Privacy Policy

About this notice

This notice sets out what the Service collects, who processes it on our behalf, how long it is kept, and the rights you hold over it. Read it together with our Terms of Service. A term defined in the Terms carries the same meaning here.

Novilyze is operated in Israel by Guy Tagger, trading as Novilyze. He is the controller of the database and the personal data described in this notice for the purposes of the Privacy Protection Law. Address any privacy question, and any request to exercise a right set out below, to support@novilyze.com.

Personal data means information relating to an identified or identifiable living person. On the Service it may include account and authentication information; email address and display name; recordings and voices contained in them; transcripts and other outputs generated from recordings; speaker and project names; chat messages; shared-project and Team membership; voiceprints; subscription and billing data; IP address; browser and device information; activity and security logs; usage events; and preferences stored on your device.

Recording a conversation is regulated, and the applicable rules vary by jurisdiction. Some require the agreement of every participant. You decide what to record and what to upload, so obtaining that agreement is your responsibility. The Terms set out that obligation in full.

What we collect

Account data: your email address, a display name if you set one, secure authentication data, your plan, and the date on which you accepted these documents. Your password is not stored by us in readable form.

Content you upload: audio and video recordings, together with everything derived from them: transcripts, speaker labels, summaries, action items, notes, and the names you assign to speakers and projects.

Chat data: the messages you exchange with the assistant about your meetings and projects.

Voiceprints: a mathematical representation of a speaker's voice. This is off unless you turn it on, and a dedicated section below deals with it.

Usage and operational data: sign-in times, use of plan allowances, significant actions within the Service, IP address, browser and device information, and technical logs required to operate and secure the Service, prevent misuse and investigate errors.

Subscription data: where you buy a paid plan, our payment provider handles the transaction and tells us what is needed to give you the plan and display billing information: customer and subscription identifiers, the plan, its status, currency and renewal date, invoice information, and sometimes the payment-card type and last four digits. We do not receive or store your full payment-card number.

Providing your information

You are under no legal obligation to provide any of it. Each item is provided voluntarily, and withholding each has a different effect.

An email address and a password are required to hold an account. Without them an account cannot be created, since they are how your data is distinguished from another user's.

Recordings are at your discretion. Where none is uploaded, there is nothing to transcribe or summarise.

A display name is optional. It affects only how you appear to other members of a shared project.

Saving voices is off unless you turn it on, in Settings. While it is off, naming a speaker labels that meeting and no voiceprint is created. Turning it on means a named speaker is recognised in later meetings.

Account-linked usage measurement in your browser is optional and runs only after you consent. Declining does not restrict the Service. Separately, we process basic operational events required to operate and secure the Service, prevent misuse and investigate errors. The Usage measurement section below explains both.

How we use it

To provide the Service: transcribing recordings, identifying speakers, generating summaries and action items, answering your questions about your own meetings, and applying your plan's limits.

To operate the Service: diagnosing errors, preventing abuse, and monitoring security.

We do not sell your data. We do not use your recordings, transcripts or chats to train AI models.

Service providers

To operate the Service, we use external providers that supply authentication, cloud hosting and storage, recording processing and transcription, artificial-intelligence processing, speaker recognition, message delivery, usage measurement, security, backup and billing services.

Personal data is provided to these providers only to the extent necessary for the purpose for which they supply their services and under the terms and obligations applicable to them. Some providers may retain limited operational, security, abuse-prevention or troubleshooting records under their applicable terms.

Automatic transcription: the recording is processed to produce a transcript. Once the transcript is saved in the Service, we ask the transcription provider to delete its copy, and we ask again when the meeting, its project or the account is deleted. The provider may still keep limited operational records under its own terms.

Artificial-intelligence processing: transcript excerpts, instructions and chat context are processed to produce summaries, action items and answers. Audio is not provided through this processing path.

Speaker recognition: selected audio segments are processed to create a voiceprint only where saving voices is enabled.

Transactional email: the message-delivery provider receives the recipient's email address and the message content. Certain messages, such as shared-project and Team invitations, may also include the inviter's name and email address and the project or Team name.

Subscription and payments: Polar Software, Inc. sells our paid subscriptions as Merchant of Record. It takes the payment, handles transaction taxes and issues your receipt or invoice, and processes payment and contact details under its privacy policy. To create a payment session, we may send Polar your email address, Novilyze account identifier, selected plan and billing period, and IP address for country, tax and currency determination. It returns to us the information needed to grant you the plan and display billing information. If you use usage credits, we also send Polar a usage record for each use past your plan: your account or customer identifier, the kind of usage (a message or transcription) and the amount, never its content.

