Notion: Privacy, Training & Output Ownership

Sensitive Data

HIPAA compliance and Business Associate Agreements (BAA) are strictly limited to Enterprise plans.

Training

Notion and its subprocessors do not use customer data to train their base models by default.

Notion explicitly states that it does not use Customer Data to train the machine learning models used by its AI features. Furthermore, it maintains contractual agreements with third-party providers like OpenAI and Anthropic that prohibit the use of Notion's customer data for their own model training. Training only occurs if a user explicitly opts into feedback programs or specific data-sharing initiatives.

Output Ownership

Users retain full ownership of all content, including AI-generated outputs, which are classified as Customer Data.

Under the Notion AI Supplementary Terms and Master Subscription Agreement, both the 'Input' provided by the user and the 'Output' generated by the AI are defined as Customer Data. Notion does not claim any ownership over this data and grants users the rights to use and exploit it, while requiring only a limited license to host and process it for the purpose of providing the service.

Data Retention

For Enterprise plan workspaces, Notion utilizes 'zero-retention APIs' with its LLM providers, ensuring data is not stored by those third parties after processing. For non-Enterprise plans, LLM subprocessors may retain data for up to 30 days for abuse monitoring. Deleted pages within Notion are typically held in the trash for 30 days before permanent erasure.

Security Measures

Notion is SOC 2 Type II and ISO 27001 certified. Data is encrypted at rest using AES-256 and in transit via TLS 1.2+. However, Notion does not currently offer end-to-end encryption (E2EE); Notion holds the decryption keys, meaning data could technically be accessed for support, security, or legal compliance purposes.

Your Rights & Control

Users have the right to access, export, modify, and delete their data at any time. Notion supports global privacy standards, including GDPR and CCPA, providing automated tools for workspace owners to manage their data footprint and request permanent account deletion.

Special Considerations

Attorneys and medical professionals should avoid using Notion for confidential client or patient data unless they are on an Enterprise plan with a signed BAA. Standard tiers involve a 30-day data retention window by subprocessors, which may conflict with strict 'vault' doctrine requirements in certain legal jurisdictions as of 2026.