This policy explains which personal data Notulous collects, why, and what your rights are. Notulous is a service of ZAPP Development, Hopstraat 19A, 2611 TA Delft, the Netherlands, KvK 42043946 ("we", "us"). Questions about privacy go to privacy@notulous.com.
Two roles
We are the controller for the data we need to run our business: the website and its forms, signing up, the accounts of the people who use Notulous, billing and support. This policy is about that data.
We are a processor for everything a customer puts in its workspace: issues, comments, notes, files, time entries, and the people and clients added to it. The customer (your employer, or the agency you work with) decides about that data, and our data processing agreement with them applies. Questions about it are best asked to them first.
What we collect and why
Visiting notulous.com
What: the technical data your browser sends (IP address, browser, the pages you open) in our server logs.
Why: to deliver the website and keep it secure. Legal basis: our legitimate interest in a working, secure website.
Visit counts: we count visits to the website and the signup with Plausible Analytics, without cookies and without storing personal data. It sees which pages are opened, where a visit came from (such as a search engine), the browser, the country, and whether someone started the signup or sent a form. Your IP address is only used to tell visits apart within a day, through a code that changes daily, and isn't stored. We only see the totals. Legal basis: our legitimate interest in knowing how the website is found and used.
We don't use advertising or tracking cookies, and there are no visit counts inside a workspace.
The contact and founding forms
What: your name, email address, company, team size, the tools you use, and your message.
Why: to answer you and, for founding workspaces, to decide about your invite. Legal basis: steps you ask for before a possible contract, and our legitimate interest in answering questions.
To keep out bots, the forms use Cloudflare Turnstile, which checks your browser without cookies for tracking.
Signing up and using Notulous
What: your name, email address, password (stored only as a one-way Argon2 hash), job title and role, profile picture if you add one, your settings (such as email notifications), the two-factor sign-in secret if you turn it on, and a record of your sign-in sessions.
Sign-in with Google: if you choose it, we receive your name, email address and profile picture from Google.
Single sign-on: if your organisation signs in through its own identity provider (such as Microsoft Entra ID, Google Workspace or Okta), we receive your name and email address from it when you sign in, and your account may be created then.
Personal access tokens: if you create one to connect an AI assistant, we keep the name you gave it, its last few characters and when it was last used. The token itself is stored only as a one-way hash.
Why: to create your account, let you sign in safely and provide the service. Legal basis: the contract with your organisation, and our legitimate interest in keeping accounts secure.
How workspaces use Notulous: once a day we count, per workspace, how many people were active and how much is used, such as the number of new issues, comments and time entries, and whether features like email to issues or Slack are connected. Only these totals are kept, without names or content. Why: to improve Notulous and to help workspaces that get stuck. Legal basis: our legitimate interest in improving the service.
Error reports: when something goes wrong in Notulous, a report of the error goes to Sentry: what failed, where in the code, the browser, and the version of Notulous. We leave out names, email addresses, cookies, passwords and what was sent in forms, but a report can contain parts of the page or data where the error happened. Why: to find and fix errors quickly. Legal basis: our legitimate interest in a working service. Reports are deleted after [PLACEHOLDER: the retention of the Sentry plan, such as 30 days].
Emailing an organisation that uses Notulous
Organisations can connect a mailbox, such as their support address, to a project in their workspace. When you email that address:
What: your name and email address, the subject, the text of your message, its attachments, and when it was sent. Your message becomes an issue in their project, and a reply becomes a comment on it. You may be added to their workspace as a contact, which can't be used to sign in unless they invite you. Automatic replies and mailing lists are skipped.
Who decides: the organisation you emailed is the controller of this data, and we process it for them under our data processing agreement. Questions about it, or requests to see or delete it, are best sent to them.
Billing
What: the name and address of the company, its VAT number, the billing email address, the plan and the number of users, and the invoices. Card and bank details are entered with Stripe and never reach us.
