DRAFT — not yet reviewed or approved by counsel. Not in effect.
Last updated: 2026-11-14 (draft)
Cannoli Privacy Policy
1. Who we are
Cannoli is operated by [CANNOLI ENTITY], [ADDRESS] ("Cannoli", "we"). You can reach our privacy contact at [PRIVACY EMAIL] (privacy@cannoli.ai).
This Policy covers three surfaces: the website at cannoli.ai (the "Website"), your account and billing (the "Account"), and the Cannoli macOS application (the "App"). The App runs in one of three modes that you choose, and what we collect depends on the mode, so this Policy is written mode by mode.
Two roles matter. For the Website and Account, Cannoli is the controller (or "business") of the personal information described here. For the content of your meetings (transcripts, notes, and excerpts of files you choose), the Cannoli customer, your organization, is the controller, and Cannoli acts only as a processor in Managed mode under the Data Processing Addendum at cannoli.ai/legal/dpa. If you took part in a meeting that a Cannoli customer transcribed, that customer decides how your words are used; please contact them. We cannot access, correct or delete transcripts because we do not have them (section 4).
2. Where your data lives
| Local-only mode | Bring-your-own-key mode | Managed mode | |
|---|---|---|---|
| Meeting audio | Your Mac, processed in real time, never saved | Same | Same |
| Transcripts and notes | Your Mac only | Your Mac only | Your Mac only |
| Transcript text in transit | Nowhere | Your Mac → Anthropic, under your own Anthropic account | Your Mac → Cannoli relay (memory only, seconds) → Anthropic, under Cannoli's account |
| Account data (email, devices, plan) | Cannoli, only if you sign in | Cannoli | Cannoli |
| Usage counts | None | None | Number of notes jobs (and, only if an experimental feature is enabled, token counts), per organization per month |
| Payment card | Stripe | Stripe | Stripe |
| Analytics or telemetry | None | None | None |
3. What we collect, and from where
3.1 Website and Account
| Information | Source | Why |
|---|---|---|
| Email address (required); name (optional); organization name | You, at sign-up | Sign-in by email link; identifying your organization |
| Device records: a random device identifier the App generates, device name, App version, macOS version, last-seen time | The App, when you sign it in and when it checks its entitlement | Showing you your devices; letting an administrator revoke one; enforcing seats |
| Subscription and billing status: plan, seats, status, invoice history | Stripe, via webhooks; you, at checkout | Entitlements and billing. Payment card details are collected and held by Stripe, never by Cannoli |
| Usage counts: number of AI-notes jobs (and, only if an experimental feature is enabled, token counts), per organization per month (numbers only) | The relay, in Managed mode | Free-plan limits, fair use, billing |
| Relay request metadata: timestamp, organization, device identifier, job type, model, token counts, latency, status | The relay, in Managed mode | Operating and securing the relay. Never the content of a request |
| Support correspondence | You, when you write to us | Answering you |
| Server request logs: IP address, user agent, timestamp, path, status | Automatic, for every request to cannoli.ai | Security, abuse prevention, debugging. Retained 30 days |
| Download records: App version and date | Automatic, when the App is downloaded | Release statistics. No identity is required to download |
| Session cookie | Your browser, after sign-in | Keeping you signed in (section 12) |
3.2 The App, in every mode
The App processes audio from your microphone and your Mac's system audio while you run a meeting session, and converts it to text with speaker labels, entirely on your Mac, using Apple's on-device speech recognition and an on-device speaker-separation model. Transcripts and notes are written to ~/Library/Application Support/Cannoli/ on your Mac. The App sends no telemetry and has no crash reporter.
If you are signed in, the App makes two kinds of request that carry no content: an entitlement check (device identifier, App version, macOS version; the response is your plan and allowances), at launch and about every six hours; and a software-update check (App version, macOS version), once a day. If you are not signed in, Local-only mode makes neither request.
