Privacy Policy

Handling of Personal Information

Effective date: October 1, 2016 Last revised: July 23, 2026

Widsley Inc. (hereinafter "we" or "our company") operates a system development business. Regarding the protection of personal information we handle, we fully recognize our social responsibility, protect the rights and interests of the individuals concerned, and comply with laws, regulations, and other rules on personal information. To realize the policy set out below, we have established a personal information protection management system, and we declare here that the entire company will work on its continuous improvement, always staying aware of the latest IT technology trends, changes in social demands, and shifts in the business environment.

1. Regarding personal information handled in our business and in the employment and HR management of our employees, we will appropriately acquire, use, and provide personal information only within the scope of the purposes specified in advance. We will not handle personal information beyond the scope necessary to achieve the stated purposes (use outside the purpose), and we will implement appropriate measures to that end.
2. We comply with laws and ordinances, national guidelines, and other norms relating to the handling of personal information.
3. Against risks such as unauthorized access to personal information or leakage, loss, or damage of personal information, we will take reasonable safety measures, invest management resources aligned with the realities of our business, and continuously improve the security posture for personal information. We will also establish internal rules that correct inappropriate matters and protect personal information in the best possible condition.
4. We will establish internal rules for responding to complaints and consultations regarding the handling of personal information, and we will respond to such complaints and consultations promptly and sincerely.
5. Given changes in the environment surrounding our company, we will review the personal information protection management system in a timely and appropriate manner and continuously promote its improvement. This Policy will be distributed to all officers and employees to ensure full awareness, and we will take measures to make it available to anyone at any time.

This Policy will be distributed to all officers and employees to ensure full awareness, and we will take measures to make it available to anyone at any time.

Widsley Inc., Representative Director, Hirotaka Takahashi

Widsley Inc., Personal Information Inquiry Desk Email: support@uninote.ai

In order to better protect our customers' personal information and to comply with changes in laws and regulations, we may revise the "Privacy Policy" and "Handling of Personal Information."

Handling of Personal Information

1. Name of the operator

2. Name or title, department, and contact of the personal information protection manager (or their representative)

3. Purposes of use of personal information handled by us

4. Safety management for personal information protection

5. Complaints and consultations

6. Procedures for responding to disclosure requests, etc.

7. Inquiries, complaints, and consultations regarding the handling of personal information

8. Authorized personal information protection organization

---

Personal Data Handling for Uninote AI (Zoom / Google Integration)

Effective Date: June 2, 2026 — Version: 3.0

This section sets out how we collect, use, store, and protect personal information when you use Uninote AI's Zoom and Google integration services. It supplements the personal information protection policy above, and prevails with respect to the use of the Zoom and Google integration services.

A. Google User Data Policy

Google User Data

Uninote's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data We Access from Google

When you sign in with Google and grant the requested permissions, Uninote accesses the following data via Google APIs.

Basic profile information (openid, userinfo.profile)
Your Google account ID, display name, profile picture URL, and locale. This information is used solely to create and identify your Uninote account.

Email address (userinfo.email)
Your primary Google email address. This is used as your unique account identifier and to send service-related notifications (e.g., recording-ready emails).

Google Calendar events (calendar.events.readonly)
Event titles, start and end times, organizer and attendee email addresses, conferencing links (Google Meet URLs), and event descriptions for calendars you choose to connect.

We do not access Gmail, Google Drive, Contacts, Photos, or any other Google services.

How We Use Google User Data

Account creation and authentication
Profile and email data are used to create your Uninote account, authenticate you on subsequent sign-ins, and personalize the application interface.

Meeting discovery and recording dispatch
Calendar event data is used to display your upcoming meetings inside Uninote and to automatically dispatch a recording bot to scheduled Google Meet meetings you have opted to record.

Service notifications
Your email address is used to send essential system-related and transactional communications necessary for operating the service such as.

• Storage usage alerts
• Meeting access permission updates
• Billing and subscription notifications

We do not use Google user data for.

