Privacy Policy

1. Controller and scope

MyData AG, Bern, Switzerland ("Nolen", "we", "us"), the company operating the Nolen platform, is responsible for the data processing described in this policy. For all privacy-related matters you can reach us at [email protected].

This policy covers our website at nolen.ai and the Nolen platform, our AI-powered business assistant for small and medium-sized enterprises. Where Nolen processes personal data on behalf of a business customer within the platform, that processing is governed by our Data Processing Agreement; this policy applies to the processing for which Nolen itself determines the purposes and means.

2. What data we process

Depending on how you interact with us, we process the following categories of data:

• Website visits: technical data transmitted by your browser (IP address, browser type and version, operating system, referrer URL, date and time of access). We use this to deliver the website and to detect and defend against attacks.
• Contact and discovery-call requests: the name, email address, company and message you submit through our contact options.
• Account data: when a workspace is created for you on the platform, we process your name, business email address and workspace settings.
• Content data: prompts, documents and other content that you or your organisation submit to the platform so the assistant can process them.
• Billing data: invoicing details of our business customers.
• Communication data: the content of emails and calls when you correspond with us, including support requests.
• Usage data: aggregated statistics about how the website and platform are used (such as page views). We do not use tracking cookies or advertising profiles.

3. Purposes and legal bases

We process personal data to provide and operate the website and the platform, to respond to enquiries, to fulfil contracts with our customers, to invoice our services, to ensure the security of our systems, and to improve our offering. Under the Swiss Federal Act on Data Protection (FADP/nDSG) and, where applicable, the EU General Data Protection Regulation (GDPR), we rely on the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), our legitimate interests in operating, securing and improving our services (Art. 6(1)(f) GDPR), your consent where we have asked for it (Art. 6(1)(a) GDPR), and compliance with legal obligations (Art. 6(1)(c) GDPR).

4. AI processing

To generate responses, the platform may transmit content you submit to carefully selected AI model providers. These providers are contractually bound to process the content only to provide the service. Content submitted to the Nolen platform is not used to train AI models. Customers with a self-hosted or on-premises deployment keep their content within their own infrastructure.

5. Hosting and data location

Platform data is hosted in Switzerland. Individual service providers may process data in the European Union or the European Economic Area. We select providers that offer a level of data protection consistent with Swiss and EU standards.

6. Disclosure to third parties

We do not sell personal data. We share personal data only with service providers that are necessary to operate our services (for example hosting, email delivery, invoicing and AI model providers), with authorities where we are legally obliged to do so, or with your consent. Service providers act on our instructions and are bound by data processing agreements. A current list of the sub-processors used within the platform is available on request at [email protected].

7. International transfers

Data is processed in Switzerland and the EU/EEA by default. If personal data is exceptionally transferred to a country without an adequate level of data protection, we ensure appropriate safeguards, in particular the standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and the European Commission.

8. Retention

We keep personal data only as long as it is needed for the purposes described above or as required by statutory retention obligations (for example accounting records). Server logs are kept only as long as necessary for security purposes. When a customer relationship ends, platform data is deleted in accordance with our Data Processing Agreement.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and the principle of least privilege. Access to customer data is restricted to personnel who need it to provide the service and who are bound by confidentiality.

10. Cookies

We do not use tracking or advertising cookies. We only use cookies and similar technologies that are strictly necessary for the website and platform to function, such as session cookies for authentication.

11. Your rights

Under the FADP and, where applicable, the GDPR, you have the right to:

• request access to the personal data we hold about you,
• have inaccurate data corrected,
• request deletion of your data,
• request restriction of processing or object to processing based on legitimate interests,
• receive the data you provided in a portable format,
• withdraw consent at any time with effect for the future.

To exercise these rights, contact us at [email protected]. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if the GDPR applies to you, with your local supervisory authority.

12. Changes to this policy

We may update this policy from time to time, for example when our services or the legal requirements change. The version published on this page is the current one. We will inform users of significant changes through the platform or by email.

13. Contact

For any questions about this policy or our data processing, contact us at [email protected].