Qenot

Privacy Policy

Qenot is operated by Ahamed Munsif, an individual sole trader based in Sri Lanka. This policy explains exactly what we collect, what leaves our servers, and what you can do about it. It describes what the software actually does — not a template.

What we collect

  • Account — your email address, and your name and profile picture if you sign in with Google.
  • What you upload — notes, slides, PDFs, past papers, scanned pages, and the text extracted from them.
  • What you produce — generated notes, flashcards, quizzes, exam attempts, answers, grades and progress.
  • Usage — counts of operations, for enforcing plan limits.
  • Errors — technical diagnostics when something breaks.

We never see your password or your card details. Authentication is handled by Supabase and payment by Dodo Payments.

What leaves our servers — read this part

To generate study material and mark your answers, Qenot sends extracts of your uploaded material to third-party AI providers. This is the core of how the product works, and you should know exactly who receives it:

  • Google Gemini
  • Groq
  • OpenRouter
  • NVIDIA NIM

These providers process the text to return a result. They are not permitted to use it to train their models under the API terms we operate on. We send only what a given task needs — not your whole library.

If a document is confidential, do not upload it. That is the honest advice, and it applies to any AI study tool, not only this one.

Who else processes your data

  • Supabase — database, file storage and authentication.
  • Dodo Payments — payments. They are the merchant of record and receive your billing details. We never receive your card number.
  • Resend — email: sign-up confirmation and password reset, and the daily recall reminder if you turn it on (off by default; every reminder has a one-click unsubscribe).
  • Sentry — error reporting, with personal data scrubbed.
  • PostHog — product analytics and session replay, only if you allow it in the cookie banner. Everything you type — notes, answers, chat — is masked in replays.

Why we are allowed to process it

  • To provide the service — performing our contract with you.
  • To keep it working and safe — our legitimate interest in security and abuse prevention.
  • To meet legal duties — tax and accounting records, handled by our merchant of record.

How long we keep it

  • Your content — until you delete it, or 30 days after you delete your account.
  • Account records — while your account exists. When you delete your account it is closed straight away and erased 30 days later; in between, it can be restored only if you ask us to.
  • Payment records — invoices are held by Dodo Payments, as long as tax law requires. When an account is erased we keep only an anonymous record of each payment event (its type, amount and date), with nothing that identifies you.
  • Error logs — 90 days.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or stop processing it. If you are in the EU/UK (GDPR) or California (CCPA/CPRA), those laws give you these rights explicitly — we apply them to everyone rather than checking where you are.

Download a copy of your data and delete your account yourself from settings, or email support@qenot.com. We respond within 2 business days.

We do not sell your personal information, and we do not share it for advertising.

Cookies

Sign-in cookies keep you signed in; they are necessary and always on. Analytics (PostHog) runs only if you choose “Allow analytics” in the cookie banner, and you can change that any time from “Cookie settings” in the footer. Error reports (Sentry) are not gated by the banner: they carry no content and no identity beyond an account id, and we rely on them to keep the service working. There is no advertising tracking.

Security

Traffic is encrypted in transit. Passwords are hashed by Supabase and never reach our servers. Sessions are stored in cookies that JavaScript cannot read. Access to production data is limited to the operator.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority without undue delay.

Children

Qenot is for people aged 16 and over and is not directed at anyone younger. If you believe someone under 16 has given us personal data, email us and we will delete it.

International transfers

Qenot is operated from Sri Lanka. Your account and study data are stored in a database in Singapore (Supabase, ap-southeast-1) and your files with Cloudflare R2, which stores them in its global network. AI processing runs on Google Vertex AI's global endpoint, and the other providers listed above process data in other countries including the United States and the European Union. Using the service means your data is transferred to those countries.

Changes

We will announce material changes in the app or by email before they take effect.

Last updated 12 September 2026. Questions? Email support@qenot.com.