Privacy
How NLDONA handles data today.
Plain-language product facts for buyers and users — aligned with Security and Pricing. No invented retention schedules, certifications, or company identity.
What this notice covers
This notice covers NLDONA’s public website, public demo, account signup/authentication, and product privacy capabilities that are live today.
It does not invent jurisdiction-specific legal conclusions or claim GDPR/SOC 2/ISO certification badges.
Data categories we process in the product
Account data: email and authentication state used to create and secure a NLDONA account.
Business data: company profile, settings, services, locations, Knowledge and Agent configuration under the tenant’s business authority.
Customer / contact context: contact details and conversational context used to operate the business front desk — not clinical or identity verification.
Interactions: conversation metadata and outcomes used to run and govern AI-assisted work.
Usage and billing references: plan/subscription and usage quantities/timestamps for commercial metering — not a transcript archive and not provider-cost disclosure.
Security data: session and security/audit events needed to protect accounts and tenants.
Voice
NLDONA’s public demo may use short-lived voice credentials and stores demo conversation turns within demo TTL limits — not as a durable public call-recording product.
This page does not claim a fixed Production call-recording rule either way. A general Production voice-recording retention schedule is not published here.
Website demo data
The public demo starts from your business website intake, keeps demo state isolated from Production mutation, and uses time-limited sessions and share tokens.
Typical technical TTLs in current implementation include approximately 24 hours for demo intake/session and share links, approximately 30 minutes for demo agent/runtime and recipient sessions, and short-lived voice credentials. Demo data is not permanent and is not claimed as immediately wiped at first click.
Knowledge and integrations
Knowledge covers business-approved content such as uploads or selected connected sources (for example selected Google Drive material) under tenant access control.
Integrations such as Google Calendar, Microsoft Calendar, Gmail, and Google Drive use OAuth credentials and selected identifiers/events/content needed for the configured workflows — not a claim that all provider data is copied or made public.
Infrastructure providers
NLDONA uses infrastructure providers (for example AI inference, telephony, email, hosting, and billing execution partners) to operate the product.
This page does not claim residency-limited processing, provider non-retention slogans, or absolute model-training prohibitions. Absolute AI-training and residency slogans are omitted until contractually and legally verified for publication.
Security alignment
Tenant boundaries, authentication, MFA, sessions, governed actions, and auditability are described on the Security & Trust page. Privacy wording here is intended to stay consistent with that page.
Retention
Privacy export download artifacts are time-limited (approximately 24 hours in current product configuration).
Demo-related artifacts follow the demo TTLs described above.
A general customer/tenant retention-policy product and legal hold are not claimed as live capabilities. This page does not invent 30/90/365-day schedules for those categories.
Export and erasure
Authorised operators can request organisation and customer data exports. Artifacts are access-controlled, time-limited, and encrypted for download. This is not an unrestricted ‘export everything instantly’ button for every dataset.
Customer erasure follows a governed prepare-and-confirm workflow that de-identifies customer records according to product rules — not an instant wipe of every remnant everywhere.
Organisation or full account erasure is not claimed as a live capability. Provider cleanup frameworks and legal hold are not claimed as live.
Rights and contact
Statutory data-subject rights, response deadlines, DPO appointment, and supervisory authority wording are not published as final legal conclusions on this page.
A verified public privacy mailbox is not published here. Use the product or account channels available when you have a NLDONA account, and check this page for future updates.
Updates
When NLDONA publishes a counsel-approved Privacy Policy, this notice will be replaced or superseded. Until then, treat Security, Pricing, and this page as product-truth surfaces — not finished legal instruments.