Privacy Notice for Notion-mind
This Privacy Notice explains how Sangjin Cha, sole proprietor trading as Notion-mind ("we", "us", "our") collects, uses, and protects your personal data when you use Notion-mind (the "Service").
Effective Date 2026-10-13 Last Updated 2026-10-13
1. Controller and Contact
Data Controller: Sangjin Cha (sole proprietor, Republic of Korea business registration no. 286-23-02144) Address: 501, 48 Myeongseo-ro 112beon-gil, Dongnae-gu, Busan, Republic of Korea Email: sangjincha719@gmail.com
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. We have not yet designated an EU Representative under Article 27 GDPR; until we do, please direct all requests to the email above.
2. Personal Data We Collect
Account and identification data
Items: Google account identifier (sub) and email address; Notion workspace ID and workspace name Source: Google Sign-In when you sign in; Notion OAuth when you connect a workspace
Authentication data
Items: Notion access token and refresh token, encrypted (AES-256-GCM) and stored on our servers so you do not have to reconnect on every device Source: Notion OAuth
Notion workspace content
Items: page titles, database properties, relations, and short body previews of the pages you connected Source: Notion API, read on your request. This content is streamed to your browser for display and is not stored on our servers.
Subscription data (Pro subscribers only)
Items: payment-provider customer ID, subscription ID, subscription status Source: Paddle, our payment provider
Usage data
Items: IP address, browser and device information, access timestamps, cookies Source: automatic, when you use the Service
Payment data
Your name, email address, card details, and billing address entered at checkout are collected and processed directly by Paddle.com Market Ltd, which acts as Merchant of Record and independent controller for the transaction. We never receive or store your card details.
We do not process any special categories of personal data (Article 9).
3. Purposes and Legal Bases (Article 6)
Providing the Service (sign-in, reading and visualising your workspace)
Legal basis: Contract (Art. 6(1)(b))
Managing Pro subscriptions, billing, and refunds
Legal basis: Contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) for tax and accounting records
Security, fraud and abuse prevention, error diagnosis
Legal basis: Legitimate interests (Art. 6(1)(f)) Specific legitimate interest: keeping the Service secure and operational and protecting other users' workspaces
Showing personalised advertising to Free users
Legal basis: Consent (Art. 6(1)(a)), given through the cookie banner. You can withdraw consent at any time.
Showing non-personalised advertising to Free users
Legal basis: Legitimate interests (Art. 6(1)(f)) Specific legitimate interest: funding the free tier of the Service
Providing account and authentication data is necessary to use the Service; without it we cannot display your workspace. Providing consent to advertising cookies is optional.
4. Recipients and Data Sharing
We share personal data with the following recipients or categories of recipients:
| Recipient | Purpose | Category |
|---|---|---|
| Vercel Inc. (USA) | Hosting the Service, access logs | Processor |
| Supabase Inc. (servers in Seoul, Republic of Korea) | Storing subscription status and user settings | Processor |
| Paddle.com Market Ltd (UK) | Payment processing, subscription management, invoicing | Independent controller (Merchant of Record) |
| Google LLC (USA) | Advertising (Google AdSense) | Processor / independent controller for personalised ads |
| Google LLC (USA) | Sign-in authentication (Google account) | Independent controller for the authentication itself |
We do not sell personal data. We may disclose personal data where required by law or to protect our legal rights.
5. International Transfers (Chapter V)
We transfer personal data outside the European Economic Area (EEA) to the following countries:
- Republic of Korea (our own operations; Supabase Seoul region) — Safeguard: Adequacy decision under Art. 45 (Commission Decision of 17 December 2021)
- United Kingdom (Paddle) — Safeguard: Adequacy decision under Art. 45
- United States (Vercel, Google) — Safeguard: EU-U.S. Data Privacy Framework where the recipient is certified; otherwise Standard Contractual Clauses (SCCs)
Where Standard Contractual Clauses (SCCs) apply, copies are available upon request at sangjincha719@gmail.com.
6. Retention
- Google account identifier and email: until you delete your account. Criteria: contract duration.
- Notion access and refresh tokens: deleted immediately when you disconnect Notion or delete your account. Signing out ends the session only; signing back in restores the connection. Criteria: contract duration.
- Subscription status and user settings: 30 days after the subscription ends or the workspace is disconnected. Criteria: contract end.
- Billing and transaction records: 5 years. Criteria: Korean e-commerce and tax law retention periods.
- Access logs: up to 1 year. Criteria: security and legal requirements.
- Advertising cookies: up to 13 months. Criteria: provider policy and your consent.
After the retention period, data is deleted or anonymized.
7. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right of Access (Art. 15) — obtain a copy of your data and information about processing
- Right to Rectification (Art. 16) — correct inaccurate or incomplete data
- Right to Erasure (Art. 17) — request deletion ("right to be forgotten") in certain circumstances
- Right to Restriction (Art. 18) — restrict processing in certain circumstances
- Right to Data Portability (Art. 20) — receive your data in structured, machine-readable format
- Right to Object (Art. 21) — object to processing based on legitimate interests or direct marketing
- Right Not to Be Subject to Automated Decision-Making (Art. 22) — including profiling with legal or similarly significant effects. We do not make such decisions.
- Right to Withdraw Consent (Art. 7(3)) — where consent is the legal basis, withdraw at any time via the cookie settings link on this page
To exercise any right, contact us at sangjincha719@gmail.com. We will respond within one month (extendable by two months for complex requests, with notice). You can also disconnect Notion-mind at any time under "Connected apps" in your Notion settings, which revokes our access to your workspace.
8. Right to Lodge a Complaint
You have the right to lodge a complaint with your local data protection supervisory authority. A list is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
9. Cookies and Tracking Technologies
We use cookies and similar technologies. Strictly necessary cookies (sign-in session, security, your theme and cookie preferences) are always set. Advertising cookies (Google AdSense) are used only with your prior opt-in consent. Visitors in the EEA, UK and Switzerland are asked through Google's certified consent management platform (IAB TCF), which lets you consent, refuse, or manage options and can be reopened from the ad settings link Google shows. Our own cookie banner additionally controls whether ads are personalised; you can change that choice at any time using the cookie settings link at the bottom of this page. "Reject" is as easy as "Accept".
Details of Google's advertising cookies: https://policies.google.com/technologies/ads. Opt out of personalised ads: https://adssettings.google.com.
10. Automated Decision-Making (Article 22)
We do not use automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.
11. Children
Our Service is not intended for children under 16. We do not knowingly collect personal data from children under 16.
12. Security
We implement appropriate technical and organizational measures including encryption of the Notion access token at rest, TLS encryption in transit, secrets kept only in deployment environment variables, and access controls limited to the sole operator.
13. Data Breach
In the event of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and, where the risk is high, notify you without undue delay.
14. Changes to This Notice
We may update this Notice. Material changes will be communicated at least 30 days before taking effect via email or prominent notice on the Service.
Revision History:
- 2026-09-25 — First version
This Privacy Notice takes effect on 2026-09-25.