Privacy policy
What personal data Nocadi stores, what it never stores, where it is kept and who helps us process it. See also our Terms of service.
Last updated
1. Summary
This policy explains how Månevann AS handles personal data in Nocadi, the Notion Campaign Dispatcher at nocadi.com. The short version:
- We store what we need to run your account: your name and email address, your organization and team, your connections to Notion and your email platform, and a record of the campaigns Nocadi syncs.
- We do not copy or store your subscriber lists. Nocadi reads the names and sizes of your lists, groups and segments, and campaign totals such as opens and clicks. Your email platform keeps the subscribers and sends the emails.
- Access tokens and API keys for Notion, MailerLite and Mailchimp are encrypted with AES-256-GCM before they are stored.
- Our database runs in Frankfurt, Germany, in the EU.
- We only use the cookies needed to keep you signed in. There is no advertising or analytics tracking.
- We do not sell personal data.
2. Who we are
Nocadi is made and sold by Månevann AS, a Norwegian company with organization number 927343134, based in Skien, Norway. Norway is part of the European Economic Area (EEA), so the EU General Data Protection Regulation (GDPR) applies to us through the Norwegian Personal Data Act.
For any question about privacy or this policy, email hello@nocadi.com.
3. Controller and processor
The GDPR separates the controller, who decides why and how personal data is used, from the processor, who handles it on someone else’s behalf. We are both, for different data:
- We are the controller for data about you as a Nocadi user (your account, sign-in sessions, organization membership, billing and support conversations) and for data about visitors to nocadi.com.
- We are a processor for personal data in the content you ask Nocadi to handle: your Notion campaign pages, the emails built from them, test recipients, approval decisions and campaign statistics. The organization using Nocadi (our customer) is the controller of that data, and we only process it to provide the service, as set out in our Terms of service.
If you are a customer, you remain responsible for having a lawful basis for the emails you send, including your subscribers’ consent where the law requires it. Notion, MailerLite and Mailchimp are services you choose and contract with yourself. They handle your data under their own terms and privacy policies, not ours.
If you receive emails from an organization that uses Nocadi, that organization is responsible for your data. Please contact them first; we will help them with your request.
4. What we collect
Your account
When you sign up we store your name, your email address and your password. The password is stored only as a salted hash, never in plain text. We also record whether you have verified your email address (you must before you can sign in) and when the account was created.
Sign-in sessions
When you sign in we create a session that records a session token, the time, your IP address and your browser’s user agent. We use it to keep you signed in and to protect your account. A session expires after at most 7 days without use, or when you sign out.
Organizations and teams
We store your organization’s name and URL name, its members and their roles (owner, admin or member). When someone invites a teammate we store the invitee’s email address, the role offered, who sent the invitation and whether it was accepted. Invitation links expire after 7 days.
Billing
For each organization we store a billing email, the trial end date, the subscription status and renewal date, and the customer and subscription IDs from Moonbase, our reseller and merchant of record. When you create an organization we create a matching customer at Moonbase with the organization’s name and your email address, to run the free trial. When you subscribe, you buy the subscription from Moonbase in a checkout form it serves on our site, prefilled with your name, the billing email and the organization name. We never receive or store your full card number.
Connected services
When you connect Notion we store the workspace ID, name and icon, the email address of the Notion user who approved the connection (if Notion shares it) and the access and refresh tokens. When you connect MailerLite or Mailchimp we store the API key or access token, the account identifier the platform returns, the name you give the connection, the default sender name and email address, and which user connected it. Tokens and API keys are encrypted before they are stored (see How we protect data).
Campaigns
For each Notion page Nocadi syncs we store the page ID, the subject line, the sender name and email address, the IDs of the chosen audiences, the ID and edit link of the campaign on your email platform, sync status and error messages, schedule and send times, and the totals your platform reports (recipients, delivered, opens, clicks, open and click rates, unsubscribes and bounces). We also note the Notion user ID of the person who changed the campaign’s status, so that a test email can go to them.
Nocadi reads the page from Notion each time it builds an email and hands the result to your email platform. It does not keep a copy of the email, with one exception: when team approvals are on, the version sent for review is stored so approvers see exactly what they approve.
Branding
Your email themes and footer: colors, fonts, brand name, links, footer text, mailing address, social media links and logo.
Team approvals (optional)
If your organization turns on approvals, we store the chosen approvers (name and email address), each review round, each approver’s decision and optional reason, and a copy of the campaign under review with its subject, preview text, audience name, sender and the name of the person who asked for the review.
Activity log
Each organization has a log of important actions, such as connecting or disconnecting a platform, syncing, test sends (including the test recipient’s email address), scheduling, sending, approvals and billing changes, with the user who did it and when. It helps you and us see who did what and investigate problems.
Emails you send us
If you contact us, we keep the conversation so we can help you and refer back to it.
Visiting nocadi.com
We do not use analytics or advertising tools, and our fonts are served from our own site. Our hosting provider processes technical data such as your IP address, browser type and the pages you request, to deliver the site and keep it secure.
5. Your email subscribers
Nocadi does not import, copy or store your subscriber lists or individual subscriber records. Your email platform keeps them and sends the emails. Nocadi only:
- reads the names, IDs and sizes of your lists, groups and segments, so you can pick an audience in Notion;
- reads campaign totals (such as opens and clicks) after a send and writes them to your Notion page, refreshing them for 30 days;
- turns personalization tags such as
{{ first_name }}into your platform’s own merge tags. Your platform fills in each subscriber’s details when it sends, so Nocadi never sees them.
Test emails are the exception. A test goes to the person who set the campaign to Send test, if Notion shares their email address, and otherwise to the organization’s owner. MailerLite has no built-in test send, so on MailerLite Nocadi adds the test recipient as a subscriber to a dedicated test group in your MailerLite account and sends the test to that group.
