Privacy Policy

Last updated: Sep 18, 2026

1. Introduction

Lungoor Notes is part of Lungoor, a suite of AI-powered productivity products developed and operated by Surfboard India Pvt Ltd, including Lungoor Voice, Lungoor Notes, and future Lungoor services.

Surfboard India Pvt Ltd is the data controller for the personal data described in this policy. It is incorporated in Maharashtra, India, with its registered office at 8th Floor, New Viva College, Y.K Nagar, Virar West, Palghar, Maharashtra 401 303. Contact: [email protected] | Phone: +91 88063 73111

This Privacy Policy explains how we collect, use, process, store, and protect your personal data when you use Lungoor Notes - our desktop application, website, and related services. It supplements the Lungoor Privacy Policy with the details specific to Lungoor Notes.

Your account identity, sign-in, organisation membership, credits, billing and account deletion are handled by shared Lungoor account services operated by Surfboard India Pvt Ltd. The same Lungoor account can be used across Lungoor products.

Some information is required for Lungoor Notes to function properly. If you choose not to provide certain information when requested, you may not be able to access some or all of our services.

By creating an account or using Lungoor Notes, you acknowledge that you have read and understood this Privacy Policy. See also our Terms of Service.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

• Email address
• First name
• Last name
• Profile image, where your Google profile provides one
• Organisation domain from your Google ID token (hosted domain, when Google includes it)
• Organisation display name, where available from your Google profile or otherwise derived from your email domain

This information is used for:

• Creating your account
• Authenticating your identity
• Establishing your organisation membership
• Providing customer support
• Sending important account notifications
• Delivering Lungoor Notes services

Sign-in via Google OAuth only. Lungoor Notes does not support password or other sign-in methods. You must sign in with Google OAuth using a work or organisation email on a non-consumer domain (not personal providers such as Gmail, Yahoo, Outlook.com, or similar free email services). Google Workspace accounts on your organisation domain are supported. We may permit specific addresses to sign in with a personal domain for evaluation, support or testing purposes. After you sign in, you may connect Google Calendar using any Google account you authorise, including personal accounts.

2.2 Usage Information

To operate and improve Lungoor Notes, we collect limited usage information including:

• Credit consumption
• Speech processing usage
• Product usage metrics
• Feature interaction data
• Application performance metrics
• Crash reports and diagnostics

Usage information helps us improve reliability, performance, and user experience.

Device and technical information. When you submit a support report, and for diagnostics, the desktop app collects technical details about the device you are using: operating system and version, application version, device model and processor architecture, screen resolution and pixel ratio, processor count, installed memory, language/locale and time zone. We use this to reproduce and diagnose the problem you reported and to understand which configurations need support. It is not used to build a profile of you or to track you across services.

Automatic updates. The desktop app periodically checks our release server for a newer version and downloads updates automatically. An update check transmits your application version and platform so the server can respond with the correct update. Update checks do not include your meeting content, account data or device fingerprint.

2.3 Content You Submit

Depending on how you use Lungoor Notes, you may provide:

• Meeting audio captured from your microphone and from your computer's audio output
• Meeting transcripts
• Notes, sticky notes and edits you write
• AI prompts, templates and recipes you configure
• Custom speech-dictionary terms
• Meeting content you import from supported external sources
• Support reports, bug reports and product feedback you submit, including the description you write, any rating or issue tags you select, and the contact email address you provide

This content is processed only to provide the features you request. What is recorded during a meeting is described in Section 5, and how your stored content is protected - including the field-level encryption applied to transcripts, summaries, notes and participant details - is described in Section 19.

When you submit a support report or feedback, we store it together with the device and technical information described in Section 2.2, and we send a confirmation email to the address you gave us.

2.4 Support Requests from People Without an Account

You can submit a support report without signing in - for example if you cannot complete sign-in. In that case we collect the contact email address you provide, the description you write, and the device and technical information in Section 2.2, solely to respond to your request. We do not create an account for you, and we do not use this information for marketing.

