logo

Privacy Policy

Last Updated: August 4, 2026

This Privacy Policy describes the information Notessa, Inc. and its affiliates ("Company", "we", "our", or "us") collects when you access the web resource located at notessa.ai and/or associated services and web resources (collectively, the "Services"), how we use this information, with whom we share it, and the choices you have in connection with this.

INFORMATION WE COLLECT AND USE

Through your use of the Services, the Company may collect personal information, which is information that identifies you or relates to you as an identifiable individual. The Company will collect personal information from you directly and automatically as outlined below.

A. Information Collected From You When You Use the Website

As you use the Services, we collect personal information from you when you:

  • Create an account: When you create a Notessa account, we will collect your personal identifiers (name, business name, email address, and selected username and password). We use this personal information to create your account and to provide you with access to the Services. Once we create your account, you will be able to upload copies of your receipts, approve or reject reimbursement requests, and organize your expenses.

B. Information Collected From You When You Use the Mobile Application

As you use the Services, we collect personal information from you when you register on the web site notessa.ai or on any other associated web resources.

C. Information Collected Automatically

In addition to the personal information you provide, we may also collect information automatically via cookies as you use our Services. This includes your:

  • Usage information: We use strictly necessary and functional cookies to collect information about your interaction with our Services, such as the pages you visit, the frequency of access, how much time you spend on each page, what you click on, and referring website address. We use this personal information to: (i) enhance user experience; (ii) prevent fraudulent use of the Services; and (iii) diagnose and repair errors.
  • Device information: We use strictly necessary and functional cookies to collect certain information about the device you use to access our Services, such as browser type, browser language, hardware model, operating system, and your preferences. We use this personal information to: (i) enhance user experience; (ii) prevent fraudulent use of the Services; (iii) diagnose and repair errors; (iv) remember your preferences; and (v) provide enhanced functionality.
  • Location information: We use strictly necessary and functional cookies to collect information about your location, which may be determined through your IP address. We use this personal information to: (i) enhance user experience; (ii) prevent fraudulent use of the Services; (iii) diagnose and repair errors; (iv) remember your preferences; and (v) provide enhanced functionality.

To conduct analytics, we may use Google Analytics. In doing so, Google Analytics may set cookies on your device, or read cookies that are already there. Google Analytics may also receive information about you from applications you have downloaded that partner with Google. We do not combine the information collected through the use of Google Analytics with personally identifiable information. Google may use and share the information collected through Google Analytics in accordance with its Terms of Use and Privacy Policy. To opt-out, you can download the Google Analytics opt-out browser add-on.

In general, to disable cookies and limit the collection and use of information through them, you can set your browser or mobile device settings to refuse cookies or indicate when a cookie is being sent.

HOW WE SHARE YOUR INFORMATION

The Company may share your personal information in the following instances:

  • Within the Company: Where necessary, we may share your personal information within the Company in order to efficiently carry out our business and to the extent permitted by law.
  • With service providers: We may share your personal information with our service providers that assist us in providing the Services, such as our IT support, payment processor, our cloud provider for storage, management, and authentication, and artificial intelligence service providers that process your content to provide the Services.
  • In the event of a corporate reorganization: In the event that we enter into, or intend to enter into, a transaction that alters the structure of our organization, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any portion of our assets, we would share your personal information with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. We would also share your personal information with third parties if we undergo bankruptcy or liquidation, in the course of such proceedings.
  • For legal purposes: We will share your personal information where we are legally required to do so, such as in response to court orders, law enforcement or legal process, including for national security purposes; to establish, protect, or exercise our legal rights, as required to enforce our terms of use or other contracts; to defend against legal claims or demands; to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person; or to comply with the requirements of any applicable law.

DATA RETENTION

We retain personal information for as long as necessary to provide the Services and as needed to comply with our legal obligations, resolve disputes, and enforce our agreements. We use the following criteria to determine retention periods:

  • Account information: We retain your account information (such as name, business name, email address, and username) for as long as your account remains active. If you delete your account, we will delete this information within thirty (30) days.
  • Customer content: Documents and other content uploaded to the Services by or on behalf of your organization are retained for the duration of the applicable subscription term and for a reasonable period thereafter, as set forth in the agreement governing your organization's use of the Services. Upon termination of that agreement, such content will be returned or securely deleted within thirty (30) days, unless retention is required by applicable law.
  • Usage information: We may retain usage information in an aggregated, de-identified form that does not identify you.

Following deletion, residual copies of personal information may remain in our backup and disaster-recovery systems for a limited period until they expire in accordance with our standard backup schedules. Such copies remain subject to the security measures described in this Privacy Policy. We may also retain personal information where required by applicable law, legal process, or regulatory requirements.

RIGHTS OF NEVADA RESIDENTS

If you are a consumer in the State of Nevada, you may request to opt-out of the current or future sale of your personal information. We do not currently sell any of your personal information under Nevada law, nor do we plan to do so in the future. However, you can submit a request to opt-out of future sales by contacting us. Please include “Opt-Out Request Under Nevada Law” in the subject line of your message.

CORRECT OR VIEW YOUR PERSONAL INFORMATION

You can access your Notessa account to correct or view certain personal information of yours in our possession and which is associated with your account.

DELETE YOUR ACCOUNT

You can delete your account at any time from the website under the Settings page.

DO NOT TRACK

We do not support Do Not Track (DNT).

INFORMATION SECURITY

We implement and maintain reasonable security measures, in compliance with SOC 2 Type II to protect the personal information we collect and maintain. We also plan to evaluate and pursue additional industry-recognized standards, such as ISO/IEC 27001 and PCI-DSS, as our business grows. However, no security measure or modality of data transmission over the Internet is 100% secure and we are unable to guarantee the absolute security of the information we have collected from you.

AGE RESTRICTION

The Services are not intended for individuals under the age of eighteen (18).

CHANGES TO THIS PRIVACY POLICY

We may change this Privacy Policy from time to time. We will post the changes to this page and will indicate the date the changes go into effect. We encourage you to review our Privacy Policy to stay informed. If we make changes that materially affect your privacy rights we will notify you with a prominent post on our Services and obtain your consent, if required.

CONTACT

If you have any questions about this Privacy Policy, please contact us at support@notessa.ai.