IVGraphYour Notion content is stored on our servers in Helsinki. Apart from Hetzner, only Cloudflare handles it: in transit and as encrypted backups.
We don't send Notion content to AI providers and don't use it to train any model.
Business customers under our DPA hear about a new provider for Notion content 30 days ahead.
IVGraph uses the service providers below. When a business customer connects Notion content, IVGraph processes the personal data in it as a processor under our Data Processing Agreement ("DPA"), and the providers in the first table are our sub-processors for that data. For account, billing, email, analytics and support data, IVGraph is the controller under our Privacy Policy; the second table lists the providers we use for that data.
Providers that process Notion content
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH, Germany | Our servers: the database, search, files and the sync software run there. | Helsinki, Finland (EU) | No transfer outside the EU |
| Cloudflare, Inc., USA | Delivers and protects the website, the dashboard and the graph app: their traffic passes through Cloudflare's network. Stores the backups of our database (R2); IVGraph encrypts them before upload, so Cloudflare can't read them. | Global network; the backup storage is not limited to the EU | EU–US Data Privacy Framework; Standard Contractual Clauses in Cloudflare's data processing addendum |
Providers for account, billing, email and analytics data
These providers don't receive the pages, databases or page text you sync from Notion.
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Stripe, LLC | Payments and subscriptions; sends payment receipts and, when a bank asks for it, payment-confirmation emails. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses in Stripe's data processing agreement |
| Resend (Plus Five Five, Inc.) | Delivers our emails: account emails, which may name the connected Notion workspace, and news and tips unless you turn them off. | USA | EU–US Data Privacy Framework; Standard Contractual Clauses in Resend's data processing agreement |
| Google LLC | Google Analytics 4 and Google Tag Manager: usage analytics with a random browser identifier and our internal account number, never your email or name. Sign in with Google, if you choose it. Gmail: the mailbox where we read emails sent to our addresses. YouTube: the demo video on our home page, loaded only when you press play. | USA | EU–US Data Privacy Framework |
| Microsoft Corporation | Microsoft Clarity: heatmaps and session replays. Text typed into form fields is masked; in the dashboard and the graph app, all text is masked, so your Notion content isn't recorded. When you are signed in, Clarity also receives our internal account number and a few labels, never your email or name. | Microsoft Azure cloud | EU–US Data Privacy Framework |
| Cloudflare, Inc. | Forwards email sent to our addresses, such as [email protected], to our Gmail mailbox. | Global network | As above |
| Telegram | Internal notifications to our team about new and deleted accounts, payments, problems and feedback. Accounts on email domains that business customers covered by our DPA have given us are not included. | Several countries | None: we have no data processing agreement with Telegram, so accounts on email domains that business customers covered by our DPA have given us are left out |
Not sub-processors
- Notion is the source of your content and, if you choose it, your sign-in. You use Notion under your own agreement with Notion Labs, Inc.
- Airbyte (sync) and Elasticsearch (search) are software that runs on IVGraph's own servers in Finland, not separate service providers.
- AI tools you connect yourself with an IVGraph API key, such as Claude or Cursor, act on your instructions and under their own terms.
Changes to this list
We update this page before we add or replace a provider that processes Notion content. Business customers covered by our DPA get an email at least 30 days in advance and may object, as set out in section 8 of the DPA. We send it to the email addresses of your IVGraph accounts on the email domains you have given us, or to another address you give us at [email protected].