Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data on Notum is:

2. Scope of this Policy

This policy applies to all personal data collected and processed through the Notum website, web application, mobile progressive web app (PWA), cloud synchronization infrastructure, billing workflows, customer support channels, and community deck galleries.

3. Categories of Personal Data Collected

• Account & Authentication Data: Email address, user ID, display name, encrypted password hashes (managed via Supabase Auth), and third-party authentication tokens (such as Google OAuth) if you choose third-party sign-in.
• User Study Content: Flashcard decks, terms, definitions, LaTeX formulas, code snippets, custom tags, collection structures, and uploaded media attachments (images/audio).
• Learning Telemetry & Spaced Repetition Analytics: SuperMemo SM-2 review ratings (Again, Hard, Good, Easy), review completion timestamps, ease factors, memory stability metrics, study streaks, and quiz performance statistics.
• Technical & Device Data: IP address, browser type, operating system, device screen resolution, access timestamps, client error logs, and local service worker cache identifiers.
• Billing & Subscription Metadata: Stripe customer identifier, subscription plan tier (Free or Premium), renewal dates, transaction receipts, and VAT country code. (Note: Complete credit card details are collected and processed directly by Stripe under PCI-DSS Level 1 certification; Notum never receives or stores your raw card numbers or CVV codes.)
• Communications & Support: Inquiries, feedback, and messages submitted via the Support and Contact pages or sent directly to our support inbox.
• Consent & Interface Preferences: Cookie consent records (notum_cookie_consent_v1) and theme customization settings.

4. Purposes and Legal Bases for Processing (GDPR Art. 6)

• Contract Performance (Art. 6(1)(b) GDPR): Authenticating user accounts, operating the spaced repetition engine, syncing decks across devices, rendering LaTeX math formulas, generating PDF exports, and processing subscription access.
• Legitimate Interests (Art. 6(1)(f) GDPR): Protecting application infrastructure from malicious activity, enforcing rate limits and abuse prevention, diagnosing server errors, optimizing performance, and ensuring platform integrity.
• Legal Compliance (Art. 6(1)(c) GDPR): Fulfilling accounting, tax, and bookkeeping obligations under Danish law (Bogføringsloven) and EU VAT directives.
• Explicit Consent (Art. 6(1)(a) GDPR): Storing non-essential analytical cookies or optional promotional communications, which may be withdrawn at any time via cookie settings.

5. Sub-processors and Third-Party Services

We rely on trusted third-party service providers (sub-processors) who process personal data strictly under data processing agreements compliant with GDPR Art. 28:

• Supabase, Inc. — Managed PostgreSQL database, user authentication, edge functions, and encrypted cloud storage for flashcard media attachments.
• Stripe, Inc. / Stripe Payments Europe, Ltd. — Independent data controller and processor for payment authorization, billing portal, and recurring subscription lifecycle management.
• Cloudflare, Inc. — Edge reverse proxy, DDoS mitigation, and global CDN delivery.
• OpenAI, L.L.C. — Automated trust & safety content moderation via the omni-moderation-latest model API to identify and prevent illegal or harmful content in public flashcard decks (DSA Art. 16 compliance).
• Google Ireland Limited — Strictly opt-in web analytics via Google Analytics 4 (gtag.js). Only initialized when analytical cookie consent is affirmatively granted via the cookie consent banner.
• Resend, Inc. — Transactional email delivery service for account verification, security alerts, and annual subscription renewal reminder notices.
• Banking Providers (Revolut / Lunar) — Commercial business banking and settlement accounts.

6. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate data protection safeguards are implemented, including European Commission Standard Contractual Clauses (SCCs), EU-US Data Privacy Framework certifications, or equivalent legal mechanisms.

7. Data Retention and Account Deletion

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Active Accounts: User account data, decks, and review history are retained while your account remains active.
• Inactive Accounts & Data Minimization: In accordance with GDPR Article 5(1)(e) (storage limitation), free tier user accounts that exhibit zero sign-in activity for six (6) consecutive months are scheduled for automated removal. A 14-day advance notice warning email is sent to the registered address before account purge. Active paid subscribers (Premium accounts) are strictly exempted from inactivity deletion.
• Account Deletion: If you delete your account via the Account Settings ("Danger Zone"), all associated personal profiles, private flashcard decks, review records, and media attachments are permanently and irrevocably deleted from active databases within 30 days.
• Statutory Consent Ledger & Financial Records: Pseudonymized affirmative consent records (including California AB 2863 auto-renewal logs and EU 14-day withdrawal waiver declarations) and transaction/invoice records are retained for 5 years as required by the Danish Bookkeeping Act (Bogføringsloven) and under GDPR Article 17(3)(b) & (e) for legal compliance and defense of legal claims.

8. Technical & Organizational Security Measures

We implement modern security standards to protect your data against unauthorized access, destruction, or disclosure:

• Transport Layer Security (TLS 1.3) encryption across all public endpoints and API traffic.
• Database Row-Level Security (RLS) ensuring strict tenant isolation so users can only access their authorized data.
• AES-256 encryption at rest for persistent storage and backups.
• Secure HTTP-only session cookies and token-based authentication.

