Privacy Policy

Notabl is a content workflow platform operated by FoundersFlow, based in the United Kingdom. In this notice, "we", "us" and "Notabl" mean FoundersFlow trading as Notabl.

For questions about this notice, or to exercise any of the rights described below, email support@notabl.net.

We act as a data controller for information about the people who hold a Notabl account: name, email address, agency name, sign-in records and billing details. We decide how that information is used to run and support the service.

We act as a data processor for the content an agency and its clients put into a workspace: ideas, notes, captions, comments, approvals, uploaded images and voice recordings. The agency decides what goes in, how long it stays and who may see it. We only process it to provide the service and on the agency's instructions.

If you are a client using a portal link, the agency that invited you is the controller of your content. Contact them first about your content; contact us if you cannot reach them.

Account data: name, email address, agency name, password hash or third-party sign-in identifier (for example Google), and account preferences.

Content data: text notes, links, captions and drafts; uploaded images and carousel slides; audio voice recordings and their text transcripts; comments, change requests and approval decisions; scheduled publish dates.

Activity and audit data: timestamps for submissions, drafts, approvals and declines, so both sides have a clear record of who agreed to what and when.

Technical data: IP address, browser and device type, and error logs, used to keep the service secure and working.

We do not collect special category data, and we ask that you do not upload health, biometric or other sensitive personal data into notes or recordings.

When you record a voice note, the audio is stored in your private workspace and sent to an automated speech-to-text service so it can be turned into text you can edit. The transcript is saved alongside the recording.

Where you ask Notabl to help draft or rewrite a post, the relevant text is sent to an AI language model to generate a suggestion. Output is always a draft for a human to review; nothing is published automatically.

Audio, transcripts and drafts are processed only to deliver these features to you. They are not used to train publicly available foundational AI models, and they are not sold or shared for advertising.

Do not record confidential information belonging to someone who has not agreed to it. If you record another person's voice, you are responsible for having a lawful basis to do so.

To perform our contract with you: creating and running accounts and portals, storing content, transcribing recordings, sending approval notifications and taking payment.

For our legitimate interests: keeping the platform secure, preventing abuse, diagnosing faults, and improving features in aggregate.

To comply with legal obligations: tax and accounting records, and responding to lawful requests.

With consent: optional product emails, where offered. You can withdraw consent at any time.

We use a small number of carefully chosen providers to run Notabl: a managed cloud database and file storage provider, application hosting, an automated speech-to-text and AI model provider, email delivery, and a payment processor. Each is bound by a written data processing agreement and may only use the data to provide its service to us.

We do not sell personal data, and we do not share it with advertisers or data brokers.

We may disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition, in which case we will tell you beforehand.

Some providers process data outside the United Kingdom. Where they do, we rely on UK adequacy regulations or, where none applies, the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, together with appropriate technical safeguards such as encryption in transit and at rest.

Every workspace is separated at the database level, so one account can never read another account's clients, notes or recordings. Uploaded images and audio sit in private storage that is not publicly listable.

Client portal links use long, randomly generated tokens that cannot practically be guessed. Treat a portal link like a password: anyone holding it can see and submit content for that client. Ask us to reissue a link if you think it has been shared in error.

Data is encrypted in transit and at rest. Access by our team is limited to what is needed for support and maintenance.

Content stays in a workspace until it is deleted by the agency or the account is closed. Deleted items are removed from backups within 30 days.

When an account is closed, we delete account and content data within 30 days, except records we must keep for legal, tax or dispute purposes, which we keep for up to six years.

Audit records of approvals are kept for the life of the workspace, because they evidence what a client agreed to.

You have the right to access your data, correct it, have it deleted, restrict or object to its processing, receive a portable copy, and withdraw consent where consent is the basis. You can also object to any solely automated decision with legal effect; we do not make such decisions.

Right to erasure: you can delete your account yourself at any time from Agency settings or the Solo Studio menu. This immediately removes your account and workspace content; remaining backup copies are purged within 30 days. You can also ask us to delete it by email.

Email support@notabl.net to make a request. We will respond within one month and may ask you to verify your identity. Requests are free unless they are excessive or repetitive.

If you are unhappy with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk.

We use only the storage strictly necessary to keep you signed in, remember your workspace preferences and keep the service secure. We do not run advertising or cross-site tracking cookies.

Notabl is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete the account.

We may update this notice as the service develops. We will change the date at the top and, where changes are significant, notify account holders by email before they take effect.