English

Version beta-2026-09-16-1 · Last updated September 16, 2026. This notice applies to the direct-to-consumer Notatky beta and its expressly labeled Stripe Sandbox plan test when this version is shown during registration.

1. Operator and scope

IKONBAI, Inc., a Delaware corporation, at 1841 N Fuller Ave #309, Los Angeles, CA 90046, United States, operates Notatky. Contact [email protected] for privacy requests or questions. The beta is for people age 14 or older. Parent Connect is optional. This notice does not cover a future school-managed service. Live paid checkout remains disabled; material changes required for live billing will receive a new notice or supplement before activation.

2. Information we handle

• Account and eligibility: email address, Supabase user identifier, selected language, email-confirmation status, 14+ confirmation, accepted Terms version, Privacy Notice version and timestamps.
• Study content: files you explicitly upload, file type and size, extracted text, notes, subjects and your additions.
• Activity you choose to save: cloud-library revisions, processing status and feedback sent through the beta form.
• Sandbox billing data: when an authenticated adult tester intentionally opens Stripe Sandbox, selected plan, checkout or subscription status, Stripe customer and event references, and the account-to-customer linkage. Notatky does not receive a full payment-card number.
• Technical and security data: IP address, request time, browser or device information, error details and security events recorded by our hosting and account providers.
• Device-only data: the local prototype library, local flashcards and unsent drafts may stay only in that browser. Clearing browser data may erase them.

Do not upload passwords, government identifiers, medical records, private information about classmates, or recordings you lack permission to make.

3. Why we use it

We use this information to confirm account access and age eligibility, provide the study feature you request, keep account data separated, prevent abuse, diagnose failures, answer support or privacy requests and review beta feedback. Notatky does not sell personal information, share it for cross-context behavioral advertising, show targeted ads, or use student content to train a general-purpose AI model.

4. Services that process data

• Supabase provides email authentication, private database records and private file storage.
• Resend delivers transactional authentication emails for Supabase. It receives the recipient email address and authentication message, including temporary code or confirmation content, and records delivery events needed to deliver and troubleshoot those messages. Resend does not receive study files or notes through this email connection. Its Data Processing Addendum and Privacy Policy describe its provider terms and procedures.
• OpenAI: OpenAI processes the selected passage, note title, source label and generated output when you request AI cards or an explanation of a saved passage. It creates that output and checks the input and output for study safety. We do not send your email, account identifier, account token, full library or original uploaded file through this connection. The passage itself may contain personal information; use non-sensitive study content.
• Railway hosts the website and the private processing service.
• GitHub stores application source code. It is not a destination for student files or notes.
• Stripe provides the expressly labeled Sandbox checkout and customer portal used to test the prepared Starter and Plus flows. Stripe receives the adult tester's email, selected plan and billing identifiers. Sandbox does not make a real charge. Live billing requires a separate release decision and matching subscription disclosures.

When account processing is marked available, Notatky sends the selected private file to its Railway processing service to extract supported text. The worker is designed to remove temporary job files after the request. Unexpected termination may delay that cleanup until the isolated runtime is replaced. The original private upload remains in Supabase until the user deletes it.

OpenAI API content is not used for model training by default. We request no stored response history (store: false). Abuse-monitoring records can still contain prompts and answers, normally for up to 30 days with legal or safety exceptions; prompt caches may persist for up to 24 hours. This is not zero retention. OpenAI data controls.

Cloud AI chat and hosted audio transcription are not included in this release. Activating a new AI, speech, analytics or advertising provider requires an updated provider review and, when the use materially changes, a new notice and registration release.

We may disclose the minimum necessary information to a service provider operating under our instructions, to respond to a valid legal requirement, or to address a serious security or safety issue. Parent Connect does not automatically disclose a student's files, notes or conversations.

5. Retention

• Account, eligibility and active study records are kept while the account participates in the beta.
• A deleted file or cloud library is removed from the active user-facing store after the service confirms deletion. Downloads and separate device copies are not affected.
• Beta feedback is kept for up to 12 months unless it is needed longer to resolve a reported security, privacy or legal issue.
• Acceptance and revocation receipts may be kept for up to three years after the beta relationship ends so we can document the version and decision.
• The AI usage ledger stores a hash of the account identifier, request time, token counts, estimated cost and provider response IDs. It does not store study text. Current-month limits survive restarts; older operational records follow the 90-day target below.
• Security and diagnostic records controlled by Notatky are limited to what is needed to operate and protect the beta, with a target maximum of 90 days unless a specific incident or legal obligation requires longer. Authentication delivery records held by Supabase and Resend expire under their provider-controlled procedures; they may not disappear at the same time as active Notatky account data.
• Stripe Sandbox customer, checkout, subscription and event references are retained only for testing, reconciliation and deletion verification. Live financial records will follow the accounting and legal schedule approved before paid launch.
• Temporary processing files are intended to be removed when the request ends. Provider backups and logs expire under the provider's controlled procedures; deletion from an active store may not remove every backup immediately.

Account closure requests are handled through [email protected]. We will remove or de-identify data that is no longer needed, subject to documented security, fraud-prevention and legal needs.

6. Your choices and requests

Use the account controls to export loaded notes, delete a listed original file or delete the cloud library. Each control states its scope. Contact [email protected] to request access, correction, a broader export, account closure or deletion, or to appeal a denied request. We may verify account ownership before acting.

California residents may have rights to know, correct and delete personal information and to receive equal service when exercising a protected right. Notatky does not sell or share personal information for behavioral advertising. We will explain any applicable exception or retention and provide an appeal route when required.

7. Age, parents and safety

Notatky does not allow registration by people under 14. If we learn that we collected personal information from a child under 13, we will restrict further collection and review deletion or legally valid authorization as required. Marketing and actual use must remain consistent with the 14+ service.

Parent Connect is optional and separate from registration. The current beta does not automatically send parent alerts and does not give parents a student's raw library or conversations. A future alert or sharing feature requires verified recipients, clear notice and a new release before it is presented as active.

8. Security and changes

We use account authentication, private storage rules, encrypted network transport, access controls and limited processing boundaries. No service can promise perfect security or permanent recovery. Keep original files and export important work.

We will publish material changes and require a new registration release when a change affects eligibility, providers, data use or user rights. This notice does not claim that every U.S. privacy law applies to IKONBAI, Inc.; it describes the beta's practices and the rights route we provide.

9. Contact

Privacy and support: [email protected]
IKONBAI, Inc.
1841 N Fuller Ave #309
Los Angeles, CA 90046, United States