Why: to bill the subscription and meet our tax obligations. Legal basis: the contract, and the legal obligation to keep financial records.
Emails we send
Invites, password resets, notifications you turned on (such as mentions and assignments), and messages about your subscription. You can switch off notification emails in your profile. Emails about your account and subscription are part of the service.
Support
What: what you write to us, and what we need to look into your question.
Why: to help you. Legal basis: the contract, and our legitimate interest.
Cookies
Notulous only uses cookies that it needs to work. They don't track you, so we don't ask for consent.
__zs_session__: keeps you signed in to your workspace. It is only sent to that workspace's address, and ends when you sign out.
notulous-sidebar-collapsed: remembers whether you collapsed the menu (one year).
theme: remembers whether you chose light or dark mode (one year).
Who we share data with
We don't sell personal data, and we only share it with service providers that help us run Notulous, under an agreement that protects it:
Hetzner Online GmbH (Germany): the servers, the databases, uploaded files and the backups, in data centres in Germany.
Stripe Payments Europe, Ltd. (Ireland): payments and invoices.
Railsware Products Studio LLC (Delaware, United States), which operates Mailtrap: sending email.
Cloudflare, Inc. (United States): the bot check on the signup and website forms.
Google Ireland Limited (Ireland): our email, and Google sign-in when you use it.
Plausible Insights OÜ (Estonia): the visit counts of the website, without personal data, on servers in the EU.
Functional Software, Inc. (United States), which operates Sentry: error reports, stored in its EU data region (Germany).
When a workspace connects an integration, data goes between Notulous and that service as the workspace has set it up. These services are chosen by the organisation that connects them, and their own terms and privacy policies apply:
Slack: the events chosen for a project are posted to a Slack channel.
GitHub and Bitbucket: branch names, commit messages, pull request titles, links and the names of their authors are sent to Notulous and shown on the issues they mention.
A mailbox at Google (Gmail), Microsoft (Outlook, Microsoft 365) or another email provider: Notulous reads new mail from it, with access the organisation gives and can withdraw. Nothing in the mailbox is changed or marked as read.
Single sign-on: the organisation's identity provider tells Notulous who signs in.
AI assistants through MCP, such as Claude, ChatGPT or Cursor: when you connect one with a personal access token, it can read and change what you can see in Notulous, and that data goes to the provider of the assistant.
We also share data when the law requires it.
Outside the European Economic Area
Your workspace and our servers are in Germany. Some providers above are, or belong to, companies in the United States. Where data goes outside the EEA, we rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
How long we keep data
A workspace and its accounts: for as long as the workspace exists. After a subscription ends, the data is kept for 30 days and then deleted, and copies in backups are deleted within another 30 days.
Billing records: 7 years, as Dutch tax law requires.
Messages through the forms and to support: up to 2 years after our last contact, unless you become a customer.
Server logs: up to 30 days.
Mail from a connected mailbox: the issues and comments it became are kept like the rest of the workspace. The record of which messages were read (sender, subject and date) is deleted when the mailbox is removed from the workspace.
Code links from GitHub and Bitbucket: deleted when the repository is removed from the workspace, or when the issue is deleted.
Security
Every workspace has its own database with its own login, and the credentials for it are stored encrypted, like the logins of connected mailboxes and the secrets of single sign-on. Personal access tokens are stored only as hashes. All connections use HTTPS, passwords are stored as Argon2 hashes, sign-in attempts are limited, and two-factor sign-in is available to every user. Backups are made every hour. See the data processing agreement for the full list of measures.
Your rights
You can ask us to see the personal data we have about you, to correct or delete it, to limit how we use it, to object to how we use it, or to receive it in a common format. Write to privacy@notulous.com; we answer within a month. For data in a workspace, we pass your request on to the customer it belongs to, or help them answer it.
If you think we handle your data wrongly, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
We may update this policy. The date at the top shows when it last changed, and we tell admins by email about important changes.