BROUILLON — à faire valider par un professionnel du droit avant publication (DRAFT — to be reviewed by a legal professional before publication.)
Version 1.0, effective [TO COMPLETE: publication date].
NeverNo is designed to collect as little data as possible. This policy explains what personal data we process, why, on what legal basis, for how long, with whom, and how to exercise your rights, under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Controller
[TO COMPLETE: first and last name], sole trader (entrepreneur individuel, EI), [TO COMPLETE: postal or registered address], SIREN [TO COMPLETE: SIREN number].
Contact for any question about your data: [TO COMPLETE: privacy email address].
We have not appointed a data protection officer, as this is not mandatory for our activity.
2. Zero-Log: what we do not keep
- Your conversations, prompts, files, characters, memory and creations are stored in your browser, encrypted locally (IndexedDB). They are not stored in readable form on our servers.
- Sync between devices (offered at sign-up, can be turned off in Settings): your browser encrypts a copy of this data before sending it; our servers (Supabase database) keep only that encrypted copy, which we cannot read. Only your approved devices, your passkey or your recovery key open it. Media (images, videos, sounds, files): until media sync is open on the Service, they stay only in the browser where they were created; once it is open, they are encrypted the same way and stored at Cloudflare R2, unless you turn off the device's "Media" switch. We see the number, date and size of synced items, never their content; that size is rounded (to a multiple of 256 bytes for an item, of 64 KB for a media file), which reveals an order of magnitude. When a device opens a media file synced by another one, our server knows at that moment which approved device asks for it and when (it signs the download link); we do not write this into our database, but the call appears in the technical logs (§ 3) and Cloudflare sees the download.
- To produce a response, your request passes through our servers to the provider of the selected model for the duration of processing, without being stored or logged by us. What the provider keeps is up to the provider: see section 5.
- Exception, Missions (agents that work while you are away): so that they can run without you, a mission's instructions, its agent's sheet and the access to services you connect (for example Google, Notion, Slack or GitHub) are kept on our servers, encrypted with a key that only our server holds: our server can therefore read them to do the work. A recurring watch also keeps the key facts of its last report (20 at most), encrypted the same way, to tell you what changed next time. The delivered result is encrypted for your devices and erased from our servers as soon as it is received, after 30 days at most.
- The encrypted backups and shares you choose to create are encrypted in your browser. We store data we cannot read; the key stays with you or in the link you share.
- We do not sell your data and do not use it to train models.
Because this data stays on your device, you control it: you can export or erase it at any time from the Service or from your browser settings.
3. Data processed, purposes, legal bases and retention
| Data | Why | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Account: email address, identifier, creation and last sign-in dates, plan and renewal date, content filter setting, date of the age declaration (18 or over) | Create and manage your Account, apply your plan's rights | Performance of the contract (b) | Lifetime of the Account, then deletion. Inactive free Account: a free Account with no activity at all (sign-in, open session, API key) for 3 years receives a notice email, then is deleted 30 days later if it still has not been used, through the same steps as "Delete my account". Signing in during that period cancels the deletion. A paying Account, one with an offered plan, one with credits left or one under suspension is never deleted this way |
| Profile appearance: avatar (a seed of at most 64 characters it is drawn from, never a photo) and accent color | Show your interface the same way on each of your devices | Performance of the contract (b) | Lifetime of the Account |
| Sign-in codes sent by email | Authenticate you | Performance of the contract (b) | A few minutes, until they expire |
| Account safety: violation counter, suspension status | Enforce the rules and prevent a new Account after an exclusion | Legitimate interest (f): protecting the Service and its users | Lifetime of the Account; after an exclusion, [TO COMPLETE: duration, for example 3 years] after closure |
| Quotas: type of action (message, image, etc.), date and time, linked to your Account identifier, your trial identifier or a fingerprint of your IP address | Apply daily limits, prevent abuse | Performance of the contract (b) and legitimate interest (f) | Linked to your Account: 31 days, to show your usage day by day on your subscription page; linked to a trial identifier or an IP address fingerprint: 48 hours. Erased automatically every hour past that. These are counters, with no content; limits still apply over a rolling 24 hours (7 days for the Confessional) |
