Notion

Notion is a freemium tool that blends notes, tasks, wikis in one app.

6.2/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes, but you may opt-out

4/10

Score

Yes

Yes, but you may opt-out

35%

Yes, but you must opt-in

70%

100%

Citation

Advertising Partners: We do not use or share your information, including personal information, to advertise any third party’s products or services via the Services. We may use and share your personal information with third-party advertising partners to market our own Services and grow our Services’ user base, such as to provide targeted marketing about our own Services via third-party services. If you prefer not to share your personal information with third-party advertising partners, you may follow the instructions below.
[...]
Cookies and Interest-Based Advertising: You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits. Please note that cookie-based opt-outs are not effective on mobile applications. However, you may opt-out of personalized advertisements on some mobile applications by following the instructions for Android and iOS. The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these websites and learn more about targeted advertising and consumer choice and privacy, at www.networkadvertising.org/managing/opt_out.asp, http://www.youronlinechoices.eu/, https://youradchoices.ca/choices/, and www.aboutads.info/choices

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Even if there is a reasonable delay before the data is fully deleted (as is common), the data still counts as "permanently deleted" and satisfies the parameters for this question.

Score

Yes, by contacting someone

60%

Yes, using an automated mechanism

100%

N/A

The service doesn't collect any personal information.

100%

Citation

Depending upon your location and in accordance with applicable laws, you may have the right to:

Request Deletion of your personal information, subject to certain exceptions prescribed by law.
[...]
If you would like to exercise any of these rights, please contact us as set forth below. We will process such requests in accordance with applicable laws. To protect your privacy, we will take steps to verify your identity before fulfilling your request, such as by requiring you to submit your request via your account.
[...]
Notion Labs, Inc.
548 Market St #74567
San Francisco, CA 94104-5401
United States
team@makenotion.com

Does the service allow third-party access to private personal data? Yes, all parties specified (including non-critical service providers such as advertisers)

3/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

We use the following sub-processors:

Amazon Web Services (USA)
Amplitude (USA)
Segment (USA)
Firebase (USA)
Intercom (USA)
Loggly (USA)
Snowflake (USA)
Fivetran (USA)
Stripe (USA)
Datadog (USA)
Sentry (USA)
[...]
We may share your personal information with the following categories of third parties:

Service Providers: We may share any personal information we collect about you with our third-party service providers. The categories of service providers to whom we entrust personal information include service providers for: (i) the provision of the Services; (ii) the provision of information, products, and other services you have requested; (iii) marketing and advertising; (iv) payment and transaction processing; (v) customer service activities; and (vi) the provision of IT and related services.

Business Partners: We may provide personal information to business partners to provide you with a product or service you have requested. We may also provide personal information to business partners with whom we jointly offer products or services.

Affiliates: We may share personal information with our affiliated entities.

Advertising Partners: We do not use or share your information, including personal information, to advertise any third party’s products or services via the Services. We may use and share your personal information with third-party advertising partners to market our own Services and grow our Services’ user base, such as to provide targeted marketing about our own Services via third-party services. If you prefer not to share your personal information with third-party advertising partners, you may follow the instructions below.

We may share your personal information with other third parties, including other users, in the following circumstances:

Workspaces Accessible by Other Users: When you submit personal information in a workspace that can be accessed by others, such personal information may be displayed to other users in the same or connected workspaces. For example, your personal information may be included in your notes or reminders in a workspace which can be viewed by other users collaborating with you in that workspace. Further, your email address or photo may be displayed with your workspace profile to other users collaborating with you in that workspace.

Enterprise Workspaces: We will share and disclose Enterprise Content in accordance with an Enterprise’s instructions, including any applicable terms in the Subscription Agreement and an Enterprise administrator’s use of the Services’ administrative functionality, and in compliance with applicable law and legal process. We may also allow an Enterprise to access the profile information of Authorized Users, including to allow such Enterprise to validate that such Authorized User is actually authorized by such Enterprise to use the Services.

Share Content with Friends or Colleagues: Our Services may allow you to provide information about your friends, and may allow you to forward or share certain content with a friend or colleague, such as an invitation email.

Disclosures to Protect Us or Others: We may access, preserve, and disclose any information we store in association with you to external parties if we, in good faith, believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal process, such as a court order or subpoena; (ii) protect your, our, or others’ rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation and prosecution of suspected or actual illegal activity.

Disclosure in the Event of Merger, Sale, or Other Asset Transfer: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

When does the policy allow law enforcement access to personal data? When reasonably requested

3/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

Transparency

Does the policy outline the service's general security practices? Somewhat

1/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

By using the Services or providing personal information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Services. If we learn of a security system’s breach, we may attempt to notify you electronically by posting a notice on the Services, by mail or by sending an email to you.

