Is Notion AI private? What Notion keeps, who trains on it, and who decides

The Morse teamPublished November 9, 202610 min read

As of November 2026, Notion AI is private from other users and kept out of model training by default, but what you send it reaches outside AI companies, and on the Free, Plus, and Business plans those providers keep it for up to 30 days. Notion's AI security page says "AI provider retains your data for 30 days or fewer, then deletes it" on Free, Plus, and Business (Notion). Zero data retention is listed only for Enterprise workspaces (Notion). Notion says neither it nor its AI providers use customer data to train models by default (Notion). Notion's AI terms still let it use your data to improve its models when you rate a reply with a thumbs up or thumbs down (Notion).

We read Notion's AI security page, its Notion AI and Notion Credit Supplementary Terms (last updated July 27, 2026), its subprocessor list, its pricing page, its security page, and nine help center articles on November 9, 2026. Notion deserves credit for publishing a retention period for each plan and a subprocessor list that says what each AI company does. Its live meeting transcription also keeps no audio by default. Most of the choices below belong to whoever owns your workspace, not to you.

Notion AI privacy settings at a glance

Every row links to the Notion page it comes from. We read them all on November 9, 2026.

Does Notion AI train on your data?

Not by default, but Notion's pages disagree about the exceptions. The AI security page says "neither Notion nor our AI providers use your Customer Data to train any models," and that Notion's contracts forbid its providers from training on it (Notion). Notion's security page drops the qualifier and says customer data "is never used to train AI models by Notion or its subprocessors" (Notion).

The thumbs buttons are the first exception. Notion's AI FAQ says "Your feedback isn't used to train Notion AI" and that it's shared with the Notion team instead (Notion). The AI terms, which form part of your contract with Notion, are broader. They say Notion "may use data we collect from your use of Notion AI to improve our models" when you "voluntarily provide Feedback to us such as by labeling Output with a thumbs up or thumbs down," or when you give permission (Notion). Until the two pages agree, treat a rating as handing that exchange to Notion, and leave confidential replies unrated.

The second exception is a workspace switch. Notion's Learning and Early Access Program (LEAP) lets a workspace owner or admin turn on Share data to improve Notion AI, after which Notion will "retain data from this workspace" to "improve and evaluate our AI models" (Notion). The choice is made "on a per workspace level," so members don't each get a say. Notion says it will "take steps to anonymize your data and remove sensitive information." Turning it off means "no new data from your workspace will be retained," and the page doesn't say what happens to data already shared. Notion's pricing page frames this as opt-in: Notion AI won't train on your data "unless you opt in to a request to share your data" (Notion). How other companies handle training is in which AI companies train on your data.

How long does Notion AI keep your data?

Up to 30 days at the AI provider on Free, Plus, and Business, and usually zero on Enterprise. On Enterprise, Notion says most models "process your data only to generate a response and keep nothing afterward," while a few that don't offer zero retention stay off until the workspace owner opts in (Notion). Notion adds that some AI features "may require the use of data-retaining LLMs," and that admins get a setting to allow them.

Notion's own copies follow its normal rules. A deleted page can be restored for 30 days, then moves into permanent deletion, and the search embeddings Notion made of it are deleted within 60 days (Notion). Notion stores those embeddings in a vector database run by Turbopuffer. What zero retention does and doesn't promise is in what is zero data retention.

Which AI companies see your Notion data?

More than a dozen. Notion's subprocessor list, read November 9, 2026, names OpenAI, Anthropic, Google, and xAI for hosting language models, and Fireworks, Baseten, Modal, and Cerebras as infrastructure for serving them (Notion). The same list adds AssemblyAI for transcription, two companies that supply web search results, Browserbase for agents' web browsing, and Turbopuffer for embeddings. OpenAI, Anthropic, and Google are listed for "abuse prevention" as well as hosting.

Notion says every provider in the chain is bound by "the same contractual commitments including our no-training and data-handling requirements" (Notion). Workspace owners can choose which AI providers their workspace uses under Settings > Notion AI, in Model controls (Notion). To hear about a new subprocessor before it starts, email team@makenotion.com with the subject "Subscribe to New Subprocessors," which gives you 10 days to object (Notion). We compare subprocessor lists across chatbots in AI chatbot subprocessors.

Is Notion AI Meeting Notes private?

The audio mostly isn't kept, but the transcript is, and the person recording carries the consent. AI Meeting Notes needs a Business or Enterprise plan, and selecting Start transcribing means "you're confirming that everyone in the meeting has given their consent for the meeting to be recorded and transcribed" (Notion). A workspace owner can make a spoken consent message play for everyone with Enforce consent for all workspace members.

On the desktop app and in a browser, audio goes straight to Notion's subprocessors for live transcription, and Notion says "Sub-processors do not store audio." If live processing fails, the audio is uploaded to Notion's servers and kept "for up to 3 days" to try again (Notion). An audio file you upload yourself is stored on Notion's servers until you delete it.

