Privacy Policy

Compendly ("we", "us") provides a service that turns lecture recordings, audio, and slides into structured study notes. This policy explains what information we collect, why, and what rights you have over it.

Account information: your email address and authentication details, handled by our authentication provider, Supabase.

Content you provide: the video, audio, and PDF files you upload or record, and the study notes generated from them.

Payment information: if you subscribe to a paid plan, payment is handled entirely by Stripe. We never see or store your card details ourselves.

Usage data: basic technical information needed to run the service, such as job status, credit usage, and timestamps.

We use your information to: provide and operate the service (processing your uploads into notes), manage your account and credits, process payments and billing, and communicate with you about your account (e.g. billing issues, support requests). We do not sell your personal information, and we do not use your uploaded content to train AI models.

To provide the service, we share data with a small number of processors, only as needed to do their specific job:

• Supabase — authentication, database, and file storage.
• Third-party AI providers — transcribe the audio in your uploads, generate your study notes from the transcript and slide images, and, when you ask for it, translate the text of your finished notes into another language (the images in your notes are not sent for this).
• Stripe — processes payments for paid plans.
• Hetzner and Vercel — host our backend (Hetzner, in the EU) and website (Vercel).
• Sentry — error monitoring for our backend. It receives technical error details and job identifiers, not your files or notes, and we configure it not to collect personal data.
• PostHog — product and website analytics. See "Cookies and local storage" below for how this is gated by your consent.
• Google Analytics and Google Ads — website analytics and, if you arrived via a Google ad, measuring whether that ad led to a signup or purchase. See "Cookies and local storage" below for how this is gated by your consent.

Each of these providers processes data under their own privacy policy and data protection commitments.

Some of these providers, including our AI providers, are located in the United States. When your content is sent to them, the transfer relies on the EU's standard contractual clauses or the EU-US Data Privacy Framework, as applicable.

If you start checking out on a paid plan, we send billing and checkout details from Stripe — such as your plan, billing status, payment history, and whether a checkout or payment attempt succeeded or was abandoned — into PostHog. This applies whether or not the payment completes. We never send full card numbers; Stripe never shares those with us in the first place. We do this to understand how customers use the product and where people run into friction while paying, so we can improve both. Unlike the analytics described below, this data transfer is not triggered by your cookie choice on our website — it is a direct link between your Stripe activity and your account, maintained as part of running our paid plans. You can request details of what is shared, or ask us to stop, at any time by contacting us (see "Contact us" below).

As the operator of Compendly, we may directly access your uploaded files and generated study notes when necessary. For example, to investigate a failed or reported processing job, respond to a support request, detect abuse of the service, or comply with a legal obligation. We do not access your content routinely or for any other purpose.

We use one strictly necessary cookie set by Supabase to keep you signed in, and store a single, non-identifying preference (light/dark mode) in your browser's local storage. Neither is used for tracking or advertising, and under applicable law neither requires a consent banner — strictly necessary cookies are exempt.

With your consent, given through the cookie banner shown when you first visit, we also use PostHog for analytics: page views, feature usage, and session recordings of how you navigate the app (with your own document and course names hidden from these recordings). These recordings are also analyzed automatically by an AI feature in PostHog (Replay Vision), which looks for bugs, errors, and points where people get stuck. It is used only to improve the product, and it only sees what the recording contains, so it never sees your hidden document and course names. If you're signed in, this activity is linked to your account email so we can tell real usage apart from our own testing — it is not shown inside the recordings themselves. If you decline, none of this runs, and no PostHog cookie is set.

We also use Google Analytics (GA4), and, if you came from a Google ad, Google Ads, to see which pages are used and whether an ad led to a signup or purchase. The Google Analytics script itself loads on every visit, but with your consent choice applied through Google's "Consent Mode": if you decline, it does not set a cookie or send any data that could identify you — at most an anonymous, aggregated signal with nothing tied to your visit specifically. Only if you accept does it set the regular Google Analytics/Ads cookies and link your activity, including a subsequent ad click, to your visit. You can accept, decline, or change this choice at any time via the cookie consent icon shown on the page.

Uploaded video and audio files are processed and then deleted from our servers, typically within a couple of hours. Generated study notes are kept in your account until you delete them yourself from your job history. If you delete your account, we delete your associated data, other than what we're legally required to retain (e.g. billing records).

If you upload or record a lecture, meeting, or other audio/video that includes other people — a lecturer, classmates, colleagues — you are solely responsible for having the right to record, upload, and process that content. This includes complying with any recording consent laws, institutional policies, or agreements that apply to you.

We do not review uploaded content before it is processed, and we take no responsibility for content submitted without the necessary rights or consent. We expressly distance ourselves from any use of the service that violates another person's privacy or legal rights, and we reserve the right to suspend accounts we become aware are being used this way.

The service is provided on an "as is" basis. You are responsible for how you use Compendly and for the accuracy of any notes it generates — we recommend reviewing generated notes before relying on them academically. To the fullest extent permitted by law, we are not liable for any damages, losses, or consequences arising from your use of the service, including content you upload or generate. See our Terms of Service for the full terms governing your use of Compendly.

We rely on reputable providers (Supabase, Stripe, Hetzner, Vercel) that maintain industry-standard security practices, and data is transmitted over encrypted connections. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete your account and its data directly from your account settings, or contact us below. If you're in Norway or the EU/EEA, you also have the right to lodge a complaint with your local data protection authority (in Norway, Datatilsynet).

Compendly is not directed at children under 13, and we do not knowingly collect personal information from them.

We may update this policy from time to time. If we make material changes, we'll update the date at the top of this page.

Questions about this policy or your data? Email us at hello@compendly.com.