# Privacy Policy

**Last updated: October 22, 2026**

## 1. Privacy Statement

This Privacy Policy describes how Notra, Inc. ("Notra", "we", "us", or "our") collects, uses, and protects your personal information when you use our website at usenotra.com and our dashboard application at app.usenotra.com (collectively, the "Service"). Notra, Inc. is the controller of your personal data where applicable data protection law uses that term. By using the Service, you agree to the collection and use of information in accordance with this policy.

## 2. Your Privacy Rights

If you are a resident of the European Economic Area (EEA) or the United Kingdom, you have certain data protection rights under the General Data Protection Regulation (GDPR). These include the right to:

- Access the personal data we hold about you
- Request correction of inaccurate personal data
- Request deletion of your personal data
- Object to processing of your personal data
- Request restriction of processing your personal data
- Request portability of your personal data
- Withdraw consent at any time where we rely on consent to process your data

To exercise any of these rights, please contact us at support@usenotra.com. We will respond to your request within 30 days.

## 3. Age Limit

The Service is not intended for individuals under the age of 13. If you are under 13, you may not use the Service. If you are a resident of the European Union, you must be at least 16 years old to consent to the processing of your personal data. If we become aware that we have collected personal data from a child under the applicable age limit, we will take steps to delete that information.

## 4. Cookies, Analytics, and Session Replay

We use functional and session cookies for authentication and session management. Analytics tools may also use cookies or browser storage to recognize a browser or session and associate usage events.

For analytics, we use [databuddy](https://databuddy.cc), a cookie-free, GDPR-compliant analytics service. databuddy does not use cookies. For general website analytics through databuddy, we do not send direct identifiers such as your name or email address. To measure signup conversion and onboarding performance, we may send limited pseudonymous event data such as internal user ID, organization ID, signup method, selected plan, and experiment variant. We do not use databuddy for advertising profiles or third-party ad targeting. This cookie-free description applies to databuddy, not to every analytics tool used by Notra.

**PostHog analytics:** We use [PostHog](https://posthog.com/privacy) for product analytics, page views, feature and workflow usage, error tracking, and troubleshooting. Data can include browser and device information, page paths, interaction and error events, timestamps, session identifiers, and internal user, workspace, and project identifiers. Server-side usage events can also include AI model identifiers, token counts, credit usage, and costs. Events can be associated with your signed-in account. The dashboard identifies signed-in users by internal user ID. It also sends your name and email to PostHog when your Hide Personal Data setting is turned off. PostHog may use cookies and browser storage to maintain analytics identifiers.

**Session replay:** Session recording is disabled in the Notra dashboard, so the dashboard does not currently collect PostHog session replays. Product analytics and error tracking remain enabled separately. Notra-hosted sites can separately use PostHog session replay with the site owner's PostHog project to record page structure and interactions such as navigation, clicks, and scrolling. What is captured depends on that site's recording and masking configuration; those recordings are available to that project's authorized users and are governed by the site owner's privacy notice and settings. Site owners can disable session replay in their PostHog integration settings.

**Referral attribution:** We use [Dub](https://dub.co/legal/privacy) to credit partners who refer new customers. If you accept analytics cookies, Dub stores a `dub_id` cookie on usenotra.com and its subdomains when you arrive through a partner link. When you create a workspace, we send Dub that click ID, your workspace ID, your name and your email address. When you subscribe, Stripe shares the purchase with Dub so the referring partner can be paid a commission. If you decline analytics cookies, Dub is not loaded and your signup is not attributed.

**Email tracking:** Emails we send through [Brew](https://brew.new) contain a small invisible image and links that pass through a redirect. This tells us whether an email was delivered, opened, or clicked, so we can keep emails deliverable and see which ones are useful. Many email clients block the image by default, and you can do the same in your email client's settings.

## 5. Information We Collect

We collect the following types of information:

**Account Data:** When you create an account, we collect your name, email address, and profile information provided through OAuth authentication (GitHub or Google).