Is the policy's history made available? Only the date it was last modified

3/5

Does the policy require users to be notified in case of a data breach? Yes, eventually

5/7

Will affected users be notified when the policy is meaningfully changed? Yes

5/5

Collection

Does the service collect personal data from third parties? Yes, but for critical data only

7/10

Is it clear why the service collects the personal data that it does? Yes

10/10

Score

Somewhat

30%

Mostly

70%

Yes

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We use your personal information for a variety of business purposes, including to:

Provide the Services or Requested Information, such as:

Fulfilling our contract with you;
Identifying and communicating with you, including providing newsletters and marketing materials;
Managing your information;
Processing your payments and otherwise servicing your purchase orders;
Responding to questions, comments, and other requests;
Providing access to certain areas, functionalities, and features of our Services; and
Answering requests for customer or technical support.

Serve Administrative Purposes, such as:

Pursuing legitimate interests, such as direct marketing, research and development (including marketing research), network and information security, and fraud prevention;
Measuring interest and engagement in our Services, including analyzing your usage of the Services;
Developing new products and services and improving the Services;
Ensuring internal quality control and safety;
Authenticating and verifying individual identities;
Carrying out audits;
Communicating with you about your account, activities on our Services and Privacy Policy changes;
Preventing and prosecuting potentially prohibited or illegal activities;
Enforcing our agreements; and
Complying with our legal obligations.

Marketing Our Products and Services: We may use personal information to tailor and provide you with content and advertisements. If you have any questions about our marketing practices or if you would like to opt out of the use of your personal information for marketing purposes, you may contact us as set forth below.

Consent: We may use personal information for other purposes that are clearly disclosed to you at the time you provide personal information or with your consent.

De-identified and Aggregated Information Use: We may use personal information and other data about you to create de-identified and/or aggregated information. De-identified and/or aggregated information is not personal information, and we may use and disclose such information in a number of ways, including research, internal analysis, analytics, and any other legally permissible purposes.

Process Information on Behalf of Our Customers: Our customers may choose to use our Services to process certain data of their own, which may contain personal information. Such personal information that is processed by us on behalf of our customers, and our privacy practices will be governed by the contracts that we have in place with our customers, not this Privacy Policy.

If you have any questions or concerns about how such personal information is handled or would like to exercise your rights, you should contact the person or entity (i.e., the data controller) who has contracted with us to use the Service to process this information. Our customers control the personal information in these cases and determine the security settings within the account, its access controls and credentials. We will, however, provide assistance to our customers to address any concerns you may have, in accordance with the terms of our contract with them.

We use the following sub-processors:

Amazon Web Services (USA)
Amplitude (USA)
Segment (USA)
Firebase (USA)
Intercom (USA)
Loggly (USA)
Snowflake (USA)
Fivetran (USA)
Stripe (USA)
Datadog (USA)
Sentry (USA)

How We Use Automatic Collection Technologies: Our uses of Technologies fall into the following general categories:

Operationally Necessary;
Performance Related;
Functionality Related; and
Advertising or Targeting Related.

Cross-Device Tracking: Your browsing activity may be tracked across different websites and different devices or apps. For example, we may attempt to match your browsing activity on your mobile device with your browsing activity on your laptop. To do this our technology partners may share data, such as your browsing patterns, geo-location and device identifiers, and will match the information of the browser and devices that appear to be used by the same person.

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, for all non-critical data/uses

6/10

Some services allow users to opt-out or opt-in to of non-critical collection or use of personal data, such as collecting data for personalized advertisements.

Score

On an opt-out basis, but only for some non-critical data/uses

30%

On an opt-out basis, for all non-critical data/uses

60%

On an opt-in basis

60%

N/A (no data used for non-critical purposes)

100%

Citation

General: You may have the right to object to or opt out of certain uses of your personal information. Where you have consented to the processing of your personal information, you may withdraw that consent at any time by contacting us as described below. Even if you opt out, we may still collect and use non-personal information regarding your activities on our Services and for other legal purposes as described above.

Email Communications: If you receive an unwanted email from us, you can use the unsubscribe link found at the bottom of the email to opt out of receiving future emails. Note that you will continue to receive transaction-related emails regarding products or services you have requested. We may also send you certain non-promotional communications regarding us and our Services, and you will not be able to opt out of those communications (e.g., communications regarding the Services or updates to this Privacy Policy).

Mobile Devices: We may send you push notifications through our Apps. You may at any time opt out from receiving these types of communications by changing the settings on your mobile device. With your consent, we may also collect precise location information if you use our Apps. You may opt out of this collection by changing the settings on your mobile device.

