Privacy Policy

1. Introduction

This Policy describes how Enzo Notes, a brand of Hineh Tecnologia Ltda. (Brazil CNPJ 69.280.849/0001-62) — “we” — processes personal data of users of the Enzo app and related public product pages where this Policy is linked, including enzonotes.com and waggsai.com, in accordance with applicable privacy laws, including the EU/UK GDPR and the California CCPA/CPRA, as well as Apple App Store and Google Play policies.

2. Data We Collect

• Registration: email, name, profile photo, and Microsoft/Google/Apple account IDs.
• Usage:
  • Audio: recorded locally on your device; securely uploaded for transcription and deleted from our servers right after processing. When you expressly choose “Send for inspection,” a copy of the raw file is stored privately, without note processing, solely for technical support and for up to 14 days. The Enzo app records audio only when the user explicitly starts a recording, and never runs or listens in the background without user action.
  • Transcript: stored with access controls for search and reading by authorized users, including assistants connected through authentication and consent.
  • Generated notes: the summarized output shown in the app and available for sharing.
  • Consumed minutes and operational logs.
  • Technical diagnostics: app logs and information about the app version, device, and error may be sent automatically when a failure is detected and periodically to help the support team investigate problems. Before sending, we take measures to reduce the presence of personal and sensitive data. Access is restricted to the support team, and this data is deleted within 14 days. Sending diagnostics does not use the microphone or create new audio recordings.
  • Help requests: when you open the Help form, we process the problem description and the mobile/WhatsApp number you provide, which becomes part of your account profile. Available technical records may be attached to the request as disclosed before submission.
• Payments: transaction identifiers provided by Apple/Google (we do not store card data).
• Device: model, OS, language, and advertising identifiers.
• Analytics and cookies: on public pages, we may collect navigation events, pages viewed, traffic source, approximate location, browser/device information, and identifiers such as Google Analytics cookies or client IDs. We do not send audio, transcripts, or generated notes to Google Analytics.
• First-party campaign measurement: we record minimal pseudonymous purchase-journey events on our servers, such as offer views, calls-to-action clicks, and form starts. These events do not contain email and are linked to a random attribution identifier and, when present in the URL, campaign parameters.

3. Purposes and Legal Bases

Note for California residents: while the CPRA does not require a “legal basis,” the rights below apply. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

4. Sharing with Third Parties

• Apple / Google — subscription payment processing.
• AssemblyAI and OpenAI — audio processing and text generation (DPAs in place).
• Google Analytics — audience and performance measurement on public pages; we do not share audio, transcripts, or generated notes with this tool.
• Cloud hosting and backup — AWS / GCP.
• Public authorities where required by law.

Enzo AI and connected assistants

When you connect your Enzo account to a compatible assistant, you authorize the connected application to read transcripts and note corrections your account can access. Depending on each request, Enzo sends account identification, meeting metadata and dates, transcript passages or pages, speaker names when available, captured corrections and source references.

The initial connection is read-only and follows current account, team and organization permissions. It does not record audio, create notes, modify records or send messages. The assistant provider you choose receives the requested data; its terms, privacy policy and settings also govern its handling of that data. Use only assistants authorized by your organization.

You can revoke access at Enzo connections. Revocation stops new requests and access renewal for that connection, but does not erase data already received by the assistant. The recipient's conditions govern its retention of that data. Deactivated or deleted accounts lose access.

For security and operation, we log the requested tool, an internal account identifier, the result, error codes and call duration. These operational records follow the retention periods in this Policy and do not include transcript content, passwords or access tokens.

5. International Transfers

Some processing occurs on servers in the United States. For data originating from the EEA/UK/Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK IDTA/Addendum, as applicable) and comparable safeguards to ensure an adequate level of protection.

6. Information Security

We use TLS 1.2+ encryption in transit, least-privilege access controls, and audit logs. No method is 100% secure, but we follow practices inspired by ISO 27001. Full transcripts are stored in an isolated database with encryption at rest and service keys under least-privilege, with access limited by the applicable account, team and organization permissions.

7. Data Retention

Audio files are automatically deleted right after transcription is complete. Full transcripts are retained only while the account remains active, in a restricted and encrypted environment. If you delete your account, we will commence permanent removal of those transcripts within up to 15 days — the maximum time to complete the process. Logs and diagnostic data are automatically deleted within 14 days. The mobile number provided in the Help form remains in your profile while the account is active or until it is corrected or deleted at your request. Support communications may be retained as long as necessary to handle the request and protect legal rights. Other pseudonymized operational logs may be kept for up to 24 months for security and audit. Pseudonymous first-party campaign-measurement events are retained for up to 180 days.

8. Your Rights

Depending on where you live, you may have rights such as: confirmation and access, correction, deletion/erasure, portability, restriction of processing, and objection (including to processing based on legitimate interests). California residents have rights to know, delete, correct, opt-out of “sale”/“sharing,” and limit the use of sensitive personal information. To exercise your rights, see the section below.

9. How to Exercise

Email us at contact@enzonotes.com with the subject “Privacy Rights.” We will respond within the timeframe required by applicable law (typically up to 30–45 days). We may need to verify your identity.

10. Children

The Service is not directed to children under 13 (COPPA). For users in the EEA/UK, if consent is the legal basis, the minimum age is 16 (or lower where permitted by local law, e.g., 13–16); we do not knowingly process children’s data. Please contact us for prompt deletion if a minor’s data was submitted inadvertently.

11. Changes to This Policy

We may update this Policy and will notify you in the app or by email. Your continued use after the effective date means you accept the new version.

12. DPO and Contact

Data Protection Officer / Privacy Contact:
Enzo Notes Privacy Team — Hineh Tecnologia Ltda.
CNPJ 69.280.849/0001-62
Email: contact@enzonotes.com