Ninno

Ninno Privacy Policy

DRAFT FOR LEGAL REVIEW. This text is a starting point written to reflect the product as specified. It is not legal advice. Fill every [bracketed] item and have a qualified lawyer review it before launch. Verify the statements marked (verify) against the final build and the terms of each service provider.

Effective date: [date] Last updated: [date]

1. Who we are

Ninno (www.ninno.org) is operated by [legal entity name], [registered address], [registration number] ("Ninno", "we", "us"). Contact for privacy questions: [privacy email address]. [If required: our Data Protection Officer or EU/UK representative is [name and contact].]

2. What this policy covers

This policy explains how we handle personal data when you visit our website, create an account, or use Ninno. It applies to:

  • Visitors to ninno.org.
  • Users who have a Ninno account.
  • Organisations that subscribe to Ninno and the people they invite.

There are two roles, and it matters which one applies:

  • Ninno as controller. For your account, billing, sign-in, security, product analytics and communications, we decide why and how your data is used, so we are the controller.
  • Ninno as processor. Inside a workspace, your organisation decides what to store (for example records about staff, volunteers, contractors, donors or beneficiaries). For that content, your organisation is the controller and Ninno is its processor. Our Data Processing Addendum ([link]) applies. If you are an individual whose data is held in an organisation's workspace, contact that organisation first about your rights.

3. Personal data we collect

You give us:

  • Account data: name, email address, job title, profile photo, password (stored hashed by our authentication provider) or Google sign-in details.
  • Organisation data: workspace name, logo, mission statement, country, currency, team member list and roles.
  • Content you add to a workspace: documents, files, records, tasks, messages, forms, requests, comments and notes (see section 2 for our role).
  • Billing data: billing name, billing address, country, tax details, plan and seat count. Payment card details are handled by our payment provider and are not stored by Ninno.
  • Communications: messages you send to support and your email preferences.

We collect automatically:

  • Technical data: IP address, browser and device type, pages visited, timestamps and error logs, used to run and secure the service.
  • Cookies and similar technologies, described in our Cookie Policy.
  • Usage data inside the product (for example features used, AI runs and storage used) for operating, billing and improving the service.

From others:

  • Information another user or organisation gives us about you, for example when you are invited to a workspace by email.

We do not intentionally collect special category data or children's data for our own purposes. Organisations may choose to store such data in their workspaces; they are responsible for having a lawful basis and for protecting it. Ninno is not intended for use by anyone under 16.

4. How we use personal data and our legal bases (GDPR Article 6)

| Purpose | Data | Legal basis | |---|---|---| | Create and manage your account; provide the service | Account, organisation, workspace content, technical | Contract | | Take payment, issue invoices, manage your trial and subscription | Billing, account | Contract; legal obligation (tax and accounting) | | Keep Ninno secure; prevent fraud and abuse; fix errors | Technical, account | Legitimate interests (security and reliability) | | Send service messages (invitations, approvals, reminders, receipts, security alerts) | Account, content metadata | Contract; legitimate interests | | Provide AI features you choose to run | Content of the project or function you run the tool on | Contract | | Product analytics and improvement | Usage, technical | Consent for analytics cookies; legitimate interests for aggregated, non-cookie measures | | Send optional tips and product news | Name, email | Consent (you can withdraw any time) | | Answer your questions and requests | Communications, account | Legitimate interests | | Comply with law and respond to legal requests | As required | Legal obligation |

5. AI features

Ninno's AI tools read only the project or function you choose to run them on, and only data that you already have permission to see. They produce drafts that you review before anything is saved. Content is sent to our AI service provider ([provider name]) solely to generate your result. We do not use your workspace content to train AI models, and we require our AI provider not to do so (verify against the provider's terms). AI runs are logged (who ran which tool, when, and the outcome) so that workspace admins can review them.

6. Who we share data with

We do not sell personal data. We share it only with:

  • Service providers (sub-processors) that help us run Ninno, under contracts that require appropriate protection: hosting, database, authentication and file storage ([Lovable Cloud and its infrastructure providers, to be confirmed]); email delivery ([provider]); payments and billing ([Stripe]); AI services ([provider]); product analytics, only with your consent ([provider]); customer support ([provider]). A current list is at [sub-processor list link]. (verify)
  • Other members of your workspace, according to the permissions your organisation sets.
  • Professional advisers such as lawyers, auditors and insurers where necessary.
  • Authorities, where the law requires it or to protect rights and safety.
  • A successor, if we merge with or are acquired by another business; we will tell you and the policy will continue to protect your data.

7. International transfers

Our providers may process data in countries outside your own, including outside the UK and the European Economic Area. Where required we rely on adequacy decisions, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with additional safeguards. Ask us for details at [privacy email address]. Hosting region: [region, to be confirmed].

8. How long we keep data

  • Account data: while your account is active and for up to [24] months after it closes, unless we need it longer for legal reasons.
  • Workspace content: while your subscription is active. After a trial or subscription ends the workspace is read-only for 14 days, then locked; content is kept for 90 days, then deleted. You can export your data at any time.
  • Deleted items: files moved to Trash are permanently deleted after 30 days. Backups are overwritten on a rolling schedule of up to [35] days. (verify)
  • Billing records: for the period required by tax and accounting law (typically [6 to 7] years).
  • Security and audit logs: up to [12] months.
  • Analytics data: up to [14] months.
  • Support messages: up to [24] months after the matter is closed.

9. Security

We protect data with encryption in transit, strict separation between organisations (each workspace's data is isolated by access rules enforced in the database), role-based access, hashed credentials, logging of sensitive actions and regular security review. No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authority as the law requires.

10. Your rights

Depending on where you live (including under the UK GDPR and EU GDPR), you may have the right to: be informed; access your data; have it corrected; have it erased; restrict or object to processing; data portability; withdraw consent at any time; and not be subject to decisions based solely on automated processing with legal effects (we do not make such decisions). To exercise a right, email [privacy email address]. We will respond within one month and may need to verify your identity. You can also complain to your data protection authority, for example the UK Information Commissioner's Office (ico.org.uk) or your local EU authority. We would appreciate the chance to help first.

For data held inside an organisation's workspace, we will pass your request to that organisation as the controller, or help it respond.

11. Cookies

We use essential cookies and, only with your consent, analytics cookies. See our Cookie Policy ([link]). You can change your choice at any time using "Cookie settings" in the footer.

12. Marketing

We send marketing email only if you opt in. You can unsubscribe using the link in any message or in your account settings. Service messages (such as invitations, approvals, receipts and security alerts) are not marketing and will continue.

13. Children

Ninno is for organisations and their adult team members. We do not knowingly collect data from anyone under 16 for our own purposes. If you think a child has given us personal data, contact [privacy email address] and we will delete it.

14. Changes to this policy

We will update this policy when our practices change. We will post the new version here with a new date and, for material changes, notify account owners by email.

15. Contact

[Legal entity name], [address]. Email: [privacy email address].