1 Who is responsible
The Nella Service is operated by Nella Group (“we”). We are responsible for the personal information processed in connection with the Service within the meaning of Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the European Union’s General Data Protection Regulation (GDPR), under which we are the “controller”.
The person in charge of the protection of personal information at Nella Group oversees the application of this policy. You can reach them at [email protected].
2 Scope
This policy applies to Nella’s website, web app, mobile and desktop apps and extensions, with or without an account. It does not apply to third-party websites and services that the Service links to, or to Creations that you publish yourself elsewhere.
3 Information we collect
Information you give us
- Account: name, name to use in conversations, email address, field or occupation (optional), personal preferences, language and display settings, hashed password (for accounts that have one).
- Confirmations: date you accepted the Terms and the version accepted, confirmation of your age, consent to news emails.
- Content: your messages, Nella’s answers, your Creations, your feedback on answers and your favourites.
- Communications with us: the emails you send us and our replies.
Information we collect automatically
- Usage: number and size of messages, model used, consumption and dates, to apply limits and bill.
- Technical data: IP address, browser or device type, language, technical logs and essential cookies (see the section on cookies).
- Country: inferred from the IP address of your visits, to adapt the language and currency and for our usage statistics; it is linked to your account.
- Guest mode: the IP address that created the guest account, to apply shared limits and prevent abuse.
Information we receive from third parties
- Sign-in with Google, Apple or GitHub: if you choose this option, we receive a unique identifier, your email address (or a relay address provided by Apple) and, if you allow it, your name. We never receive your password.
- Payment: the payment provider or app store sends us your subscription status, billing country and, where applicable, the card type and its last four digits. We do not receive your full card number.
We do not ask you for sensitive information. Avoid including it in your messages (health, political or religious opinions, biometric data, identification numbers) when it is not necessary for your request.
4 Why we use it
- to provide the Service: create and secure your account, sign you in, generate answers and Creations, store and display your conversations;
- to tailor answers to the name, field and preferences you provide;
- to apply plans and usage limits, and to bill subscriptions;
- to keep the Service secure, prevent fraud and abuse, and enforce the Terms and the Acceptable Use Policy;
- to respond to your requests and send you the messages the Service requires (sign-in codes, important notices, changes to the Terms);
- to send you Nella news, only if you have consented;
- to measure how well the Service works (errors, performance) using aggregated data;
- to comply with our legal obligations and assert our rights.
We do not use your information for other purposes without your consent, except where the law allows it.
5 Consent and legal bases
In Quebec and Canada, we collect and use your information with your consent, given when you sign up and use the Service for the purposes described here, or where the law allows it without consent. You may withdraw your consent at any time, subject to legal or contractual restrictions; some features may then no longer be available.
Where the GDPR applies, our legal bases are:
- performance of the contract: providing the Service, managing the account, plans and billing;
- our legitimate interests: securing the Service, preventing abuse and improving how it works using aggregated measurements, taking your interests and rights into account;
- your consent: news emails and any optional processing that may be offered to you;
- our legal obligations: accounting, tax, responses to authorities.
6 Your content and artificial intelligence
- To produce an answer, the content of your conversation and the profile information relevant to the answer (name to use, field, preferences) are sent to the AI model provider, which processes them on our behalf.
- We do not use your conversations to train AI models, and we choose providers that commit by contract not to use them for that purpose.
- No one on our side reads your conversations, unless you ask us to (for example for a support request), it is necessary to investigate abuse or a security incident, or the law requires it.
- Creations run in an isolated frame that has no access to your session, your cookies or your conversations.
- We make no decision based exclusively on automated processing that would produce legal effects concerning you or similarly significantly affect you. The automatic application of your plan’s usage limits is not such a decision. If this were to change, we would inform you as the law requires, and you could submit your observations to a person.
7 Sharing with third parties
We do not sell your personal information and we do not rent it. We do not share it for advertising purposes.
We share it only with the service providers that help us provide the Service, to the extent necessary for their task:
- AI model provider, to generate answers;
- hosting and infrastructure, to run the Service and store data;
- payment, to process subscriptions;
- email delivery, for sign-in codes and Service messages;
- web search, to find recent sources in answer to your questions (only the search is sent, not your account);
- running code (creation previews and analysis of your files), to run the code of your creations, the code that analyzes your attached files or the tests of a GitHub repository you linked, in an isolated, temporary environment that is deleted after use (test results are kept for 7 days);
- understanding videos and audio, if you send any: the file or link is sent to be analyzed or transcribed;
- messaging apps (Telegram, Messenger), if you link your account: your messages and Nella’s replies go through these platforms, under their own rules;
- connectors (Gmail, Google Drive, GitHub, servers you add), if you link them: Nella only reads what you ask it to search or read, only acts (draft, issue, comment) after you confirm, and never sends an email; access tokens are encrypted and deleted when you remove the connector;
- sign-in with Google, Apple or GitHub, if you choose this option.
