Last updated 30 September 2026

Privacy Policy

This policy explains what personal data NoteFish handles, why, for how long, who else sees it, and what rights you have. It is written for the people who use NoteFish and for visitors to notefish.ai.

If someone called you through NoteFish, this page is for you.

1. Who is responsible

Întreprinzător Individual „LEONARDO CALANCEA” (Î.I. „LEONARDO CALANCEA”), IDNO 1026023047638, bd. Ștefan cel Mare și Sfânt 141/2, ap. 45, MD-2004 Chișinău, Republic of Moldova, runs NoteFish. Contact: hello@notefish.ai.

We act in two different roles, depending on the data:

As controller. For your account, your use of the website and apps, your voice recording and voice clone, and our dealings with you, we decide how the data is used.
As processor. For what happens on the calls you make with NoteFish, the business that uses NoteFish decides, and we process the data on its behalf and on its instructions. That covers callers' words, transcripts and summaries. That business is the controller, and our Data Processing Agreement governs it. If you called a business that uses NoteFish, that business's privacy notice applies to you. We will pass on any request you send us.

Paddle. Paddle (Paddle.com Market Limited), our reseller, handles payments as a separate controller under its own privacy policy. We never see your full card details.

2. What we handle and why

Data	Why	Legal basis
Account: name, email, password (stored only as a salted hash), role, desk membership	To give you an account and a desk, and keep it secure	Performing our contract with you
Settings: languages, voice choice, puff, layout, phrases, word list	To make NoteFish work the way you set it	Contract
Voice recording (about one minute) and the voice clone made from it	To speak your translated replies in your voice	Your explicit consent, given when you record. You can withdraw it by deleting the voice
Call content: what is said, transcripts, translations, summaries, notes, call times, caller language	To run calls for the business that uses NoteFish	We process it as a processor, for that business (see section 1)
Usage: minutes translated, plan, number of calls	To count plan minutes and show your plan	Contract
Billing: plan, subscription status, country, from Paddle	To give you the plan you paid for	Contract; the rest is Paddle's
Support emails	To answer you	Contract, or our legitimate interest in answering questions
Technical logs: IP address, time, request, errors	To keep NoteFish running and secure and to stop abuse	Our legitimate interest in running a secure service

We do not use personal data for advertising, we do not sell it, and we do not use it to train AI models. How our providers may use data is on the Sub-processors page.

Feelings are not recorded. NoteFish carries how loud and fast you spoke into the translated voice, live, and keeps no record of it. It does not analyse, store or report how staff felt.

3. How long we keep it

Calls and transcripts. Deleted automatically after the period the desk's admin chooses. The default is 90 days, and it can be 30 days to 2 years. They can be deleted sooner at any time.
Call audio. Not stored. It is processed live and discarded.
Voice recording. Made live on NoteFish, starting with the consent sentence you read aloud. Our speech recognition provider transcribes it once to check that sentence is there. It is then sent to the voice provider to make the clone and not kept by us. The clone is kept until you delete it; deleting it removes it at the providers too.
Account. Kept while you have an account, and deleted within 30 days after you close it.
Technical logs. Kept for up to 30 days.
Billing records. Kept by Paddle for as long as tax law requires.

4. Who else handles it

We use a small number of providers to run NoteFish: hosting, a database, network protection, speech recognition and translation, and voice synthesis. The full list is on the Sub-processors page. It says what each provider does, where, under which transfer safeguard, and how each may use data.

We may also disclose data where the law requires it, for example to a court or authority with a valid order.

5. Transfers outside Moldova and the EU

NoteFish is run from the Republic of Moldova. Its servers are in Frankfurt, Germany, and its database is in the European Union. The companies behind them, and the AI and voice providers, are based in the United States or Singapore and may access or process data there. Where data leaves the EU, Moldova or the country it came from, we rely on the safeguards the law provides:

an adequacy decision, such as the EU-US Data Privacy Framework for certified providers; or
the European Commission's Standard Contractual Clauses.

For business customers in the EU, our Data Processing Agreement includes the Standard Contractual Clauses for their data coming to us. Moldova does not have an EU adequacy decision.

6. Security

In transit. All traffic is encrypted with HTTPS.
Passwords. Stored only as salted hashes.
Access. Each desk is separate, and access is limited to what the service needs.
Call audio. Never stored.
If a breach puts your data at risk, we tell the business concerned without undue delay, and the authority and you where the law requires.

7. Your rights

You have the right to:

access your personal data and get a copy;
correct it;
delete it;
restrict or object to its use;
move it to another service;
withdraw consent at any time, for example by deleting your voice. This does not affect what happened before.

Write to hello@notefish.ai. We answer within one month. For data we process for a business, we pass your request to that business and help it answer.

You can also complain to a data protection authority:

In Moldova: the Centrul Național pentru Protecția Datelor cu Caracter Personal (datepersonale.md).
In the EU: the data protection authority of your country.

8. Cookies and storage

The website uses no tracking, advertising or analytics cookies. So there is no cookie banner.

The desk uses one cookie that keeps you signed in, and it stores your own display preferences in your browser. Both are strictly necessary for the service you asked for.

9. Children

NoteFish is for adults. We do not knowingly collect data from anyone under 18.

10. Changes

When this policy changes, we update the date at the top. For significant changes we also tell account holders by email or in the app.