• Advertising or marketing purposes
• Training, evaluating, or improving generalized or non-personalized AI or machine learning models
• Selling to or sharing with data brokers
• Determining creditworthiness or lending purposes

How We Share Google User Data

Uninote shares Google user data only with the following categories of service providers, and only to the minimum extent necessary to operate the service.

• Cloud infrastructure – Amazon Web Services (AWS) for storage, compute, and database hosting in Tokyo (ap-northeast-1).
• Transcription provider – Audio captured from meetings you record is sent to our transcription provider to generate transcripts. Calendar metadata is not shared with this provider.
• Large language model (LLM) provider – Generated transcripts are sent to our LLM provider to produce summaries and AI insights at your request. Calendar metadata is not shared with this provider.
• Email delivery provider – Transactional emails are sent via a third-party email delivery service.

We do not sell Google user data and do not share it with advertisers or data brokers.

How We Store and Protect Google User Data

• All Google user data is encrypted at rest using AWS-managed encryption keys (AES-256 via AWS KMS).
• All data in transit is encrypted using TLS 1.2 or higher.
• Access to production systems is restricted to authorized Uninote personnel using multi-factor authentication and is audited.
• OAuth refresh tokens are stored in encrypted form and are never exposed to the client.
• Uninote applies the principle of least privilege across application, database, and infrastructure layers.

Data Retention and Deletion

Profile and email data
Are retained for the lifetime of your Uninote account.

Calendar event data
Is cached only as long as necessary to display upcoming meetings and dispatch recording bots, and is periodically refreshed from Google APIs.

Account deletion
You may delete your Uninote account at any time from the in-app account settings page. Upon account deletion, all Google user data associated with your account, including OAuth tokens, cached calendar data, and profile data, will be permanently deleted from our production systems within 30 days. Backups are purged according to the standard backup rotation schedule (within 90 days).

Revoking access
You may revoke Uninote's access to your Google account at any time through Google Account Permissions. Revocation immediately stops any further access to your Google data.

Data deletion requests
To request deletion of your data outside of the in-app flow, contact us at support@uninote.ai. We respond to verified requests within 30 days.

Contact

Questions about how Uninote handles Google user data may be sent to: support@uninote.ai

---

B. Uninote AI Zoom Integration Privacy Policy

Effective Date: June 2, 2026 — Version: 3.0 — Company: Widsley Inc.

1. Introduction

Widsley Inc. ("we", "our", "us") operates Uninote AI, a meeting recording and transcription platform. This Privacy Policy describes how we collect, use, store, and protect your information when you use our Zoom integration through Zoom Marketplace.

We are committed to protecting your privacy and handling your data in accordance with applicable data protection laws including Japan's Act on the Protection of Personal Information (APPI) and GDPR where applicable.

2. Information We Collect

2.1 Zoom Account Information

When you authorize the Uninote AI Zoom integration, we receive.

• Zoom User Profile — Name, email address, Zoom user ID.
• OAuth Tokens — Access and refresh tokens for API authentication (stored securely, never shared).

2.2 Meeting Data

When the Uninote AI bot joins your Zoom meetings, we collect.

• Audio/Video Recording — The meeting's audio and video content recorded by our bot participant.
• Meeting Metadata — Meeting ID, date, time, duration, and meeting title.
• Participant Information — Names and identifiers of meeting participants (as displayed in Zoom).

2.3 Processed Data

From the collected meeting data, we generate.

• Transcriptions — Text transcriptions with speaker identification and timestamps.
• AI Summaries — Automated meeting summaries, action items, and key discussion points.
• Thumbnails — Screenshot images from the meeting recording.

2.4 Account and Usage Data

• Uninote AI Account Information — Name, email, organization, subscription plan.
• Usage Data — Feature usage, meeting counts, storage usage (for billing and service improvement).

3. How We Use Your Information

We use your information solely for the following purposes.

Purpose	Data Used
Provide recording and transcription services	Audio/video, meeting metadata, participant info
Generate AI-powered meeting summaries	Transcription text
Associate your Zoom account with Uninote AI	Zoom user profile, OAuth tokens
Allow the bot to join your meetings	OAuth tokens (ZAK token generation)
Manage your subscription and billing	Account info, usage data
Provide customer support	Account info, usage data
Improve service quality and reliability	Aggregated, anonymized usage data

We do NOT.

