Privacy notice for juunote

Last updated: 7 October 2026

1. Who is responsible

juunote, this website and the admin area are provided by juunit GmbH, Eschborn, Germany (address in the legal notice). Contact: info@juunit.com.

There are two roles:

• Website, admin area, contract and billing: juunit GmbH is the controller.
• Conversation content in the app (transcripts, minutes, notes, speakers): the company using juunote is the controller. Where such data passes through juunit servers, juunit acts as processor under Art. 28 GDPR (data processing).

2. This website

The website sets no cookies, uses no advertising services and loads no fonts or scripts from third-party servers. For technical reasons the web server keeps an access log: IP address, time, requested address, browser identifier and status code. The purpose is secure operation (troubleshooting, defending against attacks); the legal basis is Art. 6(1)(f) GDPR. Logs are deleted after 14 days.

The website is operated by Hetzner Online GmbH in a data centre in Falkenstein (Germany). It forwards the details from the contact form and the newsletter sign-up to our server at Hetzner in Helsinki (Finland, EU) and does not store them itself.

Visitor statistics

To see how the website is used, we count visits with Umami. We run the software ourselves on the web server in Falkenstein; the data goes to no one else. We record the page visited, the page you came from, browser, operating system, device type, screen size and language, the country, region and city derived from the IP address, and individual actions such as a click on “Download” or a submitted form — without its content. We do not store the IP address itself for this. Umami sets no cookies and stores nothing on your device: to count visits, it derives an identifier from IP address, browser identifier and a random value that changes daily, which can no longer be linked to you the next day. If “Do Not Track” is switched on in your browser, we do not count you. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to improve the website and to see which content is in demand. We delete the statistics after two years.

In addition, we count there how many companies register for the trial, create their first minutes and take out a subscription. Our server reports these figures as plain counts, without names, company, email address or any other link to a person. If you would rather not be counted on juunote.de at all, you can switch it off under Don’t count this browser; when you click, we store a flag in your browser for this.

Contact form

If you write to us using the contact form, we process your request topic, name, email address and message, and optionally your company, phone number and the tools you use, plus the page you came from. The purpose is to answer your request; the legal basis is Art. 6(1)(b) GDPR where a possible contract is concerned, otherwise Art. 6(1)(f) GDPR. The request is stored on our server (Hetzner, Helsinki) and forwarded by email to our service team; we send emails via the Microsoft 365 tenant of juunit GmbH. You receive a confirmation of receipt. We delete requests once they have been dealt with and are no longer needed, at the latest after one year — unless a contract results from them, in which case its retention periods apply.

Booking an appointment

For appointments we link to the calendar of juunit GmbH at Calendly (Calendly LLC, USA). The website loads nothing from Calendly; only when you click the link does Calendly open in a new tab, and Calendly's privacy notice applies. We use the details you enter there to prepare and hold the appointment (Art. 6(1)(b) GDPR).

Newsletter

We only send the newsletter with your consent (Art. 6(1)(a) GDPR) and only after you have confirmed it via the link in our confirmation email (double opt-in). For this we store your email address, the time and IP address of sign-up and confirmation, and the wording of the consent — so that we can prove that you consented. We send the emails via the Microsoft 365 tenant of juunit GmbH. You can withdraw your consent at any time, via the link in every email or by writing to us. We delete unconfirmed sign-ups after 30 days; after you unsubscribe, we keep the proof for at most three years.

3. The juunote app

What stays on your device

Recording and speech recognition (Whisper) run locally. On Mac and Windows the audio only exists in memory and is discarded after transcription. On iPhone, audio segments are briefly buffered on the device until they are transcribed and then deleted. Transcripts, minutes and notes are kept in an encrypted database on the device. Deleted meetings go to the trash and are permanently deleted after 30 days.

Speaker separation derives voice features from the audio to tell speakers apart. Permanent voice profiles, which let juunote recognise people in later conversations, are only created if you switch this on explicitly and save a voice. They never leave the device and can be deleted at any time. Voice profiles are biometric data (Art. 9 GDPR); the person recognised must have consented beforehand.

What leaves the device

The AI gateway stores no conversation content, only usage figures. Microsoft processes the requests in juunit’s Azure resource (Sweden region), does not use them for training and, according to Microsoft, retains them for at most 30 days for abuse monitoring. Because the models run as a global deployment, Microsoft may compute an individual request in a data centre outside the EU; this is based on the EU standard contractual clauses and the EU-US Data Privacy Framework. ElevenLabs processes in the USA, also based on the EU standard contractual clauses.

Legal bases: performance of the contract with your company (Art. 6(1)(b) GDPR) and our legitimate interest in secure, error-free operation (Art. 6(1)(f) GDPR).

4. Admin area, registration and billing

You sign in to the admin area with your company’s Microsoft 365 or Google Workspace account. We store name, email address, the identifiers of person and company (for Google, the account identifier and the Workspace domain), the acceptance of terms and DPA (version and time) and a sign-in log with IP address. The admin area sets a technically necessary session cookie; signing in with Google adds two more that secure the sign-in and expire after at most ten minutes. From Google we only receive name, email address and identifier, no access to mail, calendar or files. Payments are handled by Stripe (Stripe Payments Europe Ltd., Ireland); you enter card and account details directly at Stripe, we do not receive them. We keep billing data for as long as commercial and tax law requires.

5. Service providers

The complete list of sub-processors is part of the data processing agreement.

6. How long we keep data

We keep account data for as long as the account exists. Usage figures are kept for billing, sign-in logs for up to one year. Shared content stays on the hub until it is withdrawn or the account is deleted. When the contract ends we delete the company’s data unless a statutory retention obligation applies.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). For conversation content, please contact the company using juunote first. You can also lodge a complaint with a data protection supervisory authority; ours is the Hessian Commissioner for Data Protection and Freedom of Information.