2.5 Local Device Signals

So that Lungoor Notes can notice when you are in a meeting and offer to start a note for you, the desktop app checks a few things about your own computer:

• Whether your microphone is switched on and in use, by any app on your computer, not only by Lungoor Notes
• Whether a meeting app is open, such as Zoom, Google Meet or Microsoft Teams, and which app you are currently working in

All of these checks happen on your own computer, and the results stay there. We do not send them to our servers, do not include them in analytics, and do not save them to your notes. They are used only in the moment, to decide whether to offer you a note.

You can switch meeting detection off at any time in Settings.

3. How We Use Your Information

We use your information to:

• Create and manage your account
• Authenticate your identity
• Deliver Lungoor Notes services
• Process speech and text requests
• Generate transcripts, summaries, action items and other AI outputs
• Index your meeting content so search and retrieval work
• Display your upcoming meetings and enable meeting workflows
• Enable sharing and collaboration that you initiate
• Manage subscriptions and credits
• Improve product performance
• Detect abuse and fraudulent activity
• Comply with legal obligations
• Respond to customer support requests, and reproduce and diagnose reported problems
• Deliver application updates and security fixes

We never sell your personal information.

4. AI Processing

Lungoor Notes uses artificial intelligence to provide features such as:

• Speech recognition
• Meeting summaries
• Action item, decision, topic and risk extraction
• Meeting assistance and chat across your meetings
• Search and cross-meeting insights
• Translation
• Jira issue drafting

Your content is processed only to deliver the functionality you request.

Processing happens in two ways:

• On request - when you generate a summary, ask a question, run a search, or draft a Jira issue
• Automatically and on an ongoing basis - when a meeting is summarised, its summary and derived artifacts are converted into vector embeddings and stored in our systems. This indexing runs in the background so that meeting search, cross-meeting insights and AI retrieval work without re-processing your meetings each time

We may use different AI processing providers over time to improve quality, reliability, or performance. These providers act solely as data processors on our behalf and are contractually required to protect your information.

Your data is not used to train external AI models.

Insights are generated only from user-authorised meeting data and are not used for profiling unrelated to user-requested functionality.

5. Audio & Transcript Processing

What is recorded

When you start a capture, Lungoor Notes records two audio sources:

• Your microphone - your own speech
• Your computer's audio output (system audio) - everything playing through your speakers or headphones during the meeting, which in a video call means the voices of the other participants

Both sources are transcribed, and each transcript segment is tagged with its source so your speech can be distinguished from remote participants' speech. Lungoor Notes does not record video and does not capture your screen contents.

Capturing system audio requires your operating system's audio-capture or screen-recording permission. macOS 14.4 and later use a system-audio-only permission; earlier macOS versions use the broader Screen Recording permission, because that is the only mechanism the operating system provides for system audio. Lungoor Notes uses this permission solely to capture audio.

How audio is transcribed

Lungoor Notes offers two transcription engines, selectable in Settings:

• Cloud transcription (default) - audio is streamed from your device to a speech-to-text processing provider for real-time transcription
• Apple on-device transcription (macOS) - audio is transcribed locally on your Mac using Apple's on-device speech models. In this mode your audio does not leave your device for transcription

In both modes the resulting text is saved to your meeting record and processed for AI features as described in Section 4.

Retention

Audio recordings are not retained after processing is complete. Audio is streamed for transcription and discarded; only the resulting text is stored. Transcript content is processed only to provide the requested functionality.

Lungoor Notes does not use your voice recordings for advertising, or for training external AI models without consent.

Speaker labels and your voiceprint

Lungoor Notes can optionally separate speakers in a meeting into anonymous labels (for example, Speaker 1, Speaker 2) using an on-device model. Audio used for that separation is processed locally and is not retained after processing, consistent with this Section 5.

