Privacy Policy

Draft for the app launch: this version has not yet been approved for publication.

This page explains which personal data the Notivate app and the website notivate.de process, why, on which legal basis and for how long. Version: 12 November 2026. This is a translation for your convenience; the German version is the authoritative text.

1. Controller

Günther Voltmann, Notivate, Ganghoferstraße 18, 30177 Hannover, Germany
E-mail: support@notivate.de

For questions about data protection and exercising your rights, you can reach us at the e-mail address above.

2. The essentials

• Notivate works without an account. Your notebooks, search and handwriting recognition then stay on your iPad.
• Cloud sync is off by default. It runs only if you switch it on in Settings with Plus or Pro and confirm the notice first.
• Nothing goes to the AI unless you ask it and have given consent first. Your name and your e-mail address are not added as account data. Personal details in your questions, notes or images are transmitted together with that content.
• We do not sell data, show no ads and do not train any AI with your notes.
• Usage statistics are off by default, run only if you switch them on in Settings, and contain no content.
• You can delete your account at any time in the app. Retention periods are listed in section 13.

3. Website notivate.de

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you visit it, Vercel processes technically necessary data: IP address, approximate location derived from it, date and time, page requested, referrer, and browser and system information. This is needed to deliver the site and protect it from attacks (Art. 6 (1) (f) GDPR; our legitimate interest is secure operation).

The site is delivered through Vercel's international infrastructure. Data may be processed in the USA and other countries outside the EU and EEA. Vercel's Data Processing Addendum includes EU Standard Contractual Clauses for the third-country transfers it covers. Vercel also processes technical usage and operational data generated while operating the service as an independent controller under its Privacy Notice.

According to Vercel's Privacy Notice, retention of technical usage and operational data depends on what is necessary to operate, secure and develop the service, fulfil legal and contractual obligations, resolve disputes and enforce rights. Once the necessary purpose no longer applies, data is deleted or anonymized. Backups that cannot immediately be deleted are secured and isolated from further processing until deletion is possible. For data processed on a customer's behalf, Vercel's Data Processing Addendum provides for deletion within a reasonable time after the agreement ends. Statutory retention obligations remain unaffected.

We do not use cookies for analytics or marketing on this website and do not embed analytics or tracking services. The preview, images and fonts are delivered through the same hosting. External websites are accessed only when you follow a corresponding link.

4. App without an account

Without an account, Notivate stores your notebooks, PDFs, images, the search index and handwriting recognition only on your iPad. Text recognition in scans and handwriting runs on the device. You grant access to camera and photos yourself in iOS; images stay on the device unless you sync them or show them to the AI.

Independently of our cloud sync, device backups in iOS or on your computer may also contain local app data. Your system settings and, where applicable, Apple's terms apply to those backups.

On launch the app fetches a technical configuration from our server (for example minimum version, notices about outages or whether the AI is currently available). Your IP address and technical request data are transmitted, but no content and no identifier of yours. The legal basis is Art. 6 (1) (f) GDPR (secure and stable operation of the app).

5. Account

You need an account for sync, subscriptions and the AI. You can sign in with Apple, with Google or with e-mail and password.

• Data: e-mail address, sign-in methods, with Apple or Google the name provided as display name, the app's language, time of registration and your consents (AI, cloud sync) with date and version. We store passwords only as a hash. With “Sign in with Apple” you can hide your e-mail address; we then receive a relay address from Apple.
• Age: when you use the AI assistant for the first time, we determine your age once to apply the age rule in section 14 (AI under 16 only with a parent's consent). Where available, the age range of your Apple Account (such as "16 or older") is enough; otherwise we ask for your date of birth. After that, only our support can change it. The legal basis is Art. 6 (1) (c) in conjunction with Art. 8 GDPR. We keep it until your account is deleted and do not send it to the AI provider. If you never use the AI, we never ask for your age.
• Parental consent: if you are under 16 and want to use the AI, we store the e-mail address of the parent you name, the time of the request and of the confirmation, the version of the confirmed text and a hash of the confirmation token. This is how we demonstrate consent (Art. 7 (1) GDPR). Requests that were not confirmed are deleted 30 days after the link expires. Details are in section 14.
• Apple: when you sign in with Apple, we store a token issued by Apple in encrypted form. We need it to revoke the connection at Apple when you delete your account.
• Google: signing in with Google takes place in your iPad's browser directly at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google learns that you are signing in to Notivate; Google's privacy policy applies.
• E-mails: confirmation and password e-mails are sent by our service provider Supabase through Supabase Auth (see section 12). This involves processing the recipient's address and the content of the respective technical message.
• Purpose and legal basis: providing the account and the services you booked (Art. 6 (1) (b) GDPR).
• Deletion: in the app under Settings → Account → “Delete account”. We then delete your account, the associated synced notebooks and files, your consents and your AI usage data, and revoke the sign-in at Apple. What is excluded from this is listed in section 13. The notebooks on your iPad remain until you delete them yourself or delete the app. Deleting your account does not automatically cancel an App Store subscription.

