Privacy policy

Who we are

[to be filled] ([to be filled]), [to be filled], runs Notable and decides how your personal data is used (we are the controller). Write to [to be filled] about anything in this policy.

What this covers

The Notable app, the free report at /free, and the public pages of this site. When an agency uses Notable for its clients, the agency decides how its workspace's data is used and we process it for them; our data processing agreement covers that.

What we collect, and why

• Your account: email address and, if you give it, your name. To run your account (our contract with you).
• Workspace members and invitations: the email addresses you invite and the role you give them. To run the workspace (contract).
• Signing in: a session cookie, and one-time sign-in links sent by email. To keep your account secure (contract).
• Billing: our payment provider holds your card details; we keep your customer reference and invoices. To charge you and keep the records tax law requires (contract, legal obligation).
• Free reports: the email address you give, the website, what you sell and the market, and a keyed hash of your IP address (never the address itself). To send you the report you asked for and to stop the form being misused (legitimate interest). The address and the hash are erased 30 days after the request.
• Email preferences: whether you want the weekly email. One click in any weekly email stops it.
• Connected Google accounts, only if you connect them: an access token, stored encrypted, and daily totals from Google Analytics and Search Console. To show those figures next to ours (contract).
• Error reports: when something breaks, technical details of the error, which can include your user reference and IP address. To find and fix faults (legitimate interest).
• The brands you track (names, websites, competitors, questions) are business information, not personal data about you.

What we send to AI assistants

To measure how assistants answer, we send the questions you track, with your brand and market, to the assistants' official APIs. We do not send your name, your email address or anything else about you. The answers we store are the assistants' replies.

Who processes it for us

These companies process personal data on our behalf, under contracts that limit them to doing so for us:

• Vercel (hosts the web app; we run it in the Frankfurt region). US company.
• Supabase (our database, in Frankfurt). US company.
• Render (background processing, in Frankfurt). US company.
• Stripe (payments and invoices).
• Resend (sends our emails). Its account data is stored in the United States.
• Sentry (error reports, kept in its EU region).
• Anthropic, OpenAI and Perplexity (AI answers to the questions you track; no personal data about you is sent). US companies.
• Google (only if you connect Google Analytics or Search Console).

Transfers outside the EU

Some of these companies are based in the United States, so data may be reached from there. Where that happens, the transfer relies on the EU–US Data Privacy Framework for companies certified under it, or on the European Commission's standard contractual clauses. [To check: each provider's certification and the clauses in its data processing terms.]

How long we keep it

• Your account and workspace data: until you delete your account or the workspace.
• A deleted brand, with its questions and answers: 30 days, so it can be restored if it was a mistake; then it is deleted.
• Free report email addresses and IP hashes: 30 days.
• Sign-in links and sessions: until they expire.
• Backups: up to 8 weeks, encrypted.
• Invoices: as long as tax law requires. [To check: the period that applies to us.]
• Server logs: kept by our hosting providers for a short period. [To check: each provider's log retention.]

Cookies

We use only the cookies the site needs to work: to keep you signed in and protect sign-in, a short-lived one while you connect a Google account, and one that carries the brand from a free report into sign-up for a day. No analytics or advertising cookies, so we do not ask for consent to cookies.

Your rights

You can ask to see the personal data we hold about you, have it corrected, have it deleted, restrict or object to how we use it, and receive it in a portable form. You can delete your account yourself on your account page, and export your brands' data as CSV. For anything else, write to [to be filled]; we answer within a month. You can also complain to a data protection authority. [To check: the lead supervisory authority, for example the CNPD in Portugal.]

Changes

If we change this policy in a way that matters, we tell account holders by email before the change takes effect.