Privacy Policy

Effective date: September 23, 2026 Version: 2026-09-23

This Privacy Policy explains what information Axevia Labs LLC, doing business as QuillAI ("QuillAI", "we", "us", or "our") collects when you use the QuillAI website, the QuillAI Desktop application, or related services (collectively, the "Service"), how we use it, with whom we share it, and the rights you have over it.

If you reside in the Russian Federation, the Russian-language Политика обработки персональных данных governs your relationship with our Russian counterparty (ИП), and this Privacy Policy does not apply to you.

A jurisdiction-specific section for residents of the European Economic Area, the United Kingdom, and Switzerland appears in Section 11. A section for residents of California (USA) appears in Section 12.

1. Categories of personal data we collect

We collect the following categories of personal data:

1.1 Account information

• email address, name, profile picture (if you sign in with Google or another OAuth provider);
• authentication identifiers (Supabase user UUID and a synthetic numeric identifier we use internally);
• your Telegram user identifier, if you use our Telegram bot or link a Telegram account;
• chosen interface language and locale.

1.2 Content you submit

• audio and video files you upload, record, or import by URL (see Section 1.6 regarding desktop-local recordings);
• transcripts, summaries, edits, notes, AI-generated outputs, and any other text or media you create or store in the Service;
• file names, descriptive metadata, tags, and timestamps;
• names of meeting participants, including names you provide so the transcription service can recognize them.

1.3 Usage data

• pages and features you interact with;
• approximate geolocation derived from IP address (country and region only, not precise location);
• IP address, HTTP request headers, cookies and similar browser identifiers, and the address of the requested page;
• device characteristics (operating system, browser, user agent, screen size);
• session identifiers;
• error and crash information (see Section 1.9);
• advertising-measurement data: which ad brought you to the site and whether you signed up or paid, including a hashed email address or user identifier sent to advertising platforms (see Section 1.10).

1.4 Payment data

• billing email and payment metadata returned by Stripe (we do not receive or store full card numbers);
• subscription state (plan, renewal date, status).

1.5 Communications

• messages you send to support, feedback you submit, and messages we send you.

1.6 Local desktop data

The QuillAI Desktop application captures audio on your device when you start a recording. For meetings, audio is stored locally on your device until you choose to upload it; you can review or delete it before upload. For Quick Dictation, audio streams to our real-time transcription provider Gladia and a local backup copy is also retained on your device for resilience. The Desktop app does not access or transmit system audio outside of a recording session you have explicitly started.

1.7 Desktop application telemetry

If you use the QuillAI Desktop application and have opted in via the "Anonymous usage statistics" toggle in the onboarding flow or in Settings → Privacy, the Desktop app collects anonymous information about how features are used: which actions you take, how long sessions last, aggregate counts, software version, operating system, and locale. This data is keyed by a per-installation identifier and forwarded to PostHog (our analytics processor, see Section 4). We never collect recording content, file names, contact names, or transcript text from your device through this channel.

If you have opted in to "Crash reports", technical data about software errors (stack trace, app version, operating system) is sent to Sentry (see Section 4) for debugging purposes.

Both toggles default to off. You can change these settings at any time in Settings → Privacy within the Desktop application. Your consent history (when each toggle was changed, from which surface, on which app version) is recorded in our database for audit purposes (data-protection law requirement).

1.8 Voice prints of speakers

To recognize the same speaker across later recordings in one workspace, the Service creates voice prints — numerical vector representations of a speaker's voice (256-dimensional embeddings). Voice prints are created for recordings processed in workspace projects: automatically for meetings recorded by the Desktop app in a project, and for other recordings when you move them into a project or start their processing. They are created for every speaker in the recording, not only for the account holder.

Voice prints are generated by our subprocessor pyannoteAI SAS (France) from audio clips of 15 to 28 seconds; the resulting vectors are stored in our Supabase database (Germany) and are used only within the workspace in which they were created. Voice prints may constitute biometric data under some laws. You are responsible for obtaining participants' consent to the creation and use of their voice prints. You can delete voice prints in the Voices section of the Service: hiding an unidentified voice deletes its voice prints, and individual voice samples can be deleted one by one. Deleting a workspace deletes its voice prints. A recording participant who is not a user may ask us to delete their voice prints by writing to legal@quillhub.ai.

1.9 Error monitoring

The server side of our web application (including edge functions) and our media-download service send Sentry (Functional Software, Inc.; servers in Germany, de.sentry.io) technical data about requests that caused an error: IP address, request headers, cookies, and the requested page address. The browser side of the Service does not send user identifiers or cookies to Sentry until you consent to cookies. We use this data to diagnose errors and keep the Service working.

1.10 Analytics and advertising measurement

For product analytics we use PostHog (US servers, us.i.posthog.com): usage events are linked to your internal user identifier and email address, and browser errors are recorded. For the AI chat, PostHog receives only technical metadata about language-model calls (model, token counts, response time, errors) — never the message text.

