or cross-site behavioral advertising.

We do not currently sell personal information for advertising purposes.

In the future, we may add analytics or marketing technologies to better understand product usage, measure marketing performance, or grow the service.

If we materially change our use of cookies, analytics, advertising, or tracking technologies, we will update this Privacy Policy and provide any notices or choices required by applicable law before or when those technologies are introduced.

13. Communications

We may use your contact information to send service-related communications, including:

• account messages;
• authentication or security notices;
• trial information;
• subscription or billing information;
• important product or service updates; and
• other communications related to your use of NoteStead.

If we later send optional marketing communications, we will provide a way to unsubscribe where required.

You may still receive transactional or service-related messages that are necessary to operate your account.

14. Security

We use administrative, technical, and organizational safeguards designed to protect the information processed through NoteStead.

These safeguards may include measures related to:

• account authentication;
• access controls;
• infrastructure security;
• backups and recovery;
• monitoring;
• credential management; and
• limiting access to information based on operational need.

No online service, transmission method, or storage system can guarantee absolute security.

You are responsible for protecting access to your own account and authentication methods.

If you believe your NoteStead account or information has been compromised, contact us at: sal@theintentional.co

15. Children’s privacy

NoteStead is not directed to children under 13.

We do not knowingly collect personal information from children under 13.

If you believe that a child under 13 has provided personal information to NoteStead, contact us at sal@theintentional.co so we can review the situation and take appropriate action.

16. Business transfers

If NoteStead or The Intentional Company is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information associated with the service may be transferred as part of that transaction.

Any successor that receives personal information will remain subject to applicable privacy obligations.

17. Legal requirements and protecting the service

We may access, preserve, or disclose information when we reasonably believe it is necessary to:

• comply with applicable law, regulation, legal process, or a valid governmental request;
• protect the rights, safety, or property of NoteStead, The Intentional Company, our users, or others;
• investigate fraud, abuse, or security incidents;
• enforce our agreements or policies; or
• establish, exercise, or defend legal claims.

18. Changes to this Privacy Policy

We may update this Privacy Policy as NoteStead changes.

When we update it, we will revise the Last updated date and Version shown at the top of the policy.

If a change materially affects how we collect, use, or disclose personal information, we will provide additional notice when appropriate or required by law.

The version of the Privacy Policy in effect when you use NoteStead governs our current privacy practices.

19. Contact

For questions or requests related to:

• privacy;
• your personal information;
• data exports;
• corrections;
• account deletion; or
• security concerns,

contact:

The Intentional Company
NoteStead
Email: sal@theintentional.co