Privacy Policy

Nynth ("Nynth", "we", "us") runs the workspace platform at os.nynth.com (the "Service"). You may also see it called Maiden. This policy covers the Service, the people who use it, and the people those users invite in, such as clients using a portal.

Two roles matter. When your company creates a workspace and puts its work in it, your company decides what goes in and why. For that content we act as your processor and handle it only to run the Service. For data about you as a person, such as your sign-in and how you use the product, we decide how it is used, and this policy is our commitment about it.

• Account data: your name, email address, role and the workspaces you belong to. Sign-in runs on Supabase Auth.
• Workspace content: what you and your team add, such as projects, tasks, clients and contacts, proposals, documents, files, messages, meeting notes and comments.
• Portal data: if a workspace invites you to its client portal, we hold your email and what you do there, such as opening files, answering requests or approving a document.
• Data from connected services: see section 3.
• Technical data: IP address, browser and device type, timestamps, and a record of actions taken in a workspace (the audit log). We keep it to run the Service and keep it secure.
• Messages to us: anything you send to hello@nynth.com.

You can connect other services to a workspace. Nothing is connected until you approve it on that service's own consent screen, and you can disconnect it at any time from the integration settings in the app. Today that can include Google (Gmail and Google Calendar), Instagram through Meta, Granola and Notion.

We ask for only the access a feature needs, and we store the access tokens encrypted. What we read from a service is used to show it to you and your workspace and to power Ask, our AI assistant, for that workspace. We do not use it for advertising and we do not sell it.

Google user data. Nynth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google data only to provide the features you can see in the Service. We do not use it for advertising, we do not sell it, we do not use it to train general AI models, and no person at Nynth reads it unless you ask us to, we need to for security or to enforce the law, or it has been aggregated and anonymized.

Instagram and Facebook data. This comes to us through Meta's platform and is handled under Meta's Platform Terms. We use it to show your account's content and insights inside your workspace. You can remove our access at any time in your Instagram or Facebook settings, and you can ask us to delete what we hold (section 12).

• To run the Service: show your work, send notifications, sync connected services.
• To keep it secure and stop abuse, using the audit log and rate limits.
• To help you when you write to us.
• To see how the product is used so we can fix it and make it better (section 7).
• To meet our legal obligations.

We do not sell personal data, and we do not share it for advertising across other companies' sites or apps.

Ask and our other AI features send your prompt, and the workspace content needed to answer it, to AI model providers, who send back a response. We currently use Anthropic for language models and OpenAI for the embeddings that let Ask search your content. An embedding is a numeric fingerprint of a piece of text. We store them in our database so Ask can find things. Ask is designed to use only content the person asking is allowed to see in the workspace.

Ask can also keep short notes about your workspace so it remembers context between conversations. These live in Tether, a memory service we run on Cloudflare, and are kept apart for each workspace.

We use the providers' business API products. Their terms do not let them train models on that content by default, and we do not use your content to train models ourselves. Ask can be wrong. Check anything that matters before you act on it.

We use a small number of providers to run the Service. They process data for us under contract and may use it only to serve us.

• Supabase: database, sign-in and file storage.
• Vercel: hosts the web app.
• Railway: hosts our API.
• Anthropic and OpenAI: AI models and embeddings (section 5).
• Resend: sends email.
• PostHog: product analytics (section 7).
• Cloudflare: hosts Tether, the memory service Ask uses.
• Google, Meta, Granola and Notion: only for services you connect.

We also share data inside your workspace according to its roles and permissions, with people you choose to share something with (a portal invite or a share link), when the law requires it through valid legal process, if we are part of a merger or sale (we will tell you first), and with your consent.

Inside the signed-in app we use PostHog, hosted in the United States, for product analytics. It records which pages and features are used, tied to your account, workspace and plan. It is set up to mask on-page text, it does not record sessions or screens, and it honors your browser's Do Not Track setting. It does not run on the sign-in page, the client portal or public share links.

We use cookies and local storage to keep you signed in, remember your theme and the workspace you last used, and run the analytics above. We do not use advertising cookies or third-party trackers.

We send you service email: invitations, sign-in and security notices, task and portal notifications. Workspaces can also email their own contacts through the Service. Those emails can include a tracking pixel that tells the sender whether a message was opened, and larger sends include an unsubscribe link. If you got one and want no more, use the link or write to us.

We keep workspace content while the workspace is active. When a workspace is closed, or you ask us to delete it, we delete it from our systems and from backups as they age out. We may keep audit records longer where security or the law needs it.

When a person is deleted, we remove their personal data and anonymize their name on shared content, so the rest of the team's history stays intact. When you disconnect a service, we stop reading it and remove our stored access to it. Data we already synced stays in your workspace until you delete it or ask us to.

Traffic is encrypted in transit. Connected-service tokens and sensitive fields are encrypted at rest. Each workspace's data is kept apart in the database by row-level security and by checks on every request, and access to production is limited to the people who need it. No system is perfectly secure. If a breach affects your data, we will tell you without undue delay and as the law requires.

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to how we use it, and to withdraw consent. California residents have similar rights under the CCPA, including the right to know and to delete. We do not sell personal data or share it for advertising.

To use any of these, write to hello@nynth.com. If your data sits in a workspace run by your employer or another company that invited you, that company is in charge of it and we may point you to them. You can also complain to your local data protection authority.

To delete your account and personal data, write to hello@nynth.com from the email address on your account with the subject "Delete my data". We will confirm and finish within 30 days. To delete a whole workspace, ask from an owner account.

To cut off a connected service without deleting anything, disconnect it in the app, or remove Nynth in that service's own settings: your Google Account's third-party access page for Google, or your Instagram or Facebook settings for Meta. If you connected Instagram or Facebook and want what we received from Meta deleted, write to the same address and say so.

Nynth is based in Ohio, USA. The Service runs on infrastructure in the United States and wherever our providers operate. If you are outside the US, your data is moved there. Where the law requires it, we use approved transfer mechanisms such as standard contractual clauses.

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children. If you think we have, write to us and we will delete it.

When this policy changes, we update this page and the date at the top. For changes that matter, we will tell workspace owners by email or in the app before they take effect. The Terms of Service sit alongside this policy.

Nynth, Ohio, USA. hello@nynth.com