Privacy policy
About us
doteo.ai is operated by PSAI Technologies FZC, a company incorporated in the Sharjah Research Technology and Innovation Park, Sharjah, United Arab Emirates ("we," "us," "our," or "PSAI Technologies").
Contact for Privacy Matters:
- Email: privacy@doteo.ai
- General Support: support@doteo.ai
- Website: www.doteo.ai
Overview
doteo.ai is a voice-powered productivity app that helps you record and organise your thoughts using artificial intelligence. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have.
Key points:
- Voice recordings are stored on your device. Each recording is also uploaded to our private storage, and our servers send it to a speech-to-text provider (Soniox, with Deepgram as a fallback) to be transcribed. We delete the uploaded audio as soon as it is transcribed, and in any case within 24 hours. Only once your monthly server transcription allowance is used up is a recording transcribed by your phone's built-in speech recognition instead
- Text transcripts are synced to the cloud for AI processing and cross-device access
- We use AI to structure, analyse, and generate insights from your transcripts
- We collect approximate location (your city, country and country code) from your IP address during registration, through our IP geolocation provider, ipapi.co
- We do not sell your personal data to third parties
- We do not use your identifiable data to train AI models
- You can export or delete your data at any time
1. What we collect
1.1 Information you provide directly
- Account information: First name (optional), email address, and password
- Voice recordings: Audio recorded through the app or your Apple Watch. Stored on your device. Every recording is also uploaded to our private storage and sent to a speech-to-text provider (Soniox, with Deepgram as a fallback) for transcription. We delete the uploaded audio once it is transcribed, and within 24 hours at the latest. We use it only to make your note: no training, no sharing, no tracking. Only once your monthly server transcription allowance is used up is a recording transcribed by your phone's built-in speech recognition instead
- Spoken questions: When you ask doteo.ai a question by voice, your phone's built-in speech recognition turns it into text. If your phone cannot do this on the device, Apple (on iPhone) or Google (on Android) may process the audio of the question on their servers. We do not keep the audio of your questions
- Transcripts: Text versions of your voice recordings, synced to our cloud servers
- Edited content: Any changes you make to transcripts or AI-structured content
- Support communications: Feedback forms and support tickets (including subject, message content, and category)
- Reminder content: Spoken reminders from which we extract reminder text, dates, and times
1.2 Information generated by AI processing
- Structured content: Titles, summaries, key points, action items, decisions, and other structured data generated by AI from your transcripts
- Context classification: Automatic detection of whether content relates to Work, Personal, or Family contexts
- Transcript corrections: AI-corrected versions of your transcripts (e.g., fixing phonetic errors from speech-to-text)
- Weekly insights: AI-generated analysis of patterns, themes, and observations from your notes
1.3 Information collected automatically
- Device information: Device type, operating system version, app version
- Usage data: Feature interactions, session duration, and usage patterns, collected through Google Firebase Analytics (see Section 4). You can turn usage analytics off with "Share usage analytics" in Settings; crash reports are still collected
- Performance data: Error logs, crash reports collected through Google Firebase Crashlytics (see Section 4), and processing metrics
- Search queries: Anonymised search terms used within the app
- Approximate location: The city, country and country code your IP address points to at registration. We send that IP address to our IP geolocation provider, ipapi.co, and store the city, country and country code on your profile for as long as your account exists; they are deleted when you delete your account. The IP address itself is kept for 7 days in a log we use to stay within the provider's request limits, then deleted (we do not use GPS or request device location permissions)
- Login attempt records: Timestamps and success/failure of login attempts for security monitoring, and the IP address of each password sign-in (kept 90 days in our security logs, see Section 6)
- Engagement metrics: Note counts, intent type distribution, and feature usage frequency
- Email interaction data: If you have opted in to receive educational emails, we collect whether you opened an email (detected via a tracking pixel — a small invisible image embedded in the email) and whether you clicked any links. This data is collected by our email delivery provider and shared with us to improve relevance and frequency. You can stop this collection at any time by unsubscribing
1.4 Biometric data
If you choose to enable biometric authentication (Face ID, Touch ID, or Fingerprint), the biometric verification is handled entirely by your device's operating system. We do not collect, store, or transmit your biometric data. Your biometric templates remain securely on your device and never leave it. We only receive a confirmation of successful or failed authentication from the device.