6. Cloud sync (Notivate Plus and Pro)

Cloud sync is off by default. While it is off, your notebooks stay on your iPad unless you previously used sync or send content to the AI. With Plus or Pro you can switch it on under Settings → Cloud Sync. Before it starts, the app shows you a text that you read and confirm. Only then does Notivate sync your notebooks between your devices and back them up.

What the text says and what is transferred

When you switch it on, all notebooks already on your iPad and everything you write afterwards are transferred to our server: handwriting, text boxes and other page objects, images and PDFs, titles of notebooks and folders, and snapshots for earlier versions. The search index and handwriting recognition are not synced. Notes may contain sensitive content, for example about health, religion or political opinions. By switching sync on you explicitly consent to such content being transferred and stored as well. The data is stored encrypted on servers in the EU. This is not end-to-end encryption: authorized administrative access may be possible for necessary operational or support tasks. Your notes are not used for advertising or AI training.

• Location: the database and file storage of our service provider Supabase in Frankfurt am Main, Germany (region eu-central-1). The transfer is encrypted; permission rules restrict other users' access to your data. The separate processing locations for AI requests are described in section 7.
• Trash and versions: deleted notebooks stay in the trash for 30 days and are then permanently deleted, including their PDFs and images. We keep earlier versions for 30 days; we always keep the latest state.
• Switching off: you can switch sync off at any time under Settings → Cloud Sync. The app then transfers nothing more; the notebooks on your iPad remain. This does not delete the copies on the server. They remain stored until you delete the notebooks (30 days in the trash, then permanently) or delete your account.
• After the subscription: when your subscription ends, your notebooks stay readable and exportable. They remain stored until you delete them or your account.
• Legal basis: Art. 6 (1) (b) GDPR, because sync is part of Plus and Pro. For sensitive content in your notes, your explicit consent applies, which you give by switching sync on after reading the text (Art. 9 (2) (a) GDPR). Switching it off is the withdrawal of this consent with effect for the future (Art. 7 (3) GDPR).
• Proof: we store your decision with the time and the version of the text (currently: 7 November 2026) until your account is deleted (Art. 7 (1) GDPR).

7. AI assistant

The AI only works when you ask it. It requires an account and your consent. If you are under 16, a parent must additionally consent (section 14). Note: the answers are generated by an AI system; they can contain errors.

What is transmitted

With every question the app sends to our server:

• your question and the last six messages of the chat,
• an image of the current page or your selection, plus small previews of the previous and the next page,
• the recognized text of the page: PDF text, scanned text, handwriting recognized on the iPad, text boxes, labels and table contents, as well as the position of free areas,
• the recognized text of up to 60 further pages of the same notebook,
• when the model looks something up in your library: search hits, titles, texts and page images from your other notebooks,
• the app's language, page number and page format,
• for users under 16, an instruction to give age-appropriate answers; the AI provider is not told the exact age or date of birth.

Our server processes your account identifier to check access and your allowance. It does not add account details such as your name, e-mail address, date of birth or account identifier to the data sent to the AI provider. However, personal details in your questions, notes and images are transmitted with that content; they are not automatically anonymized. Our server checks the request, removes image metadata and forwards the context used for the answer. We do not permanently store the content in our database or application logs.

AI provider

The answers are generated by the Claude model of Anthropic as our processor. The contracting entity is Anthropic Ireland Limited, Dublin, Ireland. Processing may take place outside the EU, particularly in the USA. The transfer is based on the EU standard contractual clauses (Module 2, Art. 46 (2) (c) GDPR). Under its standard terms, Anthropic deletes requests and answers within 30 days. Where abuse is suspected, content may be retained for up to two years and associated safety assessments for up to seven years. Statutory retention obligations remain unaffected. The content is not used to train the models. Short-lived caches may also be used to speed up requests. Details are available in Anthropic's information on retention periods.

Before using another AI provider for your content, we will inform you about the new recipient and obtain the new consent required for this.

Legal basis and withdrawal

The legal basis is your consent (Art. 6 (1) (a) GDPR). If your pages contain special categories of personal data, for example about health, your explicit consent covers that too (Art. 9 (2) (a) GDPR). Please do not show the AI pages with sensitive data of other people.

The current version of the AI consent is dated 12 November 2026. In particular, it explains Anthropic's retention periods and processing locations. Consent to this version is required before further AI use; for users under 16, the same applies to the parent's confirmation.

