Privacy Policy

1. What Information We Collect

We collect only what's necessary to provide the conversion service:

Personal Information

• Email address (for payment receipts and download links)
• Payment information (processed by Stripe - we never see or store credit card details)

Evernote Data (Temporary)

• Evernote credentials (temporary OAuth tokens for automated imports)
• ENEX files (your Evernote export files)
• Notes content (text, attachments, metadata for conversion)

Technical Information

• Session data (encrypted session tokens for secure access)
• Job metadata (conversion status, file sizes, processing logs)
• Audit logs (security and compliance tracking)

2. How We Use Your Information

We use your information ONLY for these purposes:

Conversion Processing

• Converting your Evernote ENEX files to Markdown
• Processing notes, attachments, and metadata
• Generating downloadable ZIP files with your converted notes

Communication

• Sending payment receipts (via Stripe)
• Providing download links to your converted files
• Responding to support requests

Security and Compliance

• Maintaining audit logs for security
• Detecting and preventing abuse
• Complying with legal obligations

3. How Long We Keep Your Data

Maximum 3-day retention policy for all user data.

During Processing (3 days maximum)

• Evernote credentials: Encrypted, deleted after OAuth session expires or after 3 days
• ENEX files: Encrypted during processing, deleted after conversion or after 3 days
• Converted files: Available for download for 3 days, then automatically deleted
• Session data: Deleted when session expires or after 3 days

Permanent Records (Minimal)

• Payment records: Stripe keeps these for tax/legal compliance (their privacy policy applies)
• Audit logs: Anonymized security logs (no personal notes content)

Immediate Deletion

You can request immediate deletion at any time:

• Email us: privacy@rescuemynotes.com
• API endpoint: /v1/delete-now (if available)

We'll delete your data within 24 hours of your request.

4. How We Protect Your Data

During Processing

• Encryption at rest: All files encrypted using AWS encryption (AES-256)
• Encryption in transit: HTTPS/TLS for all data transfers
• Secure sessions: Encrypted session tokens, no long-lived credentials
• Access controls: Least-privilege IAM policies, no human access to notes content

Automated Security

• Auto-deletion: Files automatically deleted after 3 days
• Session expiration: Automatic logout after inactivity
• Audit logging: Comprehensive security event tracking
• No permanent storage: Your notes never enter permanent storage systems

Infrastructure Security

• AWS security: Hosted on secure AWS infrastructure
• Network isolation: Processing in isolated environments
• Regular updates: Security patches applied promptly
• Monitoring: 24/7 automated security monitoring

5. Your Privacy Rights

Under GDPR and Privacy Laws
You have the right to:

Access Your Data

• Request a copy of all personal data we hold about you
• Review what information we've collected
• Understand how we're using your data

Delete Your Data

• Request immediate deletion at any time
• Automatic deletion after 3 days maximum
• No questions asked - it's your data

Export Your Data

• Download your converted Markdown files anytime during the 3-day window
• Receive files in open, portable format (Markdown + ZIP)

Rectify Inaccurate Data

• Correct any personal information that's incorrect
• Update your email address or contact information

Object to Processing

• Withdraw consent for data processing
• Request deletion if you change your mind about using the service

Data Portability

• Export your data in standard formats
• Transfer your converted notes to any platform you choose

How to Exercise Your Rights

Contact us at:

• Privacy requests: privacy@rescuemynotes.com
• Immediate deletion: Include "DELETE REQUEST" in subject line
• Response time: Within 72 hours for most requests

6. Third-Party Services

We use minimal third-party services:

Stripe (Payment Processing)

• What they do: Process payments securely
• What they collect: Payment information, email address
• Their privacy policy: https://stripe.com/privacy
• Why we use them: Industry-standard payment security
• Data sharing: Only payment-related information, no notes content

AWS (Infrastructure)

• What they do: Provide secure cloud infrastructure
• What they collect: Technical logs, infrastructure metrics
• Their privacy policy: https://aws.amazon.com/privacy/
• Why we use them: Enterprise-grade security and reliability
• Data sharing: Only infrastructure-level data, encrypted notes during processing

7. International Data Transfers

Where We Process Data

• Primary region: EU (London) - AWS eu-west-2
• Data stays local: We don't transfer data between regions
• GDPR compliance: Adequate safeguards for EU users

For EU Users

• Legal basis: Consent and contract performance
• Data protection: GDPR-compliant processing
• Transfer mechanisms: Standard contractual clauses (if applicable)
• Your rights: Full GDPR rights as described above

8. Children's Privacy

RescueMyNotes is not intended for users under 16 years old.

• We don't knowingly collect data from children
• If we discover data from a child, we'll delete it immediately
• Parents: contact us if you believe we've collected your child's data

9. Cookies and Tracking

Essential Cookies Only

We use only essential cookies for:

• Session management: Keeping you logged in securely
• Security: CSRF protection and session validation

No Tracking

We do NOT use:

• Analytics cookies
• Advertising cookies
• Social media pixels
• Cross-site tracking

How to Control Cookies

• Browser settings: You can disable cookies in your browser
• Impact: Disabling cookies may prevent the service from working
• Session cookies only: All cookies expire when you close your browser

10. Data Breach Notification

Our Commitment

If a data breach occurs:

• We'll notify you within 72 hours
• We'll explain what data was affected
• We'll describe steps we're taking to fix it
• We'll help you protect yourself

Why Breaches Are Unlikely

• 3-day retention: Data is deleted quickly, limiting exposure
• Encryption: All data encrypted during processing
• No permanent storage: Nothing to breach after auto-deletion
• Regular audits: Continuous security monitoring

11. Changes to This Privacy Policy

We may update this policy to:

• Reflect changes in our service
• Comply with new privacy laws
• Improve transparency and clarity

How We'll Notify You

• Email notification for significant changes (if we have your email)
• Website notice for 30 days
• Updated "Last Updated" date at the top of this page

Your Options

• Review changes before continuing to use the service
• Request deletion if you disagree with updates
• Contact us with questions about changes

12. Contact Information

Privacy Inquiries

• Email: privacy@rescuemynotes.com
• Subject line: Include "PRIVACY REQUEST" for faster response
• Response time: Within 72 hours

Data Deletion Requests

• Email: privacy@rescuemynotes.com
• Subject line: "DELETE REQUEST"
• Response time: Within 24 hours

General Support

• Email: support@rescuemynotes.com
• For: Technical support, billing questions

Legal Inquiries

• Email: legal@rescuemynotes.com
• For: Legal compliance, subpoenas, law enforcement requests

13. Legal Basis for Processing (GDPR)

We process your data based on:

Contract Performance

• Service delivery: Converting your Evernote notes
• Payment processing: Completing your purchase

Consent

• Email communications: Sending you download links and receipts
• Optional features: Any future optional features require separate consent

Legitimate Interests

• Security: Protecting our service and users from abuse
• Compliance: Meeting legal and tax obligations

Legal Obligations

• Tax records: Maintaining payment records as required by law
• Security logs: Audit trails for compliance

You can withdraw consent at any time by requesting data deletion.

14. California Privacy Rights (CCPA)

For California Residents
You have additional rights under the California Consumer Privacy Act (CCPA):

Right to Know

• What personal information we collect
• How we use it
• Who we share it with

Right to Delete

• Request deletion of your personal information
• Exceptions: Legal obligations, security, fraud prevention

Right to Opt-Out

• We don't sell personal information (so nothing to opt out of)

Right to Non-Discrimination

• We won't discriminate against you for exercising your privacy rights

How to Exercise CCPA Rights

Contact us at privacy@rescuemynotes.com with "CCPA REQUEST" in the subject line.

---