Is Notion safe with your data?

Notion

Notion Labs

73/100

Strong disclosure · high confidence

Notion earns an A (73/100) because it discloses its data practices clearly.

of 211 apps ranked

score · Productivity avg 53

+20

vs category average

Grade scaleA · 70–100B · 60–69C · 48–59D · 35–47F · 0–34

Notion's privacy policy discloses explicit no-training pledges for customer data with contractual safeguards, clear user rights including deletion and access, concrete AI-log retention periods (30 days/zero), and comprehensive security certifications, though international transfer mechanisms and some data-sharing opt-outs lack specificity.

What Notion's privacy policy and terms of service say about your data

AI Training Prohibition

By default, Notion and its AI Subprocessors do not use Customer Data to train any models. We specifically have contractual agreements in place with our AI Subprocessors that prohibit the use of Customer Data to train their models.

User Data Ownership

Notion does not claim ownership of your input or the generated output. When you use Notion AI, Input and Output are your Customer Data... you retain any and all of your rights to your User Content.

AI Log Retention Specifics

By default for all non-Enterprise plan workspaces, LLM providers only retain Customer Data for 30 days or fewer before deletion. For Enterprise plan workspaces, zero data retention.

Security Certifications

SOC 2 Type 2... ISO 27001, ISO 27701, ISO 27017, ISO 27018... encryption in-transit using TLS 1.2 or greater

What the policy is silent or vague on

Not stated: whether training use differs by plan
Not stated: automated decisions and a human-review path
Only partial: keeping user inputs out of model training
Only partial: data portability

Notion privacy rating

Training-data use2 of 4 disclosed

Keeps user inputs out of model training, or makes training opt-inPartial

Names a way to opt out of or into trainingDisclosed

Says whether training use differs by plan or tierSilent

Lets the user keep ownership of generated outputsDisclosed

Data-subject rights4 of 5 disclosed

Grants a right to access your dataDisclosed

Grants a right to delete your dataDisclosed

Offers data portability in a usable formatPartial

Grants a right to correct your dataDisclosed

Grants a way to object to or opt out of processingDisclosed

Retention and deletion1 of 4 disclosed

States a retention period for your dataPartial

States a deletion timeline after closure or requestPartial

Sets a shorter retention for AI conversation logsDisclosed

Commits to collecting only the data it needsPartial

Third-party sharing2 of 5 disclosed

Lists the categories of third parties it shares withDisclosed

References a sub-processor list or data processing agreementDisclosed

Does not sell or share data for advertising, or offers opt-outPartial

Names a safeguard for international data transfersPartial

States a standard for government and law-enforcement accessPartial

Transparency3 of 4 disclosed

Discloses that you are interacting with AIDisclosed

Marks AI-generated or synthetic outputNot applicable

Enumerates the categories of data it collectsDisclosed

Maps processing purposes to legal basesPartial

Is versioned and dated, with change noticeDisclosed

Sensitive data and children1 of 3 disclosed

Discloses automated decisions and a human-review pathSilent

Limits the use of special-category dataPartial

Governs biometric data specificallyNot applicable

States protections for children's dataDisclosed

Security and accountability2 of 3 disclosed

Describes its security safeguardsDisclosed

Commits to breach notificationPartial

Names a certification or a privacy contactDisclosed

DisclosedPartialSilentAdverseNot applicable

Details

Category: Productivity
Modalities: text
Processes biometrics: No
Policy last updated: 2025-09-29
Region scored: Global / US-default
Last assessed: 2026-07-08

Documents examined

Other productivity apps

Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.