Black Snow IntelligenceBlack Snow Intelligence
Black Snow Report

Notion

Method v1.6As At 2026-08-1037 Surfaces Read3 Offerings Assessed

Your own published record, as at 2026-08-10.

Your Details

The Macro Picture51

Red · Adverse
9
of 51 banded observations across 3 offerings band Adverse. 4 were never measured.

What Is Published8

Your Own Words3

No. Notion's zero data retention commitments don't extend to Claude agents in Notion. Claude agents are implemented via Claude Managed Agents (CMA), which is stateful by design and not eligible for zero data retention. Anthropic stores session data between requests to power the functionality.
Do Claude agents support zero data retention (ZDR)? The Cursor surface carries the parallel answer: 'Notion's own ZDR commitments don't cover Cursor agents. You configure your ZDR policy and relationship with Cursor.' This is the only place on any surface read where the headline zero-retention commitment is qualified, and it is a help-centre answer rather than a term of the DPA or of the AI Supplementary Terms. · Source
by default our LLM providers utilize zero data retention for Enterprise plan workspaces, so no data is stored with LLM providers. In addition, by default for all non-Enterprise plan workspaces, LLM providers only retain Customer Data for 30 days or fewer before deletion.
What are the data retention obligations of third-party AI providers? A period is published, and it is tiered: zero for Enterprise, thirty days or fewer otherwise. The same answer adds that certain features 'may require the use of data-retaining LLMs', switchable on by an administrator, and that 'the External Agents functionality has different data retention controls and practices'. · Source
Embeddings stored in vector databases are deleted within 60 days from when the page or workspace is deleted. If a user deletes a Notion page or Notion workspace, we can restore the content within 30 days. After 30 days, the data is deleted and unrecoverable.
Periods are published for deletion and for embeddings, and DPA Annex II adds thirty days inactive, overwritten within ninety and backups deleted within one hundred and eighty days. The general retention section of the privacy policy remains criteria-only, but a period is published where it matters most to this assessment. · Source

Parties You Name34

See which of these are assessed in this register

Register Check3

AI Role By Offering3

Assessment Basis

Produced under Method v1.6 from the entity's fact record. 8 of 8 observations were measured under that generation; the rest read Not Measured, which is a fact about this register's coverage and not a finding about the entity.

Read from 37 first-party surface(s) across 3 assessed offering(s), found by the entity's own link graph and sitemap rather than by guessed paths.

Fact Record
Version 1.0, dated 2026-08-10
Standards Commit
156a2b9f0394
Register Control Quality
Both Views

Verification And Challenge

Every finding on this record is a statement about what could be read on your own published surfaces as at 2026-08-10. Correspondence route as recorded on this card input: ror@blacksnowintel.com.

What A Machine Could Not Establish5

5 questions are open and 3 are established, read as at 2026-08-10 under method v1.6.

The One Thing To Publish First

Publish it: name the mechanism your international transfers rely on.

Red · AdverseTransfer Mechanism Published

notion-workspace DPF · SCCs · IDTA; notion-external-agents None Named; notion-calendar-mail DPF · SCCs · IDTA; Transfer Mechanism Copy Obtainable: Not Applicable · Yes

Where To Put It

This was read on your own page at https://www.notion.so/77d54634-34bb-4c9e-b803-71bb56c0f2c1. That is the page a reader already reaches for and does not find it on, so it is the page to correct first.

Where Others Stand

92 organisations in the register name the mechanism their international transfers rely on. On one of your three assessed offerings you do not, which is what this row is banded on.

What A Published Answer Looks Like

To address the transfer of data between EU and other countries in some rare occasions, we have adopted the new Standard Contractual Clauses (SCC) as our transfer basis.

A question answered plainly in public, by an organisation read as Strong on it. It is not an endorsement of the position the sentence states — Black Snow reads what is published and never recommends what to practise. Read on a published privacy notice. Claim tier Quoted. The organisation that published it is not named.

One is named here, and one is deliberate. The rest of the open questions are listed below without a prescription; what to publish for each, in what order, and drafted machine-readable evidence for all of them, is the Deep Dive.

Still Open

Deep Dive

The full assessment, plus consulting on what to fix.

Reviewing your record is free.