Privacy policy
Last updated: 3 October 2026
This page explains which personal data we process when you visit ninonai.com, contact us or use the Ninon service, why we process it, how long we keep it and how to exercise your rights.
Who is responsible for your data?
The ninonai.com website and the Ninon service are published by Ninon, a company in the process of incorporation, represented by its founder, Elom Essan. Ninon is the controller of the processing described on this page.
For any question about your data or to exercise your rights, write to privacy@ninonai.com.
Who this policy applies to
- visitors to the ninonai.com website;
- prospects who contact us, request a Pilot or download a template;
- users of the Ninon service (accounts created for a customer organisation).
Accounting data a customer imports into its Ninon workspace (general-ledger lines, entity names, descriptions) is processed on behalf of that customer, who remains the controller. Ninon then acts as a processor, under the contract and data processing agreement (DPA) signed with the customer.
Data processed, purposes and retention
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact and Pilot requests, template downloads | Name, work email, company, number of entities, target close period, message | Answer your request, send you the template, follow up about Ninon | Legitimate interest (B2B prospecting) | 3 years from the last contact |
| User account | Email, name, role, organisation, SSO sign-in history | Provide the service, manage access and security | Performance of the contract | Contract term, then at most 3 months before deletion |
| Billing | Billing identity and details, payment history | Invoice and meet our accounting obligations | Legal obligation | 10 years (accounting obligations) |
| Product usage measurement | Organisation identifier, email, role, pages and actions in the application | Understand how the product is used and improve it | Legitimate interest | 25 months at most |
| Security and abuse prevention | IP address, email entered during a sign-in attempt | Limit abusive attempts (sign-in, forms) | Legitimate interest | A few hours at most after the end of the control window |
We do not collect sensitive data and we neither sell nor rent your data.
Customer data and artificial intelligence
To propose matches, Ninon sends extracts of the data imported by the customer (descriptions, amounts, references, entity names) to artificial intelligence providers: Anthropic, for explained match proposals, and OpenAI, for computing similarity between descriptions.
- This data is used only to provide the service to the customer concerned.
- It is not used to train artificial intelligence models, either by Ninon or by these providers, whose API terms exclude this use.
- AI proposals are always subject to approval by a user: no decision producing legal effects concerning a person is made by automated means.
Who receives your data
Your data is accessible only to the people at Ninon who need it, and to the following technical providers acting on our behalf:
| Provider | Role | Location |
|---|---|---|
| Vercel | Hosting of the website and application, storage of imported files | United States |
| Prisma (Prisma Postgres) | Database | European Union |
| Resend | Email delivery (sign-in links, notifications) | United States |
| Stripe | Payment and billing | European Union and United States |
| PostHog | Product usage measurement | European Union |
| Inngest | Background job execution | United States |
| Anthropic | AI match proposals | United States |
| OpenAI | Similarity between descriptions | United States |
ERP connectors (Microsoft Dynamics 365 Business Central, NetSuite, Xero, SAP, Sage Intacct) are used only if the customer activates them; data exchanged is then also subject to the terms of the vendor concerned.
Transfers outside the European Union
Some providers are based in the United States. These transfers are governed by the standard contractual clauses adopted by the European Commission and, where applicable, by the EU–US Data Privacy Framework to which the provider adheres.
Security
- encrypted connections (HTTPS);
- data isolated per organisation and role-based access control;
- encryption of ERP connection credentials;
- sign-in by secure link or enterprise SSO.
Your rights
You have the right to access, rectify, erase, restrict and port your data, and the right to object, in particular to prospecting, which you can exercise at any time without giving a reason. You can also set instructions on what happens to your data after your death.
To exercise these rights, write to privacy@ninonai.com. We reply within one month. If you use Ninon through your employer, some requests about customer workspace data may be passed on to it, as it is the controller of that data.
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country of residence.
Changes to this policy
We may update this policy, in particular when the company is incorporated or when we add a provider. The last update date is shown at the top of the page.