Privacy Policy
Effective: November 2, 2026
1. Who We Are
Penlo is operated by Michał Włosik EFC, ul. Północna 16/5, 54-105 Wrocław, Poland (NIP: 8942747708). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). In this policy, "we", "us", and "our" refer to the operator. "You" and "your" refer to you, the user of the Penlo web and Android apps and associated services (collectively, the "Service").
2. What Penlo Does
Penlo turns handwritten notes from e-ink tablets into searchable text. Notes reach Penlo in one of two ways: from a cloud storage folder you connect (Dropbox or OneDrive), or straight from a BOOX tablet running the Penlo Android app, which uploads notebook PDFs to Penlo without a cloud service in between. Penlo then processes each PDF through an AI model for handwriting recognition and text cleanup, stores the resulting text in your Penlo account, and lets you export it, for example as Markdown, plain text or PDF files, to Notion, or by email.
On the Power plan, Penlo also offers Penlo AI, a chat assistant that answers questions from your notes, and an MCP (Model Context Protocol) integration that lets you connect AI assistants such as Claude, ChatGPT, Claude Code or Cursor to your Penlo account, so the assistant can search and read your notes. Both are opt-in. The MCP connection is read-only.
Penlo only accesses files in the specific folder you designate as your sync folder. It does not browse, index, or read any other files in your cloud storage accounts. It never edits, moves or deletes your files; if you turn on auto-export, it adds Markdown or text copies of your notes to that folder.
3. Eligibility
Penlo is intended for users aged 16 and older. By using the Service, you confirm that you are at least 16 years of age. We do not knowingly collect data from anyone under 16.
4. Data We Collect
4.1 Account data
- Email address, used for authentication and account management.
- Display name and profile photo, provided by Google if you sign in with Google.
- Password, if you sign up with email and password. It is hashed by Supabase Auth and never stored in plain text.
- Two-step verification, if you turn it on. Supabase Auth stores the authenticator secret needed to check your codes.
- Authentication tokens, managed server-side via Supabase Auth.
4.2 Cloud storage connections and linked tablets
When you connect a cloud storage provider, we store OAuth access and refresh tokens, the account identifier, token expiry time and the sync folder you choose. The tokens are encrypted in the database with a separate key kept in a secure vault and are never sent to your browser.
When you link a tablet, we store its name and model, when it was linked, last seen and last uploaded, and a hash of its access token (the token itself is kept only on the tablet).
4.3 Notebook and note data
For each notebook, we store: notebook metadata (file path, display name, sync timestamps), note versions (content hash, PDF storage path, page count, OCR status, AI summary), PDF files and page thumbnails (in Supabase Storage), OCR text and word coordinates, corrections you make to the text (together with the original OCR text, so you can revert), tags, and vector embeddings of your note text that power search by meaning in Penlo AI.
4.4 Destination connection data
If you connect Notion, we store your Notion integration token, workspace name and the selected parent page or database ID, used only to create or update pages in your Notion workspace when you send a notebook there. Notion only gives Penlo access to the pages you choose to share with it.
4.5 Settings and preferences
Your configuration choices are stored in your user profile, including: the source Penlo syncs from, which sources are shown in your library, sync folder path, OCR, text cleanup and summary settings, export preferences, how long new share links last, and theme and interface preferences.
4.6 API keys, AI assistant connections and webhooks
If you use the Penlo REST API or the Claude Desktop extension, we store a hashed version of your API key (the full key is shown once and never stored). If you connect an AI assistant with a link (OAuth), we store the assistant's registration (its name and redirect addresses) and hashed access and refresh tokens, with the time the connection was created and last used. Assistant connections expire 90 days after you approve them, and you can disconnect them at any time. If you configure a webhook, we store the endpoint URL and optional signing secret.
4.7 Shared note links
A shareable link for a notebook is created when you copy a link, email a note to yourself or send it to Notion. Anyone with the link can view the notebook's PDF. You can make new links expire after 7, 30 or 90 days, and see and turn off every link in Settings › Privacy.
4.8 Billing data
Payments are handled by Polar (polar.sh), which acts as merchant of record. We do not see or store your card details. We store your subscription status, plan, billing period end date and Polar customer and subscription identifiers.
