Privacy Policy
Qenot is operated by Ahamed Munsif, an individual sole trader based in Sri Lanka. This policy explains exactly what we collect, what leaves our servers, and what you can do about it. It describes what the software actually does — not a template.
What we collect
- Account — your email address, and your name and profile picture if you sign in with Google.
- What you upload — notes, slides, PDFs, past papers, scanned pages, and the text extracted from them.
- What you produce — generated notes, flashcards, quizzes, exam attempts, answers, grades and progress.
- Usage — counts of operations, for enforcing plan limits.
- Errors — technical diagnostics when something breaks.
We never see your password or your card details. Authentication is handled by Supabase and payment by Dodo Payments.
What leaves our servers — read this part
To generate study material and mark your answers, Qenot sends extracts of your uploaded material to third-party AI providers. This is the core of how the product works, and you should know exactly who receives it:
- Google Gemini
- Groq
- OpenRouter
- NVIDIA NIM
These providers process the text to return a result. They are not permitted to use it to train their models under the API terms we operate on. We send only what a given task needs — not your whole library.
If a document is confidential, do not upload it. That is the honest advice, and it applies to any AI study tool, not only this one.
Who else processes your data
- Supabase — database, file storage and authentication.
- Dodo Payments — payments. They are the merchant of record and receive your billing details. We never receive your card number.
- Resend — transactional email such as confirmation and password reset.
- Sentry — error reporting, with personal data scrubbed.
Why we are allowed to process it
- To provide the service — performing our contract with you.
- To keep it working and safe — our legitimate interest in security and abuse prevention.
- To meet legal duties — tax and accounting records, handled by our merchant of record.
How long we keep it
- Your content — until you delete it, or 30 days after you delete your account.
- Account records — while your account exists.
- Payment records — as long as tax law requires, held by Dodo Payments.
- Error logs — 90 days.
Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or stop processing it. If you are in the EU/UK (GDPR) or California (CCPA/CPRA), those laws give you these rights explicitly — we apply them to everyone rather than checking where you are.
Delete your account yourself from settings, or email [email protected]. We respond within 2 business days.
We do not sell your personal information, and we do not share it for advertising.
Cookies
We use cookies only to keep you signed in. There is no advertising tracking and no third-party analytics on qenot.com.
Security
Traffic is encrypted in transit. Passwords are hashed by Supabase and never reach our servers. Sessions are stored in cookies that JavaScript cannot read. Access to production data is limited to the operator.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority without undue delay.
Children
Qenot is not directed at children under 13. If you believe a child has given us personal data, email us and we will delete it.
International transfers
Qenot is operated from Sri Lanka, and the providers listed above process data in other countries including the United States and the European Union. Using the service means your data is transferred to those countries.
Changes
We will announce material changes in the app or by email before they take effect.
Last updated 12 September 2026. Questions? Email [email protected].