Notion Privacy Policy

This is Notion's privacy policy, which explains how the company that makes the Notion workspace app collects and uses your personal data, including your name, email, usage activity, device information, and the content you create in your workspace. The most important thing to know is that Notion shares data with third-party advertising platforms including Facebook, Google, Twitter, and LinkedIn, meaning your usage of a productivity tool may feed advertising profiles. You can request deletion of your personal data or opt out of the sale or sharing of your personal data by emailing privacy@notion.so.

This document is Notion's global privacy policy governing the collection, use, storage, and disclosure of personal data by Notion Labs, Inc., operating under a consent and legitimate interest legal basis framework that references GDPR, CCPA, and analogous international regimes. The policy obligates Notion to provide data subject rights (access, deletion, correction, portability, opt-out of sale/sharing) and obligates users to provide accurate information, while Notion retains broad discretion to collect usage data, device identifiers, log files, cookies, and inferred data for product improvement and marketing purposes. A notable provision permits Notion to share personal data with 'business partners' and advertising platforms including Facebook, Google, Twitter/X, and LinkedIn — evidenced by the active tracker scripts embedded in the page — creating potential data flows that may exceed user expectations for a productivity workspace tool. The policy engages GDPR (EU/EEA users), UK GDPR, CCPA/CPRA (California residents), LGPD (Brazil), PIPEDA (Canada), and APPI (Japan), with Notion acting as both data controller for end users and data processor for enterprise workspace administrators. Material compliance considerations include the adequacy of consent mechanisms for cross-border data transfers, the sufficiency of DPA agreements with enterprise customers, and whether the advertising tracker infrastructure is disclosed with adequate specificity to satisfy GDPR Art. 13 transparency obligations.