Privacy Policy

Last updated October 10, 2026

Notely ("we", "us") is a note-taking workspace with an AI assistant that can read from and act on tools you choose to connect, such as Gmail, Google Calendar and Google Drive. This policy explains what information we collect, how we use it, how we store, share and protect it, how long we keep it, and how you can delete it. We only collect what the product needs, we never sell your data, and we never use your data to train AI models.

Privacy at a glance

Who we are: Notely is available at notely.brainix.co. Contact: support@brainix.co.
Google data we access: Only the Google products you choose to connect (sign-in, Gmail, Calendar, Drive, Docs, Sheets, Meet, Tasks, Classroom) and only the permissions you approve on Google’s consent screen. The exact data is listed in section 5.
Why we use it: To do what you ask in the app: search and summarise, turn emails into notes or tasks, show your schedule, and draft or send only after you approve each action.
What we never do: We never sell your data, use it for advertising, or use Google user data to train generalized AI or machine-learning models. We do not read your data unless you ask for support, security requires it, or the law does.
How we protect it: Encryption in transit (TLS), encrypted storage of Google access tokens and your own AI keys, and restricted access to production systems.
Keeping and deleting: We keep Google tokens only while a tool is connected. Disconnect it in Settings → Connections, revoke access at myaccount.google.com/permissions, or delete your whole account in Settings → Security (section 10).
Google API policy: Our use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements (section 5.6).

1. Information we collect

Account information. Your email address, display name and, if you sign in with Google, the name, email address, profile picture and account identifier Google shares with us. If you create a password, we store only a salted hash of it. If you upload a profile picture, we store a resized copy of it.

Content you create. Notes, folders, tags, tasks, reminders, automations and anything you type or paste into Notely, including messages you send to the AI assistant and the assistant’s replies.

Data from connected tools. When you connect a tool (for example Gmail, Google Calendar or Google Drive), we access only the data allowed by the permissions you approved, and only when you or the assistant ask for it. Section 5 lists exactly which Google data we access and why. Where a connector can write (send an email, create an event, add a spreadsheet row), nothing is written until you approve that specific action.

Technical and usage information. Browser type, device and operating system, IP address, the pages and features you use, timestamps, and diagnostic logs such as error reports and request identifiers.

2. How we use information

To provide the service: store and sync your notes and tasks, run searches, and power the AI assistant.
To carry out what you ask the assistant or an automation to do in your connected tools, with your approval for any change.
To keep your account secure: sign you in, detect abuse, rate-limit requests and investigate incidents.
To operate and fix Notely: measure reliability and performance and resolve errors.
To contact you about your account, security and material changes to the service.
To comply with law and enforce our Terms & Conditions.

We do not sell personal information, we do not use it for advertising, and we do not use your notes, messages or connected-tool data to train machine-learning models.

3. Accounts and authentication

You can create an account with an email address and password, or by continuing with Google. With Google sign-in we receive your verified email address, name, profile picture and account identifier; we never receive or store your Google password. Sessions are kept in a secure, HTTP-only cookie, and you can review and sign out other sessions and turn on two-factor authentication in Settings → Security.

4. Connected tools and integrations

Connecting a tool is always your choice and always goes through that vendor’s own consent (OAuth) screen, where you can see exactly which permissions are requested. Write permissions are optional and can be left off. You can disconnect a tool at any time from Settings → Connections.

The access and refresh tokens a vendor issues are encrypted at rest and used only to make the requests you, the assistant or your automations initiate. When you disconnect a tool we revoke the token with the vendor (where the vendor supports it) and delete it from our systems.

5. Google OAuth and Google user data

This section describes how Notely accesses, uses, stores, shares, protects, retains and deletes data we receive from Google APIs (“Google user data”). You choose which Google products to connect, and optional permissions are only requested if you turn them on.