| Cost of included usage: an amount in dollars, a kind (chat, image, edit, tool, voice, memory), the date and time, linked to the same identifier as quotas, with no content | Apply each plan's daily cost ceiling | Performance of the contract (b) and legitimate interest (f): keeping the Service's costs under control | Account: 35 days, erased automatically every hour after that. Trial identifier or IP address fingerprint: 48 hours |
| Trial without an account: signed random trial identifier (cookie), IP address fingerprint, signals sent to Cloudflare Turnstile | Tell humans from bots, apply trial limits | Legitimate interest (f): preventing abuse | Cookie: 12 months. The IP address is never stored in clear: only an irreversible fingerprint, computed with a secret key, is used |
Payments and credits: Stripe customer identifier, subscription status, auto top-up (threshold, amount, card identifier at Stripe), gift codes redeemed, identifiers of Stripe events already processed, credit balance and lots, each credit spend with its amount, date and a reason naming the feature or the model paid for (for example chat:claude-opus-5.5, confessional, debate:contract), so this log shows on which dates you paid for a Confessional session, with nothing of what was said in it, invoices (amount, date, currency, country for VAT) | Bill you, manage the subscription and credits, keep accounts | Performance of the contract (b); legal obligation (c) for invoices | Lifetime of the Account; accounting records: 10 years (article L123-22 of the French Commercial Code) |
| Orders paid in crypto (CoinGate): order identifier, plan and length, price, payment status, payment date, country of residence you declare, country of your connection (derived from your IP address by our host; the IP address itself is not kept) and, when they differ, your confirmation of the declared country, VAT country and rate applied, price before VAT and VAT, fingerprint of the token that authenticates CoinGate's notices, and the payment amounts and currencies CoinGate confirms to us (never your wallet address nor the transaction) | Collect the payment, give you the plan, send you the confirmation and the receipt, apply and declare the VAT of the right country | Performance of the contract (b); legal obligation (c) for VAT and accounting | Paid order: 10 years from the payment date (accounting records, article L123-22 of the French Commercial Code; VAT evidence, Implementing Regulation (EU) 282/2011), including after the Account is deleted (GDPR article 17.3.b). When the Account is deleted, the order is no longer linked to it and we erase the token fingerprint, the payment link, and the crypto currency and amount paid; what remains is the plan, the price, the dates, the status, CoinGate's order identifier, the amounts settled in dollars and euros, the countries and the VAT, plus the record that the confirmation and receipt were sent and of your waiver of the right of withdrawal. Order never paid: lifetime of the Account |
| AI requests: content of your messages, files and prompts, during processing | Produce the requested response or creation, apply automatic safety filters | Performance of the contract (b) | Not kept by us (see § 2). Model providers apply their own retention (§ 5) |
| Long creations (video, music, sound effects): model, status, dates and reserved credits, with no prompt or file | Follow the generation and bill it only once | Performance of the contract (b) | Lifetime of the Account |
| Encrypted backup: a file encrypted in your browser with your passphrase (unreadable to us), its size and date | Let you recover your data on another device | Performance of the contract (b) | Until you delete or replace it, or until the Account is deleted |
| Encrypted shares: the encrypted content (unreadable to us, the key is in the link), its size, creation and expiry dates, the Account that created it | Let the person who has the link read it | Performance of the contract (b) | Until the chosen expiry (1, 7 or 30 days) or your deletion, then erased within the hour |
| API keys: name, first 12 characters and SHA-256 fingerprint of the key (never the key itself), last-used and revocation dates | Recognize your API calls | Performance of the contract (b) | Lifetime of the Account |
| Feedback on answers: counters per day, model, vote and reason, with no Account, identifier or text | Improve the automatic choice of model | Legitimate interest (f) | No time limit: these counters cannot identify you |
| Administration log: each action of an administrator on an Account (identifier of the Account concerned while it exists, action, details such as a credit amount or a reason, date) and some automatic actions (a subscription that reached its end, an order paid in crypto with the declared country and the country of the connection, a sync reset, the purge of an inactive account) | Oversight of administrative actions, security, evidence in case of dispute | Legitimate interest (f) | Kept after the Account is deleted, without its identifier, currently with no time limit [TO COMPLETE: set a maximum period] |