We do not sell personal data and do not use customer Content to train our own models.

Each provider is identified by name on request to support@novilyze.com.

Usage measurement

In your browser: account-linked usage measurement runs only after you consent. If you decline, no measurement cookies are placed, no account-linked usage profile is created, and your email address and display name are not provided for this purpose. You may change your choice at any time using the link at the bottom of the website or in Settings, with immediate effect.

Aggregated measurement: we may measure page views and aggregated information such as the page viewed, referring source, approximate country, browser type, device type and operating system. This measurement does not place measurement cookies or create an individual profile across pages.

On our servers: when you are signed in, actions such as completing an upload or generating a summary may be recorded against your account identifier to operate, secure and improve the Service. These records do not include the contents of recordings, transcripts or chat messages and are not controlled by your browser-measurement choice.

While you have an account and have consented to browser measurement, your usage profile at the measurement provider holds your email address and display name, so that we can recognise accounts when analysing how the Service is used. Usage events, from your browser and from our servers, are linked to your account identifier and do not carry your email address or name as event details. The provider stores a copy of the profile details on each event when it is recorded, so earlier events keep the email address and display name they were recorded with, and the IP address they were sent from. When an account is closed, we remove the email address, display name, sign-up date, precise location and full page addresses from the profile and record the closure in a final event with the plan and the age of the account. The usage events already recorded are kept for product analysis, still linked to the account identifier, which no longer belongs to any account, together with those copies.

Information in shared projects

When you join a shared project, the project owner and other members can see your display name, membership and shared Content according to their permissions. Recordings, transcripts, summaries, action items, notes and messages added to the project may be available to project members.

If you leave or are removed from a project, you will lose access to Content belonging to other members. Content you uploaded may remain in the project until you or the project owner deletes it. If you delete your account, meetings you uploaded to a project owned by someone else stay in that project unchanged and pass to its owner, with their recordings, transcripts, summaries and tasks, and your account leaves the project.

Information in a Team

On the Team plan, the Team owner can see, for each member: their name, email address, profile photo, role, the date they joined and the status of their seat. The owner can also see the Team's total transcription use for the month.

Being the Team owner does not, by itself, give access to a member's projects, meetings, recordings, transcripts or chats, and does not show how much of the shared allowance any one member used.

Project content is shared only through project membership: a person sees a project after being invited to it and accepting the invitation. Belonging to the same Team does not share any content.

To invite someone to a Team, we process the email address the owner enters, in order to send the invitation and to match it to the account that accepts it.

Information about participants who do not have accounts

Recordings and their derived Content may contain personal data about participants who do not have Novilyze accounts. The user who uploads a recording is responsible for providing any required notice and obtaining any permission required by law.

A person who believes that the Service holds personal data about them may contact us to request access, correction or deletion. We may request information necessary to verify their identity and locate the relevant Content. We may also contact the account holder who uploaded the Content before deciding how to respond, unless prohibited by law.

Voice recognition and voiceprints

Saving voices is off by default. It is turned on in Settings, and while it is off no voiceprint is created for any speaker.

Where it is on and you name a speaker in a meeting, a mathematical representation of that person's voice is stored. That representation is a voiceprint, and it allows the same speaker to be recognised in later meetings within the same project. The person whose voice it is may not be a user of this Service, which is why the setting is off until you choose otherwise, and why the Terms require you to hold their permission before you turn it on.

A voiceprint is biometric information. Under the Privacy Protection Law as amended in 2025 it constitutes data of special sensitivity, and it is treated accordingly. A voiceprint is created only where a speaker is expressly named, is never derived without that step, and the time of creation and the user responsible are recorded.

A voiceprint is a set of numbers rather than a recording, and it is not played back. It is not used to identify any person outside your own projects, and is not disclosed to our transcription provider.

A saved voice may be deleted at any time from the meeting screen, which removes the active voiceprint and its associated samples from the Service's active systems. Copies may remain in encrypted backups for up to 30 days and are not used during that period except where a backup must be restored for disaster recovery. Deleting the project or the account removes all active voiceprints associated with it.

Turning the setting off stops any further voiceprint being created. It does not delete those already stored, which are deleted individually from the meeting screen or from Settings.

Where a voiceprint of you is held within another user's project and you wish it removed, write to us and we will remove it.

Where your data is stored

Personal data may be processed outside Israel by providers that assist in operating the Service. Such transfers will be carried out in accordance with applicable law and subject to appropriate data-protection commitments.

Using the Service does not constitute consent to a new or unrelated use of personal data. Where consent is required for a new purpose, it will be requested separately.

