Notion Labs, Inc. is a privately held workspace and note-taking platform whose privacy policy (published at notion.com/trust/privacy-policy) discloses collection of account information, device data, and browsing activity, some of which the policy says is provided to third-party advertising providers for targeted advertising. The company states that customer content used with Notion AI is routed to third-party AI subprocessors (e.g., for generating responses) but that, by default, those subprocessors are contractually barred from using Customer Data to train their own models. A third-party technical analysis has identified multiple advertising-network cookies on Notion's site, and a cybersecurity report identified metadata on publicly shared Notion pages that can reveal collaborators' emails and profile images.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
Notion's privacy policy discloses that it automatically collects information about a user's device and online browsing activity, which it says is used to provide more relevant advertising.
Notion's Help Center states that account information it collects includes names, usernames, passwords, phone numbers, email addresses, workspace metadata, support communications, billing information, and usage information tied to a Notion account.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes, but for critical data only.
Notion is a privately held company; funding-tracking research shows it raised a $275 million Series C round in October 2021 led by Coatue Management and Sequoia Capital at a $10 billion valuation, with earlier participation from investors including Index Ventures and First Round Capital.
Notion's privacy policy identifies Notion Labs, Inc. and its relevant affiliates as the entity responsible for the data practices described, and identifies its public website as www.notion.so and its software platform as the 'Services.'
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Notion's Help Center discloses that when Notion AI features are used, the relevant content is shared with third-party AI subprocessors for the sole purpose of generating the AI response, though those subprocessors are contractually prohibited from using the data to train their own models.
Notion's privacy policy states that it provides device and online browsing activity information to third-party advertising providers for targeted advertising purposes, which it separately characterizes as a 'sale' or 'share' of personal information under California law.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Notion maintains SOC 2 compliance and states it has been attested by independent third-party auditors, with compliance reports available through its Trust Center, indicating ongoing external verification of its security and privacy program.
A cybersecurity report described a privacy issue in which metadata attached to Notion pages that users publish publicly can reveal personal information about collaborators, including usernames, profile images, and email addresses, which researchers attributed to the platform's page-sharing design rather than a specific software flaw.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
As assessed by Comparitech on 2024-04-10, Notion's website was found to place advertising and analytics cookies from multiple third-party ad networks, some of which can persist in a browser for up to two years.