Our website uses Yandex Metrica (Yandex LLC, Russia), including offline-conversion uploads, and Google Tag Manager, which loads Google Analytics 4, Google Ads (Google LLC, USA), and the OpenAI Ads pixel (OpenAI, USA). For OpenAI Ads conversion measurement we also send server-side events containing a hashed email address or user identifier, IP address, and browser information (user agent). How to opt out of analytics and advertising cookies is described in the Cookie Policy.

2. How we collect it

We collect personal data:

• directly from you when you create an account, configure settings, upload or record content, contact support, or pay for a subscription;
• automatically through cookies and similar technologies (see Cookie Policy);
• from your authentication provider if you sign in with Google or another OAuth provider;
• from our payment processors (Stripe, CloudPayments), our error-tracking provider (Sentry), and our analytics and advertising-measurement providers (PostHog, Google, Yandex, OpenAI Ads), each as described in Section 4.

3. How we use personal data

We use personal data for the following purposes:

We do not train AI or machine-learning models on Your Content (audio, transcripts, or derivatives).

Some processing uses OpenAI API keys enrolled in OpenAI's data-sharing program, under which OpenAI may use the submitted data to improve its models.

4. Subprocessors and third parties with whom we share data

We share personal data with the third-party subprocessors listed at /en/legal/subprocessors. The current list includes (subject to update):

• Supabase — primary database, authentication, file storage (AWS eu-central-1, Germany).
• Wasabi — object storage for your audio and video (eu-central-1, Netherlands).
• Railway — application hosting (EU West, Netherlands); an internal business-intelligence tool (Metabase) hosted on Railway in the USA accesses transcript data for our internal analytics.
• Hetzner — hosting of our media-download service and Telegram Bot API server (Germany).
• Timeweb Cloud — reverse proxy for users in Russia; access logs are kept for 14 days (Russia).
• AssemblyAI — speech-to-text transcription; receives audio and participant names as recognition hints (USA).
• Gladia — real-time transcription (live transcription, dictation) (France).
• pyannoteAI SAS — voice-print generation (Section 1.8) (France).
• OpenAI — language-model processing of transcripts: structuring, summaries, entity extraction, AI chat (USA). Some processing uses API keys enrolled in OpenAI's data-sharing program (see Section 3).
• Anthropic — language-model processing as an alternative provider: entity extraction, media-download service (USA).
• Google LLC — Google sign-in (OAuth); Google Docs/Drive documents with transcription results for our Telegram bot; Google Tag Manager, Google Analytics 4, Google Ads (USA).
• Yandex LLC — Yandex Metrica web analytics and offline-conversion uploads (Russia).
• OpenAI Ads (OpenAI) — ad-conversion measurement: pixel and server-side events with a hashed email address or user identifier, IP address and browser information (USA).
• PostHog — product analytics (Section 1.10) and Desktop telemetry (Section 1.7) (USA).
• Sentry (Functional Software, Inc.) — error monitoring (Section 1.9) (servers in Germany).
• Resend — transactional and informational email delivery (USA).
• Telegram FZ-LLC — Telegram bot, support-request forwarding, service notifications (UAE).
• CloudPayments — RUB payment processing, including recurring subscription charges (Russia).
• Stripe — USD payment processing (USA/Ireland).
• Apify — downloading public Instagram media by link (USA).
• Webshare — proxy network for the Service's outbound requests to external APIs (country depends on the proxy node).

We share personal data only to the extent necessary for each subprocessor to perform its function, and each is bound by a written data-processing agreement (Article 28 GDPR equivalent) requiring confidentiality, security, and limited use of personal data.

We may also disclose personal data:

• to comply with valid legal process (subpoena, court order, regulatory request);
• to enforce our Terms of Service;
• to investigate and prevent fraud, abuse, or security incidents;
• in connection with a merger, acquisition, or sale of assets, in which case continued protection of your data will be a condition;
• with your consent.

We do not sell personal data for money. We use advertising-measurement tools (Google Ads, Yandex Metrica, OpenAI Ads) as described in Section 1.10; to the extent this is treated as "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA/CPRA), you can opt out as described in the Cookie Policy or by contacting legal@quillhub.ai.

5. International data transfers

Some of our subprocessors are located outside the European Economic Area and the United Kingdom — in the United States, the United Arab Emirates (Telegram), and Russia (Timeweb Cloud, Yandex, CloudPayments); Webshare's location depends on the proxy node used. Where such transfers occur, we rely on (a) Standard Contractual Clauses approved by the European Commission, (b) the EU-US Data Privacy Framework where the recipient is certified, and (c) supplementary measures including encryption in transit, encryption at rest, and contractual confidentiality obligations.

The current list of subprocessors and their regions is available at /en/legal/subprocessors.

6. Retention

We retain personal data for as long as needed for the purposes described in Section 3 and, where you have an account, for as long as your account is active. Specific retention rules:

When you delete your account through Settings → Privacy → Delete Account or by contacting legal@quillhub.ai, your account and Your Content — recordings, transcripts, derived content and the related files in our Wasabi object storage — are deleted immediately and permanently; there is no waiting period and deleted data cannot be restored. Any active subscription is cancelled as part of the deletion. Backups containing your data are purged within thirty (30) days. Records we are required to retain by law (notably payment records) are kept in anonymised form, only for the legally required period and only for that purpose.