1.5 What we do not collect
- Precise GPS or device location data
- Contacts or address book information
- Photos, camera access, or media files (other than voice recordings)
- Cross-app tracking data
- Browsing history
- Your actual biometric templates or fingerprint data
2. How we use your data
2.1 To provide and operate the service (legal basis: contract performance)
- Convert your voice recordings to text using speech-to-text processing
- Structure and organise your content using AI processing
- Correct transcription errors through AI-powered transcript correction
- Automatically detect content context (Work/Personal)
- Analyse your transcripts to identify and provide related notes across your library
- Sync your transcripts and structured content across your devices
- Process reminder intents and schedule local notifications on your device
- Authenticate your account and maintain session security
- Process subscription purchases and manage trial periods
2.2 To generate insights and analytics for you (legal basis: contract performance)
- Count your notes and the days you recorded on, for the daily digest and the weekly summary
- Generate daily and weekly AI-powered insights analysing themes, action items, and patterns
- Discover related notes across your library
2.3 To improve and maintain the service (legal basis: legitimate interest)
- Fix bugs, improve performance, and troubleshoot issues
- Analyse aggregated and anonymised usage patterns to develop new features
- Monitor system health, error rates, and processing performance
- Monitor processing costs and resource usage
- Conduct security audits and fraud prevention
2.4 To communicate with you (legal basis: contract performance / legitimate interest)
- Send email verification codes (OTP) during registration and email changes
- Send password reset communications
- Notify you of material changes to these terms or our service
- Respond to support requests and feedback submissions
- Deliver AI powered insights on using the app more effectively
- Send educational emails about getting more from doteo.ai, if you opt in (see Section 2.5)
2.5 Educational and product communications (legal basis: consent)
If you opt in, we send you educational emails with tips, feature highlights, and links to video tutorials to help you get more from doteo.ai. These communications are:
- Opt-in only: During signup, you can choose to receive these emails via an unchecked checkbox. You are never automatically enrolled.
- Limited frequency: You will receive no more than one educational email per week.
- Easy to manage: You can update your preferences at any time in Settings > Email Preferences, or unsubscribe instantly via the one-click unsubscribe link included in every email.
- Permanent unsubscribe: If you unsubscribe, we add you to a permanent suppression list. You will not receive further emails unless you explicitly re-enable them in Settings.
- Content types: Tips and best practices, feature highlights, video tutorials (hosted on third-party platforms such as YouTube), and product updates.
We track email opens and link clicks to measure the effectiveness of these communications and improve their relevance. We do not share this data with third parties for their own purposes.
Engagement-based personalisation: We classify user engagement levels (such as new user, active, or inactive) to determine which educational content is most relevant to you and when to send it. This classification is based solely on your in-app activity and does not involve external data sources. You are not subject to any automated decision that produces legal effects or similarly significant effects based on this classification. If you do not engage with our emails, we stop sending them automatically.
Third-party content: Some emails may contain links to third-party platforms (such as YouTube for video tutorials). When you click these links, you leave our service and are subject to the third party's own terms and privacy policy.
Your consent is recorded in an append-only audit log that captures the date, source (signup or settings), and version of the consent text you agreed to, as required by applicable privacy regulations. Changes to your preferences take effect within 24 hours.
2.6 To ensure security (legal basis: legitimate interest)
- Track login attempts to detect and prevent unauthorised access
- Enforce account lockout after repeated failed login attempts
- Check device integrity, and warn you if your device appears to be rooted or jailbroken
- Validate secure communications through certificate verification
3. Automated decision-making
doteo.ai uses automated processing to deliver its core functionality. This includes:
- AI content structuring: Your transcripts are automatically processed by AI to generate titles, summaries, key points, action items, and other structured content. You can review, edit, or reprocess all AI-generated content.
- Context auto-detection: AI automatically classifies your notes as Work, Personal, or Family context based on content analysis. This classification is used for organisation only and does not affect service access or pricing.