| Transactional emails: email address, message content (code, invoice, alert) | Send you Service-related messages | Performance of the contract (b) | At our provider, the sending log is kept as long as our Resend account exists (Resend erases data at the latest 90 days after the account ends) [TO CHECK: log retention adjustable in Resend] |
| Support exchanges: email address, content of your messages | Answer your requests | Performance of the contract (b) or legitimate interest (f) | 3 years after the last exchange |
| Content reports (DSA): name and email of the reporter, reported content, decision | Handle reports and appeals | Legal obligation (c) | 1 year after the decision |
| Encrypted sync: for each item, an opaque identifier, its version, its rounded size (256 bytes; 64 KB for a media file, with its number of chunks and the device that sent it) and its date, the encrypted content (unreadable to us); your data key wrapped by your recovery key, your passkeys and your approved devices; the list of your devices | Bring your data to your devices | Performance of the contract (b) | Until the item is deleted, sync is turned off or the Account is deleted |
| Missions and connectors: schedule, budget and state of each mission (in clear); instructions, agent sheet, feedback, a watch's key facts from its last report and access to connected services (encrypted with the server key, readable by it); result encrypted for your devices | Run missions while you are away, with the tools you connected | Performance of the contract (b) | As long as the mission or connector exists; result: until received, 30 days at most |
| Notifications: your browser's push subscription address (provided by Google, Apple or Mozilla depending on the browser), language; for spontaneous messages from a companion, a schedule without any word of conversation | Notify you (mission finished, companion) if you allowed it | Consent (a), given in the browser | Until you withdraw permission or delete the Account |
| Sessions and devices: open sign-in sessions, managed by Supabase, which keeps for each one the IP address it was opened from and the browser's full name (its user agent) and keeps a log of sign-ins; browser and system name of each browser already seen on the Account, dates it was first and last seen, date of the alert email | Let you see and end your sessions, warn you of a new sign-in | Legitimate interest (f): account security | Duration of the session; browsers already seen: lifetime of the Account (30 at most) |
| Trials of paid features: counters per Account and per IP address fingerprint, per feature and per month (or once only for trials given a single time) | Enforce the trial limit | Legitimate interest (f): abuse prevention | IP address fingerprint: the current month, erased on the first night of the next one. Account: monthly counters kept 3 months at most; trials given a single time (Confessional, video, agents, missions…): as long as the Account exists; everything is erased with the Account |
| Technical logs: IP address, date, page or route called, browser, response code (no request content) | Security, troubleshooting, attack prevention | Legitimate interest (f) | At Vercel: 1 day on the Pro plan (30 days with the Observability Plus option) [TO CHECK: plan finally chosen] |
| Product statistics, without content (in-house tool, no cookie, no third-party tracker): event names from a closed list (page viewed, message sent, image created, feature used, payment started…), page template without identifiers, referring site's domain, campaign tags (utm), country (from the host's header), device type, language, and a daily fingerprint (a keyed hash of the IP address, browser and site whose random key is erased every night at midnight UTC: the IP address and browser are not kept, and a visit cannot be linked to the next day's). For an Account, in addition: events are linked to its identifier, with its sign-up day, the origin of its first visit, the date of its first payment and the total it paid and cost. Never the content of your messages, prompts, files, titles or searches | Know what to improve; measure sign-ups, retention, conversion and margin per acquisition channel | Legitimate interest (f): improving and funding the Service; you can object at any time ("Share anonymous statistics" switch in Settings, or your browser's Global Privacy Control / Do Not Track signal): the visit is still counted with no fingerprint and no link to your Account, and the part linked to your Account is erased. [TO VALIDATE: is legitimate interest enough for the Account-linked part, or is consent needed for European users?] | Raw events: 90 days, then only anonymous daily totals are kept; fingerprint key: until midnight (UTC) the same day; Account-linked part: until you object or delete the Account |
| Responses to authorities | Answer court or administrative orders | Legal obligation (c) | As required by the procedure |
We can only give authorities what we hold and can read: the data listed above (Account, payments and credits, quotas, usage costs, API keys, administration log), never your conversations or creations (Missions instructions and connector access, which our server must be able to read to run them, are the only exception), which we do not keep in readable form. Encrypted backups and shares are unreadable to us: we do not have the key.