“Do Not Track”: Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and Service that you do not wish such operators to track certain of your online activities over time and/or across different websites. If your browser is set to “Do Not Track”, Notion will attempt to honor this functionality. However, our third party service providers may use their own cookies, pixel tags, web beacons or other storage technology to collect and store Log Data or information from elsewhere on the internet, and we do not have access to, nor control over, a third parties’ use of cookies or other tracking technologies.

Cookies and Interest-Based Advertising: You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits. Please note that cookie-based opt-outs are not effective on mobile applications. However, you may opt-out of personalized advertisements on some mobile applications by following the instructions for Android and iOS. The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these websites and learn more about targeted advertising and consumer choice and privacy, at www.networkadvertising.org/managing/opt_out.asp, http://www.youronlinechoices.eu/, https://youradchoices.ca/choices/, and www.aboutads.info/choices/.

Please note you must separately opt out in each browser and on each device.

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

We collect personal information when you provide it to us, when you use our Services, and when other sources provide it to us, as further described below.

A. Information You Provide to Us

Account Creation: When you create an account or otherwise use the Services, we collect information such as your name, email address, password, role within your team or enterprise, and an optional profile photo.

Your Communications with Us: We collect personal information from you such as email address, phone number, or mailing address when you request information about our Services, register for our newsletter, request customer or technical support, or otherwise communicate with us. We also collect the contents of messages or attachments that you may send to us, as well as other information you choose to provide, and that may be associated with your communications.

Payment Information: When you choose to subscribe for Personal, Team, or Enterprise plans on the Services, we will collect payment information allowing you to pay us. We use third-party payment providers to process payments on the Services. We may receive information associated with your payment information, such as billing address and transaction information, but we do not directly store payment information on the Services.

Surveys: We may contact you to participate in surveys. If you decide to participate, you may be asked to provide certain information which may include personal information.

Interactive Features: We may offer interactive features such as forums, blogs, chat and messaging services, and social media pages. We and others who use our Services may collect the information you submit or make available through these interactive features. Any content you provide via the public sections of these features will be considered “public” and is not subject to the privacy protections referenced herein. By using these interactive features, you understand that the personal information provided by you may be viewed and used by third parties for their own purposes.

Registration for Sweepstakes or Contests: We may run sweepstakes and contests. Contact information you provide may be used to inform you about the sweepstakes or contest and for other promotional, marketing and business purposes.

Conferences, Trade Shows, and Other Events: We may attend conferences, trade shows, and other events where we collect personal information from individuals who interact with or express an interest in the Services.

Job Applications. We may post job openings and opportunities on the Services. If you reply to one of these postings by submitting your application, CV and/or cover letter to us, we will collect and use your information to assess your qualifications.

B. Information Collected Automatically

Automatic Data Collection: We keep track of certain information about you when you visit and interact with any of our Services. This information may include your Internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers, details about your browser, operating system or device, location information (including inferred location based off of your IP address), Internet service provider, pages that you visit before, during and after using the Services, information about the links you click, information about how you interact with the Services, including the frequency and duration of your activities, and other information about how you use the Services. Information we collect may be associated with accounts and other devices.

Cookies, Pixel Tags/Web Beacons, and Analytics Information: We, as well as third parties that provide content, advertising, or other functionality on the Services, may use cookies, pixel tags, local storage, and other technologies (“Technologies”) to automatically collect information through the Services. Technologies are essentially small data files placed on your devices that allow us and our partners to record certain pieces of information whenever you visit or interact with our Services.

Cookies: Cookies are small text files placed in device browsers to store their preferences. Most browsers allow you to block and delete cookies. However, if you do that, the Services may not work properly.
Pixel Tags/Web Beacons: A pixel tag (also known as a web beacon) is a piece of code embedded in the Services that collects information about engagement on the Services. The use of a pixel tag allows us to record, for example, that a user has visited a particular web page or clicked on a particular advertisement. We may also include web beacons in e-mails to understand whether messages have been opened, acted on, or forwarded.

Analytics: We may also use third-party service providers to collect and process analytics and other information on our Services. These third-party service providers may use cookies, pixel tags, web beacons or other storage technology to collect and store analytics and other information. They have their own privacy policies addressing how they use the analytics and other information and we do not have access to, nor control over, third parties’ use of cookies or other tracking technologies.

C. Information from Other Sources

We may obtain information about you from other sources, including through third-party services and organizations. For example, if you access our Services through a third-party application, such as a social networking site or a third-party login service, we may collect information about you from that third party that you have made available via your privacy settings.

Should you choose to use the Google Contacts feature within our Services, we will have the ability to view your contacts via the Google People API. The sole use of this data is to populate the auto-completion of your contacts when sending invitation emails. Notion will not use this data for any other purpose.

Last Updated

June 24, 2020

Sources

Source #1 ↗

Contributors

doamatto