Notability

GDPR overview

Notability states its position in plain terms. The Business page advertises GDPR and SOC 2 certification, and the privacy policy, effective 21 August 2025, carries a dedicated section on European Union and United Kingdom data subject rights. Ginger Labs declares itself the controller, lists its lawful bases (contractual necessity, legitimate interest, consent, legal obligation) and details rights of access, rectification, erasure, withdrawal of consent, portability, objection, restriction and complaint to a supervisory authority. Transfers to the United States rely on standard contractual clauses and on certified adherence to the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Framework, under FTC jurisdiction. GDPREP.ORG is named as the Article 27 representative for both the EU and the UK, and requests go to support@gingerlabs.com.

Who owns the data?

You keep ownership of everything you write, import or record. The terms call it your User Submission and state that the licences you grant do not affect that ownership. Ginger Labs takes a licence to translate, technically modify and reproduce your content so the service can run. A private note is licensed only so it can be shown back to you. Anything you publish, for instance to the Notability Gallery, is licensed far more widely: display, modification, distribution, reproduction and promotion, plus a licence granted to every other user. All of these licences are described as royalty-free, perpetual, sublicensable, transferable and irrevocable, and they survive the deletion of your account.

Reuse rights

Your own notes stay yours to reuse without asking anyone: you can export and download them, back them up to Dropbox, Google Drive, Box or OneDrive, sync them through iCloud, share them by link and collaborate on them live. The restriction runs the other way. Content that belongs to Ginger Labs, such as the template library and gallery material, comes with a worldwide, non-exclusive, non-sublicensable and non-transferable licence limited to using the service; reproducing, modifying, distributing or storing it for any other purpose requires prior written permission. Two further limits are worth knowing: a note you have shared publicly can remain available to other users after you delete it, and Ginger Labs reserves the right to remove or restrict any submission at its sole discretion.

Data retention & training

Hosting summary

Notability draws a clear line between local and synced data. Notes you keep on the device and never sync stay there, and Ginger Labs states it has no access to them. The moment you sync, the data is replicated on servers maintained in the United States: the privacy policy says plainly that the Services are hosted and operated in the U.S., and that using them authorises the transfer, storage and processing of your information there. For European, British and Swiss users, those transfers rest on standard contractual clauses and on Ginger Labs' certified adherence to the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Framework, under the jurisdiction of the Federal Trade Commission. Two AI flows are described separately: audio recordings are processed and stored temporarily for transcription and then deleted, and the content sent to study-material generation is stored on Ginger Labs' servers and on those of unnamed AI providers, then deleted once generation completes. No alternative hosting country or region is offered, and no subprocessor list is published.