- Transcript correction: AI automatically corrects phonetic errors in speech-to-text output. The original transcript is preserved and editable.
4. Third-party service providers
We use trusted third-party service providers to deliver specific functions of the app. All providers operate under data processing agreements and are contractually bound to process your data only for the purposes we specify.
| Service Category | Purpose | Data Shared | Data Retention by Provider |
|---|---|---|---|
| AI Processing (DeepSeek, China) | Structure transcripts, generate insights, correct transcription errors, answer the questions you put to your notes in Ask, and identify related notes | Text transcripts and your Ask questions (no audio) | Not retained after processing. Transfers safeguarded per Section 8 |
| Speech-to-Text (Soniox, US; Deepgram, US as fallback) | Transcribe every recording, including those made on Apple Watch. Your phone's built-in speech recognition is used instead only once your monthly server transcription allowance is used up | Audio data | The provider does not retain it after transcription. Our uploaded copy is deleted once transcribed, and within 24 hours at the latest. Transfers safeguarded per Section 8 |
| Speech recognition for spoken questions (Apple on iPhone; Google on Android, US) | Turn a question you speak to Ask doteo.ai into text when your phone cannot do it on the device | Audio of the spoken question | Handled under Apple's or Google's own privacy policy; we do not receive or keep the audio |
| Embeddings (Voyage AI, US) | Turn your notes into numeric representations so search and related-note suggestions work | Note text | Not retained after processing |
| Cloud Infrastructure (Supabase, US) | Store and sync your account data, transcripts, and structured content; manage authentication | Account information, transcripts, structured content, metadata, and each recording until it is transcribed | Retained until account deletion; recordings until transcribed, 24 hours at most |
| Push Notifications (Google Firebase, US) | Deliver reminders, digests and nudges to your device | A device identifier and the notification text, which may be derived from your notes | Transient |
| Analytics and Crash Reporting (Google Firebase Analytics and Crashlytics, US) | Measure which features are used and collect crash reports so we can find and fix faults | A hashed account identifier (never your name or email), device type and operating system version, app version, the screens and features used, and crash reports with the technical state of the app at the time. No note content, transcripts or audio | Crash reports 90 days; analytics events for the retention period set on our Firebase project (at most 14 months) |
| In-App Payments | Process subscription purchases | Handled entirely by Apple (App Store) or Google (Play Store) — we do not receive or store payment card details | Per Apple/Google terms |
| Email Delivery (Resend, US) | Send verification codes, password resets, support notifications, and educational emails (if opted in) | Email address, message content, and open/click data for educational emails | Transient; open/click data retained up to 2 years. Data Processing Agreement in place; transfers safeguarded per Section 8 |
| IP Geolocation (ipapi.co) | Look up the approximate location of the IP address you sign up from | Your IP address at signup | Per the provider's terms. We keep the city, country and country code, on your profile, until account deletion, and the IP address for 7 days |
We do not share your data for advertising, marketing by third parties, or data brokerage.
5. Data storage and security
5.1 Where your data is stored
| Data Type | Storage Location |
|---|---|
| Voice recordings | On your device. Every recording is also uploaded to our private storage and sent to a speech-to-text provider for transcription. Our copy is deleted once transcribed, and within 24 hours at the latest. The provider does not retain it. Only once your monthly server transcription allowance is used up is a recording transcribed on your phone instead |
| Spoken questions in Ask doteo.ai | Not kept. Turned into text on your device, or by Apple or Google when your phone cannot do it on the device |
| Transcripts and structured content | Secure cloud servers |
| Account and profile data | Secure cloud servers |
| Biometric authentication data | Your device's secure enclave (never leaves your device) |
| Reminder schedules | Locally on your device |
5.2 Security measures
- Encryption in transit: All data transmitted between the app and our servers is encrypted using industry-standard protocols
- Encryption at rest: All cloud-stored data is encrypted at rest using industry-standard encryption
- Access control: Security policies ensure that only you can access your own data
- Password security: Passwords are securely hashed using industry-standard algorithms and are never stored in plain text
- Session security: Your sign-in session is held in device memory. Only the token that keeps you signed in is saved, encrypted, in your device's secure storage (the iOS Keychain or the Android Keystore)
- OTP security: Verification codes are securely hashed before storage and expire after 10 minutes
- Secure communications: All communications between the app and our servers are verified to prevent interception
- Device integrity: The app warns you if your device appears to be rooted or jailbroken, because such devices weaken the protections described here
- Account lockout: Accounts are temporarily locked after 5 failed login attempts within 15 minutes
- Regular security audits: We conduct periodic reviews of our security practices
5.3 Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and in accordance with applicable law (including within 72 hours where required by GDPR, and as required by UAE PDPL and other applicable regulations). We will also notify the relevant supervisory authorities as required.
