1. Who we are

Nottut is operated by Zempra LLC, a Wyoming limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, USA ("we", "us"). We are the controller of the personal data described here. This policy covers the Nottut website, web app and desktop app. For any privacy question or request, email support@nottut.com. If you live in Türkiye, the KVKK notice (in Turkish) adds what Turkish law requires.

2. What we collect

Account data: email address, name, profile photo, a bcrypt hash of your password (never the password itself), how you sign in, your settings, and any optional profile details you add, such as a bio, location, website, phone number or birth date.
Your content: the pages, databases, folders, tags, comments, reminders and files in your Cloud workspaces, their version history, who you share them with, and comments or likes you leave on published pages.
From others: if you sign in with Google, Google gives us your email address, name and profile photo. If someone invites you, they give us your email address.
Payment data: your plan, billing period, subscription status and payment events, from Stripe (section 5).
AI data: what you send to AI features, their answers and usage records (section 4).
Usage data: events showing which features are used, with timings, app version and platform, but no note content (section 8).
Device and log data: IP address, browser, operating system, device type and times of access, including for each sign-in session, and error reports when something breaks.
Messages you send us, such as support emails.

In the desktop app, a Local workspace stays on your device. We do not receive its content unless you move it to a Cloud workspace or use an online feature with it, such as AI.

3. How we use it, and our legal bases

To provide the Service: run your account, store and sync your content, share and publish it as you choose, run the AI features you use, answer support requests, and send service emails such as sign-in codes, password resets, invitations and security alerts. Legal basis: our contract with you.
To manage paid plans and keep billing records. Legal basis: our contract with you, and our legal obligations for tax and accounting.
To keep the Service secure and working: prevent abuse, fraud and attacks, and find and fix errors. Legal basis: our legitimate interest in a secure, reliable service.
To improve the Service with our own usage data. Legal basis: our legitimate interest in improving the product; you can turn it off (section 8). Google Analytics runs only with your consent.
To comply with the law, for example to answer lawful requests from authorities. Legal basis: legal obligation.

We do not sell your personal data, show you ads, send marketing emails, or use your content to train AI models. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

4. AI features

AI features are optional. Your content goes to an AI provider only when you use one:

The editing tools, such as improve, summarize or translate, send the text you selected.
The assistant sends your question and the conversation so far. By default it also sends the page you have open and short excerpts from up to five related notes it finds in your workspace. You can switch both off in the assistant.

With the AI credits in your plan, requests go to OpenAI (US), Anthropic (US) or Google (Gemini API, US), depending on the model. The Free plan uses OpenAI. On a paid plan you can also choose a DeepSeek model, which is processed in China; it is used only when you choose it. The provider processes the content under its API terms to produce the answer.

If you connect your own account with an AI provider in Settings (for example OpenAI, Anthropic, Google, DeepSeek, Alibaba Cloud's Qwen, Mistral, xAI or OpenRouter), your requests use your key, that provider's terms apply and it bills you. In the web app these requests pass through our servers, where your key is stored encrypted; in the desktop app they go from your device to the provider.

Web assistant conversations are saved to your account until you delete them or the account; desktop ones stay on your device. Changes the assistant proposes to a page are stored with your account. For each request we record the model, the amount of text processed and the credits used, but not the text.

If you connect Nottut to ChatGPT or another MCP app, it can read the Cloud workspace you choose and, if you grant write access, prepare edits that apply only after you confirm them. Local notes are excluded, and you can remove the connection in Settings. The app's own privacy policy covers what it receives. We log which app made which request, when, and the result, but not your queries or note content.

5. Payments

Stripe sells our paid plans as merchant of record, under the name Link, and is an independent controller for those purchases: it collects your payment details, billing address and tax information under its own privacy policy. We give Stripe your email address, name and account ID, and Stripe tells us about your subscription and payments. We never receive your full card number.

6. Who receives your data

Service providers that process data for us, under contract and on our instructions:

Our hosting provider (European Union): application servers and database.
Cloudflare, Inc. (US): storage for uploaded files, delivery and protection of our website, and cookieless visit statistics (section 8).
Resend, Inc. (US): sending account emails.
Functional Software, Inc. (Sentry) (US, data stored in Germany): web app error reports, with account details removed before sending.
The AI providers in section 4, when you use AI features.
Google LLC (US): Google sign-in if you use it, Google Analytics if you accept it, and Google Fonts when you pick a font that is not built in.
Unsplash: image search. Our server sends your search words; images you pick load from Unsplash's servers, which see the viewer's IP address.
IndexNow (Microsoft Bing, Yandex): when you publish or remove a listed page, we send its address so search engines can update their results.

