Privacy Policy
Effective 29 October 2026 · Draft
- Velio Notes records on your computer. The audio goes from your device straight to speech recognition. Our servers never receive or store your meeting audio.
- We store the text: transcripts, notes, speaker names you set and the notice log of each meeting. It is encrypted on our servers with a key kept separately from the database, and you can delete it at any time.
- We do not create voiceprints or identify people by their voice. We do not train AI models on your meetings. We do not sell data or show ads.
- People in your meetings are told before or at the start of recording, and can object. If you received a notice from us, see section 3.
1. Who is responsible
Velio Notes is a product of SayVelio Technologies, Republic of Cyprus [registered address and registration number] ("we", "us"). This policy covers the Velio Notes apps (currently the Mac app; Windows, iPhone and Android apps when they are released), the website velionotes.com and the account cabinet at app.velionotes.com (together, the "Service"). Contact us about privacy at hello@velionotes.com.
We are the controller of your account data and of the data we use to run and protect the Service. The content of meetings you record (transcripts, notes, the names of participants and the notice log) is processed by us on your behalf: you, or the organization you record for, decide which meetings are recorded and are the controller of that content. When an organization sets up a Velio Notes team, our Data Processing Addendum applies to it.
You sign in to Velio Notes with your SayVelio account. SayVelio is another product of SayVelio Technologies. Signing in tells Velio Notes your account identifier, email address and name; Velio Notes keeps its own user records, plans and meeting data, and does not share your meetings with SayVelio. SayVelio's handling of your sign-in is described in the SayVelio Privacy Policy.
2. Your meetings: audio, transcripts and notes
This is the part people ask about most, so here is exactly what happens.
Recording. The app records only after you press record, or after you confirm a meeting it suggests from your calendar, and it stops when you stop it or when the meeting app closes the call. On a Mac it captures your microphone and the sound of the meeting app (using the system audio capture of macOS 14.2 or later); on Windows it will use the system loopback in the same way. While recording, the menu bar shows that Velio Notes is listening.
Transcription. The audio goes directly from your device to OpenAI's speech recognition over an encrypted connection. For each recording we give the app a short-lived access token that works for a few minutes and for that recording only; our own OpenAI key stays on our server. We tag those requests with a pseudonymous identifier derived from your account (not your email), so misuse can be traced to one account. The audio does not pass through or get stored on our servers. OpenAI processes it as our service provider under its API terms and data processing agreement with us, and does not use API data to train its models; it may keep API data for up to 30 days to monitor abuse, under its own policy.
Transcripts and notes. The app sends the transcript text to our servers, where we store it encrypted with a key kept separately from the database. To write notes (summary, decisions, action items) and to answer questions you ask about your meetings, our server sends the transcript to OpenAI's language models and stores the result the same way. You can edit or delete any transcript and note, and delete all your meetings at once.
Audio on your device (optional). If you turn on "Keep recordings on this device", the app saves the audio of a meeting only on your computer, so you can listen back, and deletes it automatically after the period you choose [default: 7 days]. These files are never uploaded to us. You can delete them sooner at any time.
Speakers. We do not identify or verify people by their voice, create voiceprints, or analyze emotion or other characteristics of a voice. To show who said what, the app uses the names the meeting app shows on screen for the active speaker (on a Mac this needs the Accessibility permission, and the app reads only the meeting window), the attendee list of the calendar event, and labels such as "Speaker 1" and "Speaker 2" that you can rename. These labels come from where pauses and turns fall in the conversation, not from a profile of anyone's voice, and they are not kept from one meeting to the next.
Zoom cloud recordings (planned). We plan to let you import recordings from your own Zoom account after a meeting. If you connect Zoom and choose a recording, our server downloads the audio from Zoom, sends it in parts to OpenAI for transcription and discards it as soon as the transcript is ready. In this one case the audio does pass through our servers, in memory and in transit only; we do not write it to disk or keep it, and the original stays in your Zoom account under Zoom's terms. We will update this policy with the exact data we receive from Zoom before the feature is available, and it applies only if you connect Zoom.
Meeting bots. Velio Notes does not send a bot into your meetings. If we ever offer one, it will be a separate option you have to turn on, described in this policy before it becomes available.
No training. We do not use your audio, transcripts or notes to train AI models, and we do not let our providers do so.
3. If you were in a meeting recorded with Velio Notes
Velio Notes is built so that people are told when a meeting is transcribed. The person who records chooses at least one of these methods, and the app keeps a notice log for each meeting:
- Notice email. About 30 minutes before a calendar meeting, we email its attendees on the organizer's behalf from notice@velionotes.com. The email names the meeting, its time, the person recording and the attendee list. It contains no tracking pixels. It has an "I object" button that works without an account: pressing it records your objection and the time, and the person recording sees a warning before they start.
- Spoken notice. The person recording reads a short phrase at the start of the meeting; the app recognizes it in the transcript and logs when it was said.
- Chat message. Optionally, a message posted in the meeting chat when recording starts.
If you are an attendee, the person recording (or their organization) is the controller of the meeting's transcript and notes, and decides how they are used and shared; we process them on their behalf. What we hold about you is what you said in the meeting, your name as it appeared in the meeting or calendar, your email address if you were on the calendar invite, and any objection you sent. Your audio is not stored on our servers. We do not create a voiceprint of you, and we do not use your data for marketing or to train AI models.
To ask for a copy of a transcript, a correction or its deletion, contact the person who recorded the meeting. You can also write to hello@velionotes.com; we will pass your request to them and help them answer it. If you do not want notice emails from Velio Notes at all, reply to any notice email or write to us, and we will stop sending them to your address.