Separately, you may choose to enroll a voiceprint of your own voice so the app can suggest which anonymous label is you. Enrollment is optional, requires your explicit action, and is gated by your device unlock. Your voiceprint is stored only on your device, encrypted with the operating system's secure storage, is not uploaded to our servers, is not used to identify other participants, and is deleted when you delete it in Settings, sign out, or uninstall the app.

Naming another participant (for example, "Speaker 2 is Rahul") is a label on that meeting's transcript only; we do not create or store a voiceprint for other people unless a later feature obtains their consent and you opt in. Action-item suggestions that name a person require your confirmation before an assignee is set.

6. Meeting Recording & Other Participants

When you capture a meeting, Lungoor Notes processes personal data belonging to people other than you - the speech of other participants, and their names and email addresses from the calendar event.

You are responsible for telling the other participants that the meeting is being recorded and transcribed, and for obtaining their consent where the law requires it. Recording laws differ by country and by state, and some require the consent of every participant. Lungoor Notes shows a consent reminder in the app and publishes guidance at lungoor.ai/docs/notes/getting-consent, but the obligation is yours as the account holder. This is set out in Section 5 of our Terms of Service.

We process other participants' data as a processor acting on your instructions, for the purpose of producing your meeting record. If a participant wishes to exercise rights over their data in a meeting you captured, contact us at [email protected] and we will work with you as the account holder to respond.

7. Google Calendar Data We Access

Lungoor Notes currently supports Google Calendar only. Other calendar providers may be added in the future.

We request read-only access to calendar events in two situations - when you sign in with Google (initial authorisation) and when you connect an additional Google Calendar account in Settings. We read only the fields necessary to power meeting workflow features you explicitly request:

• Event title - to identify and display your upcoming meetings
• Start and end time - to surface the correct meeting at the right time and enable timely workflow triggers
• Attendee names and email addresses - to show meeting participants in the meeting workflow view and attribute participants on your meeting record
• Conferencing details - specifically the event's conferenceData entry points, its hangoutLink, and its location field. We read these only to determine whether the event is an online meeting, which platform it uses (Google Meet, Zoom, Teams or other), and the join link, so the app can show a "Join" action and start your note at the right time. We read location because Zoom and Teams invitations are commonly pasted there as a plain URL; we extract the meeting URL from it and use nothing else from that field
• Event id - to match a note to its calendar event and avoid duplicate sessions

We do not read event descriptions, organiser details, guest response status, attachments, recurrence rules, visibility settings, or any other calendar field.

This data is used solely to display upcoming meetings and enable meeting workflow features you request. It is not used for advertising, unrelated profiling, sale, or model training.

You may connect more than one Google account for Calendar. Each connection is separate - we read only the primary calendar of each account you have authorised. Disconnecting one Calendar connection does not remove access for other connected accounts.

8. Google Calendar Data Flow

• Fetched from Google - upcoming events are read when you use calendar features. We do not keep a full copy of your Google Calendar
• Stored in our systems - when you start or link a meeting session from a calendar event, we store the event title, scheduled start and end time, participant names and email addresses, the calendar event id, and the detected meeting platform and join link in your meeting record, along with encrypted OAuth tokens and integration settings. These stored fields are encrypted at rest at the field level
• Used for search and AI features - meeting titles, schedule times, and participant information are retained and indexed (including as vector embeddings) to enable meeting search and context retrieval
• Sent to AI processing - when you use an AI-powered meeting feature, and when your meeting content is indexed. Only the fields needed for that purpose are included
• Sent to a connected AI client - only if you choose to connect one (Section 10)
• Shared with people you share with - only if you choose to share a meeting (Section 9)
• Not sent to - analytics systems, Slack, or Atlassian (Jira). These systems do not receive Google Calendar event content

Google Calendar data is never combined with analytics telemetry, advertising systems, or unrelated product features.

9. Sharing & Collaboration

Lungoor Notes lets you share meeting records. Sharing is always an action you take; nothing is shared by default.

