This Privacy Policy explains how Nossy, a product operated by ZENDAI DIGITAL COMPANY LIMITED (“Nossy,” “we,” “our,” or “us”), handles information when you use our website, hosted cloud service, connected chat channels, and related support channels (collectively, the “Services”).
Nossy helps small businesses set up a structured Google Sheet for how they operate and run day-to-day spreadsheet work through chat apps such as Telegram. When you use the Services, we process the information described below to authenticate users, manage organizations and projects, connect integrations, operate AI-assisted setup and chat workflows, administer billing where applicable, and keep the service secure.
The business responsible for the Services is ZENDAI DIGITAL COMPANY LIMITED. Questions about this policy can be sent to hello@nossy.ai.
1. Information We Collect
Account and profile information
When you sign in, we receive account information from our authentication provider, including your name, email address, profile details, account identifiers, session identifiers, and organization membership information.
Organization, project, and setup information
We collect and store information needed to provide the Services, such as:
- organization and project names and settings;
- membership and role information;
- responses and selections from spreadsheet setup interviews and question flows;
- sheet structure, contracts, and related project configuration; and
- billing plan, subscription status, and usage records where applicable.
Spreadsheet, Drive, and connected-service data
If you connect Google Drive or spreadsheets, we process file metadata, sheet content, and related configuration needed to set up your project, maintain your sheet contract, and perform actions you request through the Services. We process this information only as needed to provide features you use.
Chat and messaging data
If you link a chat channel such as Telegram, we process message content, identifiers, thread or chat metadata, and related delivery information needed to receive messages, route them to the right project, and respond through the agent workflows you enable.
Credentials and secrets
When you connect third-party services, you may provide OAuth tokens, API credentials, or related configuration. We process that information to authenticate requests and operate your connected integrations. We use access controls and secret-management workflows designed to limit exposure of sensitive credentials.
Website and support communications
If you contact us by email, submit a form, or otherwise communicate with us, we collect the information you provide in order to respond and improve the Services.
Usage, device, and diagnostic information
We automatically collect technical information such as IP address, browser and device data, request metadata, session cookies, product interactions, operational logs, crash reports, traces, and other diagnostics needed to secure, maintain, and improve the Services.
Payment and subscription information
If you subscribe to a paid plan, we and our billing providers process subscription status, plan selections, invoices, and limited payment-related metadata. Our payment partners, not Nossy, generally handle full payment card details.
2. How We Use Information
We use the information we collect to:
- provide, operate, secure, and support the Services;
- authenticate users and maintain sessions;
- create and manage organizations, projects, memberships, and permissions;
- run AI-assisted setup interviews and chat-based spreadsheet workflows you request;
- connect to Google, chat platforms, and other integrations you authorize;
- meter usage, manage subscriptions, and administer billing;
- monitor performance, debug issues, prevent abuse, and investigate incidents;
- communicate with you about the Services, updates, and support requests; and
- comply with legal obligations and enforce our agreements.
3. Legal Bases for Processing
If data protection laws such as the GDPR, UK GDPR, or Thailand’s Personal Data Protection Act (PDPA) apply, we generally process personal data because it is necessary to perform our contract with you, because we have legitimate interests in operating and securing the Services, because we must comply with legal obligations, or because you have given consent where consent is required.
4. How We Share Information
We may share information in the following circumstances:
- with service providers that help us run the Services, including hosting, authentication, billing, logging, analytics, error monitoring, AI inference, and customer-support vendors;
- with third-party integrations you connect or direct us to use, such as Google, Telegram, and AI providers;
- with your organization administrators and authorized teammates, consistent with your workspace permissions;
- in connection with a merger, financing, acquisition, reorganization, or sale of assets; and
- when required to comply with law, protect rights or safety, investigate misuse, or enforce our terms.
Based on our current hosted implementation, our processors or infrastructure providers may include WorkOS (authentication and organization management), Google (Drive and spreadsheet access you authorize), Telegram (linked chat channels), Anthropic (managed agent sessions where enabled), Autumn (billing when enabled), Axiom (operational telemetry when enabled), Sentry (error monitoring when enabled), PostHog (product analytics when enabled), and cloud hosting and database providers such as Cloudflare and managed Postgres providers. Our providers may change over time as the Services evolve.
5. Cookies and Similar Technologies
We use cookies and similar technologies for essential functions such as authentication, session continuity, and security. For example, Nossy uses HTTP-only session cookies to keep users signed in. We may also use cookies or comparable storage for preference, security, performance, or diagnostic purposes.
6. Data Retention
We retain information for as long as reasonably necessary to provide the Services, maintain your account and organization, meet contractual commitments, resolve disputes, enforce agreements, and comply with legal obligations. Retention periods vary based on the type of information, its sensitivity, and whether it is needed for security, billing, tax, audit, or backup purposes.
Some data may remain in backups or logs for a limited period after deletion. If you need deletion assistance, contact us using the information below.
7. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, loss, misuse, and alteration. Those measures include access controls, secret-management workflows, encrypted transport, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
8. International Data Transfers
We and our service providers may process information in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers.
9. Your Choices and Rights
Depending on where you live, you may have rights to access, correct, delete, export, or limit certain processing of your personal information, or to object to processing. You may also have the right to appeal a denial of your request.
You can manage certain information directly in the product, such as organizations, projects, and connected integrations. To exercise privacy rights or request account deletion, email hello@nossy.ai.
We do not sell personal information for money, and we do not use personal information for cross-context behavioral advertising as part of the current product implementation.
10. Region-Specific Notices
Thailand (PDPA)
If you are in Thailand, you may have rights under the PDPA to access, correct, delete, restrict, or object to certain processing, and to withdraw consent where processing is consent-based. To submit a request, contact hello@nossy.ai.
California
If you are a California resident, you may have rights to know, access, correct, or delete certain personal information and to limit certain uses of sensitive personal information, subject to exceptions. To submit a request, contact hello@nossy.ai.
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can take appropriate action.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version here and revise the “Last updated” date above. Your continued use of the Services after an update becomes effective means the updated policy will apply going forward.
12. Contact
Questions or requests about this Privacy Policy can be sent to ZENDAI DIGITAL COMPANY LIMITED at hello@nossy.ai.