Privacy

Notarus exists to carry the context of a bug report. That means it captures more than a contact form does, so this page is specific about what it takes, what it refuses to take, and how long it keeps it.

Who this describes

Two groups of people meet here. Customers are the teams who install Notarus on their site and use the panel. Reporters are their end users: the people who click the widget and send feedback. A customer decides what runs on their site; this page describes what the software does when they do.

The feedback itself: the message, the type, and anything the reporter chose to attach.
A screenshot of the page, taken on the reporter's device and only when they take one.
Technical context: page URL, browser and operating system, viewport size, and console and network metadata.
Session events (clicks, scrolls, navigation and page snapshots) when session replay is enabled for the project.
A screen or camera recording, only when the reporter starts one.

What it never collects

These are properties of the code, not policies applied afterwards.

Request and response bodies are never captured. Network activity is recorded as metadata: method, URL, status and timing. The payload is never read.
Typed input is masked in replays, always. Replay records that a field was typed into, never what was typed. This cannot be turned off.
Secret-looking keys are redacted before storage. Any key matching authorization, cookie, password, token, secret, api key or assertion is replaced with [redacted]. A project can add its own keywords to that list; it cannot remove any.

IP addresses

A reporter's IP address is never stored. It is passed through a one-way salted hash and truncated, which is enough to tell two sessions apart and not enough to recover the address. A project can switch that off entirely, in which case nothing derived from the IP is stored at all.

Where the data lives

Relational data (accounts, projects, tickets, sessions) is stored in a managed PostgreSQL database. Uploaded media (screenshots, recordings, replay assets) is stored on edge storage and served through a CDN using signed, expiring URLs, so a media link is not a permanent public address.

How long it is kept

Console and network logs: 30 days, then deleted by a nightly job.
Idle sessions: 90 days.
Recordings: until their configured expiry, then purged.
Tickets: kept until the project or the account is deleted. A ticket is the work item; it does not expire on a timer.

Deleting a project deletes its tickets, sessions and media. Deleting an account deletes its projects.

Who can see it

Access is scoped per project and per role, and enforced in one place that both the panel and the MCP server call. Every table in the database additionally denies access by default at the row level, and the database's own public REST API is switched off. The application server is the only door.

Other services

Payment details are handled by Stripe and never reach Notarus's servers. When a customer connects an integration (Slack, Microsoft Teams, Jira, Linear, GitHub, Trello, Asana, ClickUp or monday.com), ticket content is sent to that service on their instruction. No integration is connected by default.

Cookies and analytics on this site

This section describes these marketing pages only. None of it runs in the panel, in the client portal, or in the widget on a customer's site, and none of it has access to any account, project or ticket.

Ahrefs Web Analytics counts page views. It sets no cookies and stores nothing in your browser.
PostHog (EU Cloud) records page views and interactions such as clicks, with the text on the page masked, advertising click identifiers in links masked, and no screen recording. It sets no cookies and stores nothing in your browser. To tell visits apart, PostHog hashes the IP address, the browser's user agent and this site together with a salt that changes every day and is then deleted, so visits are counted under a pseudonym that cannot be carried from one day to the next.
Google Analytics runs only if you allow it. Until you choose, its script is not loaded and nothing is sent to Google. If you allow analytics, it sets the _ga and _ga_* cookies for up to 13 months. If you also allow advertising, Google Ads measurement sets _gcl_* and _gac_* cookies so that this site can learn which ads bring visitors here; it is never used to personalise the ads you see. Google may process this data in the United States under the EU-US Data Privacy Framework.

Your choice is kept in this browser's local storage, under notarus.consent, for 180 days; after that you are asked again. You can change it at any time with Cookie settings at the bottom of every page. Withdrawing removes the Google cookies from this site, and if Google Analytics was running on the page, the page reloads without it.

If you arrive from a campaign, the campaign parameters in the address you followed (utm_* and Google's gclid) are kept in this browser's session storage, under notarus:acquisition here and under notarus:signup-acquisition on the registration form, so that an account you create can be credited to the campaign that brought you. Session storage is emptied when you close the tab. Notarus creates no identifier of its own for this, nothing else is read from your device, and the parameters reach Notarus only if you register, and never anyone else.

If you create an account, the registration form also sends the time zone your browser reports, such as Europe/Madrid, and Notarus turns it into an approximate country: Spain, in that example. No IP address is used for this and nothing is asked of any outside service: the zone is simply looked up in a list. It is an estimate of where you are while you sign up, not of where you are from or where you live, so it is wrong for anyone travelling, and it is labelled an estimate everywhere it is shown. The time zone and the country derived from it are kept with your account for as long as the account exists. If your browser does not report a zone, or reports UTC, no country is derived at all rather than one being guessed. None of this is sent to anyone who visits the site without registering.

Builds made for a local address carry none of these services, which is why they never run during development or in the test suite.

Questions and requests

For access, correction or deletion of data held about you: if you reported feedback through a widget, the team who runs that site is your first contact, since the project is theirs. If you hold a Notarus account, contact the operator of the instance you signed up to. For accounts on notarus.ai, that is privacy@notarus.ai.