Privacy Policy

01Who we are

ErtiNote is published by ErtiCloud, an individual entrepreneur registered in Georgia ("we", "us"). We are the controller of the personal data processed through the Website and when you contact us.

You can reach us about anything in this policy at contact@ertinote.com.

02What this policy covers

This policy covers the website at ertinote.com (the "Website") and the ErtiNote application once it is released (the "App"). It does not cover websites or services of third parties that we link to.

ErtiCloud Backup, a planned optional paid service, is not offered yet. Before it launches we will update this policy, or publish a separate notice, describing the data it processes.

03The ErtiNote app

The App stores your notes, files and folders in an encrypted vault file at a location you choose. The vault is encrypted on your device with a key derived from your master password. We have no access to your vault, its contents or your master password, and we cannot recover them.

The App does not make network requests and does not collect telemetry, analytics, crash reports or advertising identifiers. Nothing you store in the App is sent to us.

To work properly, the App keeps a few small files in its data folder on your device. They never leave your device:

• Settings — interface preferences and, if you choose one, the folder for backups.
• Recent vaults — the paths of recently opened vault files. You can turn this list off in the settings.
• Vault revisions — for each vault, an identifier and a revision number, used to warn you if a vault is replaced by an older copy.

If you export a file or open it in another application, the decrypted copy is outside the vault and is handled by your operating system and that application.

04The website

The Website is a static site. It sets no cookies, runs no analytics, advertising or tracking scripts and loads no resources from third parties; fonts and images are served from our own server.

The Website saves two preferences in your browser’s local storage: your light or dark theme (key theme) and, if you pick one in the language menu, your language (key lang). They stay on your device, are not sent to us, contain no personal identifiers and can be removed by clearing your browser’s site data.

When you open the English version of the Website, a script in your browser compares your browser’s preferred languages with the languages of the Website and, if one matches, opens that language version. This happens only in your browser; nothing is sent to us or stored.

When you visit the Website, the web server automatically processes technical data needed to deliver pages and keep the service secure: your IP address, the date and time of the request, the requested address, the response status, the referring page and your browser’s user agent. The server is operated by our hosting provider, which processes this data on our behalf. The logs are rotated automatically and kept only as long as needed to operate and secure the Website; a specific entry may be kept longer only if it is needed to investigate abuse or a security incident.

We process this data on the basis of our legitimate interest in operating a secure website (Article 6(1)(f) GDPR and the corresponding provisions of the Law of Georgia on Personal Data Protection). We do not use it to identify you, build profiles or combine it with other data.

05When you contact us

If you email us, we process your email address, your name if you include it and the content of your message in order to reply. The legal basis is our legitimate interest in answering enquiries, or the steps needed before entering into a contract with you where your message is about one.

We keep correspondence for as long as needed to handle your request and any follow-up, and then delete it unless we are required by law to keep it. Our email is handled by an email service provider acting on our behalf.

06Purchases and payments

Paid subscriptions to ErtiNote are sold by our online reseller Paddle.com Market Limited (“Paddle”), which acts as Merchant of Record. When you buy a subscription, Paddle collects and processes the data needed for the order — such as your name, email address, billing country and postcode, payment details, a tax identification number if you provide one, and the IP address used at checkout — as an independent controller under the Paddle Privacy Policy. The checkout is provided by Paddle and may use cookies and similar technologies, as described in Paddle’s policy.

Paddle shares with us the order data we need to provide and support your subscription: your email address, your name if provided, your country, the plan, the price and taxes, order and subscription identifiers, and the status of payments, renewals, cancellations and refunds. We never receive your full card number or other payment credentials.

We use this data to provide the paid features, to answer billing questions, to process refunds and to meet our accounting and tax obligations. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR) and compliance with our legal obligations (Article 6(1)(c) GDPR). We keep order records while the subscription is active and afterwards for as long as accounting and tax law requires.

ErtiCloud Backup is designed so that backups are encrypted on your device before upload, so the service stores only data that it cannot read.

07Who receives data

We do not sell personal data and do not share it for advertising. Data is disclosed only to:

• our hosting and email providers, which process it on our behalf and under our instructions;
• once paid services launch, the payment reseller described above;
• authorities, where we are legally required to disclose it.

08International transfers

Our providers may process data outside your country, including outside the European Economic Area and the United Kingdom. Where that happens, we rely on an adequacy decision or on appropriate safeguards such as standard contractual clauses.

09Your rights

Depending on where you live, including under the GDPR, the UK GDPR and the Law of Georgia on Personal Data Protection, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format, where applicable;
• lodge a complaint with a supervisory authority — in Georgia, the Personal Data Protection Service, or the authority where you live or work.

To exercise these rights, email contact@ertinote.com. We will reply within the time required by law, usually within one month. We may need to verify your identity first.

10Children

The Website and the App are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.

11Security

We protect the data we process with appropriate technical and organisational measures. How the App protects your vault, and the limits of that protection, are described in our security principles.

12Changes to this policy

We will update this policy when our products or legal requirements change, in particular before any paid service launches. The version and effective date at the top of this page show when it last changed. Material changes will be announced on the Website.