nadicode Privacy Policy

In effect from October 12, 2026

Our lawyers are reviewing this text. If a change affects you, we tell you before it takes effect.

1. Who We Are

NADICODEAI S.R.L. ("nadicode", "we") is the controller of the personal data this policy describes. Our company details are in the Legal Notice at portal.nadicode.ai/legal/legal-notice. For any privacy question or request, write to sales@nadicode.ai.

We have not appointed a Data Protection Officer: we assessed the criteria of Article 37 GDPR and none applies to our processing today.

2. What This Policy Covers

This policy covers the personal data we process as controller about people who visit nadicode.ai, who use the Portal at portal.nadicode.ai, and who use our apps: the people who create and administer business accounts, their colleagues, and our business contacts.

It does not cover the content our business customers process with the Service, such as what their Agents read and produce. For that content the customer is the controller and we act on its instructions, under the Data Processing Agreement; the customer's own privacy notice tells the people concerned how it is used.

3. The Data We Process and Why

Data	Why we use it	Legal basis (GDPR)
Account and sign-in data: name, email address, password (stored as a salted hash), two-factor authentication settings, and the identifier of a Google or Microsoft account used to sign in	To create the account, sign the person in and keep the account secure	Contract, Art. 6(1)(b); security, Art. 6(1)(f)
Why we use it: To create the account, sign the person in and keep the account secureLegal basis (GDPR): Contract, Art. 6(1)(b); security, Art. 6(1)(f)
Company data: company name and identity, VAT number, registered office, and the email domain that links colleagues to their company	To set up the company's account, verify that it is a real business, and link each person to the right company	Contract, Art. 6(1)(b); fraud prevention, Art. 6(1)(f)
Why we use it: To set up the company's account, verify that it is a real business, and link each person to the right companyLegal basis (GDPR): Contract, Art. 6(1)(b); fraud prevention, Art. 6(1)(f)
Billing data: subscriptions, purchases, invoices and payment status	To charge for the Service and keep the accounting records the law requires	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)
Why we use it: To charge for the Service and keep the accounting records the law requiresLegal basis (GDPR): Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)
Usage data: how much model usage each member account consumed, and when	To measure usage against what was bought, and to bill for it	Contract, Art. 6(1)(b)
Why we use it: To measure usage against what was bought, and to bill for itLegal basis (GDPR): Contract, Art. 6(1)(b)
Device and connection data: the computers connected to an account, when they were connected and by whom	To let the account's administrators see and manage the computers that use it	Contract, Art. 6(1)(b); security, Art. 6(1)(f)
Why we use it: To let the account's administrators see and manage the computers that use itLegal basis (GDPR): Contract, Art. 6(1)(b); security, Art. 6(1)(f)
Acceptance records: who accepted which version of the Terms, and when and from where	To prove the contract and its specifically approved clauses	Contract, Art. 6(1)(b); establishing and defending legal claims, Art. 6(1)(f)
Why we use it: To prove the contract and its specifically approved clausesLegal basis (GDPR): Contract, Art. 6(1)(b); establishing and defending legal claims, Art. 6(1)(f)
Messages we send: service, security and billing emails and in-app notifications	To run the Service and tell people what concerns their account	Contract, Art. 6(1)(b)
Why we use it: To run the Service and tell people what concerns their accountLegal basis (GDPR): Contract, Art. 6(1)(b)
Technical data: IP address, browser and device information, logs, and the cookies described in the Cookie Policy	To operate, secure and troubleshoot the websites, the Portal and our update service	Security and operation, Art. 6(1)(f)
Why we use it: To operate, secure and troubleshoot the websites, the Portal and our update serviceLegal basis (GDPR): Security and operation, Art. 6(1)(f)
Business contact data: name, role and contact details of people at companies we work with	To answer enquiries and keep in touch about our services, with a way to object in every message	Legitimate interest in business-to-business relations, Art. 6(1)(f)
Why we use it: To answer enquiries and keep in touch about our services, with a way to object in every messageLegal basis (GDPR): Legitimate interest in business-to-business relations, Art. 6(1)(f)

Where we rely on our legitimate interest, the interest is the one named in the table: keeping the Service secure, preventing fraud, attributing accounts to the right business, proving the contract, and business-to-business relations. We limit the data to what that interest needs, and anyone may object as section 7 explains.