The transcript stays in the Notion page until someone deletes it. Only Enterprise workspace owners can set Automatic transcript deletion, and it doesn't touch pages under a legal hold. Notes started from a Notion calendar event are automatically shared with meeting participants in your workspace, and "Turning off auto-sharing doesn't make notes in a shared database private" (Notion). Meeting bots that join the call are covered in is Read AI safe.

What can Notion AI see in Slack, Google Drive, and Gmail?

Whatever a workspace owner connects, going back a year. AI Connectors need a Business or Enterprise plan, a Notion workspace owner sets them up, and "the integration can access information dating back one year from the setup date" (Notion). Disconnecting makes the content unsearchable, and Notion says the data is "deleted within a day."

For Slack, the owner picks public channels, and each member can add their own private channels and direct messages; each person sees only what they can already see in Slack (Notion). The personal Gmail connector works on any plan, and "Notion AI can read all email messages in your connected Gmail account" (Notion). Notion says it doesn't put email in vector databases but "may temporarily cache email content." When an AI app such as Claude or ChatGPT connects through Notion's MCP server, it can search these connected sources too, and "that app's own terms apply" to what it reads (Notion). Slack's own AI rules are in how to stop Slack AI training.

Can Notion employees see your notes?

Only with permission, for support. Notion says support can reach your account or workspace data "to troubleshoot an issue or recover content after you contact support and grant access" (Notion). Account access, which you grant under your name in Settings, then Support access, lasts 28 days or until you revoke it. Workspace access is a separate switch for owners and admins, and every change to it is recorded in the audit log.

Is Notion AI safe for confidential information?

Only on Enterprise, set up for it. Notion signs a Business Associate Agreement only with Enterprise customers, and "Any Beta Services are not covered by the BAA" (Notion). Enterprise Search and Research mode carry a Beta label on Notion's pricing page (Notion). Notion says its providers' zero-retention APIs "support HIPAA-compliant workflows" only "for workspaces with zero data retention in effect" (Notion). This isn't legal advice: ask your compliance team before patient or client data goes near any AI feature.

Agents add a separate risk. Notion's model picker warns that smaller models "may be more vulnerable to prompt injection," and Notion suggests a larger model for work with sensitive data or untrusted files (Notion). Owners can turn off web search for the whole workspace or require confirmation before Notion AI visits a site (Notion). We explain the attack in what is prompt injection.

Where to take the questions you'd keep out of Notion

Every answer above traces back to one arrangement. Notion AI runs inside a workspace someone else administers, and it hands what you type to a chain of AI companies that keep it for up to 30 days unless your employer pays for Enterprise. The workspace owner decides about data sharing, connectors, web search, and transcript deletion. Work belongs in Notion, under your employer's rules. The questions that are yours alone need an account you hold. Morse keeps your chat history in your browser, encrypted, and our servers don't keep your messages or log what you write.

• Private, for the zero retention Notion reserves for Enterprise. Every new chat starts in Private, with open-weight models like DeepSeek, Kimi, and GLM, plus Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for anything you wouldn't want any company to read. Your browser checks a secure enclave's hardware attestation, then encrypts the message on your device so only that enclave can read it. Our servers relay ciphertext they can't read, and the reply is decrypted only in your browser. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models like GLM, Kimi, and DeepSeek, without web search or image generation, and comes with Pro, at $19 a month.
• Anonymous, to ask GPT, Claude, or Gemini without your name on it. Our proxy strips your account, email, and IP address and sends the message under Morse's own account. The provider sees the message without knowing it's you, and may keep it for a limited time to check for abuse, under its own policy. Leave colleagues' and clients' names out of what you paste.

There's no data-sharing switch for an admin to flip and no rating clause to watch. Morse doesn't train AI on your content, sell your data, or show ads (privacy policy). Because we don't store your chats, we usually have very little to give authorities. Clearing your browser or deleting your account removes the history, and Morse can't recover it, so keep a copy of anything you need.

So is Notion AI private enough?

• From other users: yes. Notion AI answers only from pages you can already open.
• From training: yes by default. Don't rate replies on anything confidential, and ask your owner whether Share data to improve Notion AI is on. Morse has no training to opt out of.
• From the AI providers: only on Enterprise. Free, Plus, and Business requests can sit with a provider for 30 days. In Morse's Private mode, the providers have agreed to keep nothing.
• In meetings: say you're transcribing, and ask an Enterprise owner to set transcript deletion.
• From your admin: no. The owner controls the settings above and the connectors that feed Notion AI. Keep personal questions on an account you hold, on your own device.

Start a chat from the Morse home page without an account, or start free with no card needed. End-to-end encrypted chats come with Pro, at $19 a month.