5.1 What we access and why

Google product and permissions	Data accessed	Why we use it	What we store
Google Sign-Inopenid, email, profile	Your name, email address, profile picture and Google account ID.	To create your Notely account and sign you in with Google.	Name, email, picture URL and account ID are stored with your account.
Gmailgmail.readonly, gmail.compose (optional), gmail.send (optional)	Message metadata (sender, recipients, subject, date), message text and labels of the emails you or the assistant look up; with the optional permissions, drafts and emails you ask Notely to create or send.	To search and summarise your email when you ask, to turn emails into notes or tasks, and to draft or send an email only after you approve that specific message.	Not copied in bulk. Only the excerpts shown in an assistant conversation or an automation run you started are kept, in that conversation or run history.
Google Calendarcalendar.readonly, calendar.events (optional)	Your calendars and the events in them (title, time, attendees, location, description).	To show upcoming events and answer questions about your schedule; with the optional permission, to create or update events for tasks you choose to put on your calendar.	For tasks you sync, the linked event ID and link. Event details are otherwise not stored.
Google Drivedrive.readonly, drive.metadata.readonly, drive.file (optional)	File names, types, owners, modified dates and the contents of files you or the assistant open; with the optional permission, files that Notely creates for you.	To find and read files you ask about and to attach or reference them in notes; with the optional permission, to save files you ask Notely to create.	Only excerpts shown in a conversation or automation run you started, and any content you choose to save into a note.
Google Docsdocuments.readonly, documents (optional), drive.metadata.readonly	The title and text of documents you or the assistant open; with the optional permission, documents Notely creates or edits for you.	To read, summarise or import a document you ask about; with the optional permission, to create or update a document after you approve it.	Only excerpts shown in a conversation or automation run you started, and any content you save into a note.
Google Sheetsspreadsheets.readonly, spreadsheets (optional), drive.metadata.readonly	Spreadsheet names and the cell values of sheets you or the assistant open; with the optional permission, rows Notely adds or updates for you.	To read and summarise data you ask about and, with the optional permission, to append or update rows (for example in an automation you set up and approve).	Only the values shown in a conversation or automation run you started.
Google Meetmeetings.space.readonly, meetings.space.created (optional), userinfo.email	Details of Meet spaces (meeting link, code and settings); with the optional permission, meeting spaces Notely creates for you.	To add a Meet link to an event or task when you ask for one.	The meeting link, if you save it into a note, task or event.
Google Taskstasks.readonly, tasks (optional), userinfo.email	Your task lists and the tasks in them (title, notes, due date, status); with the optional permission, tasks Notely adds or completes for you.	To show and search your Google tasks and, with the optional permission, to add a task or mark one done after you approve that specific action.	Only the tasks shown in a conversation or automation run you started, and anything you save into a note or task.
Google Classroomclassroom.courses.readonly, classroom.coursework.me.readonly, classroom.announcements.readonly, userinfo.email	The names of your classes, your own assignments and questions (title, instructions, due date) and class announcements. Read-only: never other students' work or grades.	To show your classes, upcoming assignments and announcements when you ask, and to help you plan them as notes or tasks.	Only what is shown in a conversation or automation run you started, and anything you save into a note or task.

5.2 How we use Google user data

Only to provide and improve the user-facing features you can see and control in Notely, as described in the table above.
Only when you, or an automation you created and switched on, ask for it. Notely does not scan your Google account in the background.
Any change to your Google data (sending an email, creating an event, editing a document or sheet) happens only after you approve that specific action.
Never for advertising, never to build user profiles, and never sold.

5.3 How we store and protect it

We do not keep a copy of your mailbox, calendar or files. Google user data is fetched when needed, and only the pieces shown to you are kept: in the assistant conversation or automation run history where you requested them, or in a note or task if you choose to save them there. Your Google OAuth tokens are encrypted at rest with an application-level key, all data is encrypted in transit (TLS), and access to production systems is restricted to authorized personnel.