• Sell your personal data or meeting content to third parties.
• Use your meeting content for advertising purposes.
• Share your data with third parties except as described in Section 5.
• Use your meeting recordings to train AI models without explicit consent.

4. Data Storage and Security

4.1 Storage Location

All data is stored on Amazon Web Services (AWS) infrastructure.

• Region — Asia Pacific (Tokyo) — ap-northeast-1
• Recordings — Amazon S3 with server-side encryption (AES-256)
• Database — Amazon RDS PostgreSQL with encryption at rest
• Transcriptions — Amazon DynamoDB with encryption at rest (migrated to PostgreSQL after meeting ends)
• OAuth Tokens — Amazon DynamoDB with encryption at rest

4.2 Security Measures

We implement the following security measures.

• Encryption in Transit — TLS 1.2+ for all data transmission.
• Encryption at Rest — AES-256 encryption for all stored data.
• Access Control — Role-based access control (RBAC) for all services.
• Authentication — JWT-based authentication with AWS Cognito.
• Infrastructure — Private VPC, security groups, and network ACLs.
• Monitoring — CloudWatch logging and alerting for security events.

4.3 Data Retention

Plan	Storage	Data Retention Period	Data Viewing Period
FREE	10 GB	6 months	14 days
Lite	200 GB	12 months	90 days
Team	600 GB	24 months	180 days
Business	3 TB	Unlimited	Unlimited
Pro	10 TB	Unlimited	Unlimited
Enterprise	Custom	Unlimited	Unlimited

Storage capacity, data retention, and viewing periods vary by plan. For the latest plan details, see the pricing page.

• Recordings and Transcriptions — Retained according to your plan as shown above. You may delete individual recordings at any time.
• Account Data — Retained for the duration of your account. Deleted within 30 days upon account closure.
• OAuth Tokens — Deleted when you deauthorize the Zoom integration.
• Usage Logs — Retained for up to 365 days for operational purposes.

5. Third-Party Services (Sub-processors)

Service	Purpose	Data Shared
Amazon Web Services (AWS)	Cloud infrastructure, storage, compute	All data (encrypted)
Deepgram	Speech-to-text transcription	Meeting audio (real-time streaming, not stored by Deepgram)
OpenAI	AI-powered summary generation	Transcription text (processed per OpenAI's data usage policy)
Zoom	Meeting platform integration	OAuth tokens, bot participation
Google	Google Calendar and Google Meet integration	Calendar event data (when connected)
Microsoft	Outlook and Microsoft Teams integration	Calendar event data (when connected)
Stripe	Payment processing	Billing information (not meeting content)

Each third-party service is bound by their own privacy policies and data processing agreements.

6. Data Sharing

We do NOT share your personal data or meeting content with third parties except.

• Service Providers — As listed in Section 5, solely for providing the Service.
• Legal Requirements — When required by law, court order, or governmental authority.
• Business Transfers — In the event of a merger, acquisition, or sale of assets (with prior notice).
• With Your Consent — When you explicitly authorize data sharing.

7. Your Rights and Choices

7.1 Access and Export

You may access, view, and export your meeting recordings, transcriptions, and summaries through the Uninote AI platform at any time.

7.2 Deletion

You may delete.

• Individual meeting recordings and transcriptions through the platform.
• Your entire account and all associated data by contacting support.

7.3 Deauthorization

You may revoke Uninote AI's access to your Zoom account at any time through Zoom's App Marketplace or the Uninote AI platform settings.

Upon deauthorization.

• The bot will no longer join your Zoom meetings.
• Your OAuth tokens are deleted from our systems immediately.
• Your existing meeting data remains in your Uninote AI account until you delete it.

7.4 Data Portability

You may export your data in standard formats (JSON, CSV) through the Uninote AI platform.

7.5 Rights under GDPR / APPI

You have the right to.

• Access your personal data held by us.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten").
• Restrict or object to processing of your data.
• Port your data to another service.

To exercise these rights, contact us at: support@uninote.ai with subject "Data Rights Request".