Others who can see your data:

Stripe, for payments (section 5).
Embed providers: a page with an embed, such as a YouTube or Vimeo video, a Loom, Figma, CodePen or CodeSandbox item, or a Spotify player, loads it from that service, which receives the viewer's IP address and may set its own cookies.
People you work with: people you share with, or who are in the same workspace, see your name, email address and profile photo along with your contributions.
Anyone, for what you publish: a published page shows your name, profile photo and bio. A listed page also appears in Explore and in search engines; an unlisted one is reachable only through its link.
Authorities, when the law requires it, limited to what is requested.
A buyer or successor, if Zempra LLC is sold, merges or reorganizes; we will tell you before your data falls under a different privacy policy.

7. International transfers

We are based in the US, and we and our providers process data in the US, the EU and other countries, including China when you choose a DeepSeek model. When personal data from the EU, EEA, UK or Switzerland goes to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum) or on the recipient's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask us for a copy of these safeguards.

8. Cookies, local storage and analytics

Necessary: a secure cookie keeps you signed in and expires after 7 days without use. Your browser also stores your preferences, your cookie choice and, in the web app, unsynced changes and cached data so the app works offline. The desktop app keeps sign-in tokens in your operating system's credential store and Local workspaces in a database on your device.
Our usage analytics: when you are signed in, the app sends us usage events linked to your account and to a session ID stored in your browser. They contain no note content, and we keep them for 90 days. You can turn them off in Settings, under Privacy, on each device you use.
Cloudflare Web Analytics: counts visits to our website and web app without cookies or local storage and without identifying you. It records the page address, the referring site, the browser, the device type, the country and how long the page took to load, and we see only totals.
Our visit count: each page you open on our website or web app sends us its address (without any query or fragment), the referring site and the campaign tags in the link, if any. We work out your country and a rough description of your browser and device. Instead of your IP address we store a code made from it, your browser details and a value that changes every day and is then deleted, so the code cannot identify you or connect your visits on different days. It uses no cookies or local storage. If you create an account on the website we count that too, without linking it to your account.
Google Analytics: loads only if you choose "Accept all" in the cookie banner. It records the pages you visit and technical details, with IP anonymization and advertising features off. To change your choice at any time, use "Cookie settings" at the bottom of our website and legal pages, or in the app under Settings, Privacy.

9. How long we keep data

Account and content: while your account exists. Deleting your account removes it and its content at once; uploaded files are erased from storage shortly after. Comments you left on other people's pages stay without your name, and notifications you sent others may still show it.
Trash: 30 days, then permanently deleted.
Version history: for the period your plan includes. When that period gets shorter, older versions are deleted.
Assistant conversations: until you delete them or your account.
Usage analytics events: 90 days.
Visit counts: 400 days.
Account archives you prepare: 7 days after they are ready.
Sign-in and security records, including IP addresses and browser details: while your account exists.
Server logs: up to 90 days.
Payment and tax records: as long as tax and accounting law requires, up to 7 years, also after your account is deleted.
Support emails: up to 2 years after your request is closed.
Backups: kept for up to 14 days, so deleted data can remain in them for that long.

10. Security

All connections use HTTPS. Passwords are stored as bcrypt hashes. After repeated failed sign-in attempts we block sign-in for a while and email you. If you sign in with a password, you can turn on two-factor authentication. Uploaded files are scanned for malware, AI keys you connect are encrypted, and access to personal data is limited to people who need it. No system is completely secure, so please use a strong, unique password.

11. Your rights

You can see, correct, export and delete much of your data yourself: edit your profile, export pages, prepare an account archive, or delete your account in Settings. For anything else, email support@nottut.com. We may need to confirm it is you. We answer within one month, free of charge; complex requests can take up to two more months, and we will tell you why.

EU, EEA and UK: you can access your data, have it corrected or erased, restrict or object to its use (including use based on legitimate interests), receive it in a portable format, and withdraw consent at any time. You can also complain to your local data protection authority, or in the UK to the Information Commissioner's Office. Türkiye: see the KVKK notice.

US states: depending on where you live, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct or delete it, to get a copy, and to opt out of its sale, targeted advertising and profiling. We do not sell personal information, share it for cross-context behavioral advertising, or use it for profiling with significant effects, and we use sensitive personal information (your login credentials) only to provide the Service. We will not treat you differently for using these rights. An authorized agent can act for you with your written permission. If we decline a request, you can appeal by replying to our answer.

California notice at collection: in the last 12 months we collected identifiers (name, email address, account ID, IP address), customer records and commercial information (plan and payments), internet activity (usage, device and log data), audio or visual content you upload, and sensitive personal information (account login). The sources, purposes, recipients and retention periods are in sections 2, 3, 6 and 9. We have not sold or shared it.

12. Children

Nottut is not meant for children under 13, and we do not knowingly collect their data. Users from 13 to 17 need a parent's or guardian's permission (see the Terms of Service). If you believe a child under 13 has an account, tell us and we will delete it.

13. Changes to this policy

If we make a material change, such as a new category of data, a new purpose, a new kind of recipient or a longer retention period, we will email you at least 30 days before it takes effect. The date at the top shows the current version.

14. Contact

Email: support@nottut.com
Mail: Zempra LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA

Privacy Policy