Privacy policy

Data controller

The data controller is the individual who publishes and sells Nolapso: Ahmed Yacine Bouferroum, Algeria. For any question or request about your data: support@nolapso.com.

Workspaces used by a company. When a company or another organization uses a workspace for its activity, for example on the Business plan, it decides whom it invites and what it records about them and about its contracts. For that data (the people in the workspace, their roles, departments and job titles, the items and documents, and the admin log), the organization is the data controller and Nolapso processes the data on its behalf, as its processor, under our data processing agreement. Please send requests about that data to the organization; if you write to us, we pass your request on to it without delay. Nolapso remains the controller of sign-in accounts, security logs, support requests, billing records and audience statistics.

Data we process

Account: email address, name if you give one, password (stored in hashed form by our authentication provider), workspace name, language and display preferences, and a profile picture if you add one (an uploaded photo is kept without its metadata). If you continue with Google: your Google account’s email address, name and profile picture, which our authentication provider stores. Members: the email addresses of the people you invite.

Team area, in a workspace used by a company: each person’s name and job title, the departments they belong to and whether they lead one (team leader), their role in the workspace (owner, admin, editor or viewer), the items they are responsible for and the plans they use, requests to hand items over (with an optional note), and an admin log. The admin log records invitations, removals and departures; changes of role, department, team leader, name and job title; items handed over; changes to who uses a plan or who sees an item; department changes; and exports of team data. Each entry keeps its date, the type of change, the email addresses of the person who made it and of the person it concerns, and short details such as department names or item titles. Only the workspace’s owner and admins can read it. It never records sign-ins or what people view.

Content: documents and emails you import or forward, quoted passages, contracts, subscriptions, dates, amounts, decisions and notes you record. They can contain data about other people, for example the other party to a contract.

Technical data: security and operation logs (for example IP addresses in server logs), anti-abuse counters stored in hashed form, and email delivery tracking.

Payment, once paid plans open: your Paddle customer identifier, the subscription status, the plan, period, number of users, country, currency and the version of the terms in force at purchase. Card and payment details stay with Paddle; Nolapso never sees them.

Purposes and legal bases

Providing the service (account, sign-in, storage, deadline calculation, reminders, exports): performance of the contract.

Securing the service and preventing abuse: legitimate interest.

Keeping the admin log of a company workspace, so that its owner and admins can see who changed people, roles, departments and responsibilities, and when: legitimate interest of the company, which decides on this log as data controller; Nolapso keeps it on the company’s behalf.

Answering your support requests: performance of the contract or legitimate interest.

Analyzing a document you import (PDF, image, exported email or pasted text) with AI to propose its details and a summary: performance of the contract, because this is the analysis you request by importing it. This processing is shown to you before each import, and manual entry remains available without any AI.

Analyzing emails forwarded to your Nolapso inbox with AI, only if the workspace owner enables it: consent, which can be withdrawn at any time.

Answering with AI the questions you ask the Nolapso assistant in your workspace: performance of the contract, because this is the answer you request by asking. The assistant is read-only, never changes your data and is limited to a number of messages per workspace per week depending on your plan.

Billing and accounting, once paid plans open: performance of the contract and legal obligation.

Counting page visits to see how visitors find Nolapso (audience measurement): legitimate interest.

We do not sell your data and we do not run targeted advertising. No decision with legal effects on you is made by automated means.

Recipients and processors

Supabase (database, authentication and file storage), hosted in the European Union (Frankfurt, Germany).

Hetzner Online GmbH (application server), in Germany.

Resend (the service’s emails: account, reminders, notices), European Union region (Ireland).

Mailgun (receiving the emails you choose to forward to your Email Inbox address), European Union region. Message storage at Mailgun is not enabled.

Sign-in with Google, if you choose it: Google identifies you and sends us your account’s email address, name and profile picture. Google processes this data under its own privacy policy.

Bot protection, when it is turned on: sign-up, sign-in and password reset use Cloudflare Turnstile (Cloudflare, United States), which processes technical data such as your IP address and browser signals only to check that you are not a bot, and sets no advertising cookie.

