Frequently asked questions
Secure notetaking
You record a conversation with an app. Where does that recording go, who can access it, and when is it gone? With Notuly the answer is simple: processed in Amsterdam, the report in your email, the audio deleted within a minute.
Available on macOS, Windows, iOS and Android.
Used by people at these organisations.
The basics
Secure notetaking means you stay in control of what happens to the recording of your conversation. Where does the audio go? How long is it kept? Is your conversation used to train AI? And who can get at your reports?
Those questions matter the moment you use a meeting notes app. Every app that records your conversation sends the audio somewhere to be processed. For some apps that's a server in the Netherlands. For others it's a server in the US, run by a company you've never heard of.
You can't always see the difference. Most apps promise your data is "safe". But safe can mean almost anything. Safe with encryption, yet stored indefinitely. Safe behind a password, yet accessible to the vendor. Safe by American standards, but not under the GDPR.
And the law plays a part too. When you process a conversation for work, the GDPR asks for openness: you tell the participants what you capture and why. If an external service processes the recording, you're processing personal data through a third party. That calls for a data processing agreement.
The risks
The risks aren't in the app itself, but in what happens to your audio after the conversation: storage on foreign servers, use for AI training, and no control over who can access it.
After the conversation your recording is processed. With many apps it then stays put. Sometimes for days, sometimes for months, sometimes indefinitely. Your salary negotiation, your client conversation, your management meeting: all sitting in the archive of a company you've never met.
Many AI tools use your data to improve their models. Sometimes the terms say so, sometimes they don't. Fragments of your conversation then feed a system your competitor works with too.
As soon as you use an app that records conversations, you're processing personal data through a third party. The GDPR requires a data processing agreement for that. Not every app offers one. Without it, the liability is yours, not the app's.
Checklist
These aren't theoretical risks; they come with any app that stores your data. So how do you check? With five questions, and they apply to every provider. Not just to Notuly.
Short answer
You can check for yourself whether a notetaking app is secure in the provider's privacy statement and data processing agreement. Look at five points: where the audio is processed, how long it's kept, whether your data is used for training, which sub-processors are involved and whether a data processing agreement is available.
In the Netherlands? In the EU? Or in the US, where different privacy laws apply? Data that leaves the EU falls under different legislation. For confidential conversations, that matters.
Is your recording deleted straight away, or does it sit around for days or weeks? Every day your audio spends on a server somewhere is a day of extra risk. Ask specifically about the retention period.
With many apps it is, by default. Sometimes you can turn it off, sometimes you can't. It pays to read the terms. If they say nothing about it, don't assume it isn't happening.
Using the app for work? Then you're processing personal data through an external service. The GDPR requires you to put a data processing agreement in place with the provider. Not every app offers one. Ask before you start.
The reports the app produces: are they yours? Or does the provider claim rights to them? Check the terms. You don't want your reports to belong to someone else.
If an app has a good answer to all of these questions, you can work with it safely. Whichever app it is. Together, these questions form the requirements you use to select notetaking software for your organisation.
The audio is deleted within a minute of processing. Once your report has been sent, we no longer hold your data. What we don't keep can't leak.
We work in line with:
ISO 27001.
We work in line with ISO standards. Our data servers run in an ISO 27001-certified data centre in Amsterdam.
The rules
In the Netherlands you may record a conversation you take part in yourself, even without announcing it. When you process the conversation for work, the GDPR asks for openness towards the participants. Recording a conversation you're not part of is a criminal offence.
Two layers. The first: you may record a conversation you're part of (Dutch Criminal Code, Article 139a); no announcement is required for the recording itself. The second: when you process the conversation for work, the GDPR asks for openness. Saying it out loud at the start is enough; written consent isn't needed. That applies around the table and in an online meeting.
What you may not do: record a conversation you're not part of. Leaving a microphone in a meeting room and walking out is a criminal offence. The situations and the exceptions are set out on can you record a meeting.
A practical tip: open every conversation with "I'm recording this, so we don't have to write up the report ourselves. All right?" Most people are perfectly happy with it.
If an app processes the recording, you're processing the participants' personal data. The GDPR then applies: Article 6 for the legal basis, Article 28 for the processor. You need a data processing agreement with the provider; without one, you're the one liable if something goes wrong. What it should contain is on data processing agreement. At Notuly it's available on Team and above (see pricing).
Two things remain your responsibility, whichever app you choose: you say you're recording, and you check the report before you share it. Notuly is a clever app, not a person.
