Privacy Policy

What changed, in plain language

Notion deleted its entire "Data Privacy Framework" section from the privacy policy. That section said Notion was certified under the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks, that it stayed responsible for data it passed to other companies acting on its behalf, and that EU/UK/Swiss users could take unresolved complaints to their own data protection authority or to free binding arbitration. Nothing was added in its place. The rest of the edits are cosmetic (section renumbering and scrambled email-link codes), and the "Last Updated" date was not changed.

Changes that may affect you

Changelog

1. − REMOVEDData Privacy Framework section deleted

   Notion removed the section saying it was certified under the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks. That certification was one of the legal routes for moving European, UK, and Swiss users' data to the United States, and it put the U.S. Federal Trade Commission in charge of holding Notion to those promises. No replacement safeguard is described in this update.

   Notion Labs, Inc. has certified to the U.S. Department of Commerce that Notion adheres to (1) the EU-U.S. Data Privacy Framework with regard to the processing of personal information received from the European Union, (2) the UK Extension to the EU-U.S. Data Privacy Framework, with regard to the processing of personal information received from the United Kingdom (and Gibraltar), and to (3) the Swiss-U.S. Data Privacy Framework with regard to the processing of personal information received from Switzerland (the "DPF"). The Federal Trade Commission has jurisdiction over our compliance with the DPF.

2. − REMOVEDPromise to stay responsible for data handed to other companies removed

   The policy used to say Notion remained on the hook if a company it hired to process your data mishandled it. That promise is gone.

   We remain responsible for all the personal information we receive under the DPF and that we subsequently transfer to third parties acting as agents on our behalf if they process personal information in a manner inconsistent with the DPF principles, unless we prove we are not responsible for the event giving rise to the damage.

3. − REMOVEDFree complaint and arbitration route for EU/UK/Swiss users removed

   The old policy promised that if Notion could not settle a privacy complaint directly, it would cooperate with the EU data protection authorities, the UK Information Commissioner's Office, the Gibraltar Regulatory Authority, or the Swiss Commissioner — and that users could use free binding arbitration as a last resort. Those commitments are no longer in the policy.

   You may, under certain conditions, invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. Please review Annex I of the DPF for additional information:

4. ± CHANGEDTable of contents renumbered

   With section 13 gone, "Changes to our privacy policy" moved from number 14 to number 13. No wording changed.

   [13\. Data privacy framework](https://www.notion.com/trust/privacy-policy)

   [13\. Changes to our privacy policy](https://www.notion.com/trust/privacy-policy)

5. ± CHANGEDEmail link codes changed

   The scrambled codes behind the contact email links were regenerated. The email addresses and everything else about how to reach Notion are the same.

6. ± CHANGED"Last Updated" date not refreshed

   Even though a whole section was deleted, the policy still says it was last updated September 29, 2025. That makes it harder to notice that anything changed.

   Last Updated: September 29, 2025

Full text changes — 20260812_rev01 to 20260813_rev01