Security & Privacy
Privacy Policy
Effective Date: October 12, 2026 · We believe data confidentiality is fundamental. Notia maintains an unequivocal zero-training guarantee: your client notes and interactions are never used to train foundation models.
Sections
01 · Information Collected
02 · Zero Model Training
03 · Context Processing
04 · Tenant Isolation & KMS
05 · Sub-Processors
06 · GDPR & CCPA Rights
07 · Retention & Deletion
01. Information We Collect
We collect information strictly necessary to provide intelligent client memory services: workspace account credentials, connected third-party integration tokens (e.g. email, calendars, and CRM tools), and customer data processed through workspace queries. We never capture raw client credentials or unencrypted billing details.
02. Strict Zero Foundation Model Training
Your enterprise intelligence is strictly yours. Notia enters binding enterprise data protection addenda guaranteeing that Customer Data, conversation transcripts, meeting summaries, and extracted entities are never utilized to pre-train, fine-tune, or reinforce foundation models across any provider.
03. How We Process Context & Vector Memory
When Notia indexes project context, items are embedded into isolated, customer-partitioned vector databases. Contextual queries are evaluated in zero-retention runtime memory. Inference calls made to vetted model providers carry zero-day data retention clauses.
04. Single-Tenant Isolation & KMS Encryption
All data in flight is secured via TLS 1.3 cryptographic protocols. All stored customer data is encrypted with AES-256 GCM. Enterprise organizations can configure Customer-Managed Encryption Keys (CMEK) via AWS KMS or Google Cloud KMS, granting instant unilateral cryptographic revocation rights.
05. Data Sharing & Sub-Processor Standards
Notia does not sell, monetize, or broker personal information or customer context. We engage vetted cloud infrastructure sub-processors audited under SOC 2 Type II and ISO 27001 standards. Any change to sub-processors is communicated to administrators with thirty (30) days notice.
06. Global Data Subject Rights (GDPR & CCPA)
Regardless of geography, all users are provided equal privacy control rights: the right to inspect personal data collected, receive an exportable copy, request correction of inaccurate records, or demand permanent erasure under GDPR Article 17 and CCPA statutory requirements.
07. Data Retention & Irrevocable Deletion
When an account is closed or a client project is archived, associated embeddings, raw text snapshots, and contextual indexes are queued for hard deletion within 30 days. Backup purge cycles complete across all replica clusters within 60 calendar days.
Have a data privacy request?
Contact our Data Protection Officer at privacy@notia.ai to exercise access or erasure rights.
