Privacy Policy — Biu Note
Last updated: June 8, 2026
Who we are
Biu Note is operated by IAGO BELO DE OLIVEIRA VIEIRA DESENVOLVIMENTO DE SOFTWARE, CNPJ 38.009.261/0001-45 ("we"), data controller in accordance with Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018).
What data we collect
Identity
- Email address (via Clerk for authentication)
- Internal user identifier (Clerk + Convex)
Note content
- Text you type or share with the app
- Images you capture, attach, or share
- Links (URLs) added to notes
- Tags assigned (manually or by AI)
Usage and metadata
- Date and time of each capture
- Synchronization and processing status
- Occasional error messages (for diagnostics)
Where we store your data
- Convex (backend) — primary database, servers in the US
- iOS Keychain via
expo-secure-store— authentication session, on-device only - Local SQLite — local copy of your notes, on-device only
Who else processes your data
| Partner | Purpose | Location | More info |
|---|---|---|---|
| Clerk | Authentication | US | clerk.com/privacy |
| Convex | Database | US | convex.dev/privacy |
| Anthropic | Automatic note classification (tags, descriptions, OCR) | US | anthropic.com/legal/privacy. Zero retention by default since 2024 — prompts are not stored. |
| OpenAI | Embeddings for semantic search | US | openai.com/policies/privacy-policy. On the tier we use, prompts may be retained for up to 30 days for abuse monitoring. |
| RevenueCat | Subscription management (Pro) | US | revenuecat.com/privacy |
You can disable all AI processing under Settings → Privacy → Process notes with AI. Disabling only affects notes created from that point forward; previously processed notes remain in the database.
Legal basis (LGPD Art. 7)
- Contract performance — storing and syncing your notes.
- Consent — AI processing. Revocable at any time via Settings.
- Legitimate interest — error diagnostics and abuse prevention.
Your rights (LGPD Art. 18)
- Access — your notes are always available in the app.
- Rectification — edit or delete any note at any time.
- Erasure — "Delete account" in Settings (24-hour grace period, then cascading removal of all your data).
- Objection — disable AI processing in Settings.
- Portability — request your data in JSON format via the email address below.
Retention
Your data is retained while your account is active. After "Delete account", all records are removed from Convex within 24 hours (a grace period during which deletion can be cancelled). Media files may persist for up to 30 days in storage backups before automatic purging.
International transfers
As described above, data is transferred to US-based servers of the listed partners. All of them have contractual data protection clauses and comply with GDPR/CCPA — frameworks stricter than LGPD.
Cookies and tracking
We do not use tracking cookies. We do not build cross-app profiles. The app's Apple Privacy Manifest declares NSPrivacyTracking: false.
Children
The service is not directed at children under 13. If we identify use by a minor, we will remove the account.
Changes to this policy
Material changes will be communicated via email and in-app with at least 30 days' notice.
Contact
IAGO BELO DE OLIVEIRA VIEIRA DESENVOLVIMENTO DE SOFTWARE — CNPJ 38.009.261/0001-45 Email: contato@biunote.com
To exercise your rights, write with the subject line: "LGPD — Biu Note".