Privacy Policy

Summary

1. Information we collect

Information you provide

• Account information. Your email address, display name, and profile image. Authentication, including passwords, if you use one, and any social sign-in, is handled by Clerk. We never receive or store your password.
• Your content. Everything you create in Notera: boards, cards, notes, text, task lists, drawings, colour palettes, links, comments, board titles and icons, and any images or files you upload.
• Collaboration data. The email addresses of people you invite to a board, the roles you assign them, and comments and mentions exchanged on shared boards.
• Community submissions. Feature requests, votes, bug reports (including any screenshots you attach), and templates you submit to the public template gallery.
• Support correspondence. Messages you send us and the contents of those messages.

Information collected automatically

• Technical data. IP address, browser and device type, operating system, and referring page. IP addresses are used for security, abuse prevention, and rate limiting.
• Usage data. Pseudonymous events about which features you use, which pages you visit, and where errors occur. This is used to fix bugs and prioritise work.
• Real-time presence. While you have a shared board open, your display name, profile image, cursor position, and current selection are broadcast to other people viewing that board. This is transient and is not stored after you disconnect.
• Diagnostics. Error reports and stack traces when something goes wrong.

Billing information

If you subscribe to a paid plan, payment card details are collected and processed directly by Stripe. We never receive, see, or store your full card number, expiry date, or security code. From Stripe we receive only a customer identifier, subscription status, billing interval, renewal date, and invoice history. See Stripe's privacy policy.

Sensitive information

We do not ask for, and do not intentionally collect, special-category or sensitive personal information, such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, sexual orientation, or precise geolocation. Please do not store such information on your boards. If you choose to, you remain responsible for that content, and we process it only as ordinary board content under this policy.

Google API services

Notera's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the drive.file scope, which grants access solely to the specific files you pick in the Google file picker, not to the rest of your Drive. We do not use Google user data for advertising, and we do not transfer it to others except as needed to run the import you asked for.

2. How we use your information

We use personal information to:

• Create and maintain your account, and authenticate you when you sign in.
• Store, sync, and display your boards and their contents across your devices.
• Enable collaboration: invitations, shared boards, comments, mentions, and live presence.
• Process subscriptions, payments, renewals, cancellations, and referral credits.
• Enforce plan limits, including board, card, and storage quotas.
• Send transactional and service email, such as invitations, comment notifications, billing notices, storage alerts, and account-deletion confirmations.
• Send optional product email, such as a weekly digest, where you have enabled it. You can turn these off at any time in your notification settings.
• Provide customer support and respond to your requests.
• Understand which features are used, diagnose errors, and improve the Services.
• Detect, investigate, and prevent fraud, abuse, spam, and security incidents, and enforce our Terms of Service.
• Comply with legal obligations and respond to lawful requests.

We do not use your board content to train machine-learning or AI models, and we do not sell it.

3. Legal bases for processing (EEA / UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 of the GDPR:

• Performance of a contract: to create your account, store and sync your content, enable collaboration, and provide the plan you paid for.
• Legitimate interests: to secure the Services, prevent fraud and abuse, keep the product working, understand aggregate feature usage, and communicate with you about the Services. We weigh these interests against your rights and use the least intrusive option available.
• Consent: for optional marketing email, and for connecting third-party accounts such as Google Drive or Pinterest. You may withdraw consent at any time; withdrawal does not affect processing carried out before you withdrew.
• Legal obligation: to retain financial and tax records, and to respond to lawful requests from authorities.

4. When and with whom we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose personal information only in the situations below.

Service providers (subprocessors)

We rely on the providers below to run the Services. Each processes personal information only on our instructions, under a written agreement, and only for the purpose listed. All of them store and process data in the United States.

Other disclosures

• Other users. As described in section 5, collaboration and sharing make some of your information visible to other people.
• Legal requirements. We may disclose information where we believe in good faith that doing so is required by law, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of Notera, our users, or the public.
• Business transfers. If Notera is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

5. Collaboration, sharing, and public boards

Notera is built for shared work, so some information is visible to other people by design. Please read this section before putting sensitive material on a board.

• Invited collaborators.When you invite someone to a board, they can see that board's contents according to the role you gave them (viewer, commenter, or editor), along with your display name and profile image. Sub-boards inherit access from their parent board.
• Live presence.While collaborators have a board open at the same time, each person's display name, profile image, cursor position, and selection are visible to the others in real time.
• Public share links. If you enable a public link for a board, that board becomes readable by anyone who has the URL, without signing in. A preview image may be generated for social sharing. Turning the link off revokes access going forward, but cannot retract copies anyone already made.
• Embeds. An embedded board is readable by every visitor to the page it is embedded on, on the same basis as a public link.
• Comments and activity. Comments, mentions, and board activity are visible to everyone with access to that board, and may trigger email notifications to them.
• Community areas. Feature requests, bug reports, and templates you submit to the public gallery are visible to other users and to our team, alongside your display name.
• Referrals. If you refer someone, we tell you that a referral converted and credit your account. We do not disclose their identity to you beyond what you already know.

6. International data transfers

Notera is operated from the United States, and every provider listed in section 4 stores and processes data in the United States. If you use the Services from outside the United States, including from the EEA, the United Kingdom, Switzerland, Japan, or South Korea, your personal information will be transferred to, stored in, and processed in the United States, whose data-protection laws may differ from those of your country.

