Consent to the Collection and Use of Personal Data
Effective 19 September 2026 · Version 1.6
Recnovo Inc. (the “Company”) requests your consent to collect and use personal data as set out below, in accordance with Article 15 of the Personal Information Protection Act. You may refuse; the consequences of refusing are in section 5.
1. Items collected, purposes, and retention
| Category | Items | Purpose | Retention |
|---|---|---|---|
| Required | Email address, social sign-in identifier (Apple/Google), the name and profile-image address the sign-in provider passes on (only if you sign in with Apple or Google, and only what you allow on the provider’s screen), account identifier, password (stored one-way hashed) | Sign-up and identity verification, sign-in and authentication (including two-factor), account management, service notices | Until you delete your account |
| Required | Purchase receipts, subscription status, credit balance and usage history | Providing paid services (subscriptions, credits), verifying payment status, deducting and reconciling credits, refunds | Until you delete your account, except records the law requires us to keep (section 2) |
| Generated through use | Recorded audio, transcripts, AI outputs (summaries, organized notes, translations), note titles, descriptions, tags, speaker names | Storing and syncing recordings, speech recognition, and the AI features built on them | Until you delete the data or your account (the cloud copy is additionally subject to the unpaid-storage process in Article 8 of the Terms) |
| Collected automatically | App/browser version, device type and OS, error and crash diagnostics, access time and IP (processed in transit) | Service stability, fault and error diagnosis, abuse prevention | Destroyed without delay once the purpose is met; diagnostic data is kept by the processor for 30 days and then deleted (the processor’s backups are deleted 90 days after they are created) |
Your content (recordings, transcripts, summaries) is encrypted on your device before it is stored on the Company's servers. The decryption key is derived on your device from your sign-in password, security PIN or recovery key, and the Company does not keep that key in readable form; the Company therefore does not read the stored copy. For accounts that sign in with a password, however, that password passes through the Company's authentication server when you sign in, so the Company does not claim that reading the stored copy is technically impossible for it. While transcription is running, a readable copy exists on the Company's servers and at the processor. This does not extend to processing: transcription and AI features require plaintext at the moment they run, and at that moment the content is handled by the Company's servers and by the processors named in the international transfer notice. If you use the sharing feature, the person you send the link to also holds a key to that copy; even then, the Company cannot read it. Your content is never used to train AI models.
2. Retention required by law
| Statute | Records | Period |
|---|---|---|
| Act on Consumer Protection in Electronic Commerce | Contracts and withdrawal of subscription | 5 years |
| Act on Consumer Protection in Electronic Commerce | Payment and supply of goods | 5 years |
| Act on Consumer Protection in Electronic Commerce | Consumer complaints and dispute handling | 3 years |
Data kept under these provisions is used only for the purpose the statute prescribes and is destroyed without delay once the period ends.
3. How data is destroyed
Personal data is destroyed without delay once its retention period ends or its purpose is met. Electronic files are deleted irrecoverably from live systems; for content encrypted on your device, destroying the encryption key also makes recovery impossible. Daily backups are retained for seven days for operational continuity, so a copy of deleted information may remain in a backup for up to seven days. During that period we do not use those copies for any other purpose, and they are destroyed as the backups roll over.
Account deletion is available in Settings in both the app and the web, and you can export your data before deleting.
4. Children under 14
The Company does not collect personal data from children under 14, and the Service is available only to those aged 14 or over. If we learn an account belongs to someone under 14, we delete the account and its data without delay.
5. Your right to refuse, and what refusing means
You have the right to refuse consent to this collection and use.
These items are the minimum needed to provide the Service, so refusing means you cannot sign up or use cloud features (transcription, AI summaries and organized notes, sync). On-device local recording in the mobile app remains available without consent.
6. Privacy Officer and contact
Privacy Officer: Junmee You (Representative Director)
Contact: hello@recnovo.com
You may request access, correction, deletion or suspension of processing, or withdraw consent, at that address or in Settings. See the Privacy Policy for details.