Privacy Policy

Groundnote (ABN 34 557 691 587; "Groundnote", "we", "us", "our"), is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, how we use and store it, and the choices and rights you have.

1. Who we are

Groundnote is an Australian registered entity, ABN 34 557 691 587. For any privacy question or request, contact us at support@groundnote.com.au.

2. Information we collect

• Account information — name, work email, password (stored as a salted hash, never in plain text), and workspace/organisation details.
• Meeting content — audio recordings, transcripts, and the decisions, tasks, risks, and questions Groundnote extracts from them, for meetings you choose to capture.
• Usage data — feature usage, login activity, and diagnostic/telemetry data used to keep the product working and to improve it.
• Payment information — if you subscribe to a paid plan, billing details are collected and processed by our payment provider; we do not store full card numbers ourselves.
• Information from third-party integrations — if you connect Slack, Jira, Asana, Linear, Google/Microsoft Calendar, or similar tools, we access only what's needed to provide the connected feature, per the permissions you grant.

3. How we use your information

• To provide the core service: capturing meetings, extracting decisions/tasks/risks, and delivering them back to you and the participants you choose to share with.
• To operate the commitment-confirmation workflow — sending a task's assignee a secure link so they can accept, edit, or dispute what was detected, without needing an account.
• To bill and administer your subscription, including trial-to-paid conversion reminders and renewal notices.
• To provide customer support and respond to your requests.
• To maintain security, detect misuse, and meet our legal obligations.
• With your consent, to send product updates — you can opt out of marketing email at any time (see section 8, and our compliance with the Spam Act 2003 (Cth)).

4. AI processing of meeting content

Meeting audio and transcripts are processed by AI to generate summaries, decisions, tasks, risks, and confidence/evidence labels. Depending on your workspace's configuration, this processing may run on infrastructure we operate, or — if you've configured a "bring your own AI" provider — on infrastructure you control or a third-party AI provider you've chosen. We do not use your meeting content to train shared/foundation AI models without your explicit consent.

5. Overseas disclosure (APP 8)

Some of our infrastructure and service providers (e.g. cloud hosting, email delivery, optional third-party AI providers you configure) may store or process data outside Australia. Where this occurs, we take reasonable steps to ensure recipients handle your information consistently with the Australian Privacy Principles. Processing locations depend on the services and optional integrations your workspace uses. Contact us for current information about relevant providers and locations.

6. Data retention & deletion

You control the retention period for your workspace's meetings and telemetry via account settings. Deleted meetings are removed through an audited deletion process. You can place a legal hold on specific meetings to exempt them from routine deletion (e.g. for a live dispute), and you can request full account deletion at any time by contacting us.

7. Security

We apply industry-standard safeguards including encrypted transport (TLS), password hashing, optional multi-factor authentication, role-based access control, and an audit log of security-relevant account activity. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We have not completed an independent SOC 2, ISO 27001, or equivalent certification as of this writing — if that's a requirement for your organisation, please contact us to discuss.

8. Your rights

Under the Australian Privacy Principles, you can:

• Ask what personal information we hold about you and request a copy (APP 12).
• Ask us to correct inaccurate or out-of-date information (APP 13).
• Withdraw consent to marketing communications at any time.
• Request deletion of your account and associated data, subject to legal retention obligations.
• Lodge a complaint with us, and if unresolved, with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Cookies

Our website and app use cookies and local storage for sign-in, preferences, security, and core functionality. If you allow it in our privacy choices (“Allow all” or “Analytics only”), we also use Google Analytics to understand aggregate visits and feature engagement. Google may process device, browser, interaction, and approximate location information for this purpose.

Only if you choose “Allow all”, we also use the Meta pixel. It sets a Meta cookie and tells Meta (Facebook and Instagram) about visits to our pages and when you create an account, so we can measure and improve our ads. Without that choice, we use no advertising cookies or pixels. You can change your choice at any time with “Privacy settings” at the bottom of each page, and limit cookies through your browser settings.

Measuring our own advertising. When you arrive on our website from one of our ads, the link can carry a campaign tag and an ad click identifier set by the ad platform (for example Meta’s fbclid or Google’s gclid). We keep these in your browser tab only (no cookie) and, if you then create an account, we record the sign-up with them so we can tell which ad worked. We keep them with your workspace for up to 180 days, so that if the workspace later pays for a plan we can also tell which ad led to that payment (the amount and currency, never card details), and whether the workspace has recorded its first meeting (only that it happened, never what was said or written in it). We share the sign-up, that first meeting and any such payment, with the click identifier, with the platform that showed the ad (Meta or Google), through our campaign tool GroundReach, so the platform can count the result and improve which people see our ads. We share your email address, IP address or browser details for this only if you choose “Allow all” in our privacy choices. We don’t share your meeting content or workspace data for advertising.

10. Children's privacy

Groundnote is a business tool and is not directed at, or intended for use by, children.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the app or by email before they take effect.

12. Contact us

Questions, requests, or complaints about privacy: support@groundnote.com.au