Notion AI

The Personal Use Terms explicitly state Notion does not claim ownership of User Content and that the user retains all rights, granting Notion only an operational license to host and provide the Service. This is a user-favorable ownership position for prompts and submitted files.

The Terms define 'Output' as part of User Content, meaning AI-generated results fall under the user-retains-ownership provision. Notion does not claim ownership of Output; it is treated the same as other User Content.

The supplied consumer documents are largely silent on whether Notion uses user inputs to train or improve generalized AI/ML models; the only explicit no-training statement concerns Google Workspace API data within Notion Mail, not general user content. The Privacy Policy does state Notion uses information for 'developing new products and services and improving the Services,' which is ambiguous as to model training. This silence is a risk signal for AI processing.

The consumer Privacy Policy states data is retained 'as long as you use our Services or as necessary' without specific retention schedules or deletion SLAs. Users can request deletion (subject to exceptions) and can delete private User Content, but the Terms warn that some copies may persist. No concrete retention timeline is given in the consumer documents.

Notion discloses sharing with service providers, affiliates, business partners, and advertising partners, and acknowledges that disclosures of online identifiers to advertising partners may constitute a 'sale' or 'sharing' under CCPA. While the sharing is disclosed and Notion states it does not disclose personal information for third parties' own direct marketing, the use of advertising-partner disclosures and cross-device tracking goes beyond what a core knowledge-management service strictly requires.

The Privacy Policy provides multiple opt-out mechanisms: a 'Do Not Sell or Share My Info' link, recognition of Global Privacy Control signals, email unsubscribe, cookie preference controls, and industry ad opt-out links. Users may also object to or withdraw consent for certain processing by contacting Notion. These are concrete, disclosed opt-out rights.

Notion explicitly certifies to the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF, and addresses CCPA and GDPR rights. However, the consumer documents do not name SOC 2, ISO 27001/27018, ISO 42001, NIST CSF, or the EU AI Act; a Business Associate Agreement is listed but HIPAA is not relevant to the consumer tier. Given the enterprise_saas sector, the absence of named SOC 2 Type II / ISO 27018 attestations in the consumer documents holds this at YELLOW.

The consumer documents provide no transparency into AI model behavior, explainability, or enterprise auditing of AI outputs. There is no discussion of how the AI features work, what models are used, or any auditability mechanism in the supplied consumer text.

The consumer Privacy Policy states Notion takes steps to secure information but disclaims warranty of security and provides no specifics on encryption, access controls, or testing. A Security Exhibit is referenced elsewhere but its substance is not in the consumer documents; breach-notification is described only in general terms with no incident history disclosed.

The Personal Use Terms make clear that organizational, business, and enterprise plans are governed by the separate Master Subscription Agreement rather than the consumer terms, indicating a material difference in data handling between tiers. The consumer documents also note that consumer laws may not apply when using an Organizational Workspace as an Organization User. The consumer terms do not detail free-vs-paid data handling differences beyond this structural split.

The Terms reserve Notion's right to access, review, monitor, and remove Content, including User Content, to operate the Service and ensure policy/legal compliance, though it states it is not obligated to do so. This means staff may access user prompts and content under stated conditions.

The Privacy Policy discloses that Notion may access, preserve, and disclose information to comply with law enforcement or national security requests and legal process, and to cooperate with law enforcement. No pending litigation is disclosed. The Terms also include an arbitration and class action waiver, limiting consumer recourse.

The Privacy Policy discloses collection of significant PII: name, email, phone, mailing address, IP/MAC address, cookie and device identifiers, mobile carrier, advertising identifiers, browser/OS/device details, general and (with consent) precise location, and detailed usage patterns. Payment information is handled by third-party processors and not directly stored. Notion states it does not use or disclose 'sensitive personal information' other than for permitted business purposes, so SPI collection appears limited but PII collection is broad, with adequate disclosure.

The consumer Privacy Policy was last updated September 29, 2025 (with a stated effective date of April 10, 2025) and the Personal Use Terms became effective in 2024 — both within acceptable recency against the July 2026 analysis date. However, the product surface shows an explicitly AI-first offering ('AI where your team works,' Custom Agents), while the consumer documents mention AI only obliquely (Output within User Content) and are largely silent on model training, third-party model providers, and AI data flows. This partial coverage of visible AI capabilities caps the rating at YELLOW.

Multiple consumer documents were supplied (Privacy Policy and Personal Use Terms of Service), and their provisions on content ownership, data sharing, and opt-out rights are consistent with one another. No material or critical contradictions were found across the consumer documents. Minor ambiguities (e.g., retention vagueness) exist within documents but are not cross-document conflicts.