// legal

Let's be clear here, too.

Last updated: July 2026

Legal notice Privacy Cookies AI transparency

Privacy policy

Privacy is not a feature we added later: it is the principle our entire technical infrastructure was designed around.

  • API-only infrastructure — we use API-tier access to AI providers: your data is never used to train third-party models. Consumer-grade tools are prohibited in our client workflows.
  • DPA, always — we never process client data without a signed Data Processing Agreement.
  • Data residency, your choice — EU clients can request processing within EU jurisdiction.
  • A real right to erasure — deletion requests are processed within 30 days.

Key provisions

1. Data we collect and legal basis

We collect only the data strictly necessary for service delivery: contact information (this site's forms and chat), project data provided by the client, and system usage analytics. Legal basis: contractual necessity (Art. 6.1.b GDPR), legitimate interest (Art. 6.1.f), and explicit consent where required.

2. AI tool usage policy

PERMITTED: API-tier access to AI providers (client data does not train models). RESTRICTED: internal use only, no client data. PROHIBITED: consumer-tier tools with any client data, always.

3. Subprocessors and third-party providers

We maintain a current register of all AI and cloud subprocessors, bound by data processing agreements consistent with GDPR Art. 28. The full list is available to clients upon request.

4. Your rights

You have the right to access, rectify, erase, port and object to the processing of your personal data. We respond within 30 days. Contact: info@nhai.ai.

5. Intellectual property & AI-assisted work

All deliverables produced by NHAI — including those incorporating AI-assisted content — are the intellectual property of the client upon full payment, unless otherwise agreed in writing. NHAI's methodology and infrastructure remain NHAI property.

6. Data retention periods

Corporate client data: 7 years (legal/tax retention). Project working data: deleted within 30 days of project closure. Business contacts: until consent withdrawal or 24 months of inactivity, whichever comes first. All retained data is encrypted at rest and access-controlled.

7. NDA, segregation and access control

Every project starts with a signed NDA. Each client project is fully segregated from every other — separate workspaces, API credentials and document repositories. Access to client data follows strict need-to-know. Non-compete clauses by sector or geography available on request.

8. EU Representative — Art. 27 GDPR

In accordance with Article 27 of Regulation (EU) 2016/679, NHAI.AI LLC (Delaware, USA), as a controller established outside the European Union that processes personal data of individuals in the EU, has designated a representative in the Union (details below). EU data subjects and supervisory authorities may contact them directly, or write to info@nhai.ai.

🇪🇺 EU Representative — Art. 27 GDPR

Name: Ciprián Rivas · Country: Spain (European Union) · Contact: info@nhai.ai · Scope: all EU/EEA jurisdictions · Designated pursuant to Art. 27 Reg. (EU) 2016/679.

Nova's chat and this site's forms

Conversations with Nova may be reviewed by the NHAI team for supervision and service improvement; no one outside NHAI has access to them. Personal data you provide (name, company, email) is used exclusively to handle your request. Please do not share sensitive data in the chat.

Cookie policy

This site does not use cookies. None of our own, none from third parties — no analytics, no advertising. That's why we don't ask for consent with any banner.

If we add analytics or other technologies requiring it in the future, this policy will be updated and prior consent will be requested where applicable.

AI transparency

In line with the EU AI Act and our own honesty policy: Nova is an artificial-intelligence agent, supervised by the NHAI team, and identifies itself as such in the chat. You can ask for a human at any time (info@nhai.ai). The agents we sell are likewise delivered with AI identification, named human supervision and an auditable record.