Nella’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: this data is used only to answer your requests, is never sold, never used for advertising or to train AI models, and is not read by anyone at our company except with your consent, for security, or where the law requires.
Each service provider is bound by a contract requiring it to protect the information, use it only for us and destroy it at the end of its engagement. The current list of service providers is available on request, at [email protected].
We may also disclose information where the law requires or permits it (for example in response to a court order), to protect anyone’s rights, safety or property, or as part of a business transaction (merger, sale), subject to an agreement protecting its confidentiality.
8 Transfers outside Quebec and Canada
Some service providers, including the AI model provider, may process your information outside Quebec and Canada, in particular in the United States. The information may then be accessible to the authorities of those countries under their laws.
Before such a transfer, we carry out a privacy impact assessment as Quebec law requires, and we govern the transfer by a contract that ensures adequate protection. For people covered by the GDPR, transfers rely on the European Commission’s adequacy decision for Canada or, to other countries, on standard contractual clauses or an equivalent mechanism.
9 Retention
We keep your information for as long as necessary for the purposes for which it was collected, then securely destroy or anonymize it:
- Account and conversations: as long as your account is active. You can delete a conversation, all your conversations or your account at any time in Settings; deletion is immediate in the Service.
- Guest accounts: deleted automatically, with their conversations, after 30 days of inactivity. When a guest has used the Service in the last 24 hours, an anonymous record of their usage may be kept until the end of that period to apply shared limits.
- Sign-in codes: valid for 10 minutes, then unusable.
- Videos and audio you send: the copy of the file is deleted after 7 days; what Nella drew from it (answer, transcript) stays in the conversation.
- Technical and security logs: for a limited period suited to the security of the Service.
- Billing: for the period required by tax and accounting laws (in Quebec, generally six years).
- Backups: erased over their normal rotation cycle.
10 Security
We protect your information with reasonable measures suited to its sensitivity: encrypted connections (HTTPS), hashed passwords, single-use, time-limited sign-in codes, access restricted to the people who need it, and isolation of Creations.
No measure is foolproof. If a confidentiality incident presents a risk of serious injury, we will notify the Commission d’accès à l’information du Québec, other competent authorities and the people concerned, as the law requires, and we keep a register of incidents.
11 Your rights
Depending on the law that applies to you, you have the right:
- to access the information we hold about you and obtain a copy;
- to have it corrected if it is inaccurate, incomplete or ambiguous;
- to receive it in a structured, commonly used technological format (portability): the export available in Settings gives you your conversations and Creations;
- to have it deleted: in Settings for your conversations and account, or on request;
- to withdraw your consent, for example to news emails, using the unsubscribe link;
- to object to certain processing or ask for it to be restricted, and to request de-indexing of information where the law provides for it;
- to be informed of the information used to make an automated decision, if any.
To exercise a right that is not available in Settings, write to us at [email protected]. We will verify your identity, then reply in writing within 30 days. Exercising your rights is free, except for reasonable fees permitted by law for transcription or reproduction; we would tell you in advance.
If you are not satisfied with our answer, you may file a complaint with the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada or, in the European Union, the data protection authority of your country.
12 Cookies and local storage
Nella uses only cookies that are essential to the Service: no advertising cookies and no third-party analytics tools.
- Session: keep you signed in and protect forms (security token).
- Stay signed in: keep your session open on a device, if you choose to.
- Language: remember the language chosen in the selector.
The app may also keep display preferences and drafts in your browser’s local storage. You can clear this data in your browser; some features may then stop working.
13 Minors
The Service is for people 18 years of age or older. We do not knowingly collect information about younger people. If you believe a minor has given us information, write to us at [email protected]: we will close the account and delete their information.
14 Changes to this policy
We may update this policy. The current date and version appear at the top of the page. In case of a significant change, we will notify you by email or in the app before it takes effect and, where the law requires it, ask for your consent.
15 Contact us
For any question about this policy or your personal information, write to the person in charge of the protection of personal information at Nella Group at [email protected].