Retention and deletion

A recording is retained for seven days after processing completes, so that it remains available for playback within the Service, and is then deleted automatically. Generating a summary restarts that window rather than shortening it. Deleting the meeting deletes the recording immediately. Deleting an account deletes its remaining recordings as part of the deletion.

Transcripts, summaries, notes and chats are retained until you delete them or close your account. Deleting a meeting or a project removes its content from the Service.

Closing your account signs you out everywhere and starts a deletion that removes the account and its Content from active systems, step by step, including the copies held by the providers described above where they offer a way to delete them. We email you when it is complete. Meetings you uploaded to a project owned by someone else are the exception described under Information in shared projects, and usage-measurement events are the other, described under Usage measurement. Certain operational and security records may be retained after account closure for security, fraud prevention, legal compliance and dispute-resolution purposes, and billing records are kept where the law requires. In the records we keep, direct account identifiers such as the account ID, email address, IP address and browser details are removed or replaced with a random pseudonym where reasonably possible.

An encrypted backup of the database is taken every night and kept for 30 days. Data you delete leaves the backups within that time.

Your rights

You have the right to know what personal data is held about you, to inspect it, and to have it corrected where it is inaccurate.

You can download a copy of your data at any time from Settings, under Privacy, with Export my data. It prepares one file with everything you uploaded or wrote: your meetings (recordings filed in no project included) with their transcripts, summaries and notes, your chats, tasks, project memories, the names of saved voices (never the voice data itself), your activity, every record of Novilyze staff reading your content, your feedback, billing orders and invitations. We email you when it is ready; it can be downloaded for 7 days and is then deleted. Audio files are not included, because a recording is kept only for a short time after processing. A project's transcripts and summaries can also be exported from its settings.

Settings also shows your account's activity, under Activity, and Get help shows every time Novilyze staff read your content, with the reason given, under Support access. Any meeting or project may be deleted by you, and an account may be deleted from Settings.

You may also ask us to confirm what is held about you, to correct it, to export it, or to erase your account. Write to support@novilyze.com. We respond within 30 days.

Security

We use industry-standard security measures to protect personal data, including encryption in transit and at rest, access controls and permission restrictions. Sensitive content in your account is additionally protected with account-level encryption. Users are limited to their own information and to Content in shared projects of which they are members. Administrative and operational access is limited to what is reasonably necessary to operate, secure and support the Service. Novilyze staff read the content of an account only when its owner approves a request inside Novilyze that names the reason, the exact item and how long, or lets support view a chosen item for a set time when asking for help, and the owner may end it at any time. The one exception is a security incident, a legal order or confirming abuse of the Service: then staff may open read-only access to a single meeting, project or chat, never a whole account, for at most 60 minutes, and the owner is emailed when it opens and when it closes. Every such read is recorded and shown in Get help, under Support access.

No system is entirely secure. Where a security incident affects your data, we will notify you where the law requires it or where the Privacy Protection Authority directs, and we will report to the Authority where we are required to do so.

Novilyze is a first version. The safeguards described here are in place today; we extend them as the Service matures and update this section when they change.

Cookies and device storage

We use necessary cookies for authentication, security, account recovery, routing and remembering preferences such as language, reduced motion and task filters.

Your usage-measurement choice is stored for six months. If you consent to browser-based usage measurement, measurement cookies may be stored to recognise your browser between visits. Declining or withdrawing consent stops this measurement and removes the persistent browser data stored for that purpose.

The Service also uses local device storage for interface preferences, notification state, temporary processing state and temporarily preserving an upload that has not yet completed. This information is not used for advertising.

We do not use advertising cookies or perform cross-site advertising tracking.

Age

The Service does not permit anyone under the age of 18 to create an account. Content uploaded by users may contain information about other participants, including minors. The user who uploads the Content is responsible for obtaining any authorisation or consent required for recording and processing it. If you become aware that information about a minor was uploaded without appropriate permission, contact us and we will review the request and remove the information where required.

Marketing communications

Messages about your account and the Service are not marketing, and are sent because they are necessary: password resets, project invitations, notices about your subscription, and material changes to the Service.

Promotional email is sent only where you have chosen to receive it, and agreeing is never a condition of using the Service. Every such message carries a means of stopping them, and we keep a record of your choice so that it is respected.

Changes to this notice

Novilyze is a first version, and this notice will change as the Service does. Each version carries its date at the top.

A change that adds a new use of your data or a new category of provider is announced by email at least 30 days before it takes effect, and where the law requires your agreement to it we ask for it rather than assume it. Other changes take effect when published.