Account deletion. "Delete my account", in Settings, cancels the subscription, deletes the Stripe customer and its cards, then the backup, the synced copy, the shares, the API keys, the quotas (trial counters included), the usage costs, the credits and finally the Account. The authorizations given to Google, Notion, Slack or GitHub are revoked at their end; if one of them does not answer, our copy of the access is erased all the same and you can remove the authorization from your account there. What remains: the anonymous feedback counters; the administration log, without the Account's identifier; the accounting records the law requires us to keep (invoices, orders paid in crypto, detached from you; see the table above); product statistics, detached from the Account, for up to 90 days; counters tied to the fingerprint of an IP address, which erase themselves (48 hours, or at the end of the month for trials). Outside our database: the sending log of our emails at Resend, Supabase's technical backups for as long as they are kept, and the invoices Stripe keeps on its side.
3a. Sensitive data
You may share with the Service, in particular with the Confessional and memory, information about your health, your opinions, your intimate life or other so-called "sensitive" data (Article 9 GDPR). We do not ask for it and do not keep it in readable form. When you write or say it, it is processed only to answer you, at your express request: by using these features to talk about it, you explicitly consent (Article 9(2)(a) GDPR), and you can stop at any time. It reaches the provider of the model used (section 5), without your identity. [TO VALIDATE: form of explicit consent, a checkbox at first use of the Confessional is recommended; data protection impact assessment (DPIA) being drafted.]
4. Automated decisions
Automatic filters analyze requests while they are processed in order to block content prohibited by the Acceptable Use Policy (in particular any sexual content involving minors). A block may increase the Account's violation counter. A suspension or closure of an Account is never final without the possibility of review by a person: you can request this review at hello@neverno.ai.
5. Recipients and processors
Your data is accessible only to the operator, with two-factor authentication, and to the providers below, each for its own task.
| Provider | Task | Data concerned | Location | Safeguard for transfers outside the EU |
|---|---|---|---|---|
| Supabase Pte. Ltd (Singapore) | Database, authentication | Account, plan, quotas, usage costs, credits, API keys, administration log, encrypted backups, shares and synced copies, Missions | European Union (Ireland) | European Commission Standard Contractual Clauses (SCCs) |
| Vercel Inc. | Website hosting, request execution, technical logs | Technical logs; requests in transit | United States and global network; functions in the region of our database [TO COMPLETE: region to set on Vercel, Ireland dub1; until it is set, Vercel runs functions in the United States (Washington)] | EU-US Data Privacy Framework and/or SCCs |
| Stripe Payments Europe Ltd | Payment, invoicing, fraud prevention | Payment identity, card data, invoices | Ireland; transfers to Stripe Inc. (United States) | SCCs and/or Data Privacy Framework. Stripe also acts as a separate controller for its financial obligations and fraud prevention |
| UAB "Decentralized" (CoinGate), Lithuania | Crypto payment | From us: order identifier, price, plan name, return addresses (neither your email nor your name); on its own payment page, CoinGate collects your wallet address, your IP address and, above certain amounts, identity information | European Union (Lithuania) | Not applicable (EU). CoinGate also acts as a separate controller for its anti-money-laundering obligations and keeps that data under its own policy |
| Cloudflare Inc. | Anti-bot check (Turnstile); storage of synced media, encrypted in your browser (R2), only once media sync is open on the Service; until then, media stay in your browser | IP address, technical browser signals; encrypted files unreadable to Cloudflare and to us | Turnstile: United States and global network; R2: European Union (bucket created in the EU jurisdiction) [TO CHECK when the bucket is created] | Data Privacy Framework and/or SCCs. For Turnstile, Cloudflare also uses these signals to improve its own bot detection, as a separate controller |
| Resend (Plus Five Five, Inc.) | Sending emails | Email address, content of transactional emails | United States | Data Privacy Framework and SCCs |
| DeepInfra Inc. | Open text models, voice transcription, read-aloud voice, indexing of memory and the Vault | Request content, without your identity | United States | Processing agreement included in its terms [TO CHECK: transfer mechanism, SCCs] |
