Privacy Policy

1. Who we are

This policy explains how Nepteo ("we") collects, uses, stores and protects your personal data when you use our platform, under the GDPR and French data protection law (loi Informatique et Libertés).

Nepteo is an AI-powered workspace for independent professionals (coaches, consultants, freelancers): clients, invoices, meetings, documents and communications in one place.

Data controller: Nepteo, operated by Charly Pham (auto-entrepreneur).

Our company is being registered. Its registered name, registration number and address will be published here as soon as they exist. Until then, the controller is the person named above.

Contact for personal data: privacy@nepteo.ai

2. Data we collect

Data you provide

Account: email address, first name, profession and the preferences you pick at sign-up.
Professional content: the documents, invoices, meeting notes, templates, contacts and messages you create or import.
Payment: handled by Stripe. We do not store bank card numbers.
Communications: the emails and messages you send through the platform or to our support.

Data collected automatically

Technical logs: IP address, browser type, operating system and access times, kept by our hosting providers. Our application logs can also contain short excerpts (about 40 to 100 characters) of messages, replies and memory entries, which we use to diagnose errors.
Product analytics in your browser (PostHog, EU instance): only if you accept cookies. Pages viewed and clicks, with all on-screen text and element attributes masked. We do not record sessions and we do not capture network timings.
Product events from our servers (PostHog, EU instance): only if you accepted analytics. Which assistant tool or proactive suggestion was used, with fixed fields only (tool name, suggestion type and identifier, a score, a channel, a short reason code). They carry a pseudonymous identifier, not your account identifier. They never include the text of your messages or documents.
Cookies and browser storage: see section 10 and the Cookies page.

Data from connected services

When you connect a service through OAuth, we access the data you authorise:

Gmail: email messages and contacts, read, send and modify access as you authorise.
Outlook (Microsoft): email messages, with read, send and modify access, and your basic profile, as you authorise.
Google Calendar: calendar events, read access.

Messaging channels (WhatsApp, Instagram, Telegram, SMS): when you connect one, the messages you send through Nepteo go to that channel's service (Meta for WhatsApp and Instagram, Telegram, and Twilio for SMS). That service receives them under its own terms.

3. How we use your data

Provide the service: power the AI assistant, manage your professional data, send and receive messages.
Assistant memory: the assistant remembers your preferences, client details and communication style to personalise its help. This memory is stored in your account.
Run and protect the service: security monitoring, fraud prevention, error monitoring and rate limiting.
Understand how the product is used: analytics, in your browser only with your consent.
Transactional emails: account confirmations, billing notices, security alerts.
Meet our legal obligations: accounting and tax records.

Nepteo never uses your data to train AI models. Your content is sent to AI providers to run the services you use, including memory and automatic suggestions. Here is what the terms of Anthropic and OpenAI say, with the source:

Anthropic: its commercial terms (effective 17 June 2025) state that Anthropic may not train models on customer content from its services. Source
OpenAI: its API policy states that, as of 1 March 2023, data sent to the OpenAI API is not used to train or improve OpenAI models. Source

What is sent to each provider, and where, is on the sub-processors page.

4. Receipt photos and files

When you add a receipt in Accounting, Nepteo stores the file and reads it to fill in the expense.

What and where: the file you upload (photo, PDF or text) is stored in our file storage at Supabase, in a folder of your own. One line in your vault records its name, type and size.
Who reads it: a photo is sent to OpenAI, which reads its text. The text read from a photo, a PDF or a text file is then sent to Anthropic, which extracts the amount, VAT, date and supplier. Both are listed on the sub-processors page.
How long: we have set no automatic deletion period for receipt files. They stay in storage until they are deleted; closing your account deletes them. How long OpenAI and Anthropic keep what they receive follows their own terms.

