Notion is where a lot of people store a lot of things. Journal entries, meeting notes, project plans, personal finances, health tracking, draft ideas, private thoughts — the breadth of what lands in Notion workspaces is significant. It’s a second brain for many of its users, and a second brain tends to contain things you wouldn’t share freely.
Notion AI is now a default part of the Notion experience. Understanding what that means for the privacy of your content is not a niche concern.
The short version: when you use Notion AI features, your note content is sent to third-party AI providers — specifically Anthropic and OpenAI. How long those providers retain your data depends on your plan tier. And opting out requires disabling AI features at the workspace level, which is a coarser control than most users realize.
How Notion AI Actually Works
Notion AI is not a model that Notion built and runs on its own infrastructure. Notion integrates with external AI providers, routing requests through their APIs to generate responses.
When you invoke Notion AI — asking it to summarize a page, draft content, answer a question about your workspace, or use the AI Q&A feature — the following happens:
- Your request is processed by Notion’s systems, which identify the relevant context (the page you’re on, or, for workspace-level Q&A, content from across your workspace).
- That context — the actual text from your notes — is transmitted to the LLM provider along with your request.
- The LLM processes the combined prompt and returns a response, which Notion displays to you.
The third-party providers involved are Anthropic (Claude) and OpenAI (GPT models). The specific provider used may vary by feature and over time as Notion’s integrations evolve.
Data Retention at Third-Party Providers
This is where plan tier matters.
For Enterprise plan workspaces: Notion’s agreements with its LLM providers include zero data retention. Content sent to Anthropic or OpenAI for processing is used to generate a response and is not retained by those providers after the request completes.
For all other plans (Free, Plus, Business): LLM providers retain content for up to 30 days. This retention window is partly a function of how API agreements with these providers work — many offer standard retention periods on API requests, with zero-retention options available to enterprise customers at higher cost.
What this means practically: if you’re on a non-Enterprise Notion plan and you use Notion AI to process a note about a medical appointment, a financial decision, a personal conflict, or anything else sensitive, a copy of that note content exists in OpenAI or Anthropic’s systems for up to 30 days.
This is not a hypothetical. It’s the documented policy. Notion’s own help documentation confirms the distinction between Enterprise and non-Enterprise retention.
What “Used for Training” Means Here
Both Anthropic and OpenAI have been explicit that content submitted via their APIs is not used to train their foundation models, under their standard API terms. Notion is an API customer; your content processed through Notion AI is not supposed to feed back into model training.
This is meaningfully different from using ChatGPT or Claude directly via their consumer interfaces, where training opt-outs apply and the defaults have varied over time.
However, “not used for training” is not the same as “private.” Content retained for 30 days by a third-party AI provider is subject to that provider’s security posture, their legal obligations in their jurisdiction, and any future changes to their data policies. The contractual protections Notion negotiates with its providers bind those providers today; they’re renegotiated or updated as the relationship evolves.
Workspace-Level Q&A: A Broader Scope
Notion AI’s Q&A feature is worth separate attention because its scope is different from page-level AI features.
When you ask Notion AI a question about your workspace — “what did we decide about the product launch?” or “find my notes on the Morrison account” — Notion’s system performs a semantic search across your workspace to find relevant pages. Those pages are then sent to the LLM as context for generating an answer.
This means a single AI query can pull content from multiple pages across your workspace and transmit all of it to the LLM provider in a single request. If your workspace contains notes across many projects and topics, a broad question can result in a broad slice of your workspace content going to a third party.
The vector database that Notion uses for this semantic search is maintained on Notion’s own infrastructure (not the third-party LLM provider). The content that goes to the LLM is the retrieved pages — the relevant context for your specific query.
What Happens If You Don’t Use Notion AI
If you don’t invoke Notion AI features, your note content stays within Notion’s systems. Third-party LLM providers don’t receive anything.
Notion’s base platform uses standard server-side encryption — your content is encrypted in transit (TLS) and at rest on Notion’s infrastructure. Notion has full technical access to your notes, which is the architecture that allows it to provide sync, search, and any server-side features. Notion does not offer client-side or zero-knowledge encryption; the provider can read your content.