8. Zoom-Specific Data Handling

8.1 Compliance with Zoom's API Terms

We comply with Zoom's API License and Terms of Use, including.

• Only accessing Zoom data necessary for providing the Service.
• Not storing Zoom data beyond what is necessary.
• Properly handling deauthorization events (app_deauthorized webhook).

8.2 Deauthorization Compliance

When you deauthorize Uninote AI from Zoom.

1. We receive an app_deauthorized webhook from Zoom.
2. We immediately revoke and delete your OAuth tokens.
3. We send a compliance confirmation to Zoom's Data Compliance API.
4. Your meeting data in Uninote AI is handled per your account settings.

8.3 Zoom API Scopes

We request only the minimum necessary Zoom API scopes.

• user:read:user — To retrieve your profile for account association.
• user:read:token — To retrieve ZAK token for bot meeting access.
• user:read:zak — To generate ZAK tokens for bot authentication.
• meeting:read:meeting — To retrieve meeting information.

We do NOT request scopes for writing, modifying, or deleting your Zoom data.

9. Recording Consent

Users are responsible for obtaining explicit consent from all meeting participants before recording. Uninote AI does not verify consent on behalf of users. In jurisdictions that require all-party consent for recording, it is your sole responsibility to comply with applicable laws.

10. Children's Privacy

The Service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. If we become aware of data collected from a child, we will take steps to delete it promptly.

11. International Data Transfers

Your data is processed and stored in Japan (AWS Tokyo region). If you access the Service from outside Japan, your data will be transferred to and processed in Japan. We ensure appropriate safeguards are in place for international data transfers in compliance with APPI and GDPR requirements.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via.

• Email to your registered account address.
• Notice on the Uninote AI platform.

Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

• Email: support@uninote.ai
• Company: Widsley Inc.
• Website: https://www.uninote.ai

For data deletion requests, please include "Data Deletion Request" in the subject line.

---

Uninote MDM Agent (Device Management)

This section applies to the Uninote MDM Agent Android application (package com.uninote.mdmagent), a Device Policy Controller (DPC) that lets IT administrators manage corporate and work-profile devices on behalf of an organization. The App is deployed by IT administrators and is not installed independently by end users for personal use. The App does not collect data for advertising or analytics — only for device management.

Roles
Widsley Inc. develops the App and operates the backend and admin dashboard (data processor). The enrolling organization (your employer/institution) is the data controller. The device user is the data subject.

Deployment modes

• Fully Managed Device (Device Owner)
  The organization manages the whole device.

• Work Profile (Profile Owner / BYOD)
  The organization manages only an isolated work profile; personal apps, data, and usage outside the work profile are invisible to the App. In Work Profile mode the installed-app list is limited to work-profile apps only.

How enrollment works
Your IT administrator creates a device record and issues an enrollment QR code. For a fully managed device you scan it at device setup (after a reset), and the device installs and provisions the App automatically. For a work profile you scan it inside the already-installed App. You then sign in with the device ID and password your administrator assigned to you (see "Device access credentials" below).

Data processed by the App
Each item notes what triggers it, so it is clear that not everything is administrator-initiated.