5.4 How we share it

We do not sell or transfer Google user data to third parties, except: (a) to the AI model provider that answers your request, which receives only the excerpts needed for that request (see section 6); (b) to service providers that host and operate Notely on our behalf under confidentiality obligations; (c) when required by law; or (d) with your explicit consent. Humans at Notely do not read your Google user data unless you ask us to for support, it is necessary for security purposes (such as investigating abuse), or it is required by law.

5.5 Retention and deletion

Google OAuth tokens are kept while the connection is active and deleted as soon as you disconnect the Google product in Settings → Connections.
Excerpts in an assistant conversation are deleted when you delete that conversation; excerpts in an automation’s run history are deleted when you delete the automation.
Content you saved into notes or tasks stays until you delete it (deleted notes are removed permanently 30 days after being moved to Trash).
You can also revoke Notely’s access at any time from your Google Account at myaccount.google.com/permissions.
To have all of your Google user data and your account deleted, use Settings → Security → Delete account; it happens immediately. If you can't sign in, email support@brainix.co and we complete deletion within 30 days.

5.6 Limited Use

Notely’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google Workspace API data (such as Gmail, Calendar, Drive, Docs, Sheets, Meet, Tasks or Classroom data) to develop, improve or train generalized or non-personalized AI and/or machine-learning models.

6. AI features and your own model keys

To answer a request, the assistant sends the parts of your notes and connected-tool data needed for that request to a large-language-model provider. Which provider depends on this deployment’s configuration or, if you add your own model under Settings → AI, on the provider and key you choose. The provider processes that data only to generate the response. Your own API key is stored encrypted, is never shown again after you save it, and is used only for your requests. We choose providers and settings that do not use API data to train their models.

8. Cookies and similar technologies

Notely uses strictly necessary cookies: a session cookie that keeps you signed in and a security cookie that protects forms from cross-site request forgery. We do not use advertising or cross-site tracking cookies. Your browser’s local storage holds preferences such as theme and may briefly hold unsaved note edits so they survive a crash. Clearing cookies and site data signs you out.

9. Data storage and security

Data is stored on servers operated by our hosting provider and is encrypted in transit (TLS). OAuth tokens and your own AI keys are additionally encrypted with an application-level key. Access to production systems is restricted to authorized personnel. Our servers and the AI and integration providers we use may process data in countries other than your own; wherever it is processed, this policy applies to it. No method of transmission or storage is completely secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as required by law.

10. Data retention and deletion

Notes and other content stay until you delete them. Notes moved to Trash are permanently deleted after 30 days, or immediately if you delete them forever.
Assistant conversations stay until you delete them; automations and their run history stay until you delete the automation.
Connected-tool tokens are deleted when you disconnect the tool.
Expired sign-in sessions are removed automatically.
You can delete your account yourself in Settings → Security → Delete account. Your account and the data it owns are removed from our active systems immediately and from backups within 90 days. Notes you shared are deleted and their collaborators lose access; edits you made to other people's notes stay in their history without your name; feature requests and comments you posted stay without your name. Admin and security logs keep the event without your email (security logs are removed after 90 days). If you tell us why you're leaving, we keep that answer without anything that identifies you. If you can't sign in, email support@brainix.co from the address on your account.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to complain to a supervisory authority. In Notely you can edit your profile, delete notes, tasks, conversations and automations, disconnect tools, sign out other sessions and delete your account. For anything else, including a copy of your data, contact us at support@brainix.co; we respond within 30 days.

12. Third-party services

Tools you connect (such as Google, Microsoft, Notion, Slack, Atlassian Jira, Asana, ClickUp, Todoist, Dropbox and Zoom) are operated by their vendors under their own privacy policies, and notes may contain links to other sites. We are not responsible for their practices and encourage you to read their policies.

13. Children's privacy

Notely is not directed to children under 16 (or the higher age required in your country), and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as Notely evolves. We will post the new version here and update the date at the top; for material changes, especially to how we use Google user data, we will notify you by email or in the app before they take effect.

15. Contact

Questions, requests or concerns about privacy or your data: support@brainix.co. Please include enough detail for us to identify your account and your request.

This policy is available at notely.brainix.co/privacy-policy.