5. Legal bases (GDPR, Article 6)

Each purpose rests on one legal basis:

Performance of the contract (Art. 6(1)(b)): providing the service you signed up for, including the assistant, your data, messages and transactional emails.
Consent (Art. 6(1)(a), and Art. 82 of the loi Informatique et Libertés): product analytics, in your browser and from our servers, and the connection of outside accounts such as Gmail. You can withdraw it at any time.
Legitimate interest (Art. 6(1)(f)): security, fraud prevention, error monitoring and rate limiting.
Legal obligation (Art. 6(1)(c)): keeping accounting and tax records.

6. Recipients

Your data is processed by the providers that run Nepteo: Supabase Pte. Ltd. (Singapore), Vercel, OpenAI, Anthropic, Google (Gemini API), Stripe, Resend, PostHog, Sentry, Langfuse, Upstash, Brave Search API, Google Fonts. For each one, the sub-processors page says what is sent, where it is processed and what its terms say about training.

We never sell your data. We do not share personal data with advertisers or data brokers.

We disclose data to an authority only when the law requires it.

7. Location and transfers outside the EU

Your database is hosted in Paris (AWS eu-west-3), through Supabase: the contracting entity is Supabase Pte. Ltd., in Singapore. Server functions run in Paris (Vercel, cdg1); the routing layer runs on Vercel's edge network, close to each visitor. Hosting your database in Paris does not mean all processing stays in the EU:

AI processing: Anthropic and OpenAI process data in the United States, and Google's Gemini API endpoint is global, with no region we can choose.
PostHog product analytics use the EU instance.
Vercel, Stripe, Sentry, Resend, Upstash and Brave are US companies. For Resend, Sentry, Upstash and Langfuse we have not confirmed the processing region, and we say so rather than guess.

Safeguards: transfers outside the EU rely on the Standard Contractual Clauses adopted by the European Commission or on the EU-US Data Privacy Framework, depending on the provider. Each provider's terms are linked on the sub-processors page.

8. Retention

Account data and content: kept as long as your account exists.
Account closure: you close your account yourself, from Settings. Your data and your files are deleted immediately. The only thing kept is the archive of your data that we email you: its download link works for 30 days, then the archive is deleted. Questions: privacy@nepteo.ai.
The assistant's action logs: erased after 90 days.
Technical logs: kept for the period set by our hosting providers (Vercel, Supabase).
Backups: database and uploaded files (including receipt photos) are backed up nightly and kept for 7 days. Closing your account deletes the backup copies of your files at once; database backups expire on their own.
Our own billing records: kept as French accounting and tax law requires (generally 10 years for invoices).
Your cookie choice: 6 months in your browser, then we ask again. We keep your latest choice and its date while your account exists. The PostHog cookie lasts 1 year.
Analytics at PostHog and error reports at Sentry: the retention period follows the settings of those services. We have not confirmed the exact durations yet.

9. Your rights (GDPR)

You have the following rights:

Access: get a copy of your personal data.
Rectification: correct inaccurate data.
Erasure: ask us to delete your data.
Restriction: limit how we process your data.
Portability: receive your data in a structured, machine-readable format. You can also export your data from Settings.
Objection: object to processing based on legitimate interest.
Withdrawal of consent: at any time, for processing based on consent. The Cookies link in the footer, and in Settings once you are signed in, reopens your cookie choice.

To exercise a right, write to privacy@nepteo.ai. We answer within one month.

Right to complain: if you believe your rights were not respected, you can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.

10. Security

Data travels over encrypted connections (HTTPS).
Encryption at rest is provided by our database host.
Sign-in is handled by Supabase Auth.
Errors are monitored with Sentry.

11. Cookies and browser storage

We set the entries below. The Cookies page lists each one with its name, issuer and duration.

Strictly necessary

Sign-in session (Supabase authentication cookie): keeps you signed in.
Sign-up progress (sx_onboarding_done, sx_setup_done): remember that your setup is finished.
Language (NEXT_LOCALE): remembers the language you chose.
Account connections (short-lived OAuth cookies for Gmail and Outlook; Google Calendar uses the Gmail connection and sets none): carry out a connection you start.
Interface and session storage (browser storage): your display settings, the page you were on, unsent drafts and local copies of working data. It stays in your browser and the Cookies page lists its families with the main names.