Images in your campaigns are copied to our storage and served from assets.nocadi.com. When a subscriber opens an email, their email app loads those images from our hosting provider, which receives the subscriber’s IP address and app details. Nocadi does not add tracking pixels: open and click tracking is done by your email platform, under your settings there. If your theme uses a Google font, or social media icons in the full-color style, the email also loads files from Google.
6. What Nocadi does in Notion
Nocadi can only see the pages and databases you share with it when you connect Notion. Within those, it:
- lists the databases shared with it, so you can choose your campaigns database;
- reads the properties and content of pages in the databases you add, to build emails;
- adds the columns it needs, whose names start with 📨 (status, subject, audience, theme, result, statistics and similar), or reuses a matching column you already have, keeps their options up to date and arranges them in your database views;
- writes to those columns: the status, the result of each action, a preview link, the campaign statistics, and the default theme when a campaign’s theme is left blank;
- looks up the email address of the Notion user who asks for a test email, when your Notion connection allows it.
Nocadi never deletes your pages or your own columns. It only changes columns it manages: it resets its read-only columns (such as 📨 Result and the statistics) if someone edits them, and it removes the retired 📨 Confirm send column that earlier versions of Nocadi created.
You can remove Nocadi’s access at any time in Notion’s connection settings, or disconnect Notion in Nocadi, which deletes the stored tokens.
7. Why we use data
We use personal data for these purposes, on these legal bases under the GDPR:
| Purpose | Legal basis |
|---|---|
| Creating your account and running Nocadi for you: syncing, test sends, sending, scheduling, statistics and approvals | Contract (Article 6(1)(b)) |
| Service emails: email verification, team invitations, approval requests and template previews | Contract (Article 6(1)(b)) |
| Free trials, subscriptions and payments | Contract (Article 6(1)(b)) |
| Keeping accounting records | Legal obligation under Norwegian bookkeeping law (Article 6(1)(c)) |
| Keeping Nocadi secure, preventing abuse, fixing errors and keeping the activity log | Our legitimate interest in a secure, working service (Article 6(1)(f)) |
| Answering your questions and giving support | Contract, or our legitimate interest in helping you (Article 6(1)(b) and (f)) |
We only email you about your account and the service. We do not send marketing newsletters, and we do not use your data for automated decisions or profiling that affect you.
9. International transfers
Our database is in Frankfurt and our server functions run in Vercel’s Frankfurt region. Some of our providers are based in the United States or elsewhere outside the EEA, and Vercel delivers pages and images through servers around the world. When personal data is transferred outside the EEA, we rely on the provider’s certification under the EU-U.S. Data Privacy Framework where available, or on the European Commission’s Standard Contractual Clauses. Contact us if you want details of the safeguards for a particular provider.
10. How we protect data
- Notion tokens and MailerLite and Mailchimp credentials are encrypted with AES-256-GCM before they are stored. The encryption key is kept outside the database.
- Passwords are stored only as salted hashes.
- Connections to nocadi.com are encrypted with HTTPS.
- Every record belongs to one organization, and the server checks that you belong to that organization before it reads or changes anything.
- Email addresses must be verified before sign-in. Invitation links carry a single-use secret and expire after 7 days.
- Staff access is limited to a small number of people, as described above.
Campaign images and logos must be publicly reachable so that email apps can show them. They are stored at hard-to-guess addresses, but anyone with a link can open them, so do not put confidential information in email images.
If a personal data breach affects you, we will notify you and the authorities as the GDPR requires.
11. How long we keep data
- Account, organization and campaign data is kept for as long as the account or organization exists.
- Sign-in sessions expire after at most 7 days without use, and staff support sessions after 2 hours. Email verification links expire after 1 hour, invitation links after 7 days.
- Campaign statistics are refreshed for 30 days after a campaign is sent. The last figures stay with the campaign record.
- When you disconnect an email platform, its stored credentials and Nocadi’s records of that platform’s campaigns are deleted immediately. When you disconnect Notion, its tokens and the list of databases you added are deleted.
- The activity log is kept for as long as the organization exists.
- The billing record we keep (trial and subscription status) goes with the organization. Invoices and payment records are kept by Moonbase, the seller, for as long as bookkeeping law requires.
Deleting your data
An organization. Its owner can delete it under Settings, Team. That removes everything we store about it: members, invitations, connections and their credentials, campaigns, themes, approvals, the activity log and the billing record. An active subscription is cancelled first, and the campaign images and logos in our asset storage are deleted, so images in emails you already sent stop loading.
Your account. You can delete it under Settings, Account. That removes your login, sessions and memberships. Organizations where you are the only member are deleted with it, as above. If you are the only owner of an organization that still has other members, delete it first or ask us to hand it over.
You can also email hello@nocadi.com from the address on your account and we will do it for you. Deleted data can remain in our database provider’s backups for a limited period before it is overwritten.
Your campaign content itself lives in your Notion workspace and on your email platform. Deleting your Nocadi data does not delete it there.
13. Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to how we use your data;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use these rights, email hello@nocadi.com. We will reply within one month, and we may ask you to confirm your identity first.
If you believe we handle your data unlawfully, you can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or to the data protection authority where you live or work. We would appreciate the chance to put it right first.
If your data reached us through a Nocadi customer, for example because you receive their emails or were a test recipient, please contact that organization. We will help them answer you.
14. Changes to this policy
We update this page when Nocadi changes how it handles personal data, and change the date at the top. If a change materially affects you, we will tell you by email before it takes effect.
15. Contact
Månevann AS, organization number 927343134, Skien, Norway. Email hello@nocadi.com.