4.9 Usage data
We record how many pages are processed with OCR each month and how many Penlo AI questions are asked each day, to apply plan limits.
5. How We Use Your Data, and Why
- Provide the service: authenticate you, sync notes, read handwriting, store and show the results. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
- AI processing: send PDF pages and note text to Google Gemini for handwriting recognition, text cleanup, summaries, embeddings and Penlo AI answers. Legal basis: contract.
- Exports, webhooks, API and MCP access: only when you set them up. Legal basis: contract.
- Billing: manage your subscription with Polar. Legal basis: contract and our legal obligations (Art. 6(1)(c)).
- Service emails, such as trial reminders and important changes, and keeping the Service secure. Legal basis: our legitimate interests (Art. 6(1)(f)); you can opt out of non-essential emails.
- Customer support: respond to your messages.
Penlo does not use your notes to train AI models, and does not sell or rent your data.
6. Service Providers
Penlo relies on these providers. Each receives only what it needs for its task.
| Provider | What it does | Where data may be processed |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Ireland) |
| Google (Gemini API) | Handwriting recognition, text cleanup, summaries, embeddings, Penlo AI | United States and other regions |
| Vercel | Hosting of the web app | United States and other regions |
| Polar | Payments, merchant of record | EU and United States |
| Resend | Emails you request, such as exports, and service emails | United States |
| Dropbox, Microsoft OneDrive, Notion | Only if you connect them | As set by your account with them |
| AI assistants via MCP | Only if you connect them | As set by the assistant's provider |
When you connect an AI assistant via MCP, your note text is returned to that assistant, which forwards it to its own AI provider (for example Anthropic or OpenAI). Penlo does not send your data to those providers itself. You can revoke access at any time in Settings › AI assistants & API.
7. Data Sharing
We do not sell, rent, or trade your personal data. We share data only with: the service providers above, webhook recipients you configure, AI assistants you connect, people who have a shared link you created, when required by law, or in the event of a business transfer.
8. Data Retention
Account data, notebooks, PDFs, OCR text, embeddings, connection tokens, API keys, webhook settings, and preferences are kept for as long as your account exists.
- Deleting a notebook (Delete from Penlo) removes its PDFs, thumbnails, text, summary, embedding, tags and share links straight away. We keep only a minimal record (the file path, the file's content hash and dates) so the same file isn't imported again; it is deleted with your account.
- Hiding a source or archiving a notebook does not delete anything.
- Deleting your account (Settings › Account › Delete account) deletes your account, notebooks, stored PDFs and all their text, and any remaining copies, such as backups, are permanently removed within 30 days.
- Expired or turned-off share links stop working at once.
- Emails we send for you are also kept by Resend for its own limited delivery-log period.
Your original files in your cloud storage or on your tablet are never modified or deleted by Penlo.
9. Data Security
All communication uses HTTPS/TLS. Data at rest is encrypted with AES-256. Cloud access tokens are additionally encrypted with a separate vault key; API keys, AI assistant tokens and tablet tokens are stored only as hashes. Row-level security in the database ensures each account can only access its own data, and links to your PDFs inside the app expire within an hour. You can turn on two-step verification and sign out of every device in Settings › Account. Webhook payloads can be signed with HMAC-SHA256.
10. Your Rights
Under the GDPR and similar laws, you have the right to access your data, correct it, delete it, receive it in a portable format, object to or restrict its processing, and withdraw consent where we rely on it. Many of these you can do yourself: download all your notes in Settings › Privacy, delete a notebook or your account, and turn off links and connections. For anything else, contact hello@penlo.app; we reply within one month.
You also have the right to lodge a complaint with a data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw; you can also contact the authority where you live.
11. International Data Transfers
Our database and file storage are in the EU. Some providers, including Google, Vercel, Polar and Resend, may process data in the United States or other countries outside the European Economic Area. Where they do, we rely on the safeguards those providers offer, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we update the effective date and tell you in the app or by email.
13. Contact
Michał Włosik EFC
ul. Północna 16/5, 54-105 Wrocław, Poland
Email: hello@penlo.app