Privacy notice
In short: recordings and notes are saved on your device. When you use cloud transcription, completed audio segments can be sent for processing while you continue recording. We temporarily keep encrypted transcription results to recover interrupted requests without repeating paid processing. There are no ads, no trackers and no analytics.
1. Who is responsible
Luxxow S.à r.l.-S, 12 rue Treeschheck, L-3321 Berchem, Luxembourg (R.C.S. Luxembourg B311306), is the controller for this app within the meaning of the General Data Protection Regulation (EU) 2016/679 (GDPR). Contact: hello@luxxow.com.
2. What is saved on your device
Your recordings, transcripts, summaries and any notes you write are stored on the device, including audio segments awaiting transcription. Deleting a note deletes its local audio and segment cache. Deleting local data does not itself erase server-side usage or duplicate-prevention records described below. Device or cloud backups are controlled separately by your device and backup settings.
The microphone is used only while you are recording, and only after iOS has asked your permission. On Android, the app requests Android microphone permission.
3. What happens when you transcribe
Transcription and summarising do not run on the device. When you ask for either, the audio is sent to our own service at notes-api.paperorg.com, which passes it to the provider that does the work and returns the text to your device. With cloud transcription enabled, completed segments (approximately two minutes each) may upload while the next segment records. A combined summary is requested after recording stops and all segments have been transcribed. Offline segments remain on your device and can be retried when connectivity returns.
The providers we use for that are:
- LuxASR, operated by the University of Luxembourg, for Luxembourgish speech.
- OpenAI, for speech in other languages and for summaries and action items.
- ElevenLabs, for speech processing.
They act as processors on our instructions. OpenAI and ElevenLabs are established outside the European Economic Area, so a transcript made through them involves a transfer out of the EEA. LuxASR is in Luxembourg.
- Legal basis: performance of a contract (GDPR art. 6(1)(b)) — it is the feature you asked for.
- Playing saved audio locally does not upload it. Using cloud recording and transcription can transfer completed audio segments before you tap Stop.
Transcription replay and retention
For segmented recordings, our backend encrypts and caches successful transcription responses for up to 24 hours so a lost connection can recover the same result without another provider request. Expired response content is removed by startup and hourly cleanup, normally within 25 hours in the running service. Service outages can delay cleanup. This replay cache does not store raw audio.
Separate duplicate-prevention records contain the account or device-associated user identifier, recording and segment identifiers, an audio fingerprint (SHA-256), segment offset, duration and processing state. They do not contain the recording or transcript text, but they are not anonymous. They are retained after the replay content expires to prevent the same request being processed or charged again and to enforce recording limits. These records currently have no automatic expiry. Contact hello@luxxow.com for access or erasure requests; deleting a note on your device does not submit such a request.
The replay-cache expiry is not a promise that third-party providers or backup systems delete all their copies at that time. Their processing and retention arrangements are separate. Contact us for information about those arrangements.
4. Your account and Pro
The free tier includes a monthly allowance of cloud minutes. Paperorg Pro raises it. Accounts and entitlements are handled by Paperorg Platform, and a purchase is made through Apple or Google Play, not by us: we are told that a subscription is valid, not how you paid for it. We never see your card.
5. Checking the app is genuine
Before the service will transcribe anything, it checks that the request came from a genuine app installation using Apple's App Attest or Google Play Integrity, as applicable. These checks and device-associated identifiers support abuse prevention and usage limits; they do not make device-associated records anonymous.
6. What we do not do
There is no advertising, no analytics, no crash-reporting SDK and no third-party tracking in this app. We do not sell, rent or trade personal data, and we do not use your recordings to train anything.
7. Your rights
Under the GDPR you may ask us for access to your personal data, its rectification or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to hello@luxxow.com and we will answer within one month.
If you believe we have handled your data badly you may lodge a complaint with the Luxembourg supervisory authority: Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux —cnpd.public.lu.
8. Children
Paperorg Notes is not directed at children and is not intended for use by anyone under 16.
9. Changes
If this notice changes, the date at the top of this page changes with it.