**Usage Data:** We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, signup method, onboarding selections, and related product analytics events.

**Content Data:** When you connect third-party integrations (such as GitHub, Linear, or Slack), we collect and process the data you authorize us to access from those services. This includes repository activity, issue data, and messages that you explicitly choose to connect.

**Contact Data:** When you use our contact form, we collect your name, email address, company (if provided), and message to handle your inquiry. To screen for spam, we send only the message text to TypeSafe AI's Jev model through Vercel AI Gateway; the separate name, email, and company fields are not sent to the model. Your message may contain personal information you choose to include. Messages classified as spam are not forwarded to our team.

**Notra Feedback:** Notra Feedback is our own feedback collection and triage system. When you submit a bug report, feature request, question, or other feedback, we store the message and any supplied title, category, sentiment, related page URL, project reference, and submission metadata. Depending on the submission channel, metadata can include the source, agent or integration name and model, tool version, browser or client user-agent, external identifiers, and additional context supplied by the submitting integration. Public feedback endpoints use IP-based rate limits to prevent abuse.

Feedback is routed to the receiving organization's inbox and is accessible to its authorized users. Feedback sent to Notra's own inbox is used by our team to investigate issues, respond to requests, and improve the product. We may process the message, title, related URL, and agent context through our AI classification and evaluation providers to suggest a title, category, or sentiment. Send only information relevant to the feedback, and do not include credentials, payment-card details, health records, or other sensitive personal records. The fields available through an individual assistant tool may be narrower than those supported by the feedback API.

**AI Traffic Data:** When you install Notra's AI traffic tracking on your website or connect a log drain, we receive request logs for visits from AI agents, crawlers, and assistants. These logs can include the requested host and path, request method, timestamp, user-agent, sanitized referrer, approximate country, preferred language, request ID, and the agent and purpose we classify from the request. We use IP addresses only transiently to group requests into journeys and do not store them with these logs. Ordinary human visits are dropped unless you separately enable visitor analytics for a Notra-hosted site.

**Email Data:** To send account, notification, and (if you opted in) marketing emails, we share your email address, name, sign-up date, internal user ID, your email notification preferences, and, if you opted into marketing emails, when and how you gave that consent with our email provider [Brew](https://brew.new). Brew also records delivery, open, click, bounce, and unsubscribe events for the emails we send you.

**Payment Data:** If you subscribe to a paid plan, payment processing is handled by our billing provider [Autumn](https://useautumn.com) (powered by Stripe). We do not store your credit card details directly. When you sign up, we create an Autumn customer profile to enable usage tracking. If you later initiate a payment and a Stripe customer does not already exist, we may create one to process the transaction.

### Connected assistants and MCP

When you connect Notra to an assistant such as ChatGPT or Codex, the assistant sends the arguments for the tools you authorize it to use. These can include workspace and project identifiers, business content such as draft text and writing instructions, publishing destinations and times, and product feedback you choose to send. Notra processes those requests to carry out the selected operations and returns the requested results to the connected assistant. Content-generation and visibility tasks may also send the task's content or queries to the AI and infrastructure providers used to perform that task. Publishing and webhook delivery send the selected content to the configured destinations.

The connection is intended for business content and brand visibility. Do not submit health records, biometric data, government identifiers, payment card information, passwords, API keys, or authentication secrets in tool arguments. Authenticate using the connection's sign-in flow; configure integration credentials in Notra's dashboard. Billing on our website is separate from this connection and does not require payment-card details in an assistant conversation.

When enabled, MCP usage analytics are sent to PostHog and include tool name, client and protocol version, time, duration, outcome, authentication type, and internal workspace and user identifiers. These usage events do not include tool arguments, response content, or authentication tokens. Saved content and feedback are subject to the retention and deletion provisions below. You can disconnect Notra in your assistant to stop future calls through that connection; disconnecting does not delete content already saved in Notra or in the assistant. Contact us using the details below to exercise your data rights.

