Version française

Privacy Policy — MyAiCompany

Version 1.3, in force since 10 October 2026 (1.2: 8 October 2026; 1.1: 30 September 2026; 1.0: 25 September 2026). MyAiCompany is a service of NINABOT Sàrl, Geneva.

This is a translation of the French text; in case of divergence, the French text prevails.

1. Who processes your data

NINABOT Sàrl, Chemin de Riantbosson 19, 1217 Meyrin (Geneva), Switzerland — company number CHE-287.575.522. Questions and requests: [email protected]. We answer within 30 days.

The platform is operated and hosted in Switzerland, and your data is stored there. The AI models it uses are served in Switzerland or in the European Union (§ 4), never elsewhere.

For your account data and our landing page, NINABOT is the controller. For the data your company entrusts to the platform (your customers, leads, orders, invoices, mail, files), you are the controller: NINABOT processes it for you as a processor, under the data processing agreement.

2. What we process, and why

• Your account: name, address, date of birth, e-mail, phone, business number if you have one. Needed to open your company, register a domain in your name and issue your invoices.
• Your company's content: your customers, products, orders, invoices, documents, website copy. This data is yours; we process it for you, on your instruction.
• Your payments: handled by our payment provider. We never see or store your card number — only that a payment succeeded, its amount and its date.
• Mail sent and received by your company through the platform, to deliver it and let you read it back.
• Conversations with the assistant: the question, the answer, and a fingerprint of the IP address (never the address itself) to limit abuse.
• Your site's traffic: we count page views, not people. No IP address, no user agent, no referrer, no cookie, no tracker. You will not know *who* visits you — and neither will we.
• Technical logs (errors, response times), kept 30 days at most.
• Visits to our own landing page, measured without cookies, with no tracking across sites.
• The waiting list and invitations: your e-mail address and the idea you describe, to invite you.

On what basis (GDPR and FADP)

• Performance of the contract: your account, your company's content, payments, mail, agents.
• Legal obligation: keeping invoices and accounting records.
• Legitimate interest: security and abuse prevention (technical logs, IP fingerprint of conversations, content review), cookie-free audience measurement.
• Consent: the waiting list; you may withdraw it at any time.

3. What we do not do

• We do not sell or rent any data.
• We do not use your data to train AI models, ours or anyone else's.
• We set no advertising trackers.
• We do not read your company's content, unless you ask us to in order to help, or the law requires it.

4. Artificial intelligence

When an agent works for you, the text the task requires (your catalogue for a quote, say) is sent to the model that writes. Those transfers are limited to what the task needs, processed in Switzerland (our own servers in Geneva, Infomaniak) or in the European Union (OVHcloud, France) for the time it takes to answer, and are not used to train any model. They go through our inference router (SOKKAN Router, run by NINABOT), which refuses any provider outside Switzerland and the EU. Nothing is sent, published or bought without your explicit approval.

Automated decisions: before each publication an automatic review checks the content; doubtful content is reviewed by a person, and you can contest any refusal through Support (Terms § 8). No other decision producing legal effects for you is taken solely by automated means.

5. Sub-processors

We rely on providers, each for one precise function. Naming them is deliberate: a policy that hides them tells you nothing.

• Hosting and backups: Exoscale (Akenes SA), Geneva data centre and object storage, Switzerland; backups are encrypted.
• Inference (AI models): NINABOT's own infrastructure, Geneva, Switzerland; Infomaniak Network SA, Switzerland; OVH SAS (OVHcloud), France — European Union.
• Payments: Stripe (Ireland / United States).
• Transactional mail: Resend (United States).
• Network and protection: Cloudflare (United States) — to serve pages and filter abuse.
• Domain names: Gandi SAS (France) or Infomaniak, depending on the extension, when you register a domain.

Third-party service YOU switch on — Social networks (Postiz). If you switch on “Social” in the deck (Market → Social) and connect your accounts there, your posts, their images and access to those accounts pass through Postiz (Gitroom, a post-scheduling service) and are stored there, then by the networks concerned (Instagram, Facebook, LinkedIn…). Postiz is not a sub-processor we chose to run the platform: nothing is sent to it until you switch it on, after accepting an explicit warning. We do not control where Postiz hosts this data or how it processes it: it falls outside our Switzerland/EU hosting commitments. You can switch it off at any time; the connected account is then deleted at Postiz, scheduled posts included.

Your company's data (customers, products, invoices, documents) is stored in Switzerland. The text an AI task requires may be processed in the European Union (OVHcloud), whose level of protection the Swiss Federal Council recognises as adequate; we do not keep it there. Transfers to providers outside Switzerland are limited to what their function requires — an e-mail address to deliver a message, an amount to collect a payment — and are covered by standard contractual clauses or, where the provider is certified, by the EU–US Data Privacy Framework. Switzerland benefits from an adequacy decision of the European Commission: for a user in the European Union, hosting in Switzerland is not a transfer to a non-adequate third country.

6. Retention

• Account and company data: as long as the account exists.
• After closure: 30 days, long enough to change your mind, then permanent deletion.
• Invoices and accounting records: 10 years, because Swiss law requires it.
• Assistant conversations: 12 months.
• Technical logs: 30 days.
• Backups (encrypted, in Geneva): 90 days.
• Waiting list: until you sign up or ask for deletion.

7. Your rights

At any time you may request access to your data, its correction, its deletion, the restriction of a processing, a copy in a machine-readable format (portability), object to a processing based on our legitimate interest, or withdraw a consent. Write to [email protected].

Two things we make possible without your even having to ask: the domain is registered in your name and you leave with it, and your site's code lives in a git repository that is yours, downloadable at any time. Leaving the platform is not a negotiation.

If our answer does not satisfy you, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), Bern. If you live in the European Union or the European Economic Area, you may also contact the data protection authority of your country of residence.

8. Cookies

We set a session cookie when you sign in to your deck: it keeps you signed in, nothing else. Our audience measurement works without cookies.

Since October 2026 our public site also loads a Google Ads tag (Google Ireland Ltd) so we can tell whether our advertising campaigns bring sign-ups. Without your consent this tag sets no cookies and only sends Google signals without identifiers ("Consent Mode"). If you accept via the banner, it may set advertising cookies and send Google, in hashed form, the e-mail address entered at sign-up, to attribute that sign-up to the ad click. You can decline, or change your mind at any time by clearing the site's data in your browser; the banner then shows again. No cross-site tracking cookies otherwise.

9. Security, and what happens if things go wrong

Access is encrypted in transit, passwords are never stored in clear text, and access to production data is limited to the people who operate the platform. In case of a data breach likely to create a high risk for you, we notify you and we report the incident to the FDPIC and, for data subjects in the European Union, to the competent authority, within the legal deadlines.

10. Minors

The platform is also meant for young people. If you are under 16, a parent or legal guardian must agree, and that person is the holder of the account and of the domain.

11. Changes

Any change to this text is published on this page with a new date of entry into force. A significant change is announced to you by e-mail.