• Share with specific people - grant another Lungoor Notes user viewer or collaborator access to a meeting or folder. They are notified by email and can open the record according to the role you granted
• Share with your organisation - as owner, share a meeting with everyone in your organisation (Section 11)
• Forward a summary by email - send a meeting summary link to any address you enter, including addresses outside your organisation
• Public share links - a shared meeting can be opened through a public link. Anyone who has the link can read the meeting summary and ask AI questions about it without signing in. Treat a public link as public: anyone you send it to can forward it onward

When someone requests upgraded access to a meeting or folder you own, we notify you by email so you can grant or decline it.

Data you share in these ways leaves your sole control. We cannot retrieve or un-send content a recipient has already read, copied or forwarded.

10. Connected AI Clients (MCP)

Lungoor Notes offers a Model Context Protocol (MCP) server so you can connect a third-party AI client or assistant to your Lungoor Notes data. This is optional, off by default, and entirely under your control - it exists only if you deliberately authorise a client through an OAuth flow.

• What a connected client can read - read-only access to your meetings (list, detail, transcript and summary content), folders, meeting insights, recipes, and the people associated with your meetings, with the same read visibility you have
• What it cannot do - it cannot create, modify or delete your meeting data through the MCP server, and cannot access your credentials, OAuth tokens, or payment information
• Where the data goes - to the AI client you connected, and onward to whatever provider operates that client, under that provider's privacy policy and terms. Once data leaves through a connection you authorised, it is governed by the receiving service, not by this policy
• Google user data - records exposed through MCP can include Calendar-derived fields such as meeting title and attendee list. By connecting a client you are directing us to disclose that data to it
• How to revoke - disconnect the client in Settings. Revoking stops further reads immediately; it does not retrieve data the client already received

You are responsible for the clients you connect and for the handling of data by their providers. Connect only clients you trust.

11. Your Organisation

When you sign in with a work email, we associate your account with an organisation derived from your email domain.

• People you see are limited to people you have worked with. Your people directory shows only members of your organisation you have actually interacted with - that is, people who appear as participants on a meeting you captured, or who share a meeting or folder with you. It shows their name, email address and profile image. We do not show you a directory of everyone on your email domain, and we do not list you to colleagues you have not interacted with
• You can share a meeting or folder with everyone in your organisation
• Organisation membership is used to label your organisation in the product and to enable organisation-level sharing

Because the directory is derived from shared meetings, another person appearing in it means you and they were both on a meeting record. If you do not want to be associated with other users on your domain, do not sign in with that domain.

12. Cookies & Analytics

Lungoor Notes uses cookies and similar technologies for the following purposes:

Authentication

Authentication cookies keep you securely signed in and protect your account.

Analytics

Analytics help us understand:

• Feature usage
• Session activity
• Performance
• Reliability
• Crash diagnostics

Before any analytics event leaves the app, identifying values are removed: names, email addresses, meeting and note titles, and all record identifiers are stripped and replaced with placeholders. Analytics information is associated with a pseudonymous identifier and is not used for advertising. We do not sell analytics data.

Analytics systems do not receive Google Calendar event content, transcription text, meeting titles, meeting participants, any Google user data, or the local device signals described in Section 2.5.

13. Legal Basis for Processing

Where required by applicable law, we process personal information based on one or more of the following legal bases:

• Your consent
• Performance of a contract
• Legitimate business interests
• Compliance with legal obligations

You may withdraw your consent where applicable.

Where you capture a meeting involving other participants, you are the controller of that meeting data and are responsible for establishing a lawful basis for processing their personal data; we act as your processor (Section 6).

14. Your Privacy Rights

Subject to applicable law, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account
• Withdraw consent
• Request a copy of your data
• Object to certain processing
• Restrict certain processing activities
• Nominate another individual to exercise your rights in the event of your death or incapacity, subject to verification

We fulfil access and data-copy requests manually - Lungoor Notes does not currently offer a self-service export. We may verify your identity before fulfilling privacy requests, and we aim to send an initial response within 24-48 business hours.

