Privacy Policy

1. Controller and contact

The controller for account administration, billing and service security is [OPERATOR_NAME], [OPERATOR_ADDRESS], [OPERATOR_COUNTRY]. Contact support@notcharts.com for privacy requests. Effective date: [EFFECTIVE_DATE].

When a business customer connects other people's personal data, that customer determines the purpose of that processing. Our processing of that content must be covered by agreed data processing terms. Do not connect sensitive data until the relevant permissions and safeguards are confirmed.

2. Information we process

Account information includes your email, profile information supplied during sign-in, session and verification records, workspace membership and preferences. Password sign-in uses password hashes; OAuth sign-in also uses provider identifiers and tokens.

Connected content includes the Notion pages or databases you authorise, selected property names and values, chart configuration, source snapshots and rendered chart data. Connecting Notion is optional; it is needed for charts based on your Notion data.

Billing records include the selected plan, trial and subscription status, Stripe customer and transaction references and payment outcomes. Card entry is handled by Stripe; our application does not store full card numbers or card security codes.

Service operation may generate IP addresses, request and error details, security records and support correspondence. Optional website analytics uses browser identifiers and event information when you consent. It should not be understood as fully anonymous data.

3. Purposes and legal bases

We use account and connected data to perform the service you request, billing information to administer purchases and meet applicable record-keeping duties, and limited security information for our legitimate interest in preventing abuse and keeping the service reliable. Optional analytics relies on consent. We do not use chart data for automated decisions with legal or similarly significant effects.

You can decline optional analytics without losing access to the service. Necessary account data is required for sign-in and paid plan administration; without it we cannot provide those functions.

4. Providers and transfers

The current integration uses Hetzner for hosting, Stripe for payment and subscription services, Resend for transactional email and Better Stack for telemetry. Notion supplies the data you connect. Google and Notion can supply sign-in information if you select them. Google Analytics is optional website analytics when configured and consented to. These providers may have their own controller responsibilities for parts of their services.

Before publication, confirm the contracting entities, processing regions, processor agreements and any international transfer safeguards: [VERIFIED PROVIDER ENTITIES, PROCESSING REGIONS AND TRANSFER SAFEGUARDS]. We may disclose information when legally required or necessary to handle a security incident or legal claim.

5. Public embeds

A public embed can expose chart values, labels and any enabled detail data to anyone with the link. Choose source fields and sharing permissions carefully. A secret link is not a substitute for authenticating every viewer. You control whether to publish your charts; other people can retain information they already viewed.

6. Retention, deletion and security

We retain active account and chart information to provide the service. Deletion and backup timelines: [ACTIVE DATA DELETION TIMELINE AND BACKUP EXPIRY]. Billing record retention: [STATUTORY BILLING RECORD RETENTION AND LEGAL BASIS]. Security and support retention: [SECURITY AND SUPPORT LOG RETENTION].

The application uses access checks, encrypted transport and encryption for stored Notion tokens. Access is limited according to operational need. No security measure eliminates every risk. Deleting an account does not automatically delete records held independently by payment or identity providers.

7. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Contact support@notcharts.com; we may need proportionate identity verification. We respond within the applicable legal deadlines and explain any lawful restriction.

You may withdraw analytics consent through Cookie settings. Withdrawal does not change the lawfulness of earlier processing. You can disconnect the Notion integration or revoke its permissions in Notion. You may complain to a competent supervisory authority: [COMPETENT DATA PROTECTION AUTHORITY AND CONTACT URL].