Where we transfer personal information out of the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses(together with the UK International Data Transfer Addendum where applicable), incorporated into our agreements with the providers listed above, or on another lawful transfer mechanism such as a provider's certification under the EU–US Data Privacy Framework. Email support@notera.so if you would like more detail about these safeguards.

7. Cookies and analytics

We use a small number of cookies, and we use no advertising cookies or advertising trackers of any kind. Our Cookie Notice lists every cookie we set, what it does, and how long it lasts.

For product analytics we use PostHog in cookieless mode, meaning it stores no identifier on your device. For traffic and performance measurement we use Vercel Analytics and Speed Insights, which are also cookieless and do not build cross-site profiles.

We do not use session replay. We do not record your screen, your keystrokes, or the contents of your boards for analytics or diagnostic purposes.

8. Social logins and connected accounts

You can register and sign in using a third-party account through our authentication provider, Clerk. When you do, we receive a limited profile from that provider: typically your name, email address, and profile image. We do not receive your contact list, your friend list, or your password.

Separately, you can connect Google Drive or Pinterest to import content. If you do, we store an access token, a refresh token, your account email or identifier at that provider, and the granted scopes, so that the import can run. Tokens are encrypted at rest. You can disconnect a linked account at any time in your settings, which revokes and deletes the stored tokens.

We do not control how third-party providers process your information. Please review their privacy policies for details.

9. How long we keep your information

We keep personal information only as long as we need it for the purposes in this policy, unless a longer period is required by law.

• Account and board content: for as long as your account is open.
• After you delete your account: your account is deactivated immediately and enters a 30-day grace period during which you can restore it. At the end of that period your profile, boards, cards, uploaded files, and comments are permanently deleted.
• Billing and tax records: retained by us and by Stripe for as long as financial and tax law requires, typically up to seven years, even after account deletion.
• Security, abuse, and rate-limiting logs: typically under 30 days.
• Analytics and error data: pseudonymous, retained according to our providers' standard retention windows.
• Content shared with others: content you contributed to a board owned by someone else may remain on that board after you leave or delete your account. Your comments are anonymised rather than removed, so that reply threads stay readable.

Backups are rotated on a rolling basis. Where information persists in a backup after deletion, it is isolated from further processing and removed when that backup expires.

10. How we keep your information safe

We use appropriate technical and organisational measures to protect personal information, including encryption in transit (HTTPS), encryption at rest for stored files and OAuth tokens, database-level permission rules that restrict every record to the users entitled to it, scoped pre-signed URLs for file access, rate limiting, CSRF protection, and audit logging of privileged administrative actions.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities where the law requires it.

11. Staff access to your content

Access to production data is limited to the people who need it to operate the Services. Support and administrative tooling allows authorised staff to view account-level information and, where necessary to investigate a support request or a suspected violation of our Terms, to access an account. Privileged administrative actions are recorded in an audit log. We do not browse user boards for any other reason.

12. Children's privacy

The Services are not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will deactivate the account and delete the information promptly. If you believe a child has provided us with personal information, contact us at support@notera.so.

13. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal information: to access it, to correct it, to delete it, to obtain a portable copy, to restrict or object to certain processing, and to withdraw consent. We do not carry out automated decision-making that produces legal or similarly significant effects.

Right to complain. If you are in the EEA, the UK, or Switzerland and believe we have mishandled your personal information, we would like the chance to put it right, but you also have the right to lodge a complaint with your local data protection supervisory authority. In the UK that is the Information Commissioner's Office; a list of EEA authorities is published by the European Data Protection Board.

Other regions. If you are in Japan, South Korea, Canada, Australia, Brazil, or another jurisdiction with its own privacy law, you may have comparable rights under that law. Email support@notera.so and we will honour any right that applies to you.

14. United States state privacy rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to know what personal information we collect, to access and delete it, to obtain a portable copy, to correct inaccuracies, and to appeal a decision we make about your request. Use the methods in section 13 to exercise these rights.

We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising, in the preceding twelve months, including the personal information of anyone under 16. There is therefore no "Do Not Sell or Share My Personal Information" link, because there is nothing to opt out of.

Categories of personal information collected

The table below reflects the categories defined by the California Consumer Privacy Act that we have collected in the preceding twelve months.

We collect these categories directly from you, automatically from your device as you use the Services, and from the third-party providers listed in section 4. We use and retain them for the purposes in section 2 and for the periods in section 9, and we disclose them for business purposes only to the providers listed in section 4.

You may use an authorised agent to submit a request on your behalf; we will ask for proof of the agent's authority and may ask you to verify your identity directly. If we deny your request you may appeal by replying to our response, and we will inform you of the outcome and of your right to contact your state Attorney General.

15. Do-Not-Track and Global Privacy Control

There is still no uniform industry standard for Do-Not-Track ("DNT") browser signals, and we do not respond to them. California law requires us to say so.

Global Privacy Control ("GPC") signals are treated as a valid opt-out request under California law. Because we do not sell or share personal information for advertising, and use no advertising or cross-site tracking cookies, there is no processing on our side for a GPC signal to stop.

16. Changes to this policy

We may update this Privacy Policy from time to time. The revised version is indicated by the "Last updated" date at the top of this page. If we make material changes we will notify you by email or through a prominent in-app notice at least 14 days before they take effect. Where the law requires your consent to a change, we will ask for it.

17. How to contact us

For any question about this policy, or to exercise a privacy right, contact:

We are an online-only business and handle privacy requests by email. If you need a postal address for a formal legal or regulatory notice, email us and we will provide one.