Evernote

GDPR overview

GDPR compliance is explicit and documented. The privacy policy, effective 1 January 2026, is written under Regulation (EU) 2016/679 and Italy's Legislative Decree 196/2003, with Bending Spoons S.p.A. in Milan named as controller, an EU-based establishment, and no Article 27 representative listed. A data protection officer can be reached by post or through the dedicated privacy form, which also handles access, rectification, update and deletion requests; a regional privacy section covers local variations. Evernote Enterprise comes with a published data processing addendum naming Bending Spoons S.p.A. as processor and covering the GDPR, Brazil's LGPD and California's CCPA. Transfers outside the EEA rely on the standard contractual clauses of EU decision 2021/914. Subprocessors are listed publicly, changes are notified, and customers have ten calendar days to object. The minimum age is 16, and data belonging to a younger user without parental consent is deleted.

Who owns the data?

Ownership is split between the Bending Spoons entities behind the product. Bending Spoons S.p.A., based in Milan, is the data controller; Bending Spoons Operations S.p.A. owns the software itself; Bending Spoons US Inc., a Delaware company headquartered in New York, distributes the service, with Evernote do Brasil serving Brazilian residents. Your content, however, stays yours: the terms confirm that you own the input you provide and assign you whatever rights the company might hold in the AI output, so both your original notes and anything the assistant generates remain the property of your account. On Enterprise, the account holder, meaning your employer, controls the account.

Reuse rights

Because your notes and the AI output attached to them remain yours, you can reuse, republish or repurpose them without asking anyone, and export notes and notebooks whenever you like. On its own side, Evernote collects content, subscriber and usage data, location and IP, device details and, where you allow it, contacts, photos, audio, video and calendar entries. The processing is automated: systems parse this material to power the features and to screen incoming and outgoing mail and shared notes for spam and malware, while human access to your content requires your express permission or a legal obligation. The legal bases invoked are consent, contract, legal obligation and legitimate interest. Personal data is neither sold nor rented, and none of it is shared for third-party advertising; subprocessors are disclosed publicly and include Google Cloud, OpenAI (Ireland), Datadog, Fastly, Sentry, Zendesk, Calendly, Bird, hCaptcha and Google Analytics. Input and output from AI features are not used to train the company's models unless you direct it to. Browser Do Not Track signals are not honored.

Data retention & training

Hosting summary

Evernote runs entirely on Google Cloud Platform, and all of its data sits inside the United States, with sync replicated across US-based servers and no European or other regional option offered. Content is encrypted at rest with AES-256 under Google-managed keys and in transit over enforced TLS, while traffic passes through the Fastly CDN, which brings built-in DDoS protection alongside native Google Cloud tooling. The deployment spans several zones and can fail over to another region should a major outage occur. Test, staging and production environments are logically separated, and no user data is used outside production. Retired storage media are handled through Google's cryptographic erasure, backups are taken regularly and no removable media are involved. In jurisdictional terms, this means US law governs the place where the data physically lives, even though the controller, Bending Spoons S.p.A., is established in Milan and the processing is documented under the GDPR, a combination that European buyers with strict residency requirements should weigh carefully.