Privacy Policy

1. Information we collect

A. Information you provide

• Account registration: name, email address, password, and optional profile photo.
• Payment information: when you subscribe, we collect billing details through Stripe. We do not store your card number — Stripe handles payment processing on our behalf.
• Communications: any messages, support requests, or feedback you send us.

B. Information collected automatically

• Usage data: pages visited, features used, session duration, and interactions with the platform.
• Device and log data: IP address, browser type, operating system, and referring URLs.
• Cookies: we use cookies and similar technologies for authentication and to remember your preferences. See our Cookie Policy for details.

C. Content you upload

When you use NOLYB, you may connect third-party sources (Google Drive, Notion, Slack, Dropbox, OneDrive, Zoom) or upload files directly. We process this content solely to provide the Services to you — specifically to index, store, and retrieve your knowledge assets. We do not use your uploaded content to train our own models or share it with other users.

2. How we use your information

• To create and manage your account.
• To provide, operate, and improve the Services, including AI search and retrieval features powered by OpenAI.
• To process payments through Stripe.
• To send transactional emails (account verification, password reset, billing receipts) via Resend.
• To respond to your support requests and communicate with you about the Services.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

3. Sharing your information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers: we share data with third-party vendors who perform services on our behalf, including: Supabase (database and authentication), OpenAI (AI processing), Stripe (payments), Resend (email), AssemblyAI (audio transcription), and Railway (infrastructure). These providers are contractually obligated to protect your data and may only use it to provide services to us.
• Plausible Analytics: We use Plausible Analytics, provided by Plausible Insights OÜ, to understand aggregate website traffic and measure sign-up conversions. Plausible operates without cookies or persistent identifiers and does not store visitors’ raw IP addresses. See Plausible’s data policy for details.
• Legal requirements: we may disclose your information if required by law or in response to a valid legal request.
• Business transfers: if NOLYB is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.
• With your consent: we may share your information in other ways if you give us explicit permission.

4. Third-party connectors

NOLYB lets you connect external services to import your knowledge content. When you authorize a connector, we receive an OAuth access token from that service and use it only to fetch content you explicitly select. We do not store connector credentials beyond what is necessary to maintain the connection.

The connectors we currently support are:

• Google Drive (Google LLC)
• Notion (Notion Labs, Inc.)
• Slack (Salesforce, Inc.)
• Dropbox (Dropbox, Inc.)
• Microsoft OneDrive (Microsoft Corporation)
• Zoom (Zoom Video Communications, Inc.)

Each connector’s use of your data is also governed by that provider’s own privacy policy. We encourage you to review them. You can disconnect any connector at any time from your Settings page, which revokes our access to that service.

Google API Services: NOLYB’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access Google Drive data only to import the files you select and do not use this data for advertising or share it with third parties except as necessary to provide the Services.

5. Data retention

We retain your personal information for as long as your account is active or as needed to provide you the Services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or regulatory reasons. Content you have uploaded or imported will be deleted from our systems upon account deletion.

6. Security

We use industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest. Your data is stored on Supabase infrastructure with row-level security controls. However, no method of transmission over the internet or electronic storage is 100% secure. If you believe your account has been compromised, please contact us immediately at hello@nolyb.com.

7. Your choices and rights

Depending on where you live, you may have certain rights regarding your personal information:

• Access: you can request a copy of the personal information we hold about you.
• Correction: you can update your account information directly in the Settings page.
• Deletion: you can delete your account at any time from the Settings › Danger Zone section. This will delete your data as described above.
• Data portability: you can request an export of your data by contacting us.
• Opt-out of marketing: we do not currently send marketing emails. If we do so in the future, each email will include an unsubscribe link.

To exercise any of these rights, email us at hello@nolyb.com. We will respond within 30 days.

8. International transfers

NOLYB is operated globally. Your information may be processed in countries other than the one in which you reside, including the United States, where our service providers maintain their infrastructure. By using the Services, you acknowledge that your information may be transferred to and processed in countries with different data protection laws than your own.

9. Children’s privacy

The Services are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child under 16, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on this page and update the effective date at the top. For material changes, we will notify you by email (to the address on your account) or by a prominent notice in the Services. We encourage you to review this policy periodically.

11. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at: