Who is responsible
The controller for the personal data described here is the operator of notdocs described on the legal notice, whose details are given on request as that page says. Write to privacy@notdocs.dev for anything about your data. We have not appointed a data protection officer, because the scale of our processing does not require one.
When you use notdocs to process personal data of other people, for example names in a meeting document, you are the controller of that data and we are your processor. The data processing agreement covers that.
What we process, and why
Visiting the website
The pages of notdocs.dev are served by Vercel. Vercel receives your IP address and the request as part of delivering the page and keeps its own platform logs; we do not run analytics, advertising or tracking of any kind on the site. Legal basis: our legitimate interest in serving the site (Article 6(1)(f) GDPR).
Your account
When you sign in we receive from Clerk an identifier and your email address, and we store both, with the time you first signed in. Your name is not stored. We use these to know who you are, to show who did what in a workspace, and to send you notices about the service. Legal basis: performance of our contract with you (Article 6(1)(b)).
Clerk processes the sign-in itself, including any password, passkey or sign-in code, under its own privacy policy. We do not see your password.
Organizations and projects
We store the organization's name and slug, its custom domain if set, the login of the GitHub account it connected, the repositories registered as projects, who is a member or guest of what, and invitations by email address. Legal basis: performance of the contract.
Plans and billing
We store which plan an organization is on, when its paid period ends, and the identifiers Polar assigns to the organization as a customer and to its subscription. Polar, as merchant of record, holds the billing name and address, VAT id and payment details under its own privacy policy; we never see card details. When the assistant runs on a paid plan's allowance we record each model call's cost with the organization, the account that made it, the model and the time, so the allowance can be enforced; the prompt and the answer are not stored. Legal basis: performance of the contract, and our legal obligations around invoicing.
Your content and the index
Your documents are in your repository. To run the workspace we keep an index in our database: each document's path, type, title and frontmatter, its text for full-text search, pieces of its text with embeddings for semantic search, and the text of every version we have seen, which is what lets us merge concurrent edits and open a document without a round trip to GitHub. If your documents contain personal data, that data is in the index too. Comments you write are stored in your repository as files with your email address as the author, and a change you make through notdocs to a repository on GitHub is committed with your name and email address as the commit's author, as a commit you make yourself would be; both are visible to everyone who can read the repository, and a commit stays in its history after you delete your account. A change made by an app you connected is committed in your name too, with the app named in the commit message.
We process your content only to provide the service to you. Legal basis: performance of the contract; where your content contains other people's personal data, we act as your processor.
Activity
Every change to a document is recorded as an event: the path, the document id, the version hash, who made it (your account or a token) and when. Agent tokens record when they were last used. We use this for the change feed and history in the workspace. Legal basis: performance of the contract, and our legitimate interest in security.
Agent tokens
We store a token's name, scope, who created it, when, and a hash of the secret. The secret itself is shown once and not kept.
Connected apps
When you connect an app such as Claude to your account over OAuth, we store the app's name and the addresses it registered to send you back to, the access you allowed (read, or read and write), when you connected it and when it was last used, and hashes of the tokens it holds; the tokens themselves are not kept. The app acts as you, so the changes it makes are recorded as yours. Your conversation with the app stays with the app: we receive only the operations it calls. Legal basis: performance of the contract, on your request.
AI features
When you use the assistant, inline rewrite or search, the text described in the AI disclosure is sent through Vercel AI Gateway to the provider of the model. No account identifier is sent with it. Legal basis: performance of the contract, on your request. If you supply your own gateway key, it is kept in your browser and sent with your requests; we do not store it.
GitHub
We receive push webhooks from GitHub for the repositories you connected. We use them to learn which files changed and then read those files through the GitHub API; we do not store the webhook payload, the pusher, or commit messages.
Support and correspondence
If you write to us we keep the correspondence as long as needed to deal with it and, if it matters to the contract, for the life of the contract. Legal basis: legitimate interest and performance of the contract.
Who receives data
Only the providers listed on the subprocessors page, each for the purpose stated there, and public authorities if the law requires it. We do not sell personal data, we do not share it for advertising, and we do not use it to train models.
Vercel and Clerk are companies established in the United States; transfers to them rest on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. The model provider behind a chosen AI model may be outside the EU; the AI disclosure names the defaults.
How long
- Account, organization and project records: for the life of the account, then deleted within 30 days of your request.
- The document index: for as long as the project exists. An owner deletes a project or an organization from its settings, and the index rows, the change events, the guests, the agent tokens and the uploaded files of the project are deleted with it, at once.
- Version texts: stored by content hash. When a project is deleted, every version text that no other project's index or change feed still names is deleted with it. A text that another project also holds (the same file, byte for byte) stays for that project.
- Change events and token usage: for the life of the project.
- Connected apps: until you disconnect the app in Settings, which ends its access at once, or until your account is deleted. An authorization you started and never completed is deleted the next time you connect an app.
- Assistant stream pointers: at most one hour.
- Assistant conversations: in your browser only, until you clear them.
- Platform logs at Vercel and Clerk: under their retention, which is short and which we do not extend.
Your rights
You can ask for access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interest, by writing to privacy@notdocs.dev. We answer within one month. You can also complain to a supervisory authority; ours is the Hellenic Data Protection Authority (dpa.gr).
Most of your data is already portable without asking: your documents and comments are files in your repository. See data portability and exit.
For residents of California and other US states with similar laws: we do not sell or share personal data as those laws define it, and we honour the Global Privacy Control signal. The notice at collection and how to make a request are on do not sell or share my personal information.
Children
notdocs is for adults and organizations. We do not knowingly process data of anyone under 16.
Changes
We will change this policy when the service changes. The date at the top is the current version's; for material changes we will tell account holders by email or in the app.