7. Security

We implement reasonable and appropriate technical and organizational measures to protect personal data, including:

• TLS 1.2+ encryption in transit;
• AES-256 encryption at rest for stored audio, video, and database records;
• access controls and least-privilege principles for engineering access;
• audit logs of administrative actions;
• contractual obligations on subprocessors;
• regular review of security practices.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, but we will notify you of a personal-data breach involving your data without undue delay and within applicable legal deadlines (notably 72 hours for GDPR-applicable breaches).

8. Cookies

We use cookies and similar technologies to operate the Service, remember your preferences, measure usage, and measure the effectiveness of our advertising. See the Cookie Policy for details and to manage your preferences.

9. Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from children under 18. If we learn that we have collected such data, we will delete it promptly. If you believe a child has used the Service, contact legal@quillhub.ai.

10. Recording-Consent Notice (third-party participants)

When you use the Service to record meetings or conversations involving third parties, those third parties' personal data (including their voices, statements, and any personal information they share) is captured and processed by us as a processor on your behalf. You are the controller for those third parties' personal data and are responsible for obtaining their consent before recording, as required by Section 5 of the Terms of Service and by applicable wiretapping and privacy laws.

If you receive a request from a third party (a meeting participant) to access, correct, or delete their personal data captured in your recordings, you are responsible for handling that request. We will assist on commercially reasonable terms.

11. Information for residents of the European Economic Area, the United Kingdom, and Switzerland

This Section 11 applies if you are a resident of an EEA member state, the United Kingdom, or Switzerland.

11.1 Controller and representative

Axevia Labs LLC (d/b/a QuillAI), organized in Wyoming, USA, is the controller for personal data processed under this Privacy Policy.

Our representative in the European Union, designated under Article 27 of the GDPR, is [to be filled — VeraSafe / Prighter / equivalent service]. You may contact our EU representative at the address published on our subprocessors page once designated. In the interim, please contact legal@quillhub.ai.

For residents of the United Kingdom, our UK GDPR representative is the same entity unless otherwise specified.

11.2 Lawful bases

We process personal data under the lawful bases identified in the table in Section 3. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.

11.3 Your rights under the GDPR / UK GDPR / Swiss FADP

You have the rights to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete personal data;
• erase ("right to be forgotten") your personal data, subject to lawful retention requirements;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests, including direct marketing;
• data portability — receive your personal data in a structured, machine-readable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the supervisory authority in your country of residence, place of work, or place of the alleged infringement.

To exercise any of these rights, contact legal@quillhub.ai or use the in-app controls at Settings → Privacy. We will respond within thirty (30) days; complex requests may take up to ninety (90) days, in which case we will inform you of the extension.

11.4 Automated decision-making

We do not engage in solely automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 GDPR.

11.5 Special-category data

Audio recordings can incidentally contain special-category personal data (Article 9 GDPR), such as health information, political opinions, or biometric characteristics, depending on what is said. We do not deliberately solicit such data. Voice prints (Section 1.8) may constitute biometric data under Article 9 GDPR. If you upload or record content containing special-category data of any person, you confirm that you have a lawful basis under Article 9 GDPR (typically explicit consent of the data subject under Article 9(2)(a)) for both the controller (you) and any processor (us).

12. Information for residents of California (USA)

This Section 12 applies if you are a California resident under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA/CPRA").

12.1 Categories collected and disclosed

In the past 12 months, we have collected the categories of personal information described in Section 1 of this Privacy Policy and disclosed them to the categories of subprocessors described in Section 4.

We do not "sell" personal information for money. Our use of advertising-measurement tools (Section 1.10) may be treated as "sharing" for cross-context behavioral advertising; you can opt out as described in Section 4.

12.2 Your rights under the CCPA/CPRA

You have the rights to:

• know the categories of personal information we collect and the purposes for which we use it;
• access specific pieces of personal information;
• delete personal information, subject to lawful retention exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information;
• limit the use of sensitive personal information.

You may exercise these rights by contacting legal@quillhub.ai or through Settings → Privacy. You will not be discriminated against for exercising your rights.

You may designate an authorized agent to make a request on your behalf, subject to verification of the agent's authority.

12.3 Notice at collection

The categories collected, the purposes of collection, and the retention periods are described in Sections 1, 3, and 6 respectively.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If a change is material, we will provide reasonable advance notice through in-product messaging or email. The current version is shown at the top of this page; previous versions can be requested by emailing legal@quillhub.ai.

14. Contact

For privacy questions, requests, or complaints:

• legal@quillhub.ai
• Axevia Labs LLC (d/b/a QuillAI), 30 N. Gould St Ste R, Sheridan, WY 82801, USA
• EU/UK representative under GDPR Article 27: [to be filled before publish]