At first run, the App downloads its speaker-separation model file once from Hugging Face, Inc. That request discloses your IP address to Hugging Face and nothing else. We plan to host the file ourselves so that even this request stays with us.
3.3 Local-only mode
Nothing else leaves your Mac. AI features are off. We receive no transcript text in any form.
3.4 Bring-your-own-key mode
When you ask for enhanced notes, the App sends the transcript text and the notes you typed (and, only if you enabled the experimental research-folders feature, excerpts of files you selected) directly from your Mac to api.anthropic.com, using an Anthropic API key from your own Anthropic account. The key is stored in your Mac's Keychain. Anthropic's terms, privacy policy and retention arrangements with you apply, including any zero-data-retention arrangement your organization has. Cannoli never receives the key or the text and cannot see what you send.
3.5 Managed mode
When you ask for enhanced notes, the App sends the transcript text and the notes you typed (and research-folder excerpts, only if that experimental feature is enabled) to Cannoli's relay at cannoli.ai, which forwards it to Anthropic's API under Cannoli's account and streams Anthropic's output back to the App. Section 4 describes exactly what the relay does and does not do. Anthropic processes the text as Cannoli's subprocessor (section 7).
3.6 Experimental features, disabled by default
The App contains three experimental features that are hidden until you turn them on in its configuration. Nothing below happens unless you do.
Live mode sends transcript text repeatedly during a meeting, rather than once at the end, so more text transits in a session.
Web research lets the AI run web searches with queries derived from your transcript, using Anthropic's server-side search tool, and fetch web pages. Anthropic's search provider receives the queries; the websites fetched receive the request and may log it as they would any visitor.
Research folders let you point the App at folders on your own Mac. Excerpts of those files may then be sent with transcript text to Anthropic, in Managed or Bring-your-own-key mode. The App never reads those folders in Local-only mode and never uploads whole folders.
Each of these is labelled in the App and can be disabled for a whole organization by an Enterprise administrator.
4. What we do not collect
We do not collect, receive, or store:
- Audio. No audio leaves your Mac in any mode, and the App does not save a recording. Audio exists only in memory while it is being transcribed.
- Recordings. There is no audio file to recover, on your Mac or anywhere else.
- Transcripts and notes. Cannoli operates no transcript storage. Your transcripts and notes exist only on your Mac.
- Keyboard input, screen video, or files outside research folders you explicitly select.
- Analytics, advertising identifiers, or tracking cookies. The Website has none. The App has none.
- Your Anthropic API key, in Bring-your-own-key mode.
Managed-mode transit, precisely. In Managed mode, transcript text does pass through Cannoli's relay. The relay is a stateless function: it receives your request, checks your device token and allowance, replaces the token with Cannoli's Anthropic credential, forwards the body unchanged to Anthropic, and streams the response back. The text is held in the relay's process memory only for the seconds the request takes and is not written to disk, a database, a cache or a log; the relay's logs contain the metadata listed in section 3.1 and nothing from the body. Anthropic keeps API inputs and outputs for up to 30 days by default and then deletes them, except where law requires retention or its trust-and-safety systems flag content (then up to two years), and may not train on them (section 7). Cannoli does not currently have a zero-data-retention arrangement with Anthropic, so we do not claim one.
5. How we use information, and our legal bases
Where the GDPR or UK GDPR applies, our legal bases are:
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Website, Account and App; issuing entitlements; forwarding Managed-mode requests at your instruction | Account data, device records, relay metadata | Performance of a contract (Art. 6(1)(b)); for Managed-mode content, we act as processor on the customer's instructions |
| Billing, invoicing, tax | Billing status, usage counts | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax records |
| Security, abuse prevention, debugging | Server request logs, relay metadata | Legitimate interests (Art. 6(1)(f)) in keeping the Service secure and available |
| Fair-use assessment and Free-plan limits | Usage counts | Contract (Art. 6(1)(b)) |
| Support | Support correspondence | Contract; legitimate interests in answering you |
| Service notices (security, terms changes, renewal reminders) | Contract; legal obligation | |
| Product news | Only with your consent (Art. 6(1)(a)); we send none at launch and you may opt out at any time | |
| Legal compliance, disputes | Any of the above as needed | Legal obligation; legitimate interests in defending claims |
We do not use personal information for advertising, profiling, or automated decisions with legal or similarly significant effects. We do not use transcripts, notes or any customer content to train or improve machine-learning models, and our agreement with Anthropic prohibits Anthropic from doing so.