Some places require everyone's consent before a conversation is recorded, not only a notice. Our Terms require users to have that consent where the law asks for it.
4. Data we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| From your SayVelio sign-in: account identifier, email address and name | Create your Velio Notes account, sign you in, contact you about the Service | Contract (Art. 6(1)(b)) |
| Date you accepted the Terms and Privacy Policy, and which version | Show that you agreed to them | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) |
| Meeting content: transcripts, notes, titles, times, speaker names and labels, your edits, and questions you ask about your meetings. Stored encrypted with a key kept separately from the database | Show you your meetings and notes on every device and in your cabinet, and share them with the people you choose | Contract; for meeting participants, processed on the instructions of the person or organization recording |
| Notice settings and the notice log of each meeting: which methods were used and when, which attendees were emailed, when the spoken phrase was detected, objections received | Give the notice you chose and let you show who was told and how | Contract; legitimate interest of the person recording and of participants in transparent recording |
| Calendar data, if you connect a calendar: event titles, times, meeting links, organizer and attendee names and email addresses for upcoming events | Suggest meetings to record, send notice emails, name speakers | Contract |
| Your vocabulary: names and terms you add | Recognize them correctly in transcripts | Contract |
| Team: name, members and roles, shared settings and team notice policy (including whether members accepted recording once for internal meetings) | Apply team settings and the team's notice policy | Contract; for organizations, on their instructions |
| Connected devices: name, kind of device, app and operating system versions, date connected and last seen | Keep the app signed in, let you disconnect a device, help with support | Contract; legitimate interest in fixing errors |
| Usage counts: per day, the number and length of recordings and the AI requests and tokens used (counts only, never audio or text) | Show your usage, enforce plan limits, keep the cost of our AI account in check and prevent abuse | Contract; legitimate interest in preventing abuse |
| Session cookies, IP address and technical request logs | Keep you signed in, protect against attacks and fix errors | Legitimate interest in a secure Service |
| Messages you send us | Answer you | Contract or legitimate interest |
We do not collect special categories of data on purpose. Meetings can contain anything people say, including health or other sensitive information; we store such content only as part of the transcript you chose to record, and never analyze it to profile anyone. We do not make decisions about you based solely on automated processing.
5. Cookies
velionotes.com sets no cookies and loads nothing from third parties. app.velionotes.com sets only cookies that are strictly necessary: a sign-in session cookie and short-lived cookies that protect sign-in with your SayVelio account. We use no advertising or analytics cookies.
6. How long we keep data
- Meeting audio: not kept on our servers at all. Optional recordings on your device are deleted automatically after the period you set.
- Transcripts, notes and notice logs: until you delete them, set automatic deletion for your account or team, or delete your account. The notice log stays with its meeting and is deleted with it.
- Objections from attendees: with the meeting they concern; a request to stop notice emails, as long as needed to honor it.
- Calendar data: upcoming events are refreshed while your calendar is connected and removed when you disconnect it; events linked to a recorded meeting stay with that meeting.
- Account, team and device data: as long as your account exists. When you delete your account, we delete it and all its meetings within 30 days, except where the law requires us to keep something.
- Usage counts: 24 months, then deleted day by day; all of them when your account is deleted.
- Server logs: kept by our hosting provider for a limited period, typically no longer than 30 days.
- Backups: encrypted and overwritten in the normal backup cycle [within 30 days].
7. Who receives data
We share personal data only with the providers below, and never sell it.
| Provider | Purpose | Location |
|---|---|---|
| Railway Corporation | Hosting of velionotes.com, app.velionotes.com and the database, served from a data centre in the Netherlands | EU (Netherlands) / United States |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | Speech recognition (audio sent directly from your device) and writing notes from transcripts | United States |
| Resend (Plus Five Five, Inc.) | Sending notice emails to attendees and account emails | EU (Ireland) / United States |
| Google LLC / Microsoft Corporation | Calendar connection, only if you connect a Google or Microsoft calendar | EU / United States |
| Zoom Video Communications, Inc. | Import of your cloud recordings, only if you connect Zoom (planned) | United States |
| Apple Inc. / GitHub, Inc. | App distribution and updates. The update check sends nothing about you; like any download, it lets the host see your IP address | United States |
Within the Service, your meetings are visible only to you and to the people or team you share them with. We may also disclose data if the law requires it, to protect people's safety or our rights, or to a successor if the Service is transferred, for example to a company formed to run Velio Notes. We will tell you if that happens.
8. International transfers
Some providers above are outside the European Economic Area. Where they are, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for details.
9. Security
Connections use HTTPS. Transcripts, notes and calendar tokens are encrypted at rest with keys kept separately from the database. The app receives only short-lived access tokens for transcription, never our long-term keys. Only staff who need it for their role can access production systems, with two-step verification, and their access to accounts is logged. The Mac app is signed and notarized by Apple and its updates are cryptographically signed. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
10. Your rights
Under the GDPR and similar laws you can ask us to access, correct, delete or export your data, to restrict or object to our processing, and to withdraw consent where we rely on it. Most of this you can do yourself in the app or cabinet; otherwise email hello@velionotes.com. We answer within one month. For meeting content we hold for someone else, we pass your request to them, as described in section 3.
You can also complain to a data protection authority: in Cyprus, the Commissioner for Personal Data Protection (dataprotection.gov.cy), or the authority where you live or work.
If you are in California or another US state with a privacy law: we don't sell or share personal information for targeted advertising, we don't collect biometric identifiers, and you can use the rights above regardless of where you live. [US state-specific notices, including Illinois BIPA and California CIPA wording, to be confirmed by counsel.]
11. Children
Velio Notes is not meant for anyone under 16 and we don't knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
12. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows the current version.