Privacy
How 11MHz handles personal data, where it lives, and the rights you have.
Last updated 21 May 2026
01 / 12
In short
Your data isn't sold and isn't used to train anyone's models.
No advertising trackers, no fingerprinting, no cross-site tracking.
Servers sit in the European Union.
Locked notes are encrypted before they leave your browser. Even 11MHz can't read them. Only you, or your team, can.
02 / 12
Who handles your data
11MHz is the controller for the personal data described on this page.
Privacy questions or requests can be sent to hello@11mhz.com or by phone to +31 (0)38 206 7060.
03 / 12
What's collected
In an 11MHz account: an email address and a hashed password to identify the account, plus the tasks, notes, tags, and attachments you create. The account email is used for transactional messages such as verification, reminders, and billing.
Server logs: timestamp, IP address, and user agent are kept briefly for security, abuse prevention, and debugging. Logs are not used to build a behavioural profile.
04 / 12
Locked notes
When a note is locked, its content is encrypted in the browser before it reaches the server. The key stays with you. Even 11MHz can't read locked notes.
Note titles, tags, timestamps, and task descriptions are stored in readable form so they can be listed and searched.
Losing the key means a locked note can't be recovered. That is by design.
05 / 12
Audit log
Important actions in an 11MHz account and workspace are recorded in an append-only audit log. Sign-ins, password changes, member role changes, and edits to tasks and notes are kept so you and your workspace admins can see what happened and when.
Each entry stores the action, the person who performed it, an IP address, a user agent, and a timestamp. The log exists for security and accountability, not to build a behavioural profile, and is stored in the EU alongside the rest of the account data.
06 / 12
Where the data lives
Servers and backups are located in the European Union. Data is not transferred outside the EU or EEA without an appropriate safeguard such as Standard Contractual Clauses.
08 / 12
Third parties
Data is never sold.
A short list of sub-processors is used to operate the service (hosting, transactional email, error monitoring). Each is bound by a data processing agreement and selected for EU residency where possible.
The current list is available on request via hello@11mhz.com.
09 / 12
How long things are kept
Account data is kept while the account is active. After deletion, it's removed within 30 days. Some records, such as invoices, are retained longer where law requires.
Server logs are retained for up to 30 days.
10 / 12
Your rights
Under the GDPR you can ask to see what data 11MHz holds about you, correct it, export it in a portable format, delete it, or restrict and object to processing. Requests are handled at hello@11mhz.com.
A complaint can also be filed with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
11 / 12
Changes to this policy
This page may be updated as the product evolves. The "last updated" date at the top tracks meaningful changes. Significant changes that affect personal data will be communicated by email where possible.
12 / 12
Contact
Privacy questions land at hello@11mhz.com.