| Groq, Inc. | Voice transcription (Confessional and dictation); DeepInfra takes over when Groq does not answer | Recording of what you said, without your identity; nothing is kept at Groq ("Zero Data Retention" turned on for our account) or by us | United States | SCCs (processing agreement included in its terms) |
| OpenRouter, Inc. | Access to third-party models, including the "anonymized" models of Anthropic, OpenAI, Google and xAI, and to some of the open models; built-in web search of GPT 6.1 Sol (OpenAI, through OpenRouter, on Microsoft Azure, zero retention requested) for the premium writer of deep research | Request content, without your identity. OpenRouter screens every request, zero retention included, for child abuse material, and may keep a flagged request to review it and report it to the authorities | United States | SCCs (processing agreement included in its terms) |
| Model hosts behind OpenRouter, chosen by us from a closed list | Run the chosen model: Google Cloud (Vertex AI) and Amazon Web Services (Bedrock) for Claude and Gemini; Microsoft (Azure) for GPT; xAI for Grok; Anthropic and OpenAI for the two models without a zero-retention route (see below); DeepInfra, Parasail, Wafer, DigitalOcean and Venice for open models | Request content, without your identity | Mostly the United States; the European Union for some calls | Sub-processors covered by OpenRouter's agreement (SCCs) |
| Runware Ltd (London) | Image generation and editing | Request content, uploaded images, without your identity | United Kingdom; servers in the United States, Germany and Romania | [TO COMPLETE: DPA requested from Runware; the United Kingdom benefits from an adequacy decision, the United States do not] |
| ElevenLabs (Eleven Labs Inc.) | Confessional voices, voices created from a description, and read-aloud of replies on the Pro+ and Max plans | Text of the reply read aloud (Pro+ and Max), without your email address or your Account; text to read, voice description, without your email address or your Account; email addresses, numbers, postal addresses and IBANs are masked, but the first names and names you mention may be spoken | United States | Data Privacy Framework and SCCs (according to ElevenLabs) |
| Inworld AI | Read-aloud voice (when enabled) | Text to read, without your identity | United States | SCCs (processing agreement included in its terms) |
| Exa Labs, Inc. | Quick web search of the chat and the API (default engine) | Search text: a short query drawn from your message, without your identity or IP address; items your browser masked are never in it. Depending on their subject, some searches are never sent to Exa and go through Serper and Jina. Exa may keep these queries: its terms grant it a license to the queries and their results to provide, develop and improve its services, and its privacy policy says it uses them to train its models. No zero-retention option is subscribed on our account | United States | [TO COMPLETE: read Exa's data processing agreement (DPA); SCCs] |
| Serper | Web search (Google results): the other searches, and the quick search when Exa fails, times out or finds nothing | Search text, without your identity or IP address | [TO COMPLETE: country] | [TO COMPLETE: safeguard] |
| Jina AI GmbH (Elastic group) | Reading web pages found or pasted | Page address, without your identity or IP address | Germany | Not applicable (EU) |
| Internet Archive | Archived copy of an original page that has become unreadable, in a deep research | Page address, without your identity or IP address | United States [TO CHECK] | [TO COMPLETE: safeguard] |
| arXiv, OpenAlex, SEC EDGAR | Open databases queried when a deep research runs on "all sources" | Queries written from your question, without your identity or IP address | United States [TO CHECK] | [TO COMPLETE: safeguard] |
Higgsfield has no longer been a subprocessor since 9 November 2026: the only model served there (Soul 2) was withdrawn and its requests are now served by Runware. Higgsfield receives no request any more. Its terms allowed training on our requests and images during the period it was used; long creations started there before that date are no longer followed.
Services you connect yourself. If you link a Mission or the Workshop to Google, Notion, Slack or GitHub, those services receive the requests the agent makes on your behalf and apply their own privacy policies; you can remove access at any time. The agent mode's weather tool queries MET Norway and OpenStreetMap with the name of the place asked for only.
[TO COMPLETE before publication: final list of providers used at launch (Cartesia or xAI for voice, Featherless, Brave for search are not used today); signature or acceptance of each data processing agreement (DPA); check of Data Privacy Framework certification on dataprivacyframework.gov.]
