Notify

Privacy Notice

Last updated: September 2026

Notify is operated by Velox Technologies Ltd (“Velox”, “we”, “us”). Velox is the data controller for personal data processed through Notify (including the website and iOS app). Company details are on our Company page.

What we collect

Depending on how you use Notify, we may process:

We deliberately collect no more than the product needs.

Sign-in providers

You can create an account with email and password, or sign in with Apple or Google. Those providers share basic identity details (such as name and email) with us so we can create or link your Notify account. Their own privacy notices also apply to their sign-in services.

How AI processing works

Notify sends personal data to OpenAI so it can organise notes, extract actions, transcribe audio, read text in photos, and answer questions. That content can include text you type or import, text from files, a note attached to a file, photos, audio, a question and recent messages in that conversation, passages from your account or from shared folders you can access, and an instruction together with the document it changes.

On the website, submitting that content sends it to OpenAI as part of the service. Using the website is not recorded as a separate permission, and it does not grant or remove the choice you make in the iOS app.

In the iOS app, Notify asks you to allow or decline before the first send from that app. Allow is remembered on your account for the iOS app. Not now, or turning AI processing off in the iOS app under Settings → Account, stops later sends that started in the iOS app. You can still read what is saved, use keyword search, export your data, and delete your account. The same account can keep using AI on the website.

Guest notes stay on your device until you save them to an account. If the categories of data or the AI provider change in a material way, the iOS app asks again before sending under the new description.

OpenAI’s API agreement for business and developer customers limits how that content may be used. OpenAI may use it to provide the service, comply with law, enforce its usage rules, and prevent abuse. It may not use it to develop or improve its services unless Notify explicitly agrees. Notify has not agreed to share that content for model feedback, evaluation, fine-tuning, or as training inputs and outputs.

Notify sets the Responses API store option to false on every Responses request, so those calls are not kept for OpenAI’s default application-state period. OpenAI’s current API data-controls page says embeddings and audio transcriptions do not keep application state. The same page says Responses and embeddings content may be kept in abuse-monitoring logs for up to 30 days, and for longer where the law requires it or where OpenAI reasonably needs the log to protect its services or another person from harm. Audio transcriptions are listed with no abuse-monitoring retention. The page also says prompt caching may keep encrypted processing data for up to 24 hours, and that an image sent for transcription can be kept for review if a child-safety check flags it.

OpenAI must protect that content to the standard this notice requires of a provider that receives it. Its API agreement treats the content as confidential, limits use to the purposes above, and requires the security measures incorporated into that agreement. Where the content includes personal data, OpenAI’s data processing addendum is part of the agreement: people who handle it are under a duty of confidence, subprocessors are bound by comparable terms, and UK and European personal data is transferred under the EU standard contractual clauses. That is the same protection this notice confirms for OpenAI. The retention periods above are disclosed handling under that agreement. They do not reduce those confidentiality, purpose, or security obligations. Deleting a Notify account removes the login and the copies Notify holds. OpenAI deletes customer content when the API agreement ends, except where the law requires retention or the content violates OpenAI’s usage rules. Copies already in an abuse-monitoring log follow the retention above.

Other services that process data

Depending on how you use Notify, these providers also process data for us:

Photos, scans and recordings

Photos or camera scans you upload are treated as source content (for example handwritten notes). Audio you record or upload is transcribed to organise its contents. You are responsible for obtaining any consent required from other participants before recording them — Notify cannot verify recording legality on your behalf, and laws differ by region.

Shared folders

If you join or create a shared folder, content filed there may be visible to other members of that folder according to the roles you set. Invitations use the email address you provide. Do not share content you are not entitled to share with collaborators.

Push notifications

If you use the iOS app and allow notifications, we store a device token so we can send alerts you have enabled (for example action reminders or shared-folder updates). You can turn individual alert types off in Settings → Account, and you can revoke notification permission in iOS Settings at any time.

Analytics and diagnostics

We use privacy-conscious product analytics (for example feature usage events — never note content) to understand how Notify is used. You can opt out in Settings → Account. We may also collect crash and performance diagnostics (for example via an error-monitoring provider) to keep the app reliable. We do not use this data for third-party advertising or tracking across other companies’ apps.

Your rights

You can export the data stored in Notify from Settings → Account → Export data. You can delete your account in the app from Settings → Account → Delete account. Deletion removes the login and, through database deletion rules, the workspaces and content that account owns, and Notify deletes the stored files it can find for those workspaces at the time of the request. Individual items you delete inside the product are kept for 30 days and then purged. This does not by itself delete copies a provider such as OpenAI may already hold under the retention described above.

UK GDPR rights (access, rectification, erasure, portability, objection) apply; contact us to exercise them. In the iOS app you can turn off later sends to OpenAI under Settings → Account without deleting the account. The website does not use that switch.

Where data lives

We host the application on Vercel and the database and file storage on Supabase, using UK/EU regions where those providers support it. Background jobs run on Inngest, website subscription payments go through Stripe, product email goes through Resend, and AI processing goes through OpenAI (on the website as part of the service, and in the iOS app after you allow it). Payment card details are held by Stripe, never by Velox.

Contact

Privacy questions or requests: support@notifys.ai. See also Support.