Giving us account and company data is necessary to open an account; without it we cannot provide the Service. We do not make decisions about people based solely on automated processing that produce legal effects on them or similarly affect them.

4. Who Receives the Data

We use service providers that process personal data on our behalf, under contracts that bind them to our instructions. The current list, with each provider's role and location, is published at portal.nadicode.ai/legal/subprocessors. They provide hosting, database, email, in-app notifications, payment processing, sign-in, file storage and app connections.

Some providers act as independent controllers for their own purposes: Stripe for its fraud prevention and regulatory obligations, and Google and Microsoft when a person signs in with their accounts. Their own privacy policies apply to that processing.

To verify a company's identity, we query public registers: the European Commission's VAT Information Exchange System (VIES) for the VAT number, and OpenStreetMap's geocoding service for the registered office address.

We may disclose data where the law requires it, or to a successor in a merger or acquisition, with notice.

5. Transfers Outside the European Economic Area

Our Portal and its database run in Frankfurt, Germany. Some providers are established in the United States or may access data from there. Each such transfer relies on an adequacy decision, including the EU-U.S. Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses. The list in section 4 names the safeguard for each provider, and we send a copy on request.

6. How Long We Keep It

Account, company and device data: while the account is open, and for a limited period after it closes to handle remaining requests and claims.
Billing records and invoices: for the period accounting and tax law require.
Acceptance records: while the contract lasts, and afterwards for the limitation period of claims under it.
Technical data and logs: for a short operational period, for security and troubleshooting.
Business contact data: while we are in touch, and until the person objects.

7. Your Rights

You may ask us to give you access to your data, to correct it, to erase it, to restrict its use, and to receive the data you gave us in a portable format. You may object at any time to processing based on our legitimate interest, including business-to-business messages. Where processing relies on your consent, you may withdraw it at any time, without affecting what was done before. Write to the address in section 1.

You may also complain to a supervisory authority: in Italy, the Garante per la protezione dei dati personali; in Romania, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal.

8. Security

We protect personal data with measures suited to the risk, including encryption in transit, hashed passwords, optional two-factor authentication, access limited to the people who need it, and a primary database in the European Union.

9. Google and Microsoft Account Data in Connected Apps

A person can connect a Google account (such as Gmail, Google Drive, Google Calendar or Google Contacts) or a Microsoft 365 account (such as Outlook, OneDrive, Teams or SharePoint) so that the Agents of their company can use it, after approving the access on Google's or Microsoft's own consent page. We explain the feature at nadicode.ai/en/apps.

What is accessed. Only what an action the person asked an Agent to perform needs, within the permissions approved on the consent page, and the name, email address and identifier that show which account is connected.
Purpose. Only to carry out the actions the person asks an Agent to perform, such as reading and sending email, finding or updating a file, or creating a calendar event.
No storage of content. Each action passes through the Portal, which checks that the Agent may take it, and does not keep the email, file, event or message content the action carries. We record who ran which action, in which app, when, and with what outcome. Our app-connection provider holds the connection's access tokens for us.
Use by AI models. When an action's content is needed for the work the person asked for, it is sent to the AI model the Agent uses, only to produce that answer. On request, we send it only to model providers that keep no data from the requests they answer (zero data retention).
No advertising, no sale, no model training. We do not sell this data, use it for advertising, or use it to develop, improve or train AI or machine-learning models.
No transfer. We transfer this data only as needed to provide the feature the person asked for, to comply with the law, or as part of a merger, acquisition or sale of assets with notice.
No human access. Nobody at nadicode reads this data, except with the person's agreement for specific content, where needed for security, to comply with the law, or once it has been aggregated and anonymised.
Google Limited Use. Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We apply the same commitments to data received from Microsoft.
Revoking access. A connection can be removed at any time in the Portal, or from the Google account's third-party connections page (https://myaccount.google.com/connections) or Microsoft's app permissions. Agents then stop using the account. Removing a connection does not delete what an Agent already wrote into the person's own apps at their request.

10. Children

Our services are for businesses and are not directed at anyone under 18.

11. Changes

We update this policy when our processing changes, and tell account holders about material changes through the Portal or by email. The version date at the top shows when this policy took effect.