This is consistent with most cloud-based productivity tools. Notion is not unusual in this respect.
What is worth noting: the AI features represent an additional data-sharing layer on top of the standard Notion architecture. Content doesn’t just sit on Notion’s servers — it moves to third-party AI infrastructure whenever you engage AI features.
The Opt-Out Is Coarse
You can disable Notion AI. The control lives at the workspace level: go to Settings > Workspace > AI, and disable AI features. This prevents any content from being sent to third-party LLM providers through Notion.
The limitation is that this is an all-or-nothing control. You cannot disable AI for specific pages or databases while keeping it active for others. If you want to use Notion AI for some content (low-sensitivity project notes) but not others (personal journal, medical records), the workspace-level toggle doesn’t allow that distinction.
For teams on Business or above plans, admins can control AI feature access at the workspace level. Individual team members cannot override an admin-level disablement. But the per-page or per-section granularity that would allow meaningful selective use doesn’t exist.
Enterprise customers can negotiate zero data retention as part of their agreement. For non-Enterprise users, the 30-day retention window applies to all AI feature use.
What This Means for Sensitive Notes
The practical question is whether Notion AI’s data handling is a problem for your specific use case.
For genuinely low-sensitivity content — work project notes, meeting agendas, draft blog posts, task lists — the risk profile of Notion AI is modest. The 30-day retention at third-party providers is an additional exposure compared to content that stays entirely within Notion, but for this category of content, the consequence of exposure is limited.
For sensitive personal content, the picture is different. Consider what’s actually in your Notion workspace:
- Health and medical notes
- Financial records and account details
- Personal relationship notes
- Legal documents or case summaries
- Mental health journaling
- Notes about employment situations (job search, workplace issues, compensation)
- Authentication details or security notes (if you store these in Notion — which you shouldn’t)
For any of these, using Notion AI features means that content moves through Anthropic or OpenAI’s infrastructure, with a 30-day retention window (for non-Enterprise plans), and is subject to legal process in the jurisdictions where those providers operate (the US, primarily).
The structural answer for people who want AI-assisted organization of genuinely private content is that the content and the AI processing need to happen either on-device or through a provider whose architecture doesn’t involve sending your content to third parties.
Alternatives and Approaches
Disable AI features for sensitive workspaces. If you maintain separate Notion workspaces for different categories of content, you can disable AI at the workspace level for the workspace containing sensitive material while keeping it active for others. This requires organizational discipline but provides a meaningful separation.
Move sensitive content out of Notion. For genuinely private material — personal journals, medical records, sensitive documents — a storage tool designed for privacy rather than productivity collaboration may be more appropriate. Notion is built for connected, searchable, AI-augmented work. That architecture is not compatible with strong privacy for your most sensitive material.
Use local-first alternatives for private notes. Tools like Obsidian store your notes as local Markdown files. There’s no server-side component unless you add sync. No content is transmitted to third parties unless you specifically enable AI plugins — and if you do, you choose which AI provider and accept the same data-flow dynamics as Notion AI.
Understand what’s in your workspace before using Q&A. The workspace-level Q&A feature can pull from a wide range of pages in response to a single query. If your workspace contains a mix of work and personal content, an AI query can surface and transmit personal content unexpectedly. Compartmentalization — keeping sensitive content in a separate workspace — reduces this risk.
What Notion Does Well, and Where the Tension Is
Notion is a genuinely capable tool. For team collaboration, project management, and networked note-taking, it has features and an interface that are hard to match. The AI features, particularly AI Q&A and AI summaries, add real utility for people managing large workspaces.
The tension is that these features are built on an architecture that requires Notion to have access to your content. There’s no technical path to zero-knowledge Notion — the server-side processing that enables sync, search, sharing, and AI features requires server-side access. That’s a real constraint that follows from how the product works, not a policy choice Notion made carelessly.
The question for each user is whether the privacy profile of Notion’s architecture — including AI data sharing — matches the sensitivity of what they’re storing there. For work content in an Enterprise workspace, the protections are substantial. For personal content in a free or individual plan, the answer requires more thought than most users give it.
The category of content that deserves its own storage solution is the one where a 30-day window of third-party AI provider access would actually concern you. That category is worth knowing.