Privacy policy
How Nordvec collects, processes, and protects your data.
Last updated:
Overview
This privacy policy describes how we collect, use, disclose and store personal data when you visit our website, create an account or use Nordvec. When you use Nordvec on behalf of your employer, we act as a processor and your employer is the controller; for that data, see our Data Processing Agreement (DPA). This policy covers the data we process as controller, such as your sign-in details, payment data and website logs.
1. What data do we collect?
We collect: identification and contact information (name, email, company name), account and authentication data (passwords hashed via bcrypt, profile pictures via OAuth, connector tokens encrypted with AES-256), payment information (processed via our EU payment provider Mollie once billing is enabled; we store only a token reference, never full card details), technical data (IP address masked in Sentry, browser type, login timestamps, page views), desktop file synchronisation data (file names, content, and metadata from locally synced folders, with file paths stored in hashed form), and AI interaction history (queries, AI responses, cited sources, and timestamps).
2. Purpose and legal basis
We process your personal data for these purposes. Providing the service (Art. 6(1)(b)): creating and managing your account, and support. Payment and bookkeeping (Art. 6(1)(c)): invoicing, and keeping accounting records for 5 years under the Danish Bookkeeping Act. Security and improvement (Art. 6(1)(f)): preventing misuse, debugging, and analysing anonymised usage data; we do not train AI models on your data. Memory (Art. 6(1)(f)): our legitimate interest in answering you with the context of your earlier conversations; you object with the memory switch under Settings > Memory. Marketing (Art. 6(1)(a)): the launch list. An address entered in the launch list form receives one email with a confirmation link, and only a confirmed address receives launch news: at most one email a month until launch, then the launch announcement. We store the address, the language, the wording and time of the consent, and when it was confirmed or withdrawn. Every email carries a one-click unsubscribe (Art. 7(3)), and nothing reaches the list through a cookie choice. The optional weekly briefing of changes in your own connected sources is a service feature you turn on in your notification settings.
3. Use of AI and third parties
Nordvec is built around large language models (LLMs). Nordvec does not use your queries or documents to train AI models. For each question, the model receives the passages the assistant retrieved from documents you have access to, and more of a document only when the assistant opens it to answer. Your data is isolated per tenant via Row Level Security (RLS). Generation and embeddings run in France. Documents are stored in Ireland. Some providers are incorporated outside the European Economic Area, so their remote access counts as a transfer under GDPR Chapter V; our sub-processor register names each one with the transfer basis that applies.
4. International transfers
Documents are stored in Ireland (via Supabase). All AI inference takes place in the EU: generation and embeddings in France. We are migrating to servers we operate ourselves, and until that migration completes some providers are incorporated outside the EEA or run without a pinned EU region. Our sub-processor register records each provider, its transfer basis, and the status of that migration.
5. Data retention
We keep your profile while your account is active. When you delete your account, it is frozen at once and erased 14 days later, unless you cancel with the link we email you. The erasure deletes your documents, conversations, memories, embeddings, connector tokens and stored files in one transaction. Two records outlive it: accounting records, kept for 5 years under the Danish Bookkeeping Act, and audit logs, which are anonymised and kept. No backup copy of the database exists beyond the running instance, so the erasure is complete once it finishes. Data from connected systems is deleted at the next sync after it is deleted at the source, and all of it within 30 days after the agreement ends. A launch list address nobody confirms is deleted when its confirmation link expires, 7 days after it was sent. After an unsubscribe we keep the consent record for 24 months to show the consent was given, then delete it.
6. Your rights
Under GDPR you can use these rights yourself in Nordvec. Access (Art. 15) and portability (Art. 20): export your data as JSON under Settings > Data and privacy > Export data. Rectification (Art. 16): edit your profile, and correct or dispute a memory under Settings > Memory; data in a synced document is corrected in its source system and follows on the next sync. Erasure (Art. 17): Settings > Data and privacy > Delete account; the account is frozen at once and erased 14 days later unless you cancel. Restriction (Art. 18): pause a memory, turn a source off or exclude uploads. Objection (Art. 21): the memory switch under Settings > Memory stops memory extraction and recall in every workspace. Automated decisions (Art. 22): our AI advises and never makes a binding decision about a person. For anything else, file a request under Settings > Data and privacy > Your data requests or write to privacy@nordvec.com. We answer within one month, extendable by at most two further months for a complex request, with the reasons (Art. 12(3)).
8. Changes to this policy
We reserve the right to update this privacy policy to reflect changes in legislation or our Service. We will notify you via email or through the platform of significant changes.
9. Contact
If you have questions or want to exercise your rights, contact Nordvec ApS at privacy@nordvec.com (privacy contact: dpo@nordvec.com; web: nordvec.com). You also have the right to lodge a complaint with the Danish Data Protection Agency (www.datatilsynet.dk).