9. Your Rights Under GDPR and Global Laws

Under GDPR and applicable privacy legislation, you have the following rights:

• Right of Access (Art. 15 GDPR): Request a copy of the personal data we hold about you, or download your complete unified personal data archive via your Account Settings.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal information.
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data ("Right to be Forgotten") via the Profile Danger Zone.
• Right to Data Portability (Art. 20 GDPR): Export all personal profile data, decks, cards, folders, collections, and spaced repetition metrics in a structured, machine-readable format (JSON) via the "Export Personal Data" button in your Account Settings (/api/profile/export).
• Right to Restriction of Processing (Art. 18 GDPR): Request that we restrict data processing under specific conditions.
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Revoke cookie or marketing consent at any time without affecting past lawful processing.

To exercise any of these rights, contact us at [email protected] or via the in-app Support page.

10. Supervisory Authority & Complaints

If you reside in the EU/EEA and believe our data processing infringes your rights, you have the right to lodge a complaint with your local data protection authority. For Denmark, the competent authority is:

11. California & United States Multi-State Privacy Notice

This section supplements our Privacy Policy and applies exclusively to residents of United States jurisdictions with comprehensive consumer data privacy statutes, including California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Delaware (DPDA), Indiana (INCDPA), Iowa (ICDPA), Kentucky (KPA), Maryland (MODPA), Minnesota (MNDPA), Montana (MCDPA), Nebraska (NDPA), New Hampshire (NHPA), New Jersey (NJDPA), Oregon (OCPA), Rhode Island (RIDPA), Tennessee (TIPA), Texas (TDPSA), Utah (UCPA), and Virginia (VCDPA).

Statutory Consumer Rights

• Right to Know & Access: You have the right to request disclosure of the categories of personal information collected, the sources from which it was obtained, the business or commercial purposes for collection, the categories of third parties to whom data is disclosed, and the specific pieces of personal information collected about you over the preceding 12 months.
• Right to Access & Data Portability: You have the right to receive a portable, structured, and readily usable electronic copy of your personal data. You may download your comprehensive account export at any time via your Account Settings or by querying /api/profile/export.
• Right to Correction: You have the right to correct inaccurate or incomplete personal information maintained about you via your Account Settings or by contacting us.
• Right to Deletion: You have the right to request the permanent deletion of your personal information, subject to limited statutory exceptions (such as compliance with legal obligations or completing transactions), which can be executed directly via the in-app Profile Danger Zone.
• Right to Opt Out of Sale, Sharing & Targeted Advertising: Notum does not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising without affirmative opt-in consent. You may exercise your right to opt out of sale/sharing or targeted advertising at any time via the Cookie settings toggle ("Do not sell or share").
• Right to Appeal: If we decline to take action regarding your privacy request, you have the right to appeal our decision within forty-five (45) calendar days of receiving our denial. To file an appeal, email [email protected] with the subject line "Privacy Request Appeal". If your appeal is denied, you may contact the Attorney General for your state of residence.
• Right to Non-Discrimination: We will never discriminate against you for exercising any of your statutory privacy rights, including by denying goods or services, charging different prices, or providing a different quality of service.

Global Privacy Control (GPC) & Do Not Track Signals

In compliance with California regulations (11 CCR § 7025), Colorado Rule 5.04, Connecticut, and Texas law, Notum automatically detects and honors browser-level opt-out preference signals, specifically the Global Privacy Control (GPC) (navigator.globalPrivacyControl === true or Sec-GPC: 1 header). When a GPC signal is detected, Notum automatically sets your preferences to "Do Not Sell or Share", suppresses marketing and tracking scripts, and applies restricted data processing without requiring you to manually adjust your settings.

Automated Decision-Making & Profiling (GDPR Art. 22)

Notum does not subject users to automated decision-making or profiling that produces legal effects or similarly significant consequences concerning the user (GDPR Article 22). Our algorithmic spaced repetition scheduling (SuperMemo-2 interval calculations) is an educational memory-retention tool operating on user self-graded cards and does not produce discriminatory, legal, or profiling outcomes.

AI Processing & Zero Foundation Model Training

When you choose to use optional artificial intelligence capabilities (such as automated flashcard generation or multiple-choice distractor creation), your prompt text, notes, and study inputs are transmitted transiently via encrypted TLS connections to enterprise large language model APIs (Google Gemini and OpenAI). Prompts and generated outputs are used strictly to deliver the immediate study material requested. Zero Training Guarantee: Under our enterprise API terms of service, your private study materials, cards, notes, and personal data are never used, stored, or processed to train, retrain, or fine-tune public foundation models or commercial AI systems.

12. Children's Privacy & Restricted Safe Mode

Notum is designed for general educational audiences (13+, or 16+ in applicable EU Member States; 13+ in Denmark pursuant to Databeskyttelsesloven § 6).

When a learner below the applicable age of digital consent registers, Notum automatically enforces Restricted Safe Mode (is_restricted_minor): analytics/marketing cookies are strictly disabled, custom media file uploads are blocked, and public deck/collection publishing to the Community Gallery is disabled at the database level. A parent or guardian email is requested during registration for parental notice and verifiable consent under COPPA and GDPR.

Parents or legal guardians may review, export, restrict, or permanently delete a minor's account at any time by contacting [email protected] or using the in-app Account Deletion tool.

13. Contact & Inquiries

For any questions regarding this Privacy Policy or data protection practices, please reach out to us at [email protected] or by post at:

Notum · Milrimvej 89, 9981 Jerup, Denmark