Privacy Notice

This notice explains what personal data Minutes collects, why, who it is shared with, and your rights under the UK GDPR. The controller is [operator's full legal name], an individual based in the United Kingdom. Contact: privacy@minutes-app.com.

What we collect

Account data — your email address and name, held by our authentication provider (Clerk) and mirrored in our database.
Your Content — the notes, files, tasks, folders and seller profile you create. Notes and files may contain personal data about other people that you choose to put there; you are the controller of that data and Minutes processes it on your behalf.
Usage records — AI action counts and cost, connected-assistant activity, sign-in times, and health-check logs.
Error reports — when something breaks, a scrubbed error report (type, stack trace, request path, your user id). Note content, request bodies, cookies and credentials are stripped before the report leaves our server.
We do not use analytics, advertising, tracking pixels, or session-recording tools.

Why we process it, and our lawful basis

To provide the Service (store and display your notes, run searches, take backups) — performance of our contract with you.
AI actions — when you run one, we send the content of that one note (and your seller profile) to our AI sub-processor and return the result. This happens only on your explicit request. Lawful basis: performance of the contract at your instruction.
Security, debugging and abuse prevention — our legitimate interest in keeping the Service safe and working.
The weekly operations report emailed to the operator — our legitimate interest in running the trial. It contains aggregate numbers and per-user counts, not note content.

AI processing — the detail

AI actions are handled by Anthropic (the Claude models), reached through the Vercel AI Gateway. When you run an action:

only the note you selected, plus your seller profile, is sent — not your whole account;
it is sent at request time and is not stored by us beyond the result;
Anthropic does not train its models on data sent through the API, and the Vercel AI Gateway is configured for zero data retention;
the result is shown to you and only saved if you accept it. AI output can be wrong — check it.

Connected assistants (MCP)

If you connect a third-party AI assistant, that assistant can read the data its tools request (notes, folders, tasks, attachments) and — only if you enable writes for it — add or change notes and tasks. Every call is logged (tool name, time, a hash of the arguments; never the argument values or note content). You control the connection entirely from /dashboard/connections: turn it off, set read-only, or revoke a client. What the assistant’s own provider does with data you send it through that assistant is governed by that provider’s terms, not this notice.

Cookies

Minutes uses strictly-necessary cookies only, so there is no cookie banner:

Clerk session cookies — keep you signed in.
A short-lived cookie on a password-protected share link — remembers that you entered the link password, scoped to that one link.
Local storage — your light/dark theme choice and a few UI preferences, kept only in your browser.

Who we share data with

We use the sub-processors listed on the Sub-processors page — hosting, database, file storage, authentication, AI, email and error monitoring. Some are in the United States; transfers rely on the UK International Data Transfer Agreement / Addendum or equivalent safeguards. We do not sell personal data or share it for advertising.

Retention

Your Content is kept until you delete it or close your account.
A deleted note or folder goes to an undo state for about a day, then is permanently removed by a nightly job.
Backups are kept for 14 days on a rolling basis, then overwritten. A deleted item can still exist in a backup until it ages out of that window.
Usage records and error reports are kept up to 90 days (health checks) or up to a year (AI cost history), then removed.
When you delete your account, your database rows and stored files are deleted immediately and your authentication record is removed. Any copy still present in a backup is purged as that backup ages out (within 14 days).

Your rights

Under the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or provide it in a portable format. You can:

export everything yourself at any time (account menu → Export data);
erase everything yourself (account menu → Delete account);
email us at privacy@minutes-app.com for anything else. We respond within one month.

You can also complain to the UK Information Commissioner’s Office (ico.org.uk), though we’d rather you told us first.

Changes

If we change this notice materially we’ll tell you by email or in the app before it takes effect.