Privacy Policy

When you use our Service, we may collect the following types of information:

• A

  Personal Information: We collect personal information you voluntarily provide to us, such as your name, email address, and any other information you submit when you sign up for an account, contact us, or communicate with us in any other way.

• B

  Usage Information: We collect information about your usage of the Service, such as the data sources you add and the pages you create and share.

• C

  Technical Information: We collect technical information automatically when you use our Service, such as your IP address, browser type, device type, operating system, and other similar data.

We use a single analytics service, Google Analytics, to understand how the Website is used: how many people visit, which pages they open, which links and buttons they use, and which of the questions in our FAQ they expand. We do not use advertising, retargeting, or social media tracking cookies, and we do not sell or share analytics data.

• Consent comes first: Google Analytics is not loaded until you accept it in the cookie banner. If you decline, or if you simply ignore the banner, the analytics script is never requested and no analytics cookies are set.

• What is stored if you accept: Google Analytics sets cookies (named _ga and _ga_<id>) which distinguish one browser from another, so that repeat visits are not counted as new people. They expire automatically; Google's current default is up to two years, and you can delete them at any time in your browser.

• What the measurements record: Alongside the pages you open, we record when a button or link is used and when a FAQ question is expanded. What is stored is which button it was (for example the one in the page header rather than the one at the foot of the page), the words printed on it, where it led, and the text of the FAQ question. These records contain nothing you have typed, and your name and email address are never attached to them.

• Legal basis: Your consent (GDPR Art. 6(1)(a)). Consent is also the basis required for setting non-essential cookies under the Danish cookie rules.

• Withdrawing consent: Choose "Cookie settings" in the footer of any page. That clears your stored choice and asks you again. Analytics already running in the page you are looking at continues until you navigate; from your next page view onwards, nothing is loaded.

• Browser opt-out signals: If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a refusal. The banner is not shown to you and no analytics is loaded.

• Remembering your answer: Your choice is stored locally in your own browser so that you are not asked again on every page. This is strictly necessary in order to honour the decision you made, it is not sent anywhere, and it is not used for any other purpose.

Because Google is based outside the European Economic Area, accepting analytics involves a transfer of data to the United States. The safeguards we rely on for such transfers are described in the section on sharing your information and international data transfers.

We process your personal data under the following legal bases permitted under GDPR Article 6:

• A

  To provide and maintain the Service: Processed to perform our contractual obligations with you (GDPR Art. 6(1)(b)).

• B

  To enhance the performance and functionality of the Service: Processed based on our legitimate interest in optimizing our platform (GDPR Art. 6(1)(f)).

• C

  To communicate with you and respond to your inquiries: Processed to fulfill our contract or based on your consent/legitimate interest to receive support (GDPR Art. 6(1)(b)/(f)).

• D

  To monitor and analyze usage and trends to improve our Service: Processed based on our legitimate interest in product development and market analytics (GDPR Art. 6(1)(f)).

• E

  To ensure the security and integrity of our Service: Processed based on our legitimate interest in fraud prevention and network security (GDPR Art. 6(1)(f)).

• F

  To send you marketing communications, such as product updates, newsletters, and promotional offers: When you sign up for an account, you may opt in to receive marketing emails from us. This processing is based on your consent (GDPR Art. 6(1)(a)). You may withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us at support@numa.ai, without affecting the lawfulness of processing based on your consent before its withdrawal.

• G

  To comply with legal obligations and enforce our terms and conditions: Processed to satisfy our legal requirements under Danish or EU law (GDPR Art. 6(1)(c)).

We do not sell or rent your personal information to third parties. However, we may share your information in the following circumstances:

• A

  With third-party service providers: We share data with infrastructure partners that perform services on our behalf, such as hosting providers, customer support, and AI providers (OpenAI, Anthropic, and Google, with OpenAI being our primary provider). When you use our AI features, we may share your metadata (such as data source names and column names) and, in some cases, your actual data with these AI providers to analyze it and generate insights for you. This data is used by the AI providers solely for the purpose of performing the requested analysis and is subject to their respective privacy policies.

• B

  International Transfers: Because our primary AI providers (OpenAI, Anthropic, Google) are headquartered in the United States, your data will be transferred and processed outside the European Economic Area (EEA). We ensure such transfers are legally safeguarded by relying on the EU-U.S. Data Privacy Framework or executing Standard Contractual Clauses (SCCs) approved by the European Commission.

• C

  With your consent: When you choose to share your data sources or pages with other users.

• D

  Legal requirements: If required by law, in response to a court order, or in connection with a legal investigation or proceeding.

• E

  Corporate restructuring: In connection with a merger, acquisition, or sale of assets of AI Symphony ApS, in which case the buyer would assume responsibility for the information collected under this Privacy Policy.

Numa.ai allows you to create external AI Connectors that can access the data stored in your account.

• Default Access: When you add an AI Connector, it is initially granted access to all data in your Numa.ai account.

• User Configuration: You may limit or restrict an AI Connector's access by configuring which data sources are exposed. Until you set restrictions, the AI Connector will be able to query all available data.

• Shared Responsibility: Anyone with account access to that AI Connector can use it to query whatever data it has been granted.

• Your Control: You can update or revoke an AI Connector's access at any time through the Numa.ai interface.

• Third-Party Use: Once data is made available to an AI Connector, it may be processed, stored, or analyzed by that AI Connector's provider according to their own terms and privacy policies. Numa.ai does not control, and is not responsible for, how those third parties handle your data.

Where a business user or enterprise connects external data sources containing third-party personal data (such as customer databases or employee files) to Numa.ai, the business user acts as the Data Controller under GDPR, and Numa.ai acts as the Data Processor. In such instances, our processing of that specific customer data is strictly governed by our Data Processing Agreement (DPA), which is incorporated into our Terms of Service by reference.

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected or to comply with legal, regulatory, or contractual obligations.

We take appropriate technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your personal information.

You have the following rights regarding your personal information under the GDPR:

• A

  Access, correct, or delete your personal information by logging into your account or contacting us.

• B

  Object to or restrict the processing of your personal information by contacting us.

• C

  Data Portability to request a digital transfer of the personal data you provided to us.

• D

  Withdraw your consent to our processing of your personal information at any time by contacting us, without affecting the lawfulness of processing based on your consent before its withdrawal.

• E

  Lodge a complaint with a supervisory authority. If you are based in Denmark, you have the right to lodge this complaint directly with the Danish Data Protection Agency (Datatilsynet).

Our Service may include links to third-party websites or services, such as Google Sheets. This Privacy Policy does not apply to these third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you use.

Our Service uses AI technologies from OpenAI as our primary provider, and may also use services from Anthropic and Google to analyze your data and provide insights. Depending on the feature, these services may process either your metadata or your actual data according to their respective privacy policies.

Numa.ai's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. By using our app, you acknowledge and agree that we will access, process, and store your Google Sheets data in accordance with these policies.

We reserve the right to make changes to this Privacy Policy. In the event that the changes affect our obligations or your rights, we will inform you about the changes in advance so that you are given the opportunity to take a position on the updated policy.

Please contact us if you have questions about your rights or if you have any other questions about how we process your personal information: support@numa.ai.

This Privacy Policy shall be governed by and construed in accordance with the laws of Denmark, without regard to its conflict of law principles. Any disputes shall be resolved exclusively in the courts located in Copenhagen, Denmark.