6. Retention
| Data | Retained |
|---|---|
| Transcripts, notes, audio | Not held by Cannoli. Audio is never stored anywhere. Transcripts and notes stay on your Mac until you delete them |
| Transcript text at the relay (Managed mode) | Duration of the request, in memory only |
| Transcript text at Anthropic (Managed mode) | Up to 30 days by default, per Anthropic's published policy; up to two years if flagged by Anthropic's trust-and-safety systems or required by law |
| Account data (email, name, organization, device records) | Life of the account, then deleted within 30 days of account deletion or termination |
| Subscription and billing records | Life of the account plus the period required for tax and accounting (seven years in the US) |
| Usage counts and relay metadata | 13 months, then deleted or aggregated so that no organization is identifiable |
| Support correspondence | Three years after the last exchange, then deleted |
| Server request logs | 30 days |
| Download records | Indefinitely, as counts by version and date; no identity |
| Session cookie | Expires on sign-out or after 30 days of inactivity |
| Encrypted database backups | Overwritten within 30 days after deletion from the live database |
7. Sharing and subprocessors
We share personal information only with the service providers below, each under a written contract limiting their use to our instructions, and as section 7.2 describes. We do not sell personal information and do not share it for cross-context behavioural advertising.
7.1 Subprocessors
| Provider | Purpose | What they receive | Location |
|---|---|---|---|
| Anthropic, PBC | AI model inference in Managed mode | Transcript text and research excerpts you choose to send; the output | USA |
| Vercel Inc. | Website hosting, relay runtime, request logs, file storage for downloads | Everything that passes through cannoli.ai; content in memory only | USA, with a global edge network for static content |
| Neon, Inc. | Account database | Account data, device records, usage counts | USA |
| Stripe, Inc. | Payments, invoicing, tax | Billing contact details, payment card details (held by Stripe only), invoice history | USA |
| Resend | Transactional email: sign-in links and receipts | Email address and the email content | USA |
Anthropic acts as our processor under its Data Processing Addendum (effective February 24, 2025), which incorporates EU standard contractual clauses and UK and Swiss addenda. Its Commercial Terms of Service (effective June 17, 2025), section B, provide that Anthropic may not train models on customer content. Anthropic publishes its own subprocessors at anthropic.com/subprocessors and its SOC 2 reports at trust.anthropic.com. The current list of our subprocessors, with a way to be notified of changes, is at cannoli.ai/legal/subprocessors.
Hugging Face, Inc. is not a subprocessor. The App downloads its speaker-separation model file from Hugging Face once at first run; Hugging Face sees your IP address and nothing else.
7.2 Other disclosures
We may disclose personal information: to comply with law or a binding legal request, after notifying you where the law allows (section 14.7 of the DPA describes how we handle government requests); to protect the rights, safety or property of Cannoli, our customers or the public; to professional advisers under confidentiality; and to a successor in a merger, acquisition or sale of the Cannoli business, who will be bound by this Policy. In each case we disclose only what is necessary. We hold no transcripts, so no legal request to us can produce them.
8. International transfers
Cannoli is in the United States and processes personal information there, as do our subprocessors. If you are in the European Economic Area, the United Kingdom or Switzerland, your personal information is transferred to the United States. For customers, the transfer is governed by the EU standard contractual clauses (Modules Two and Three), the UK Addendum and the Swiss modifications incorporated in our DPA. We do not participate in the EU-US Data Privacy Framework. For individuals using the Website, we rely on the standard contractual clauses with our subprocessors and on the necessity of the transfer to perform our contract with you.
