Privacy policy

1. Data controller

The data controller is Plenumera, 58 rue de Monceau, 75008 Paris, France.

2. Data processed

Your note contents and titles, folder organisation, synced preferences and indexes, and the contents, filenames and precise file types of your attachments are end-to-end encrypted on your device before sync. Notance does not hold your reading key in clear text.

Pre-registration for Notance’s opening: your email address and optional first name are used to process your request and notify you about access at launch, with your consent. This does not create an account. You can withdraw your request through Contact. Requests are received in our mailbox to process your pre-registration. They do not automatically subscribe you to a newsletter.

Depending on how you use the service, Notance processes data needed to create and secure an account, manage a subscription, provide support, and prevent abuse. This may include your email address, subscription-status information, the version, language and fingerprint of the accepted terms and the acceptance date, security logs, and messages sent to support.

Sync, quotas and security require technical data: object identifiers, sizes, dates and attachment categories (image or PDF). Sessions may include an IP address protected by the server, a country and dates.

An email address and username are needed to create an account; outside pre-registration, a name, email address and message are needed to process the contact form. Without these data, the operation cannot be completed. Additional information is optional.

• For purchases made through Polar, Polar sells and bills the subscription and processes the data needed for the transaction. Notance does not receive card numbers.

3. Purposes and legal bases

Accounts, subscriptions and related support rely on contract performance; accounting requirements on legal obligations. Security and fraud prevention rely on Notance’s legitimate interest in protecting the service; other enquiries on its legitimate interest in responding to requests received. Any non-essential marketing relies on your consent where required.

4. Recipients and transfers

Only people authorised by Notance and providers needed to operate the service may receive the data strictly necessary for their role.

• Data storage: your encrypted notes and the accounts database are stored in France with a French host, subject to French law.
• Application hosting and delivery: the website, app and APIs use a global delivery network, which processes requests and technical connection data. Note content passes through it in encrypted form.
• Payment: Polar, as merchant of record for subscriptions.
• Mailbox and email delivery: receiving the messages sent to us and sending service emails (confirmation, password reset).

5. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area, including in the United States for service delivery and subscription sales. The mechanisms provided for are described in the Cloudflare agreement and the Polar Privacy Policy: an adequacy decision covering the transfer or European Standard Contractual Clauses with the necessary additional measures. You can request further information and a copy of the applicable safeguards at [email protected].

Your contents remain end-to-end encrypted in transit and in storage, without a reading key accessible to these providers. Data needed for accounts, connections, transactions and service operation are processed separately, for the purposes described in this policy.

6. Retention periods

Without an active subscription, notes remain readable and exportable for 90 days after the trial ends or two years after the last paid period ends, unless the account is deleted or the service closes, under the Terms.

Deleting your account immediately disables access and initiates erasure of your data. If a technical issue occurs, any remaining erasure must be completed. Data subject to a legal retention requirement, including billing records, is kept for the required period.

For security logs, retention depends on the validity period of the relevant mechanism and the time needed to identify and address abuse or incidents. For support, it depends on resolution of the request and any necessary follow-up. These criteria do not extend retention of note content after account deletion.

7. Your rights

You may request access, rectification, erasure, restriction, objection, or portability where these rights apply. You may withdraw consent at any time for processing based on consent.

You can tell us in writing what you want for your data after your death, at [email protected].

Contact us at [email protected] or via our contact form. You may also contact the CNIL.

8. Protecting your data

These protections work together: end-to-end encryption of your contents, server-side encryption of account records, secure connections and restricted access.

Notance’s encryption model means that losing both your password and recovery key may permanently prevent access to your notes. Keep these items safe.

In the event of a personal data breach, Notance notifies the CNIL where required by Article 33 GDPR, without undue delay and, where feasible, within 72 hours after becoming aware of it. Affected individuals are informed without undue delay where there is a high risk to their rights and freedoms, subject to the exceptions in Article 34 GDPR.

9. Updates

This policy is updated when processing, providers, or applicable obligations change. The update date appears at the top of the page.