6. Data retention
| Data Type | Retention Period | Notes |
|---|---|---|
| Voice recordings | 90 days on your device | Automatically deleted after 90 days; you can delete sooner. A copy of an Apple Watch recording is kept on your phone for at most 7 days. |
| Recordings uploaded for transcription | Until transcribed, 24 hours at most | Each recording is uploaded to our private storage so our servers can transcribe it. The uploaded audio is deleted as soon as it is transcribed, and in any case within 24 hours. It is deleted straight away with your account |
| Transcripts and structured content | Until you delete them or your account | You can delete individual notes or all data |
| Server transcription results | 24 hours | A copy of each server transcription is kept for 24 hours, so that a retry of the same recording is not transcribed and counted twice. It is deleted within the following hour, even if you delete the note sooner, and straight away with your account |
| Data export files | Up to 48 hours | The file behind the download link we email you when you export your data. The link works for 24 hours; the file is deleted from our servers at the daily clean-up after the link expires, so within 48 hours of the export. Deleted sooner if you export again or delete your account |
| Account and profile data | Until account deletion | Includes name, email, preferences |
| AI-generated insights | Until account deletion | Weekly insights accumulate over time |
| Support tickets | 2 years after resolution, then deleted | Retained for service improvement and audit purposes |
| Ask conversations | Stored on your device only | Your last 50 Ask messages are kept in encrypted storage on your device so the thread survives closing the app. They are not stored on our servers. Removed when you delete your account or the app. |
| Login attempt records | 24 hours | Used for the account lockout check; entries older than 24 hours are removed each time a new attempt is recorded |
| Sign-up location lookup log | 7 days | The IP address each sign-up was looked up from, kept to stay within our IP geolocation provider's request limits. Deleted after 7 days. The city, country and country code on your profile are kept until you delete your account |
| Security logs | 90 days | A record of each password sign-in to your account, with the IP address it came from, and of other security events on your account. We keep it for our legitimate interest in account security and abuse prevention. Deleted after 90 days, and straight away with your account |
| Email verification codes (OTP) | Deleted after expiry | Active codes expire after 10 minutes |
| Unverified accounts | Deleted periodically | Accounts that never complete email verification |
| Email consent audit log | Until account deletion | Records the date, source and consent-text version each time you opt in or out; deleted with your account. If you unsubscribed, your email address stays on the suppression list (below) |
| Email engagement logs | Until account deletion | Send, open and click records for educational and digest emails; deleted with your account and not purged earlier. Our email delivery provider's own copy is covered in Section 4 |
| Email suppression list | Indefinitely | Ensures unsubscribed users are never re-contacted |
| Aggregated analytics | Indefinitely | Fully anonymised and non-identifiable |
After account deletion: All cloud-stored data associated with your account, including any recording not yet transcribed, is permanently and irreversibly deleted. Your email address remains on the suppression list to prevent future marketing emails. On the device you delete your account from, the app also deletes your voice recordings, unfinished recordings, Ask conversation, cached notes and scheduled reminders straight away. Any other device where you used doteo.ai keeps its local copies until you delete the app there, and so does a recording from your Apple Watch that had not yet reached the app.