You can withdraw your consent at any time with effect for the future: in the AI panel with “Withdraw consent” or under Settings → AI & Privacy. All saved chats are then deleted on the device. The app stores chat histories only on your iPad; they are not synced and are not held on our servers. Answers that you place on a page become part of your notebook.

Usage data

For each request we store the time, the model used, the number of tokens processed and the cost. We use this to calculate your AI allowance and to protect the service from abuse (Art. 6 (1) (b) and (f) GDPR). Our server logs contain, per request, an identifier, status, duration, token counts and error codes, but no content. Usage data is deleted after 3 months, at the latest together with your account.

AI answers can be wrong or incomplete. The AI makes no decisions about you that produce legal effects concerning you (Art. 22 GDPR).

8. Subscription and payment

You buy and pay for subscriptions through the App Store. The contracting party shown at the time of purchase is authoritative. We do not receive your full payment details, such as credit card details. Apple's terms and privacy information also apply to the purchase process.

To manage subscriptions we use RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, as a processor. RevenueCat receives your Notivate account identifier (no name and no e-mail address), the purchase receipts from Apple (product, purchase and expiry date, status, country, price) and technical device data such as operating system, app version and IP address. RevenueCat reports changes to our server; we store your subscription (plan, status, end of term, trial used, renewal) and the related subscription events. The transfer to the USA is based on the EU standard contractual clauses under Art. 46 (2) (c) GDPR.

Subscription management is initialized when the app launches. Before you sign in, RevenueCat may process a random app user identifier and technical connection data for this purpose; after sign-in, the subscription status is associated with your Notivate account.

The legal basis is Art. 6 (1) (b) GDPR, for the subscription events also (f) (proof of purchases and handling of refunds).

9. Usage statistics

Usage statistics are switched off by default. They only run once you switch them on yourself in Settings under AI & Privacy → “Anonymous usage statistics”. Only then does the app send usage events without note content to TelemetryDeck GmbH, Augsburg, Germany. The servers are in the EU. Transmitted are a random installation identifier, which TelemetryDeck additionally replaces with a hash, a session identifier, the app version and the event, for example “notebook created”, “AI question asked” or “subscription page shown”. Note content and account details are not part of these events. An IP address is involved in the network connection; according to TelemetryDeck, it is not stored permanently. The identifiers are used to group events together.

The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can withdraw it at any time under Settings → AI & Privacy → “Anonymous usage statistics”.

10. Crash reports

iOS provides the app with reports about crashes and hangs (Apple MetricKit). Notivate keeps the last five reports on your iPad. They contain technical details but no content of your notes. They only leave the device if you add “Attach diagnostics” to a feedback e-mail. You can switch off collection in Settings. The legal basis is Art. 6 (1) (f) GDPR (finding and fixing errors) and, for sending, your decision in the individual case.

If you have enabled “Share analytics” in iOS, Apple receives its own crash data and passes it on to developers in anonymized form. Apple is responsible for that.

11. Support and feedback

When you write to us, we process your e-mail address, your message and, if you select it, the diagnostics package. It contains app and iOS version, device model, language, whether you are signed in, your plan, the sync status, the number of your notebooks and pages and, on request, the crash reports, but no content. The e-mails are held at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The legal basis is Art. 6 (1) (b) GDPR, otherwise (f) (answering your request). We delete the messages once the request is resolved, at the latest after two years, unless a statutory retention obligation applies.

12. Recipients

We use processors who process data according to our instructions (Art. 28 GDPR). Apple and Google, as well as Vercel for the technical usage and operational data explained in section 3, process data as independent controllers. Disclosures required by law remain possible.

• Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513): account, database, storage, sync (only if you switch it on), our server for the AI and sign-in e-mails. The database and file storage are in the EU. Depending on the location of the request, server functions may also execute outside the EU; support access from third countries is also possible. The EU standard contractual clauses apply to such transfers. Sub-processor: Amazon Web Services, Frankfurt region.
• Anthropic (Anthropic Ireland Limited, Dublin; processing also outside the EU, particularly in the USA): AI answers, section 7.
• RevenueCat (RevenueCat, Inc., USA): subscription management, section 8.
• TelemetryDeck (TelemetryDeck GmbH, Augsburg): usage statistics, only with consent, section 9.
• Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland): App Store, purchases, “Sign in with Apple”; independent controller.
• Google (Google Ireland Limited, Dublin): only with “Sign in with Google”; independent controller.
• Vercel (Vercel Inc., USA): website hosting and technical usage and operational data; international processing, section 3.
• STRATO (STRATO GmbH, Berlin): support mailbox, section 11.

