Notion
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Notion collects account, workspace, and tracking data, may share it for ads with an opt-out, and keeps it while you use the service.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, workspace content, device IDs, browsing, and optional Gmail, calendar, and contacts.
Read the exact line
Privacy policy
“This information may include your Internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers”
Training
They use it to run Notion, market to you, improve the product, and show targeted ads about Notion.
Read the exact line
Privacy policy
“we may use your information to tailor and provide you with content and advertisements.”
Sharing
Service providers, your workspace teammates, your employer, and ad partners can see some of it.
Read the exact line
Privacy policy
“we may disclose your information to third-party advertising partners to market our own Services and grow our Services’ user base”
Kept
They keep it while you use Notion and as long as they say they still need it.
Read the exact line
Privacy policy
“We store the information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected”
Controls
You can ask them to access or delete data, and opt out of ad sharing via a website footer link.
Read the exact line
Privacy policy
“please click on the "Do Not Sell or Share My Info" link on the bottom of our website footer at www.notion.com.”
Fine print
They may change the policy; keeping using Notion counts as agreeing. Terms of service were not in these documents.
Read the exact line
Privacy policy
“You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use the Services after the new Privacy Policy takes effect.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of sale or sharing for ads
“Do Not Sell or Share My Info” link in the website footer at www.notion.com
or access
Contact Notion Labs, Inc. at the address in the policy or team@makenotion.com as listed
Change cookie settings
Website footer, or if logged in: Settings & Members → My notifications & settings
Move off a work email if you do not want org sharing
Account settings: https://www.notion.so/help/account-settings
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Ad companies can use data from Notion to follow you around the web with ads.
Read the exact line
Privacy policy
“These third parties (e.g., ad networks and ad servers) may use this information to serve relevant content and advertising to you as you browse the Internet”
For example, after you use Notion, you might see Notion ads on other sites based on your device and browsing data.
Sharing your device and browsing data with ad partners can legally count as selling or sharing it.
Read the exact line
Privacy policy
“The disclosure of your information to these third parties to assist us in providing these services may be considered a “sale” of personal information under applicable law”
For example, cookie and IP data sent to an ad network may be treated as a sale even if no cash changes hands.
If you sign up with a work email, your company can get your profile and even workspace content.
Read the exact line
Privacy policy
“If you register a Notion account or associate a Notion account with an email address provisioned by your organization, Notion may share information about you and any Workspaces owned or managed by you with your organization.”
For example, notes in a personal workspace tied to your company email could be visible to your employer.
There is no short, fixed delete-by date. They can keep data for many business and legal reasons.
Read the exact line
Privacy policy
“We store the information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue , enforce our agreements, and comply with applicable laws.”
For example, even after you stop using Notion, they may keep logs for disputes or audits.
If they change the rules, just keeping using Notion can count as you agreeing.
Read the exact line
Privacy policy
“You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use the Services after the new Privacy Policy takes effect.”
For example, you might not read an update email and still be bound by new sharing rules.
If your data leaks, they say they are not responsible as far as the law allows.
Read the exact line
Privacy policy
“To the fullest extent permitted by applicable law, we do not accept for unauthorized disclosure.”
For example, if hackers get workspace files, this policy tries to limit what you can claim from Notion.
Google Workspace API data used for Notion Mail is not used to train general AI models.
Read the exact line
Privacy policy
“We do not process Workspace API user data to develop, improve, or train generalized AI and/or ML models.”
For example, your Google Workspace contacts pulled for Notion Mail should not train a general chatbot.
You can turn off some ad-related sharing with a website link.
Read the exact line
Privacy policy
“If you would like to opt out of our online disclosure such as through cookie and pixel technology of your personal information for purposes that could be considered “sales””
For example, you can click “Do Not Sell or Share My Info” in the site footer.
They say Notion is not meant for kids, but this policy does not describe a hard age check.
Read the exact line
Privacy policy
“Our Services are intended for general audiences and are not directed at children.”
For example, a teen could still create an account if they type in an email.
They take some security steps but do not promise your data cannot be stolen.
Read the exact line
Privacy policy
“Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us.”
For example, they will not guarantee that a workspace full of private notes stays secret forever.
Words to know
Legal words from the lines above, in plain English.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- legitimate interest
- A legal reason that lets a company use your data without asking, when it decides its own need outweighs your privacy. For example, an app may analyse how you use it to improve the product, without ever asking you.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
How we got here · grade D · score 35/100 · 15 of 15 policy answers backed by a verified quote · 8 not stated
What does the app collect beyond what it needs to work?
They collect account and workspace content plus device IDs, cookies, IP, browsing, and optional Gmail, calendar, and contacts.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
Third-party ad partners place cookies and may use your data to target ads as you browse the internet.
Do they sell or share your data, and can you opt out?
Sharing device and browsing data with ad partners may count as a sale or share; you can opt out via a footer link.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep data while you use the service and for other listed purposes; deletion is by contacting them.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they take steps to treat information securely but do not warrant it and mention no audit or bug-bounty program here.
Is there a real age gate, and are teens protected?
They say the service is not directed at children and will delete data if they learn they collected it without needed parental consent, with no stated age check.
Will they tell you when the rules change, and is the policy specific?
The policy is dated. They say they will notify of material changes as required by law, and continued use means you accept.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 4,900 words at a professional or legal expert level (Flesch reading ease 9.3).
