Version française

Privacy Policy — MyAiCompany

Version 1.0, in force since 25 September 2026. MyAiCompany is a service of NINABOT Sàrl, Geneva.

This is a translation of the French text; in case of divergence, the French text prevails.

1. Who processes your data

NINABOT Sàrl, Chemin de Riantbosson 19, 1217 Meyrin (Geneva), Switzerland — company number CHE-287.575.522. Questions and requests: [email protected]. We answer within 30 days.

The platform is operated and hosted in Switzerland, and the AI models it uses are served in Switzerland.

2. What we process, and why

• Your account: name, address, date of birth, e-mail, phone, business number if you have one. Needed to open your company, register a domain in your name and issue your invoices.
• Your company's content: your customers, products, orders, invoices, documents, website copy. This data is yours; we process it for you, on your instruction.
• Your payments: handled by our payment provider. We never see or store your card number — only that a payment succeeded, its amount and its date.
• Mail sent and received by your company through the platform, to deliver it and let you read it back.
• Conversations with the assistant: the question, the answer, and a fingerprint of the IP address (never the address itself) to limit abuse.
• Your site's traffic: we count page views, not people. No IP address, no user agent, no referrer, no cookie, no tracker. You will not know *who* visits you — and neither will we.
• Technical logs (errors, response times), kept 30 days at most.
• Visits to our own landing page, measured without cookies, with no tracking across sites.

3. What we do not do

• We do not sell or rent any data.
• We do not use your data to train AI models, ours or anyone else's.
• We set no advertising trackers.
• We do not read your company's content, unless you ask us to in order to help, or the law requires it.

4. Artificial intelligence

When an agent works for you, the text the task requires (your catalogue for a quote, say) is sent to the model that writes. Those transfers are limited to what the task needs, served by an inference provider in Switzerland, and are not used to train any model. Nothing is sent, published or bought without your explicit approval.

5. Sub-processors

We rely on providers, each for one precise function. Naming them is deliberate: a policy that hides them tells you nothing.

• Hosting: Exoscale (Akenes SA), Geneva data centre, Switzerland.
• Inference (AI models): Infomaniak Network SA, Switzerland.
• Payments: Stripe (Ireland / United States).
• Transactional mail: Resend (United States).
• Network and protection: Cloudflare (United States) — to serve pages and filter abuse.
• Domain names: Gandi SAS (France) or Infomaniak, depending on the extension, when you register a domain.

Your company's data (customers, products, invoices, documents) stays in Switzerland. Transfers to providers outside Switzerland are limited to what their function requires — an e-mail address to deliver a message, an amount to collect a payment — and are covered by those providers' standard contractual clauses.

6. Retention

• Account and company data: as long as the account exists.
• After closure: 30 days, long enough to change your mind, then permanent deletion.
• Invoices and accounting records: 10 years, because Swiss law requires it.
• Assistant conversations: 12 months.
• Technical logs: 30 days.

7. Your rights

At any time you may request access to your data, its correction, its deletion, a copy in a machine-readable format, or object to a processing. Write to [email protected].

Two things we make possible without your even having to ask: the domain is registered in your name and you leave with it, and your site's code lives in a git repository that is yours, downloadable at any time. Leaving the platform is not a negotiation.

If our answer does not satisfy you, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), Bern.

8. Cookies

We set a session cookie when you sign in to your deck: it keeps you signed in, nothing else. No advertising cookies, no cross-site tracking cookies. Our audience measurement works without cookies.

9. Security, and what happens if things go wrong

Access is encrypted in transit, passwords are never stored in clear text, and access to production data is limited to the people who operate the platform. In case of a data breach likely to create a high risk for you, we notify you and we report the incident to the FDPIC, within the legal deadlines.

10. Minors

The platform is also meant for young people. If you are under 16, a parent or legal guardian must agree, and that person is the holder of the account and of the domain.

11. Changes

Any change to this text is published on this page with a new date of entry into force. A significant change is announced to you by e-mail.