13. Retention periods at a glance

• Account and synced notebooks: until you delete them or your account.
• Trash and earlier versions: 30 days.
• Consent log (AI and cloud sync: kind, text version, granted or withdrawn, time): until the account is deleted.
• AI content at Anthropic: up to 30 days by default; where abuse is suspected, content for up to two years and safety assessments for up to seven years. Statutory retention obligations remain unaffected. We do not permanently store request and response content.
• AI usage data: 3 months, at the latest until the account is deleted.
• Date of birth: until the account is deleted.
• Proof of parental consent (parent's e-mail address, time, text version, token hash): until the account is deleted. Unconfirmed requests: 30 days after the link expires.
• Subscription events: until the end of the third calendar year after your subscription ends, even beyond an account deletion, because we use them to prove purchases and refunds (Art. 6 (1) (f) GDPR; limitation period under Section 195 BGB).
• Support e-mails: until the request is resolved, at most two years.
• Website at Vercel: according to the purposes and deletion rules explained in section 3; in particular operation, security and development, legal and contractual obligations, resolving disputes and enforcing rights.

14. Children and young people

The rules on legal capacity and the consent of a legal representative explained in the terms of use apply to entering into the usage agreement and making purchases. The age rating shown in the App Store does not replace that consent. You can give your own data protection consent for the AI from the age of 16. If you are under 16, a parent or another person with parental responsibility must consent (Art. 8 GDPR).

How we determine your age

We ask for your age once, when you use the AI assistant for the first time. On iOS 26 and later we first ask for the age information of your Apple Account (Declared Age Range); we then learn only which age range Apple places you in, not your exact date of birth. If Apple says "16 or older", we ask nothing further and store only that range. Otherwise, for example on older devices, without an Apple Account or if you decline, we ask for your date of birth; after that, only our support can change it. If the upper bound of the Apple range is under 16, we treat you as under 16, even if the entered date of birth says otherwise. For children in Family Sharing, the Apple information comes from the parent. Notivate does not verify identity documents (data minimisation, Art. 5 (1) (c) GDPR).

A parent's consent

If you are under 16, you enter the e-mail address of a parent in the app; the address of your own account is not allowed for this. The parent receives an e-mail from us with the text of the consent and a confirmation link that is valid for 72 hours and can be used only once. We send at most three such e-mails for your account within 24 hours. Only after confirmation does the app enable the AI for you. As proof of consent (Art. 7 (1) GDPR) we store the parent's e-mail address, the time of confirmation and the version of the confirmed text until your account is deleted. Requests that were not confirmed are deleted 30 days after the link expires. The parent can withdraw the consent at any time via the link in the confirmation e-mail or by e-mail to support@notivate.de; the AI is then blocked for you. If we change the text of the consent, a new confirmation is required.

From your 16th birthday you can confirm, change or withdraw the consent yourself; your parents' consent does not automatically become invalid (EDPB Guidelines 05/2020, paras. 147–149).

Age-appropriate answers

If you are under 16, the AI receives an instruction to give age-appropriate answers, without your exact age or account identifier. This protective instruction cannot rule out errors or unsuitable answers. You can report problems with answers through the feedback feature or by e-mail to our support.

If an age was recorded wrongly

If your age was recorded wrongly or someone entered a date of birth without your knowledge, write to us at support@notivate.de. We will review the case, correct the date of birth (Art. 16 GDPR) and, where necessary, obtain a parent's consent afterwards or block the AI until it is in place.

Parents can use Apple's Family Sharing and “Ask to Buy” for purchases by minors. Parents can contact us at any time to view their child's data or have it deleted.

15. Security

All connections are encrypted (TLS). Access to your data in the database is restricted to your account. We store the Apple token in encrypted form; we remove metadata from images sent to the AI. Our service providers access data only as far as needed for operation.

16. Your rights

Towards us you have the right to

• access to your data (Art. 15 GDPR),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability subject to the conditions of Art. 20: you can export profile, device and consent data in the app as a file and your notebooks as PDF. You can request further information and copies of data by e-mail,
• withdrawal of consents given, with effect for the future (Art. 7 (3)),
• lodge a complaint with a data protection supervisory authority (Art. 77), for example at your place of residence. The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragter für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, e-mail: poststelle@lfd.niedersachsen.de. Contact details and ways to lodge a complaint are available on the supervisory authority's website.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

For any request an e-mail to support@notivate.de is enough.

17. Obligation to provide data

You do not have to provide any data. Without an account you can use Notivate on your iPad; sync, subscriptions and the AI need an account, the AI additionally your consent.

18. Changes

If the app or the legal situation changes, we adapt this policy. The current version is always on this page. If a new processing operation requires your consent, we ask you in the app beforehand.