To exercise these rights, contact: [email protected]

15. Regional Privacy Rights

European Economic Area and United Kingdom

If you are in the EEA or the UK, you have the rights set out in Section 14 under the GDPR and UK GDPR, including the rights of access, rectification, erasure, restriction, objection, and data portability. You also have the right to lodge a complaint with your local supervisory authority. Our legal bases for processing are set out in Section 13, and information about transfers outside your region is in Section 19.

We do not use your personal information for automated decision-making producing legal or similarly significant effects.

United States

If you are a resident of California or another US state with comprehensive privacy legislation, you may have the right to know what personal information we collect and how it is used, to access and delete it, to correct inaccuracies, to obtain a portable copy, to opt out of the "sale" or "sharing" of personal information and of targeted advertising, and not to be discriminated against for exercising these rights.

We do not sell or share your personal information as those terms are defined under US state privacy law, and we do not use it for targeted advertising or cross-context behavioural advertising. Because we do not sell or share personal information, there is no opt-out to exercise; all other rights can be exercised through Section 14.

India

If you are in India, your rights under the Digital Personal Data Protection Act - including access, correction, erasure, grievance redressal and nomination - can be exercised through Section 14, and you may escalate to our Grievance Officer in Section 26.

To exercise any regional right, contact [email protected]. Where applicable law permits, an authorised agent may submit a request on your behalf subject to verification.

16. Children's Privacy

Lungoor Notes is intended for users who are at least 18 years of age.

We do not knowingly collect personal information from children. If we become aware that a child has provided personal information, we will take reasonable steps to delete it.

17. Data Retention, Account Deletion & Recovery

How the data listed below is protected while we hold it is described in Section 19.

We retain personal information only for as long as necessary to:

• Provide our services
• Comply with legal obligations
• Resolve disputes
• Prevent fraud
• Enforce our agreements

Generally:

Deleting your account

You can request deletion of your Lungoor account, which covers Lungoor Notes, from your Lungoor account settings or by emailing [email protected]. Deletion follows a defined lifecycle:

1. Immediately on request - your account is suspended, all active sessions are revoked, and your data is frozen
2. 30-day recovery period - you can restore your account by signing in and completing email verification. Restoring reinstates your data
3. After 30 days - your account and associated data are permanently deleted. This is irreversible

An account can go through the delete-and-restore cycle up to three (3) times. On the fourth deletion request the deletion is final and cannot be restored; we warn you in the app before a final-chance deletion.

Two limits apply before deletion can start: an account with an outstanding negative credit balance must settle it first, and the sole owner of an organisation that still has other members must transfer ownership first. If you still hold credits, you must acknowledge that they are forfeited.

What is deleted, and what survives

Permanent deletion runs across both the shared Lungoor account services and the Lungoor Notes services, so that no meeting data is left behind when your identity is removed. On permanent deletion we delete:

• Account and identity - your user record, sign-in accounts and stored OAuth credentials, profile, organisation membership, credits and subscription data
• Meeting data - meeting records, transcripts, summaries, action items and other derived artifacts, and the sticky notes and edits attached to them
• Derived indexes - search indexes and the vector embeddings generated from your meetings
• Organisation and collaboration data - folders, todos, share grants, public share links, pending access requests, and your notifications
• Integrations - Google Calendar, Jira and Slack connections and their stored OAuth access and refresh tokens
• Preferences and tooling - saved searches and search history, custom speech-dictionary entries, meeting templates and recipes, and API tokens

Two things survive by design:

• Payment and transaction records, anonymised as described in Section 18, retained for accounting and taxation compliance
• A one-way irreversible hash of your email address, retained to prevent abuse of first-time credit offers through repeated deletion and re-signup. It cannot be reversed to recover your email address

Content you shared with other people before deletion cannot be recalled.