## 6. Third-Party Services

We use the following third-party services to operate and improve the Service:

- **Vercel** -- Hosting, deployment, and AI Gateway access for content generation, contact-form spam classification, and feedback classification
- **TypeSafe AI** -- Jev model used through Vercel AI Gateway to classify contact-form messages for spam and evaluate feedback for classification
- **[Brew](https://brew.new)** -- Email delivery, email contact management (email address, name, user ID, sign-up date, and email preferences), and email delivery and engagement tracking
- **[PostHog](https://posthog.com/privacy)** -- Product and MCP usage analytics, account and workspace analytics, error tracking, and session replay where enabled, as described above
- **Upstash** -- Redis database and message queues
- **Tinybird** -- Storage and analysis of AI traffic logs
- **[Autumn](https://useautumn.com)** -- Subscription billing (powered by Stripe)
- **[databuddy](https://databuddy.cc)** -- Cookie-free, GDPR-compliant analytics and signup attribution
- **[Dub](https://dub.co/legal/privacy)** -- Partner referral attribution and commission tracking
- **GitHub** -- OAuth authentication and repository integration
- **Google** -- OAuth authentication

Each of these services has its own privacy policy governing the data they process.

## 7. Retention and Deletion

We retain your personal data for as long as your account is active or as needed to provide you with the Service. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required to retain certain information for legal or regulatory purposes.

Contact messages forwarded to our team are retained as needed to handle the inquiry. We do not save contact-form messages classified as spam. Notra Feedback entries, their classification and submission metadata, and triage status are stored in the receiving organization's inbox and fall under the retention and deletion provisions in this section. For feedback sent to another organization, contact that organization to request deletion or exercise your data rights.

AI traffic logs are retained to power your traffic reports. We may also keep these logs, in aggregated or de-identified form where practical, for research and product improvement as described in section 9, including after the reporting period shown in your dashboard.

When you delete your account, we also delete your contact record at our email provider Brew.

To request deletion of your account and associated data, contact us at support@usenotra.com.

## 8. Third-Party Websites

The Service may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any website you visit.

## 9. How We Use Your Information

We use the information we collect for the following purposes:

- **Service delivery:** To provide, maintain, and improve the Service
- **Billing:** To process subscriptions and payments
- **Communications:** To send you important updates about the Service, including security notices and changes to our terms. Marketing emails are opt-in only, and you can unsubscribe using the link in the footer of each marketing email or in your notification settings. Notification emails can be turned off in your organization's notification settings.
- **AI content generation:** To process your connected data through AI models and generate content drafts on your behalf
- **Contact inquiries and spam prevention:** To handle contact-form submissions and classify message text for spam before forwarding inquiries
- **Notra Feedback:** To collect and classify product feedback, investigate reports, and track their resolution
- **Research and product improvement:** To analyze AI traffic logs, including aggregated patterns across customers, so we can understand how AI agents and crawlers behave and improve the Service, such as agent classification and traffic insights. We do not use these logs to identify individual human visitors
- **Analytics and troubleshooting:** To understand product and workflow usage, diagnose errors, and improve the user experience; session replay, where enabled, helps investigate interaction problems

We do not sell your personal data to third parties.

## 10. California Privacy Rights

If you are a California resident, you have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which your personal information is collected, the business purpose for collecting your personal information, and the categories of third parties with whom we share your personal information.

To exercise your rights under the California Consumer Privacy Act (CCPA), contact us at support@usenotra.com.

## 11. Updates to This Notice

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically. Continued use of the Service after any changes constitutes your acceptance of the updated policy.

## 12. Data Breach

In the event of a data breach that affects your personal data, we will notify the relevant supervisory authority within 72 hours as required by the GDPR, where applicable. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

## 13. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Germany. Any disputes arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Hamburg, Germany.

## 14. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at:

**Email:** support@usenotra.com

Notra, Inc.<br />
2261 Market Street STE 98632<br />
San Francisco, CA 94114<br />
United States