Consent to the Cross-Border Transfer of Personal Data
Last updated July 26, 2026
Effective 10 September 2026 · Version 1.4
The Company's servers and processors are located in the United States. Under Article 28-8 of the Personal Information Protection Act, we request your consent to transfer personal data abroad as set out below.
1. Recipients, country, timing and method, items, purposes and retention
| Recipient | Country | Timing and method | Items transferred | Purpose | Retention |
|---|---|---|---|---|---|
| Supabase, Inc. | United States | At the time you use the Service, over an encrypted connection (TLS) | Account data (email, account identifier), end-to-end encrypted content, service usage records | Authentication, database, encrypted file storage and sync | Until you delete the data or your account |
| Vercel, Inc. | United States | At the time you use the Service, over an encrypted connection (TLS) | Access records created when you use the web service (IP address, request time, request path, browser information) | Hosting and delivery of the web service (recnovo.com, app.recnovo.com) | Deleted per the processor's access-log retention policy |
| Amazon Web Services, Inc. | United States | At the time you use the Service, over an encrypted connection (TLS) | A sealed value used to protect the encryption key (contents not readable) | Secure custody of the value that protects encryption keys | Until you delete the data or your account |
| Anthropic, PBC | United States | At the time you use the Service, over an encrypted connection (TLS) | Text data sent at the time of processing, such as transcripts | AI text processing (summaries, organized notes, translation, answers, study material) | Kept up to about 30 days for abuse monitoring, then deleted; never used for model training |
| ElevenLabs Inc. | United States | At the time you use the Service, over an encrypted connection (TLS) | the original recording audio and the transcript and speaker-separation data derived from it | speech recognition (transcription) and speaker separation | held in the provider's request history; deleted when we request deletion, after which it may remain in the provider's backups for up to about 30 days before expiring. The Company has turned off the setting that lets this provider use data to improve its models, so data sent after that change is not used to train the provider's models. That rests on the account setting rather than on a separate contract. The Company does not use your content to train the Company's AI models. |
| OpenAI, L.L.C. | United States | At the time you use the Service, over an encrypted connection (TLS) | Audio and text sent at the time of processing | Speech recognition, search indexing, AI chat responses, backup AI processing | Kept up to about 30 days for abuse monitoring, then deleted; never used for model training |
| Microsoft Corporation | United States | At the time you use the Service, over an encrypted connection (TLS) | Audio and text sent at the time of processing | Backup (fallback) processing for speech recognition and search indexing | Kept up to about 30 days for abuse monitoring, then deleted; never used for model training |
| Functional Software, Inc. (Sentry) | United States | At the time you use the Service, over an encrypted connection (TLS) | Anonymous error and crash diagnostics, app version, device type | Fault and error diagnosis, service stability | Deleted per the processor's retention policy |
| RevenueCat, Inc. | United States | At the time you use the Service, over an encrypted connection (TLS) | Purchase receipts, subscription status, account identifier | Verifying and managing subscriptions and purchases | Until you delete your account |
| Plus Five Five, Inc. (Resend) | United States | At the time you use the Service, over an encrypted connection (TLS) | Email address and the content of the message sent (e.g. sign-in codes) | Transactional email for sign-in and authentication | Deleted per the processor's retention policy once sent |
Stored content is encrypted on your device before transfer, so the recipients — meaning the processors listed above, not anyone you choose to send a share link to — cannot read it. Transcription and AI processing inherently need plaintext at the moment of processing, so the data is sent only then. Turning off “Cloud AI processing” in the app's settings stops transcription, AI summaries, organized notes and chat, transcript sync and audio backup. It does not stop sign-in and account management, subscription and credit checks, error diagnostics, or credit-funded cloud search — so it is not a switch that ends every transfer.
2. Recipients' privacy contacts
Each recipient's privacy contact is the one published on its official website.
Contact the Company at hello@recnovo.com and we will provide it, or pass your enquiry on for you.
3. Level of protection in the destination country
The United States may not provide the same statutory protections as Korea. The Company compensates with encryption in transit (TLS), end-to-end encryption of stored data, least-privilege access controls, and data processing agreements with each processor.
4. Your right to refuse, and what refusing means
You have the right to refuse consent to this cross-border transfer.
Because the Company's servers are in the United States, refusing means you cannot sign up or use cloud features (transcription, AI processing, sync). On-device local recording in the mobile app remains available without consent.
After signing up you can also turn off “Cloud AI processing” in Settings, which stops audio and text being sent for transcription and AI processing. Communication needed to run the service — sign-in, account management, subscription and credit checks, error diagnostics — continues.
5. Contact
Privacy Officer: Junmee You (Representative Director) · hello@recnovo.com
You may request that the cross-border transfer be suspended; the related features will then be unavailable.