This policy explains which personal data Notulous collects, why, and what your rights are. Notulous is a service of [COMPANY NAME], [ADDRESS], KvK [KVK NUMBER] ("we", "us"). Questions about privacy go to privacy@notulous.com.
Two roles
We are the controller for the data we need to run our business: the website and its forms, signing up, the accounts of the people who use Notulous, billing and support. This policy is about that data.
We are a processor for everything a customer puts in its workspace: issues, comments, notes, files, time entries, and the people and clients added to it. The customer (your employer, or the agency you work with) decides about that data, and our data processing agreement with them applies. Questions about it are best asked to them first.
What we collect and why
Visiting notulous.com
What: the technical data your browser sends (IP address, browser, the pages you open) in our server logs.
Why: to deliver the website and keep it secure. Legal basis: our legitimate interest in a working, secure website.
We don't use analytics, advertising or tracking cookies.
The contact and founding forms
What: your name, email address, company, team size, the tools you use, and your message.
Why: to answer you and, for founding workspaces, to decide about your invite. Legal basis: steps you ask for before a possible contract, and our legitimate interest in answering questions.
To keep out bots, the forms use Cloudflare Turnstile, which checks your browser without cookies for tracking.
Signing up and using Notulous
What: your name, email address, password (stored only as a one-way Argon2 hash), job title and role, profile picture if you add one, your settings (such as email notifications), the two-factor sign-in secret if you turn it on, and a record of your sign-in sessions.
Sign-in with Google: if you choose it, we receive your name, email address and profile picture from Google.
Why: to create your account, let you sign in safely and provide the service. Legal basis: the contract with your organisation, and our legitimate interest in keeping accounts secure.
Billing
What: the name and address of the company, its VAT number, the billing email address, the plan and the number of users, and the invoices. Card and bank details are entered with Stripe and never reach us.
Why: to bill the subscription and meet our tax obligations. Legal basis: the contract, and the legal obligation to keep financial records.
Emails we send
Invites, password resets, notifications you turned on (such as mentions and assignments), and messages about your subscription. You can switch off notification emails in your profile. Emails about your account and subscription are part of the service.
Support
What: what you write to us, and what we need to look into your question.
Why: to help you. Legal basis: the contract, and our legitimate interest.
Cookies
Notulous only uses cookies that it needs to work. They don't track you, so we don't ask for consent.
__zs_session__: keeps you signed in to your workspace. It is only sent to that workspace's address, and ends when you sign out.
notulous-sidebar-collapsed: remembers whether you collapsed the menu (one year).
theme: remembers whether you chose light or dark mode (one year).
Who we share data with
We don't sell personal data, and we only share it with service providers that help us run Notulous, under an agreement that protects it:
Hetzner Online GmbH (Germany): the servers, the databases and the backups, in data centres in Germany.
[OBJECT STORAGE PROVIDER] ([COUNTRY]): uploaded files and the backups.
Stripe Payments Europe, Ltd. (Ireland): payments and invoices.
Mailtrap ([MAILTRAP COMPANY AND COUNTRY]): sending email.
Cloudflare, Inc. (United States): the bot check on the signup and website forms.
Google Ireland Limited (Ireland): our email, and Google sign-in when you use it.
When you connect an integration such as Slack, the data you choose to send goes to that service. We also share data when the law requires it.
Outside the European Economic Area
Your workspace and our servers are in Germany. Some providers above are, or belong to, companies in the United States. Where data goes outside the EEA, we rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
How long we keep data
A workspace and its accounts: for as long as the workspace exists. After a subscription ends, the data is kept for 30 days and then deleted, and copies in backups are deleted within another 30 days.
Billing records: 7 years, as Dutch tax law requires.
Messages through the forms and to support: up to 2 years after our last contact, unless you become a customer.
Server logs: up to 30 days.
Security
Every workspace has its own database with its own login, and the credentials for it are stored encrypted. All connections use HTTPS, passwords are stored as Argon2 hashes, sign-in attempts are limited, and two-factor sign-in is available to every user. Backups are made every hour. See the data processing agreement for the full list of measures.
Your rights
You can ask us to see the personal data we have about you, to correct or delete it, to limit how we use it, to object to how we use it, or to receive it in a common format. Write to privacy@notulous.com; we answer within a month. For data in a workspace, we pass your request on to the customer it belongs to, or help them answer it.
If you think we handle your data wrongly, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
We may update this policy. The date at the top shows when it last changed, and we tell admins by email about important changes.