Model providers and how long they keep requests. We do not send them your email address or your Account identifier. They receive the content of your request: if you include personal data (yours or someone else's), it reaches them. Models labeled "private" go through routes without retention: DeepInfra (no-retention commitment in its terms) or OpenRouter with its zero-retention option, to the hosts of the list above only. Models labeled "anonymized" are served by the following hosts, which receive the request without your identity; according to their terms and OpenRouter's list of zero-retention routes, read in November 2026:
| Model and host | What it may keep |
|---|---|
| Claude Opus, Sonnet and Haiku (including the Confessional): Google Cloud (Vertex AI) or Amazon Web Services (Bedrock), never Anthropic | Nothing: zero retention |
| Claude Fable: Anthropic, Google Cloud, Amazon Web Services or Microsoft Azure depending on availability (no zero-retention route exists for this model) | At Anthropic, up to 30 days, longer (up to 2 years) for a request flagged by its safety checks; at the others, under their abuse-monitoring policy [TO CHECK] |
| GPT 6.1 Sol and GPT 6 Astra: Microsoft (Azure) | Nothing: zero retention |
| GPT 6.1 Terra: OpenAI, Microsoft (Azure) or Amazon Web Services depending on availability (zero retention is not required for this model) | At OpenAI, up to 30 days, for abuse detection; at the others, under their abuse-monitoring policy [TO CHECK] |
| Gemini: Google Cloud (Vertex AI) | Nothing by default; Google may keep a request flagged by its safety filters for up to 90 days, for abuse monitoring, without using it to train its models |
| Grok (including when it takes over from a private model): xAI | Nothing: zero retention |
| ElevenLabs (voice) | Keeps each generation (Confessional voices and read-aloud) in our account's history: we delete it a few seconds after it is spoken, and anything left after 10 minutes is swept every 5 minutes; what ElevenLabs keeps for its own abuse monitoring follows its policy [TO CHECK: zero-retention mode obtained or not] |
None of them uses these requests to train its models, according to their API terms; every call through OpenRouter also refuses any collection for training.
Masking before an "anonymized" model. Before sending, your email addresses, phone numbers, postal addresses, IBANs, card numbers, IP addresses and the names you listed in Settings are replaced by tokens. This masking is not perfect: in our tests (cases written by someone other than the person who tuned the detectors), it hid 72% of postal addresses, 94% of phone numbers and 100% of IBANs. The rest of the text is not masked. The details are on the Service's Transparency page.
6. Cookies
Cookies and other trackers are described in the Cookie Policy.
7. Security
- Encrypted connections (HTTPS) and local encryption of your history in the browser.
- End-to-end encrypted backups and shares: we do not hold the key.
- We never keep an IP address in clear in our own tables: it is replaced there by a fingerprint computed with a secret key. Supabase, which handles sign-in, keeps the IP address and the browser name of each open session.
- Database partitioned per user (row-level access rules); every quota and payment decision is made on the server.
- Administrative access reserved to the operator, with two-factor authentication.
If a data breach puts you at risk, we notify the CNIL (French data protection authority) and, where required, inform you.
8. Your rights
You have the following rights:
- access to your data and portability (a copy in a machine-readable format);
- rectification of inaccurate data;
- erasure (you can also delete your Account from Settings);
- restriction of processing;
- objection to processing based on legitimate interest;
- withdrawal of consent at any time, without affecting past processing;
- objection to product statistics in one tap, with the "Share anonymous statistics" switch in Settings (or your browser's Global Privacy Control / Do Not Track signal);
- instructions on what happens to your data after your death (article 85 of the French Data Protection Act).
To exercise them, write to [TO COMPLETE: privacy email address] from your Account's address. We reply within one month, which may be extended by two months for a complex request. We may ask you to confirm your identity.
We cannot access the data stored in your browser: you export or erase it yourself.
You can lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr) or with the data protection authority of your country of residence.
9. Minimum age
The Service is reserved for people aged 18 or over, who declare it when creating their Account [TO COMPLETE: age verification, once in place]. We do not knowingly collect data from minors. If we learn that an Account belongs to a minor, we close it and delete its data.
10. Changes
We may change this policy. For any significant change, we notify you by email or in the Service before it takes effect. The version date is shown at the top of the page.