Notumation

Privacy Policy

Last updated: March 25, 2026

1. Introduction

Notumation ("we", "us", "our") is an automation platform for Notion. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our service. By accessing or using Notumation, you acknowledge that you have read and understood this policy.

This policy applies to all users of the Notumation platform, including visitors to our website, free-tier users, and paid subscribers.

2. Information We Collect

Notion Account Data

When you connect your Notion workspace via OAuth, we receive the following information from Notion:

  • Your Notion workspace ID and workspace name
  • Your user name, email address, and avatar
  • An OAuth access token that allows us to interact with your workspace on your behalf

Workspace Content

Our automations read and write database entries, page content, and comments within your Notion workspace as configured by you in your flows. We only access the data strictly required to execute the automations you have set up. We do not scan, index, or analyze your workspace content beyond what is necessary for your configured flows.

Usage Data

We collect anonymous, aggregated usage metrics to improve the service. This includes the number of flows created, automation executions performed, and error rates. These metrics are not linked to individual users or identifiable workspace content.

Payment Data

If you subscribe to a paid plan, payment processing is handled by our third-party payment processor, Lemon Squeezy. We do not store, process, or have access to your credit card numbers or full payment details. We receive only your subscription status, plan type, and Lemon Squeezy customer ID to manage your account.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Execute the automations you configure within your Notion workspace
  • Display your dashboard, flows, execution logs, and account information
  • Store authentication tokens to maintain your active session and workspace connection
  • Process payments and manage your subscription through Lemon Squeezy
  • Improve the service based on anonymous, aggregated usage data
  • Send service-related communications, such as trial expiration notices, service disruption alerts, and important account notifications

We do not use your information for advertising, profiling, or any purpose unrelated to providing and improving the Notumation service.

4. Data Storage and Security

We take the security of your data seriously and implement the following measures:

  • Flow configurations are stored in your own Notion workspace (in the _Notumation_Flows database), not on our servers. You retain full ownership and control of this data at all times.
  • OAuth access tokens are encrypted using AES-256-GCM encryption before being stored on our server. These tokens are never stored in plaintext.
  • Session data is managed through encrypted, HTTP-only cookies that cannot be accessed by client-side scripts.
  • All communication between your browser, our servers, and the Notion API is conducted over HTTPS/TLS, ensuring data is encrypted in transit.
  • Stored variables (such as API keys or secrets you configure in your flows) are encrypted at rest using industry-standard encryption.

5. Data Sharing

We do not sell, rent, or trade your personal data to third parties for marketing or any other purpose.

We share data only with the following third-party services, solely to provide the Notumation service:

  • Notion — We access the Notion API using your OAuth token to execute your configured automations. Data shared is limited to what is required for your flows.
  • Lemon Squeezy — Our payment processor receives the information necessary to process your subscription payments and manage billing.

We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Notumation, our users, or the public.

6. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with applicable data protection laws, you have the following rights regarding your personal data:

  • Right to access: You may request a copy of the personal data we hold about you.
  • Right to rectification: You may request that we correct any inaccurate or incomplete personal data.
  • Right to deletion: You may request the deletion of your account and all associated personal data from our systems.
  • Right to data portability: You may request an export of your flow configurations in JSON format.
  • Right to object: You may opt out of any non-essential data processing activities.

To exercise any of these rights, please contact us at privacy@notumation.com. We will respond to your request within 30 days, as required by applicable law.

7. Cookies

Our use of cookies and local storage is minimal and limited to essential functionality:

  • Session cookie: A single HTTP-only, encrypted cookie is used for authentication. This cookie is essential for the service to function and cannot be disabled while using the platform.
  • Theme preference: We use localStorage to store your display theme preference (light or dark mode). This data never leaves your browser.

We do not use tracking cookies, third-party analytics cookies, or any form of cross-site tracking. No cookie consent banner is required because we do not use non-essential cookies.

8. Data Retention

  • Account data is retained for as long as your account remains active and you maintain a connection to your Notion workspace.
  • Execution logs are retained according to the limits of your subscription plan, ranging from 7 days (Free tier) to 90 days (Business plan).
  • Upon account deletion: OAuth tokens and authentication data are permanently deleted from our servers. The _Notumation databases that were created in your Notion workspace remain under your control, and you may delete them at your discretion.

9. Children's Privacy

Notumation is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly. If you believe a child under 16 has provided us with personal data, please contact us at privacy@notumation.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you through your Notumation dashboard. Your continued use of the service after such notification constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

privacy@notumation.com