Privacy Policy

NoteWave is developed and operated by Blaze AI Solutions (Pty) Ltd ("Blaze AI Solutions", "we", "us", or "our"). For purposes of South Africa's Protection of Personal Information Act, 2013 ("POPIA"), we act as the responsible party for the personal information we process in connection with the Service, except where we process information strictly on behalf of another responsible party.

This Privacy Policy explains how we collect, use, store, share, retain, and protect information when you use NoteWave's AI-powered meeting transcription, summarisation, collaboration, recording, integration, and mobile app services.

We are a South African company and handle personal information in accordance with POPIA and, where applicable, the GDPR, CCPA/CPRA, consumer protection laws, electronic communications laws, and other privacy regulations that apply to your use of the Service.

By using NoteWave, you confirm that you are at least 18 years old. If you are under 18, you may not use the Service.

Depending on your location and applicable law, you may have some or all of the following rights:

• Access: request a copy of personal information we hold about you.
• Correction: ask us to correct inaccurate, outdated, or incomplete information.
• Deletion: ask us to delete personal information, subject to legal, billing, fraud-prevention, backup, and operational retention requirements.
• Objection or restriction: object to or restrict certain processing activities, including direct marketing.
• Consent withdrawal: withdraw consent where processing is based on consent. This does not affect lawful processing that occurred before withdrawal.
• Portability: receive certain information in a structured, commonly used, machine-readable format where applicable law provides this right.
• Complaint: lodge a complaint with the Information Regulator or another competent supervisory authority.

To exercise these rights, contact us at contact@blazesolutions.ai. We will respond within the timeframes required by applicable law and may need to verify your identity before acting on a request.

We process personal information on lawful bases that may include contract performance, legitimate interests, legal obligations, consent where required, and protection of our rights, users, and systems.

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

• Encryption: encryption in transit and at rest where supported by our infrastructure providers.
• Access controls: authentication, session handling, role-based access controls, and restricted administrative access where applicable.
• Infrastructure safeguards: we use established hosting, storage, and database providers that maintain recognised security programmes and certifications.
• Monitoring and backups: diagnostic logging, operational monitoring, and provider-managed backups where available.

No system is perfectly secure. We cannot guarantee absolute security, and your own account practices, device security, meeting-sharing choices, and connected third-party platforms also affect the security of your information.

We share personal information only in limited circumstances:

• Service providers: categories include cloud hosting, storage, database, authentication, backend infrastructure, AI transcription and summarisation, analytics, email delivery, payment processing, app-store billing support, customer support, security, and operational tooling.
• Connected integrations: where you connect or use meeting platforms such as Zoom, Microsoft Teams, Google Meet, Google Calendar, or similar services, we exchange information needed to provide that integration.
• Team and sharing features: where you invite team members, share transcripts, or use collaborative workspaces, relevant content and metadata are shared with the recipients you choose.
• Legal and safety reasons: we may disclose information to comply with law, court orders, lawful requests, fraud prevention, security investigations, or to protect rights, safety, and property.
• Business transfers: information may transfer in connection with a merger, acquisition, restructuring, financing, insolvency, or sale of assets, subject to appropriate notice where required.
• With consent: we may share information for another purpose with your consent.

We may process information in countries outside South Africa, including through providers based in or supporting operations from the United States, European Union, United Kingdom, or other jurisdictions. Where required by POPIA, GDPR, or other applicable law, we rely on contractual, organisational, and technical safeguards for cross-border transfers.

We do not publish a detailed architecture list in this Policy. Relevant service-provider or subprocessor information can be requested at contact@blazesolutions.ai where appropriate.

If we become aware of a security compromise involving personal information, we will investigate, take reasonable containment and remediation steps, and notify affected data subjects, the Information Regulator, or other competent authorities where required by POPIA or other applicable law.

• We will provide notice as soon as reasonably possible where required by law.
• We will describe the nature of the compromise, likely consequences, and practical steps affected users can take where appropriate.
• We may delay direct notice only where law enforcement, regulatory guidance, or applicable law permits or requires delay.

We retain information only for as long as reasonably necessary for service delivery, user control, operational reliability, legal compliance, billing, tax, dispute resolution, fraud prevention, and security.

• Account data: retained while your account is active and then deleted or anonymised within a reasonable period after account deletion, except where retention is legally or operationally required.
• Main meeting audio: retained for playback, recovery, and processing for the retention period associated with your plan or settings. Current default windows are Free: 7 days, Pro: 14 days, and Business/Enterprise: 30 days, after which main audio may be expired or deleted.
• Speaker-verification snippets: small snippets used for speaker identification may be retained for up to 120 days unless deleted earlier as part of account, meeting, or operational cleanup.
• Transcripts, summaries, and workspace content: retained until you delete them, close your account, or the content is removed under our retention and account policies.
• Analytics and diagnostic data: retained for a reasonable period and aggregated, anonymised, or deleted where practicable.
• Legal, tax, billing, and financial records: retained for periods required by applicable law, including South African record-keeping obligations.

You can request deletion of your personal information through the Service or by emailing contact@blazesolutions.ai. We may retain limited records where required for legal, billing, security, fraud-prevention, backup, or dispute-resolution purposes.

We use cookies, local storage, pixels, SDKs, and similar technologies for authentication, security, preferences, diagnostics, analytics, performance measurement, and advertising conversion measurement. See our Cookie Policy for details.

• Essential technologies: login sessions, authentication, security, fraud prevention, app state, and core service functionality.
• Preference technologies: remembered choices such as theme, layout, notifications, and browser/app preferences.
• Analytics and measurement: privacy-focused web analytics, referral attribution, conversion measurement, performance insights, and feature usage.

You can control many cookies through browser settings. Some essential technologies are required for the Service to function, and browser controls may not block all local storage, pixels, or SDK behaviour.

NoteWave is not intended for people under 18, and we do not knowingly offer the Service directly to children. If meeting content includes a child or another vulnerable person, the user who records or uploads that content is responsible for ensuring a lawful basis, required notices, and required consent.

If we learn that personal information relating to a child has been collected or processed in a way that requires action under applicable law, we will take appropriate steps to address it.

We may update this Privacy Policy from time to time to reflect changes in our Service, technology, vendors, integrations, law, or business operations.

• We will update the "Last updated" date when this Policy changes.
• Where a material change adversely affects your rights, we will provide reasonable notice through email, the Service, or another appropriate channel.
• Your continued use of the Service after the effective date means you accept the updated Policy.

Blaze AI Solutions (Pty) Ltd

Privacy and Information Officer requests: contact@blazesolutions.ai

For privacy inquiries, POPIA requests, data subject access requests, PAIA requests, or subprocessor information requests, include the request type in your subject line. Our PAIA manual and company address details can be requested through the same contact channel until published in a dedicated public format.

By creating an account or using NoteWave, you acknowledge that you have read this Privacy Policy and our Terms of Service.