7. Your rights
7.1 Rights available to all users
Regardless of your location, you can:
- Access your data: View all your notes, transcripts, insights, and structured content within the app
- Export your data: Download a complete export from Settings > Data & privacy > Export my data (we also email you a download link), or request one by emailing privacy@doteo.ai
- Delete individual notes: Remove specific notes from your library at any time
- Delete your account: Permanently delete your account and all associated cloud data from Settings > Data & privacy > Delete account
- Correct your data: Edit your transcripts, structured content, profile name, and email address
- Manage email preferences: Control which educational emails you receive through Settings > Email Preferences, or unsubscribe via the link in any email. Unsubscribing does not affect transactional emails (password resets, account notifications)
- Withdraw consent: Disable optional features (biometric login, notifications, educational emails, usage analytics) at any time through Settings
7.2 Additional rights for California residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, disclose, and sell (we do not sell personal information)
- Delete your personal information, subject to certain exceptions
- Correct inaccurate personal information
- Opt-out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising
- Non-discrimination — we will not discriminate against you for exercising your rights
Categories of personal information collected (per CCPA): Identifiers (name, email, IP address of sign-ins), internet or electronic network activity (usage data, search queries), geolocation data (approximate, from IP address), audio/electronic information (voice recordings stored on your device and, until transcribed, on our servers; transcripts), inferences drawn from the above (AI-generated content, context classification, well-being indicators).
To exercise your rights, email privacy@doteo.ai or use the in-app data controls in Settings. We will respond within one month of receiving your request, and may extend that by up to two further months for complex requests — we will tell you within the first month if we need to. California residents: we will respond within 45 days as CCPA/CPRA provides.
7.3 Rights for UAE residents (UAE Personal Data Protection Law)
If you are located in the United Arab Emirates, you have the right to:
- Access your personal data and obtain a copy
- Request correction of inaccurate or incomplete data
- Request deletion or destruction of data that is no longer necessary
- Restrict or object to the processing of your data in certain circumstances
- Request data portability in a common electronic format
- Withdraw consent at any time for processing based on consent
We process sensitive personal data (including AI-inferred well-being indicators) only with your consent, which you provide by using the Insights features. You can disable Insights processing by contacting privacy@doteo.ai.
Supervisory Authority: The UAE Data Office is the competent authority for data protection matters in the UAE.
We will respond to all privacy rights requests within the time set out in section 7.2: one month, extendable by up to two further months for complex requests, or sooner where applicable law requires.
8. International data transfers
Your data may be processed and stored outside your country of residence. The providers listed in Section 4 are located in the United States, with one exception: our AI processing provider, DeepSeek, is located in China. That means the text of your transcripts and the questions you put to Ask is sent to China for processing. Audio is never sent there — it goes only to the speech-to-text providers listed in Section 4, both of which are in the United States.
When we transfer personal data internationally, we implement appropriate safeguards:
- EU/EEA and UK transfers: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organisational measures where necessary. China has not received an adequacy decision from the European Commission, so the transfer to our AI processing provider relies on SCCs together with the supplementary measures described above
- UAE transfers: We comply with the cross-border data transfer requirements under the UAE PDPL, including ensuring that the receiving jurisdiction provides adequate data protection or implementing appropriate contractual safeguards
- Other jurisdictions: We ensure that all international transfers comply with applicable local data protection laws
9. Children's privacy
doteo.ai is designed for individuals aged 16 and older. We do not knowingly collect personal data from anyone under the age of 16. If you believe that a person under 16 has provided us with personal data, please contact us at privacy@doteo.ai, and we will take steps to delete that data promptly.
In jurisdictions where the age of digital consent is lower than 16 (such as 13 in the United States under COPPA), we apply the higher threshold of 16 to maintain a consistent global standard.
10. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify you via email or in-app notification at least 14 days before the changes take effect
- Where required by law, obtain your consent before applying changes that affect how your data is processed
Your continued use of doteo.ai after the effective date of changes constitutes acceptance of the updated policy. If you do not agree with the changes, you should stop using the app and delete your account.
11. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:
- Privacy inquiries: privacy@doteo.ai
- General support: support@doteo.ai
- Website: www.doteo.ai
PSAI Technologies FZC
Sharjah Research Technology and Innovation Park (SRTIP) Block B, Office B54-156
Sharjah, United Arab Emirates
We respond to privacy requests within one month, extendable by up to two further months for complex requests (see section 7.2), or sooner where applicable law requires.
By using doteo.ai, you acknowledge that you have read and understood this Privacy Policy.