On top of the GDPR, each sector adds its own standards: for government the BIO and the Dutch Open Government Act, in healthcare the Dutch NEN 7510 standard, and for legal and financial professionals, professional confidentiality. Below is what that means for your conversations.
Sectors
BIO standards and data inside the EU. And the Dutch Open Government Act: if a conversation is stored, it can be requested. With Notuly there's nothing held by the vendor to request; the audio no longer exists and the report sits in your own mailbox. Read more at Notuly for local government.
The Dutch NEN 7510 standard for information security. Client conversations carry medical or personal information; confidentiality is a requirement, not an option. Audio that disappears at once means nothing drifting around in a system where it doesn't belong. Read more at Notuly for healthcare.
Professional confidentiality. A solicitor or accountant recording client conversations through an app that stores data in the US runs a real risk. With Notuly the report stays in your own mailbox, not in an external archive. Read more at Notuly for lawyers.
If your profession comes with a duty of confidentiality, there's a page per profession on what recording and writing up means: for the lawyer and the notary (professional confidentiality), for the psychologist and the physiotherapist (professional confidentiality and the GDPR in healthcare), and for coaching (confidentiality through the code of conduct).
Compare
We put the public privacy documentation of eleven widely used notetaking and transcription apps next to Notuly's. The biggest finding isn't the server location, it's the storage. Nearly every app keeps your text by default, often indefinitely; some keep the audio too. Notuly deletes both: the audio within a minute of processing, the text once the email has been sent.
Location and retention are two separate axes, too. A European provider can still keep things for a long time, and an American one can delete properly. So always check both. And American processing means your conversation falls under American law. Why that matters is on keep your data in the EU.
The big meeting platforms offer AI features of their own too, usually under an existing contract. Microsoft Copilot processes through Microsoft and OpenAI, often in the US, and stores in the Microsoft cloud. And anyone who pastes a conversation into ChatGPT has quietly added a processor. How that works is on is ChatGPT GDPR compliant and AI tool data breaches.
The comparison per tool, feature by feature: Notuly vs Copilot, Notuly vs Fireflies and Notuly vs Otter. Five tools side by side are in best AI notetakers in Europe. Want to run the test yourself first? Use the framework on choosing a GDPR-compliant AI tool.
The process
This is the route your audio travels. Short, straightforward, and nothing left at the end.
Open the app or start Notuly in your online meeting and press the record button. Around the table? Phone in the middle. The audio travels encrypted to our servers in Amsterdam.
Our own AI, with no Big Tech in the chain. The single sub-processor is based in the EU and may not keep your audio or train on it.
Everyone gets the report with the decisions and action points by email. The audio is deleted within a minute of processing; the text follows once the email has been sent.
There is no step four. No archive, no backup, no "just in case". It's gone. How the report itself comes together is on automatic meeting notes.
On all your devices
Meeting on Teams, Zoom or Google Meet? The desktop app takes the notes straight from your laptop. And the iPhone and Android apps capture every conversation on the go.
Secure notetaking means you stay in control of what happens to the recording of your conversation: where the audio goes, how long it's kept, and whether it's used for AI training.
Notuly processes in line with the GDPR: servers in Amsterdam, your data never leaves the EU, the audio is deleted within a minute of processing, and a data processing agreement under Article 28 is available on Team and above.
In Amsterdam. The data stays in the Netherlands and never leaves the EU. There is no international transfer.
No. Not now, not ever. It's in our privacy policy too: notuly.app/privacy-policy.
The audio is permanently deleted within a minute of processing. The text is deleted once the email has been sent. After that, we hold nothing.
For the recording itself there's no notification duty when you take part in the conversation yourself. The moment an organisation processes that conversation, the GDPR asks for openness about what you record and why. One sentence at the start of the conversation covers it, and it's the decent thing to do. The rules per situation are on notuly.app/can-you-record-a-meeting.
Yes. Under Article 28 of the GDPR, available on Team and above. On Enterprise we can arrange a custom DPA. Email team@notuly.nl.
Notuly reports data breaches to the Dutch Data Protection Authority within 72 hours. Business customers are informed within 48 hours. Because we store nothing, the attack surface is minimal.
Copilot processes audio through Microsoft/OpenAI, usually on servers in the US. The audio is stored in the Microsoft cloud. With Notuly everything runs on our own servers in Amsterdam. The audio is deleted within a minute of processing.
A data processing agreement is a contract between you and a service provider that processes personal data on your behalf. The GDPR requires you to arrange one when you use a notetaking app for work. At Notuly it's available on Team and above.
Phone on the table or the desktop app switched on. Have the conversation, the report in your email, the audio gone. Three conversations free each month, no payment details needed.