HyNote

GDPR overview

HyNote claims alignment rather than certified compliance. The security page says it is aligned with GDPR and CCPA; the homepage advertises GDPR, CCPA and HIPAA-aligned workflows. The privacy notice, last updated on 31 January 2025, is concrete on rights: EEA and UK users are told they may request access and a copy, rectification, erasure, restriction and portability, may object to processing and withdraw consent, and are given links to the EU and Swiss supervisory authorities. Legal bases are named, explicit consent is collected at sign-in, and retention is capped at one year. The gaps are equally concrete: no Article 27 EU representative, no named data protection officer, no published Data Processing Agreement, no subprocessor list and no mention of standard contractual clauses. Every privacy request goes to one generic mailbox.

Who owns the data?

HyNote states plainly that you own your content and that it is never used to train its models. Uploaded recordings, documents and images are described as encrypted end to end, the vendor claiming it cannot read them itself. The privacy notice then qualifies that picture: user content is transmitted to third-party AI providers, named only as Gemini or similar large language model providers, in order to produce the requested output. Personal data may also be shared with business partners for promotional purposes, and transferred wholesale in a merger, financing or acquisition. The terms of use let HyNote remove content without notice and keep storing what it has removed.

Reuse rights

Nothing on the site makes reuse of your own notes, transcripts or summaries conditional on the vendor's permission. You can export at any time to Google Docs, Notion, PDF or TXT — transcript export from the Pro tier, direct transfer into Google Docs and Notion from Plus upward — pass content on through the native iOS and Android share sheet, and delete everything whenever you choose. Access to Google Docs and Google Calendar runs on OAuth 2.0, is triggered only by your own actions and can be revoked at will. The restrictions in the terms of use point the other way entirely: they protect HyNote's own brand, logo and site content, forbid crawling, scraping or caching the service, and prohibit automated access to the private HyNote API.

Data retention & training

Hosting summary

The security page states that HyNote is a US-based company and that all data is hosted on Google Cloud Platform. No hosting country or region is named anywhere on the site. Region-specific data residency is mentioned, but only as an option for enterprise clients and without identifying a single region. Encryption is described as AES-256 at rest and TLS in transit — the security page says TLS 1.2 or above, the homepage says TLS 1.3 — with end-to-end encryption claimed for uploaded content. Infrastructure is said to sit behind strict firewall policies, automatic updates and continuous monitoring, with penetration testing by outside firms. The homepage phrase SOC 2 Type II infrastructure describes the underlying platform rather than a certification HyNote itself holds, and no audit report is published. Payment data is stored by Apple. The terms of use are governed by US law, with disputes heard in US courts, and nothing addresses standard contractual clauses or any other international transfer mechanism.