These entries are needed to deliver what you asked for, so the law does not require your consent for them (Art. 82 of the loi Informatique et Libertés, CNIL guidelines).

Optional, with your consent

PostHog (product analytics, EU servers) sets a cookie and a browser storage entry only after you click Accept, and our servers send PostHog events for your account only after that click too. Refusing is as easy as accepting. If you withdraw after accepting, PostHog is stopped at once and a small mark is kept until the next page load so that it stays off. Your choice is kept for 6 months, and the Cookies link reopens it.

Set by other services

Card payments are completed on Stripe's pages, which set their own cookies.
Our fonts are loaded from Google's servers, so your IP address reaches Google when a page loads. This is not a cookie.

We use no advertising tracker.

12. Minors

Nepteo is built for professional use by people aged 18 and over. We do not knowingly collect personal data from minors. If we learn that a minor created an account, we delete it promptly.

13. Google API Services

When you connect your Google account (Gmail, Google Calendar), Nepteo accesses your Google data through Google APIs. This section describes how that data is handled.

Limited Use disclosure

Nepteo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data accessed, by scope

Gmail, read and modify (gmail.modify): Nepteo reads your received and sent messages, threads, labels and attachments to show them in a unified inbox, make them searchable, create contacts for your correspondents and remember useful information about them. It changes labels when you archive, star, or mark read or unread. It moves threads to trash or restores them when you ask. Nepteo never permanently deletes messages.
Gmail, send (gmail.send): Nepteo sends an email from your address only when you act: you write and send it, you approve a draft prepared by the Nepty assistant, or you ask the assistant to send it.
Email address (userinfo.email): Nepteo reads your Google email address to identify the connected account. No other profile data is accessed.
Google Calendar, read events (calendar.events.readonly): Nepteo reads the events of your primary calendar, from yesterday to 30 days ahead: title, description, location, start and end times, and whether they are cancelled or declined. It stores them in its database to show them in the agenda view, and the AI assistant uses them as planning context. Nepteo does not create, modify or delete events in Google Calendar.

Storage and retention

Email messages retrieved from Gmail and Google Calendar events (title, description, location, start and end times) are stored in our database (Supabase, AWS eu-west-3, Paris) to power the unified inbox and the agenda. Gmail and Google Calendar share one connection: its OAuth tokens (access and refresh) are stored encrypted (AES-256-GCM) in our credentials vault. All of this is deleted with your account when you close it.

When you disconnect your Google account in Settings, Nepteo stops reading new messages and events and the connection is switched off. The encrypted tokens stay in our vault, unused, and the messages and events already retrieved stay in your account, until you close your account. To delete everything, close your account in Settings (Security & vault), or write to us at privacy@nepteo.ai. You can also withdraw Nepteo's access at any time from the third-party access page of your Google Account.

No secondary use

Google user data is used only to provide the Nepteo service as described above. It is never sold, shared with advertisers or used for profiling. Nepteo does not use Google user data to develop, improve or train generalized AI or machine-learning models, as the Limited Use requirements of the Google API Services User Data Policy demand. It is transferred only to our sub-processors. Supabase stores it and Vercel delivers it. When the assistant works on your messages or events, their content is sent to Anthropic, OpenAI and Google (Gemini API) to produce the answer. For Google's Gemini API, Google's terms for paid services state that Google does not use your prompts to improve its products. All are listed on the sub-processors page.

No human at Nepteo reads message content, except with the user's explicit consent for support, to investigate abuse or a security incident, or where required by law. Content covers emails, messages, attachments, notes, memories, documents and calendar events.

14. Changes to this policy

We may update this policy from time to time. For material changes, we notify you by email at least 30 days before they take effect. The "last updated" date at the top shows the latest revision.

15. Contact

For any question about this policy or your personal data:

Data protection: privacy@nepteo.ai
General questions: contact@nepteo.ai