9. Your rights
9.1 Everyone
You can view and correct your account information in the Account, revoke devices, download your invoices through the Stripe portal, and delete your account from the Account page or by writing to [PRIVACY EMAIL]. Deletion removes your account data within 30 days, subject to the retention table.
9.2 EEA, UK and Switzerland
You have the right to access, rectify and erase your personal information, to restrict or object to processing, to data portability, to withdraw consent where processing is based on consent, and to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office). Where we rely on legitimate interests, you may object, and we will stop unless we have compelling grounds. To exercise these rights, write to [PRIVACY EMAIL]. We respond within one month, extendable by two months for complex requests, and will tell you if we extend.
9.3 California and other US states
If you are a California resident, the CCPA gives you the right to know what personal information we collect, use and disclose (this Policy, and a copy on request); to delete it; to correct it; to opt out of sale or sharing; to limit use of sensitive personal information; and not to be discriminated against for exercising your rights. Residents of other states with comprehensive privacy laws have similar rights.
We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months. We do not knowingly collect personal information of consumers under 16. We collect no sensitive personal information through the Website or Account. The categories we collect are identifiers (email, name, device identifier, IP address), commercial information (subscription and billing status), and internet activity (request logs, usage counts), from the sources and for the purposes in sections 3 and 5, disclosed to the service providers in section 7.
To exercise your rights, write to [PRIVACY EMAIL]. We verify requests by sending a confirmation link to the email on the account; for requests about content you may have spoken in a customer's meeting, we will refer you to that customer, as the business that controls it. You may use an authorized agent if the agent provides your signed permission. We respond within 45 days, extendable once by 45 days with notice. If we decline a request, you may appeal by replying to our decision, and we will respond within 45 days with reasons.
9.4 Meeting participants
If you were a participant in a meeting transcribed with Cannoli, the transcript is on the Cannoli customer's Mac and the customer is responsible for your rights in it. We will forward a request to the customer where we can identify them, but we cannot act on the transcript ourselves because we do not have it.
10. Security
Transcripts and notes stay on your Mac, protected by macOS file permissions and data protection; we recommend FileVault. All connections use TLS 1.2 or higher. The account database is encrypted at rest. Sign-in is by single-use email link, so we store no passwords. Vendor console access is limited to named personnel with multi-factor authentication, and no one at Cannoli has a path to read transcript text. The App is signed and notarized by Apple, built with the hardened runtime, and requests only the Microphone, Screen & System Audio Recording and Speech Recognition permissions. The Security Overview at cannoli.ai/security has the detail and the roadmap. Report vulnerabilities to [SECURITY EMAIL] (security@cannoli.ai). If a breach affects your personal information, we will notify you without undue delay and within 72 hours of becoming aware.
11. Children
Cannoli is a business product and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, write to [PRIVACY EMAIL] and we will delete it.
12. Cookies
The Website sets one cookie: a session cookie after you sign in, which keeps you signed in and expires on sign-out or after 30 days of inactivity. It is strictly necessary and needs no consent banner. We set no analytics, advertising, or third-party cookies. Stripe's hosted checkout and customer portal, which are on Stripe's domain, set Stripe's own cookies under Stripe's policy.
13. Do Not Track and Global Privacy Control
We do not track you across sites, so there is nothing for a Do Not Track signal to switch off. We treat a Global Privacy Control signal as a request to opt out of sale or sharing, which is already our default.
14. Changes
We will post changes here and update the "Last updated" date. For material changes we will email account holders at least 30 days before they take effect. While this Policy carries a DRAFT banner it is published for review and is not yet in effect. Prior versions are available on request.
15. Contact
[CANNOLI ENTITY] [ADDRESS] Privacy: [PRIVACY EMAIL] (privacy@cannoli.ai) Security: [SECURITY EMAIL] (security@cannoli.ai) Legal: [LEGAL EMAIL] (legal@cannoli.ai)