Your data,
handled with care.

Plain English, then the legal bit.

Notealy is a customer relationship management (CRM) platform. To run it, we collect personal data about you (the person reading this) and about the people your team interacts with. This policy explains what we collect, why we collect it, how long we keep it, and what choices you have.

We wrote this in plain language on purpose. Where the law requires formal terms, we use them — but every section starts with what you actually need to know.

This policy applies to notealy.com, app.notealy.com, and any related Notealy services. If you’re a customer’s customer (your email address landed in someone else’s Notealy workspace), the controller of your data is that customer — not us. We process it on their behalf as described in our Data Processing Addendum.

The controller of your data.

For account holders and visitors of our marketing site, the data controller is Notealy, Inc., a Delaware corporation with a Brazilian subsidiary (Notealy Tecnologia Ltda.) serving customers in Latin America.

US entity

Notealy, Inc. — 1209 Orange Street, Wilmington, DE 19801, USA.

BR subsidiary

Notealy Tecnologia Ltda. — São Paulo, SP, Brasil.

EU representative

Maetzu Legal — Article 27 GDPR representative for European users.

Data Protection Officer

Reach our DPO directly at dpo@notealy.com.

Three kinds of data, three reasons.

We collect data only in three contexts: when you create an account, when you use the product, and when your browser visits our marketing pages.

1. Account data

You give this to us directly when you sign up:

• Name, work email, password (hashed with Argon2id).
• Company name, role, team size — if you choose to share them.
• Profile photo, phone number, time zone — optional.
• Billing details (card last four, billing address, tax ID) — handled by our payment processor; we never store full card numbers.

2. Content data

Records you create or import — contacts, deals, notes, messages, calls, emails synced from Gmail/Outlook, files. This is the data your team puts into Notealy. You own it, we host it.

3. Usage data

Generated automatically as you use the product:

• Login history, IP address, device, browser, OS.
• Pages visited, features used, error logs.
• API calls, including timestamps and endpoint paths.

We do not record screen activity, capture form inputs in analytics, or use session-replay tools that reproduce what you typed.

Six legitimate purposes.

We use your data only for the purposes below, and only to the extent necessary for each one. The legal bases (under GDPR Art. 6 and LGPD Art. 7) are listed alongside.

Run the service

Authenticating you, syncing your inbox, sending notifications, processing pipeline updates. Legal basis: contract performance.

Billing & accounting

Issuing invoices, processing payments, fraud prevention, tax compliance. Legal basis: contract + legal obligation.

Support

Replying to tickets, debugging, training our team. We access your workspace only with explicit, time-bound, logged consent. Legal basis: legitimate interest.

Security

Detecting abuse, blocking attacks, investigating incidents. Legal basis: legitimate interest + legal obligation.

Product improvement

Aggregated, de-identified usage analytics. Never tied to individual records or used to train AI on your content. Legal basis: legitimate interest.

Marketing

Sending product updates and educational content to account holders. Opt out at any time from any email. Legal basis: legitimate interest (existing customers) or consent (everyone else).

Who we share with — and why.

We share data only with vetted sub-processors that help us run the service, with authorities when legally compelled, or with you when you ask us to (e.g., connecting Gmail). The full list of sub-processors is published at notealy.com/sub-processors and updated whenever it changes; existing customers receive 30 days advance notice of any addition.

Service providers

• AWS — infrastructure (São Paulo, Frankfurt, Virginia).
• Stripe — payment processing.
• Postmark / Amazon SES — transactional email.
• BetterStack — uptime monitoring.
• PostHog — product analytics (self-hosted, no third-party cookies).
• Cloudflare — DNS, DDoS protection.

Legal disclosures

We disclose data when compelled by valid legal process — subpoena, court order, or equivalent. We push back on overbroad requests, and where the law allows, we notify the affected customer first. Annual numbers are published in our Transparency Report.

Business transfers

If Notealy is acquired or merges with another company, your data may transfer to the successor entity under terms equivalent to this policy. We’ll notify you 60 days in advance, and you’ll have the right to delete your data before the transfer takes effect.

Eight rights you can exercise — for free, anytime.

You can exercise any of these rights through the in-app Settings → Privacy page or by emailing dpo@notealy.com. We’ll respond within 15 days; complex cases may take up to 30.

• Access. Request a copy of all personal data we hold about you.
• Rectification. Correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”). Delete your account and all associated data.
• Portability. Export your data in a machine-readable format (JSON, CSV).
• Restriction. Pause processing while a dispute is resolved.
• Objection. Stop us from processing data on a legitimate-interest basis.
• Withdraw consent. For anything we do based on your consent — instantly, no penalty.
• Lodge a complaint. With your local data protection authority (e.g., ANPD in Brazil, the EU equivalent).

For end users whose data is inside a customer’s workspace (your email is in someone else’s CRM): we’ll forward your request to that customer within 5 business days. They are the controller; we are the processor.

How long we keep things.

The general rule: we keep data for as long as we need it for the purpose it was collected, then delete or anonymize it. Specific retention windows below.

Account data

For the life of your subscription. After cancellation: 30-day grace window for restoration, then permanent deletion within 60 days.

Content data

Same as account data. You can also delete individual records at any time (immediately wiped from primary storage; purged from encrypted backups within 30 days).

Audit logs

90 days by default; extendable to 1 year on Scale plan.

Backups

Encrypted snapshots, 30-day rolling retention. After 30 days, snapshots are cryptographically destroyed.

Billing records

7 years (tax compliance, US and Brazil).

Marketing emails

Until you unsubscribe; suppression list kept indefinitely so we don’t accidentally email you again.

Cross-border data flows.

Notealy operates globally. Your data is stored in the region you select at signup — São Paulo, Frankfurt, or Virginia — and we never replicate it across regions without your explicit consent.

However, some sub-processors operate in other jurisdictions (Stripe’s fraud engine, our support team in São Paulo and Lisbon). For those transfers we rely on:

• EU → outside EEA: Standard Contractual Clauses (2021), with supplementary safeguards where the destination lacks an adequacy decision.
• Brazil → outside Brazil: ANPD-approved standard contractual clauses (Resolução CD/ANPD nº 19/2024).
• UK transfers: UK Addendum to the EU SCCs, in force from 21 March 2022.

How we protect your data.

A short summary appears below. Full details — encryption, access controls, pentest cadence, incident response — are in our Security page.

• TLS 1.3 in transit, AES-256 at rest, with per-tenant key separation for sensitive fields.
• Engineers do not have routine access to production data. Just-in-time, time-bound, logged.
• Annual third-party penetration tests; critical findings remediated within 7 days.
• SOC 2 Type II audit in progress. Report available on request once issued.
• Customers notified within 24 hours of any confirmed security incident.

Notealy is for working adults.

Our service is not designed for, marketed to, or intended for children under 16. We do not knowingly collect data from anyone under 16. If you become aware that a child has provided us personal data, email dpo@notealy.com and we’ll delete it within 7 days.

When and how we revise this.

We update this policy when our practices change, when the law changes, or when we add features that handle data differently. Changes that affect your rights are flagged at the top of this page and announced via in-app banner and email at least 30 days before they take effect.

A full revision history is published at notealy.com/privacy/history.

How to reach us.

Privacy & DPO

dpo@notealy.com

Legal

legal@notealy.com

Security

security@notealy.com

Postal — US

Notealy, Inc. · 1209 Orange Street · Wilmington, DE 19801 · USA

Postal — BR

Notealy Tecnologia Ltda. · Av. Paulista, 1374 · São Paulo, SP · 01310-100 · Brasil