プライバシーポリシー
Last updated: August 29, 2026
1. Who We Are (Data Controller)
Note Bridge ("we", "us", "our") is the data controller for your personal data as described in this Privacy Policy. Our payment processor (identified in §5) acts as an independent data controller for payment data they process on our behalf.
2. Data We Collect
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Name, email, avatar | Microsoft sign-in | Account, session | Until account deletion |
| Microsoft access credential | Microsoft | OneNote read access | Encrypted; automatically deleted 3 days after last sign-in, or on disconnect/deletion |
| Notion access credential | Notion | Page creation | Encrypted; automatically deleted 3 days after last sign-in, or on disconnect/deletion |
| OneNote page content | Microsoft | Conversion | Temporary only — deleted after job completes |
| Obsidian vault files | User upload | Conversion | Stored in temporary cloud storage (R2); deleted immediately after migration completion; auto-purged within 7 days as safety fallback |
| Page titles and section names | Microsoft / user upload | Migration report, verification | Up to 15 days after job completion, then automatically deleted |
| Migration history | Service usage | Dashboard, support | Until account deletion |
| Transaction metadata (timestamp, page count, amount) | Payment processor | Tax compliance, fraud prevention | Permanent (no card data, no email; see §6) |
| Session cookie | Browser | Authentication | Session duration |
| Note Bridge の同意状態、ファーストパーティ分析 Cookie／ストレージ、GA4 行動分析イベント、初回接触マーケティング属性 | ブラウザ、Note Bridge、ページ URL のマーケティングパラメータ、リファラー、D1 属性レコード | 分析同意を管理し、GA4 で製品利用とキャンペーンを測定し、D1 に永続的な収益属性を保持します | Note Bridge の同意選択とファーストパーティ分析 Cookie は Note Bridge／Google の設定に従います。D1 初回接触属性は登録前最大 90 日、その後はアカウント削除まで保持されます。集計 GA4 分析は Google のポリシーに従います |
3. Legal Basis for Processing
- Contract performance: Processing your data to provide the migration service you requested.
- Legitimate interest: Service improvement, security, and fraud prevention.
- 同意または適用される法的根拠: 必要な場合、Note Bridge が任意の分析同意を管理します。D1 の永続属性は、キャンペーン測定、不正防止、集計ビジネスレポートという正当な利益のために処理されます。
4. How We Use Your Data
- Authenticate you and maintain your session
- Read your OneNote content when you initiate a migration
- Process your Obsidian vault files for migration — individual files are uploaded directly from your browser; no third-party API access is required
- Create Notion pages with content you select
- Track migration status and history
- Process payments (via our payment processor — we never see card numbers)
- Send service notifications (migration complete, failures)
- Note Bridge 管理の GA4 分析とプライバシー制限付き D1 初回接触属性レコードで、製品利用とマーケティング属性を測定します
Note Bridge が分析同意を管理し、許可された場合に GA4 を読み込んで行動分析を行います。D1 初回接触属性レコードは、移行コンテンツ、ノートブック名、ページタイトル、OAuth 識別子、カード情報を分析ツールへ送信せずに、登録、移行、購入につながったページやキャンペーンを理解するために使います。
5. Third-Party Data Processors
| Processor | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Microsoft | Login (OAuth) + OneNote access | Profile info, access credentials | microsoft.com/privacy |
| Notion | Page creation | Access credentials + content | notion.so/privacy |
| Payment providers, including Lemon Squeezy for purchases completed through it | Payment processing (MoR) | Email, payment amount | Provider privacy policy shown at checkout |
| Cloudflare | ホスティングと一時ファイルストレージ（R2） | Obsidian Vault ファイルと移行データ | cloudflare.com/privacypolicy |
| Google Analytics 4 | 必要な場合は Note Bridge の同意後に行動分析とコンバージョン測定を行います | ページパス、リファラー、キャンペーンパラメータ、集計コンバージョンイベントメタデータ。移行コンテンツ、ノートブック名、ページタイトル、OAuth アカウント ID、カード情報は含みません | policies.google.com/privacy |
6. Data Retention
- OneNote page/section content (HTML): Processed transiently and not persisted after job completion.
- Obsidian vault files: Individual files are uploaded directly from your browser to temporary cloud storage (Cloudflare R2) for processing. Deleted immediately upon migration completion. As a safety measure, any remaining files are automatically purged no later than 7 days after upload. No vault content is retained beyond this period.