AI analysis: the text of the document or email being analyzed is sent to Anthropic (United States), which processes it with its Claude model through its API. Processing may take place outside the European Union. Anthropic does not use this data to train its models and deletes it within 30 days, unless the law requires otherwise or a request is flagged as breaking its usage policy (then it may be kept for up to 2 years). Only proposed fields with their quotations and a short summary are returned; they still need your review and never change your dates without your confirmation.

Scanned pages and photos: when a document has no readable text (a scanned PDF, a JPEG or PNG photo), those pages are sent as images to the same AI provider, through the same route and under the same terms.

Nolapso assistant: your question, the latest turns of the conversation and a minimal summary of your workspace’s confirmed information (for example suppliers, titles, amounts, dates, statuses and plan, without notes, documents, summaries, contacts or email addresses) are sent through the same route, to Anthropic in the United States, under the same terms.

Payments, once paid plans open: Paddle (Paddle.com Market Limited, United Kingdom, or the Paddle company for your region), our reseller and Merchant of Record, collects and processes the payment, billing and tax data itself, as a separate controller, under its own privacy policy (https://www.paddle.com/legal/privacy). Nolapso receives only what it needs to run your plan: your Paddle customer identifier, the subscription status, the plan, your country and the currency, never card details. To show prices in your country’s currency, Nolapso sends your IP address to Paddle, which returns only the country; the address and the country stay only in the server’s memory, for six hours at most, and are never saved. The United Kingdom benefits from an adequacy decision of the European Commission. Today, no payment is processed.

Supabase, Resend, Mailgun, Google, Cloudflare and Anthropic are companies or groups headquartered in the United States. Any access or transfer outside the European Union is covered by the EU-US Data Privacy Framework for certified companies, or by the European Commission’s standard contractual clauses. You can get a copy by writing to us.

Retention

Account, tracked items and evidence you kept: while the workspace exists, then deleted with it. A document you import yourself stays in your workspace, as a draft or as evidence, until you delete it.

Forwarded emails: the raw message and files that were not kept are deleted after 7 days; a draft from an email that was not confirmed, after 30 days.

Nolapso keeps no conversation with the assistant: it stays in your browser tab and is cleared when you sign out. Only a content-free usage record (workspace, user, date, cost and token counts) is kept, while the workspace exists, to apply the limits.

Content-free technical fingerprints used to avoid duplicates are kept for 90 days; technical and security logs for at most 12 months.

Team area: a person’s name, job title, departments, role and hand-over requests are deleted when they leave the workspace or are removed from it. Each admin log entry is deleted automatically 24 months after it was made, and the whole log is deleted with the workspace. When a person deletes their Nolapso account, their email address and name are removed from the admin log entries; the entries stay, without naming them, so that the company keeps the history of its items.

Audience statistics: at most 25 months.

Billing data Nolapso holds, once paid plans open: up to 10 years, as accounting law requires. Paddle keeps its own records under its privacy policy.

Backups are kept for a limited time and then overwritten; deleted data may remain in them until they rotate.

Cookies and browser storage

Nolapso only uses what the service needs: sign-in session and security cookies, a cookie that remembers the workspace you chose, a cookie that remembers the display theme you pick, and your browser’s storage for interface choices (closed notices, the plan chosen before sign-up) and for the assistant conversation, cleared when you sign out.

Audience measurement: we count page visits with Umami, running on our own server in Germany, without cookies. It records the page, the referring site, the browser and operating system, the device type and the country. Your IP address is only used to look up the country and to compute an anonymous identifier that changes every day, and is not stored. This data is never shared or used for advertising.

No advertising or audience measurement cookies are used. These items do not need consent, so no cookie banner is shown.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw a consent at any time. Under French law you can also give instructions about your data after your death.

The owner of a workspace can export its data and delete the workspace from the settings. You can delete your sign-in account yourself with Delete my account in Settings, or write to support@nolapso.com and we delete it within one month. Deletion from Settings takes effect at once; backups are overwritten on their normal rotation (see Retention). For any other request, write to support@nolapso.com: we answer within one month.

You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or your local supervisory authority.

The service is intended for people aged 15 or over.

Security

Connections are encrypted (HTTPS), documents are stored in a private space and access to each workspace is checked on the server. No measure offers absolute security; if an incident affects your data, we will act as required by the GDPR.

Changes

We will update this policy when something changes, in particular before adding a new provider. For a significant change, we tell you by email or in the app. The last update date is shown at the top of the page.