• Device access credentials (you, at sign-in)
  an organization-assigned device identifier in phone-number format and a password, both created by your IT administrator at enrollment (they are not chosen by you and are not verified against a real phone line or personal account). The App transmits them over HTTPS to authenticate the device against your organization's backend; the backend stores the password only as a salted hash, never in plain text.
• Device identifiers (administrator-triggered)
  IMEI and serial number (Device Owner mode only; not accessible in Work Profile mode), device model/manufacturer, Android OS version, and management mode (Device Owner/Profile Owner). Used for device identification, fleet inventory, and compliance.
• Location
  collected in two contexts only.
  • Lost Mode (administrator-triggered)
    when an administrator activates Lost Mode, the device shows a lock screen and a persistent notification ("This device is locked and its location is being reported to your organization"), and location coordinates are sent to the backend at intervals until the administrator deactivates Lost Mode.
  • Telemetry report (administrator-triggered)
    when an administrator requests a device report, the App takes a single location reading and shows a notification ("Your organization is collecting device information") during collection.
  • The App performs no background, continuous, or scheduled location tracking outside these two contexts, and does not store location on the device.
• Installed application inventory (administrator-triggered)
  package name, app name, version (Work Profile mode: work-profile apps only). Used to enforce app allow/block policy.
• Device communication identifier (automatic, at registration)
  a technical messaging token used to deliver management commands; not shared with third parties beyond the messaging provider named below.
• Command execution status (automatic, after each command)
  the success/failure of each administrator command, for audit.
• Diagnostic / error reports (automatic, on error)
  when the App encounters an error it may send a diagnostic report (error type, technical message, stack trace, a short trail of recent non-sensitive events, and the device identifier). These reports are used only to detect and fix malfunctions. They are processed through Widsley's operational monitoring tools (see "Recipients" below) and are not used to profile the user; the App is designed not to place personal content into them.
• Wi-Fi configuration (administrator-triggered)
  Wi-Fi profiles (SSID, security type, passphrase) pushed by the administrator are applied and stored encrypted on-device; passphrases are never uploaded to the backend.
• Security/tamper-detection signals (automatic, periodic and on detection)
  on fully managed devices, the App periodically checks the device for signs of rooting and reads the SIM's identifier (ICCID), storing it encrypted on-device as a baseline to detect SIM swaps. If your organization has enabled anti-tamper policies and tampering is detected (rooting or a SIM change), the App sends a security event report (event type and timestamp) to the backend. These signals are collected only to detect device integrity issues; they are never tied to payment status, subscriptions, or license state. The device-management actions your organization may configure in response (e.g., locking or factory-resetting the device).

Data we do NOT collect
SMS, call logs, contacts, photos, files, documents, microphone audio, camera images, clipboard content, web browsing history, keystrokes/screen recording, and personal-side app usage (in Work Profile mode).

Transmission & storage
All data is transmitted over HTTPS; plaintext HTTP is disabled. Sensitive credentials (enrollment token, Wi-Fi passphrase) are stored encrypted on-device. The App uses no third-party analytics/advertising SDKs; the only third-party components in the App are Firebase Cloud Messaging (command delivery), Google Play Services Location (Lost Mode/telemetry), and Google Play Services Code Scanner (enrollment QR).

Recipients & retention
Device-management data is sent to Widsley-operated servers and accessed by the organization's IT administrator via the admin dashboard. Diagnostic/error reports are additionally processed through Widsley's operational monitoring tools (e.g. cloud logging and incident-alerting services) used to keep the service running. Widsley does not sell device-management data and does not disclose it except as required by law, to these service providers acting on Widsley's behalf, or as authorized by the controller. Backend data is retained while the device is enrolled and is deleted (cascading delete of telemetry, location history, command history, and installed-app list) when the device record is removed via the admin dashboard, automatically when the device is unenrolled (work-profile removal or factory reset), or on request to support@uninote.ai.

Your rights & unenrollment

• Fully Managed Devices
  unenrollment can be initiated remotely by your administrator, or by a manual factory reset of the device.
  • Administrator-initiated unenrollment removes the App's device-management control (Device Owner status) from the device. It does not erase apps or data already on the device — the device simply stops being managed. Your organization's backend record for the device, and the data described above, are still deleted at this point (see "Recipients & retention").
  • Factory reset erases all data on the device, including the App itself, in addition to removing management.
• Work Profile (BYOD)
  you can leave management at any time, either from within the App (the "Revoke Consent" / unenrollment flow) or from Android Settings → Accounts / Work Profile. Either path removes all work data and the App from your device; the personal side is unaffected. Unenrolling also deletes that device's record and associated data on the organization's backend.
• Data-rights requests (GDPR/APPI, etc.)
  Contact your organization's data protection officer or Widsley Inc.

Contact
Widsley Inc., Personal Information Inquiry Desk
Email: support@uninote.ai
Address: VORT Ebisu Maxim, 3-9-19 Higashi, Shibuya-ku, Tokyo

Effective / Last revised: July 23, 2026