Google user data specifically

• Google OAuth refresh tokens are replaced on each re-authentication, deleted when you disconnect an integration, and permanently deleted when account deletion completes
• Calendar-derived data in your meeting records is permanently deleted when account deletion completes
• Jira and Slack connection data is removed when you disconnect the integration, and permanently deleted when account deletion completes

18. Payments & Billing Data

Lungoor Notes uses a prepaid credit model. Payments are securely processed by third-party payment providers.

Lungoor Notes does not collect, store, or process your complete payment card information, UPI credentials, or other sensitive payment information. Payment credentials are handled directly by certified payment processors in accordance with their own security and privacy practices.

For each successful transaction, we receive and store a payment record containing:

• The order and payment identifiers, amount, currency and status
• The payment method used (for example card, UPI, netbanking or wallet)
• For UPI payments, the UPI VPA (your UPI address, for example name@bank)
• For card payments, the masked card number and last four digits, card network, card type and issuing bank
• For netbanking, the bank code

We store this to show you your billing history, to reconcile and verify payments, to process refunds and chargebacks, and to meet accounting and tax obligations. We do not use it for any other purpose. These records are retained for the period required by Indian accounting and taxation law, and are anonymised rather than deleted when your account is deleted - the record remains for financial compliance, but the link to your user account is severed.

19. Security

We implement industry-standard administrative, technical, and organizational safeguards to protect your information. These include:

• Encryption in transit
• Encryption at rest
• Field-level encryption of the most sensitive fields in your meeting records - transcript text, summaries, notes, meeting titles, participant names and email addresses, and meeting join links - so they are unreadable in the database without the service's encryption keys
• Token protection - OAuth access and refresh tokens for Google, Jira and Slack are encrypted at rest in a dedicated token vault; API tokens are stored only as irreversible hashes
• Restricted employee access
• Access logging
• Security monitoring
• Least-privilege access controls
• Analytics minimisation - identifying values are stripped before events leave your device (Section 12)

We work with service providers that maintain recognised security certifications such as SOC 2 Type II and ISO 27001, and we expect our processors to maintain appropriate technical and organisational security measures.

Although no system can guarantee absolute security, we continuously work to protect your information.

20. International Data Transfers

Some Lungoor Notes services may process data using infrastructure located outside your state or country, and your information may be processed by the service providers described in Section 21, for the purposes set out in this policy.

Where international transfers occur, we implement appropriate contractual and technical safeguards consistent with applicable data protection laws. For transfers of personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with the technical measures described in Section 19.

By using Lungoor Notes, you acknowledge that your information may be processed in multiple jurisdictions.

21. Third-Party Service Categories

To operate Lungoor Notes, we work with trusted service providers in the following categories:

• Speech processing
• AI language processing
• Cloud infrastructure
• Payment processing
• Authentication
• Product analytics
• Customer support
• Transactional email delivery
• Error monitoring

These providers process personal information only on our behalf and only for delivering Lungoor Notes services. They are contractually prohibited from using your information for unrelated purposes or for training their own models. We will provide the current list of named processors on request to [email protected].

Integrations you connect yourself are named, because you authorise each one directly:

• Google Authentication - handles OAuth sign-in and issues access/refresh tokens. Governed by Google's own terms
• Slack API - the optional Slack bot integration. Operates independently and does not access or combine Google Calendar data
• Atlassian (Jira Cloud API) - the optional Jira integration. Does not receive Google Calendar event content
• Third-party AI clients you connect over MCP - see Section 10

Payment processing is handled by certified third-party payment providers (Section 18).

Which categories receive Google user data is limited to what is described in Section 8: AI language processing and cloud infrastructure only. Speech processing, analytics, email delivery, customer support and error monitoring do not receive Google Calendar event content.

22. Google, Jira & Slack OAuth Scopes

Google

When you sign in with Google, we request OpenID scopes - openid, email, and profile - plus https://www.googleapis.com/auth/calendar.events.readonly for read-only Calendar events access.