- Page titles and section names: Retained for up to 15 days after job completion to allow migration verification, then automatically deleted. These are stored in our database and permanently deleted on account deletion.
- Account data: Retained until you delete your account.
- Authentication credentials: Automatically deleted within 3 days of your last sign-in. If you disconnect the service or delete your account, credentials are removed immediately.
- Transaction Metadata: We retain essential transaction records (timestamp, page count, and amount) as long as necessary to fulfill our legal and tax obligations. Your email for these transactions is held by our payment processor (see §5), not by us. This data is strictly limited to service usage logs and is disconnected from your migrated content upon account deletion. No card data is retained.
- マーケティング属性と分析同意: D1 初回接触属性レコードは、サニタイズ済みのランディングパス、リファラー、キャンペーンパラメータ、ロケール、ルートカテゴリを保存します。プライベートなクエリ文字列を含む完全な URL、OAuth トークン、移行コンテンツ、ノートブック名、ページタイトルは含みません。これらのレコードはアカウント削除時に削除されます。支払いレベルの属性スナップショットは、会計、不正防止、集計ビジネスレポートに必要な場合、取引メタデータとともに保持されることがあります。Note Bridge の同意選択とファーストパーティ分析 Cookie は Note Bridge／Google の保持設定に従います。
7. Your Rights
You have the following rights regarding your personal data:
- Access: View your data in Settings.
- Correction: Update your profile via Microsoft re-authentication.
- Deletion: Delete your account from Settings → Danger Zone. All personal data — including your profile, authentication credentials, first-party user attribution, and any retained page titles and section names — is permanently removed on deletion. Anonymous usage statistics (page counts, timestamps, migration status, and aggregated attribution reports) are retained with no identifying information attached, for product analytics and service improvement. Transaction records (timestamp, page count, amount, and payment-level attribution snapshots) are retained for tax compliance, fraud prevention, and aggregate business reporting; your email for these transactions is held by our payment processor (§5), not by us.
- Portability: Export your migration history (CSV) — coming soon.
- 同意の撤回: 連携サービスは設定からいつでも解除できます。分析同意が必要な場合は、「Cookie を管理」コントロールで Note Bridge の同意バナー を再度開き、任意の利用状況分析の選択を変更できます。Note Bridge は同意エンジンとファーストパーティ Google Analytics 4 の読み込みを提供します。
- Object: Contact us to object to specific processing.
- Do Not Sell (CCPA): We do not sell personal data. We do not share personal data for cross-context behavioral advertising. No opt-out mechanism is needed because no sale occurs.
- Lodge a complaint: With your local data protection authority.
To exercise any of these rights, contact us at support@note-bridge.co.
8. Cookies
当社はログイン状態の維持とサービス運営に必要な Cookie を使用します。また、Note Bridge に到達した最初のランディングページ、リファラー、許可されたキャンペーンパラメータを記憶するため、ファーストパーティ属性ストレージを使用する場合があります。
Note Bridge の同意バナーが任意の利用状況分析の選択を管理します。Note Bridge は同意エンジンとファーストパーティ分析 Cookie／ストレージを提供します。許可された場合、Note Bridge は Google Analytics 4 を読み込み、プライバシー制限付きの行動イベントとコンバージョンイベントを送信します。D1 初回接触属性に機密性の高い完全 URL は保存せず、移行コンテンツ、ノートブック名、ページタイトル、OAuth 識別子、カード情報を分析プロバイダーへ送信しません。
9. International Data Transfers
Your data may be processed on servers located outside your country of residence. Where required, we rely on standard contractual clauses (SCCs) or equivalent safeguards. Temporary content storage uses encrypted cloud infrastructure.
10. Children's Privacy
Note Bridge is not intended for users under 16. We do not knowingly collect personal data from children under 16. If we discover we have done so, we will delete that data immediately. Some EU member states permit digital consent from age 13 per GDPR Article 8(1); we apply the strictest threshold (16) globally.
11. Data Security
We implement the following security measures:
- Authentication credentials encrypted at rest and automatically deleted within 3 days of your last sign-in, minimizing the exposure window in the event of a security incident
- All data transmitted over encrypted connections
- Temporary content storage encrypted (server-side encryption)
- Regular security reviews
- Access to transaction logs is restricted to authorized personnel for support and accounting purposes only. We implement strict internal access controls on this data.
12. Changes to This Policy
We will notify you of material changes via email and/or in-app notice. Non-material changes will be reflected with an updated "Last updated" date at the top of this page.