OAuth authorisation includes offline access so meeting workflows continue without re-authenticating each session. Access and refresh tokens are encrypted at rest, accessible only to the backend services that need them, replaced on each re-authentication, and permanently deleted when you disconnect or when account deletion completes.

Jira

• offline_access - refresh access without prompting you for each action
• read:jira-work - read issues, projects, fields, and project metadata
• read:jira-user - read assignable users so you can pick an assignee
• read:issue:jira, read:issue-meta:jira, read:issue-type:jira - read issues and the issue types and metadata available in a project
• read:project:jira, read:project.property:jira - read projects and their properties
• read:field:jira, read:field.option:jira, read:field-configuration:jira, read:field.default-value:jira - read field definitions, options and defaults to populate issue creation forms
• read:user:jira, read:avatar:jira, read:application-role:jira - read user details and avatars so people can be displayed and selected
• write:issue:jira - create and update issues
• write:comment:jira, write:comment.property:jira - add comments to issues
• write:attachment:jira - attach files to issues

Jira access and refresh tokens are encrypted at rest. Disconnecting Jira in Settings immediately revokes our stored tokens.

Slack

• chat:write - send messages in conversations the bot is in
• chat:write.public - post in public channels without being added
• users:read - read basic user profile info
• users:read.email - read user email address when available
• channels:read - read public channel list and details
• groups:read - read basic information about private channels the bot has been added to
• im:write - start or send direct messages

The bot cannot read the contents of any channel, public or private. groups:read returns only metadata about private channels a user has explicitly added the bot to.

23. Limited Use Compliance

Lungoor Notes' use of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not:

• Use Google user data for advertising or ad targeting
• Sell Google user data to any third party
• Use Google user data to train AI or machine learning models
• Share Google user data with any party other than the service providers described in Section 21, and only to the extent described in this policy - except where you yourself direct a disclosure, by sharing a meeting (Section 9) or connecting an AI client (Section 10)
• Allow human review of Google user data, except with your explicit consent for a support request, or where required by law
• Use Google user data for any purpose other than providing or improving the meeting workflow features you have requested

24. Data Breach Notification

If we become aware of a security incident affecting your personal information, we will notify affected users as required by applicable law.

25. Your Controls & How to Revoke Access

• Choose on-device transcription - in Settings, select the Apple on-device speech engine on macOS so your audio is transcribed locally and never sent to a transcription provider
• Turn off meeting detection - in Settings, to stop the local device signals in Section 2.5
• Disconnect an additional Google Calendar account - in Settings. This removes that connection's tokens and stops calendar reads for that account; it does not sign you out or delete stored meeting data
• Disconnect Jira - in Settings, or revoke at id.atlassian.com/manage-profile/apps
• Disconnect Slack - in Settings, or remove Lungoor Notes from your Slack workspace
• Disconnect an AI client (MCP) - in Settings, at any time
• Stop sharing - revoke a person's access, remove organisation sharing, or disable a public link on any meeting or folder you own
• Delete your account - from your Lungoor account settings, or by emailing [email protected] (Section 17)
• Revoke Google access - at myaccount.google.com/permissions. Lungoor Notes cannot revoke sign-in Google access from inside the app

26. Grievance Officer

If you have any complaints or concerns regarding the processing of your personal data, you may contact our Grievance Officer:

Kshitija Katare

Grievance Officer

Surfboard India Pvt Ltd

Email: [email protected]

Phone: +91 88063 73111

We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days of receipt.

27. Changes to This Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will notify registered users before those changes become effective.

The Effective Date at the top of this page will always indicate the latest version.

28. Contact Us

If you have questions, concerns, or privacy requests, please contact us:

Surfboard India Pvt Ltd

8th Floor, New Viva College, Y.K Nagar, Virar West

Palghar, Maharashtra 401 303

India

Email: [email protected]

Phone: +91 88063 73111