Ready to become an N.Rich AI builder and get paid for it?

Find out more

Privacy Notice for Users of N.Rich Technologies Products and Services

Last updated on 6 November 2026


Data Subjects

This privacy notice explains how we collect and use personal data concerning customers and their representatives and people who sign up for a free trial of our products, such as the N.Rich AI Playground ("users") of N.Rich Technologies products and services. It applies to both:

  • N.Rich Technologies Oy (our EU entity)
  • N.Rich US Inc. (our US entity)

Collectively referred to as “N.Rich,” “we,” “us,” or “our.”

The section "N.Rich AI Playground" below applies only to Playground users and, for them, takes precedence over the rest of this notice.

Data Controller

Depending on your location and which N.Rich entity you interact with, the data controller for your personal information will be:

For EEA operations:

N.Rich Technologies Oy c/o Kuopion Tilitieto Oy, Kirkkokatu 1, 70100 Kuopio, Finland email: privacy@n.rich

For US operations:

N.Rich US Inc., with its address at 169 Madison Ave STE 15643, New York, NY 10016, USA, is a limited liability established under the laws of Delaware, United States.

Purposes of Processing

We may use the personal data we collect about you for the following purposes:

  • Customer relationship management and other internal administrative purposes
  • Customer communications
  • Product and service delivery
  • Further development of our products and services
  • Targeting and personalization of our products and services
  • Commercial offers and other marketing
  • Market research and other statistical purposes
  • Invoicing, monitoring and collection of payments
  • Detection, prevention and investigation of fraud and other criminal activity
  • General administrative purposes and ensuring compliance with our legal and regulatory requirements

Legal Bases of Processing

For the activities described in this notice, we rely on the following legal bases for processing personal data:

For users to N.Rich Technologies Oy (EU):

  • Performance of a contract between you and us
  • Compliance with our legal obligations, such as data retention obligations related to accounting and taxation
  • Our legitimate interests to conduct and develop our business: This is the legal basis we mainly rely on for activities not covered by the above-mentioned legal bases, such as for managing our customer relationships as well as developing and marketing our products and services
  • In individual cases, and where legally required, we may also rely on your separate consent. You may later revoke your consent at any time.

For users to N.Rich US Inc. (US):

  • To perform or prepare a contract with you
  • Compliance with legal obligations
  • Our legitimate business purposes (e.g., analytics, fraud detection, CRM)
  • Consent, where required under applicable US state privacy laws

You may opt out of marketing at any time using the instructions in any communication or by contacting us at the addresses mentioned below under “Contact Us”.

Categories and Sources of Data

The types of information we may collect and use for the purposes detailed above are the following: Information you provide to us yourself, such as your contact details or information necessary for the provision of our services Customer account data gathered by us in the context of service provision or customer relationship management, such as details on your communication with us and information related to the services provided to you or your organization.

Information related to your business and/or organization collected from publicly available sources, such as updates to your contact information from public registers or similar sources

Disclosure and Transfer

Where necessary for the purposes detailed above, your personal data may be disclosed to the following categories of recipients:

  • Our group companies
  • Our third party services providers who assist us in providing you with our products and services
  • Our service providers for the purposes of accounting, financial, ICT, legal and other services provided to us
  • Potential buyers (and their agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that the buyer is informed that it must use your personal data only for the purposes set out in this notice
  • Competent courts, law enforcement bodies, or other authorities or third parties where we deem that disclosing your personal data is necessary for compliance with laws or regulations, or to exercise, establish or defend our legal rights, or to protect your vital interests or those of any other person
  • Any other person – but only with your separate consent

Your personal data will not be transferred to countries outside the European Union or the European Economic Area, except where the European Commission has held that the country ensures an adequate level of protection for personal data (including transfers to recipients certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions), or where we have taken appropriate safeguards to require that your personal data remains protected in accordance with this notice, such as by implementing the European Commission’s Standard Contractual Clauses for transfers of personal data. You may contact us for more information on the safeguards in place. In individual cases, such transfers may also take place based on your separate consent or in order to provide you with a service you have specifically requested, or where otherwise allowed by applicable data protection laws.

For users of N.Rich US Inc. (US): Your personal data may be processed in the United States and stored on secure servers located in Canada or in the EU/EEA.

Automated Decisions

In order to optimize the products and services we offer, we reserve the right to make automated decisions, including using machine learning and artificial intelligence algorithms, about our customer behaviour. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Data Retention

We keep your personal data only as long as we have a legitimate business need to retain it for the purposes described above. We will regularly assess the existence of such need against the data we keep, and where we have no such ongoing business need, we will either erase or anonymize your personal data or, if this is not possible – for example, for information stored in backup archives – we will store your personal data securely and block any further processing until deletion is possible.

Personal data related to a customer relationship will be usually retained only for the duration of the ongoing customer relationship and for a reasonable period thereafter in order for us to be able to answer inquiries related to the relationship. However, some data may be retained for longer where we believe retention is necessary for compliance with laws or regulations (such as in the fields of accounting and taxation), or to exercise, establish or defend our legal rights or those of our customers, affiliates or partners.

Security

To protect your personal data, we use appropriate technical and organizational measures designed to provide a level of security appropriate to the risk of processing.

Data Subject Rights

You have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed by us, and where that is the case, access to that personal data as well as to have any inaccurate or incomplete personal data rectified or completed. In certain circumstances, you may also have the right to request the erasure, or the restriction of processing, of your personal data or parts of it, to object to the processing and/or to receive the data in a structured, commonly used and machine-readable format. Please contact us for any inquiries related to exercising the above rights. If you consider our processing activities of your personal data to be inconsistent with applicable data protection laws, you may lodge a complaint with the responsible supervisory authority. Contact information for the supervisory authority in Finland can be found here: www.tietosuoja.fi

For users of N.Rich US Inc. (US): Depending on your state of residence, you may have rights to:

  • Know what personal information is collected
  • Access your personal information
  • Request deletion of your personal information
  • Correct inaccuracies
  • Opt-out of certain processing activities, including targeted advertising
  • Non-discrimination for exercising these rights

Please contact privacy-us@n.rich for any inquiries related to exercising these rights. Complaints may be directed to the appropriate state attorney general's office, depending on your state of residence.

N.Rich AI Playground

This section applies if you sign up for or use the N.Rich AI Playground at playground.nrich.io, a free trial of N.Rich AI. Where it differs from the rest of this notice, this section applies.

Who is responsible. For the Playground, the controller is N.Rich Technologies Oy, wherever you are located. Contact: privacy@n.rich.

What we collect, why, and on what legal basis

  • Work email address and sign-in identifier: to create and run your account. Legal basis: contract (Article 6(1)(b) of the General Data Protection Regulation).
  • Prompts, AI answers, apps you build and their versions: to provide the Playground. Legal basis: contract (Article 6(1)(b)).
  • Usage records (AI usage and budget): to apply usage limits and prevent abuse. Legal basis: contract, and our legitimate interest in preventing abuse (Article 6(1)(f)).
  • Technical logs, including excerpts of AI conversations, and the web server access log with IP addresses: for security and fixing errors. Legal basis: legitimate interest (Article 6(1)(f)).
  • Your email in our customer relationship system (HubSpot): to manage our relationship with you. Legal basis: legitimate interest (Article 6(1)(f)).
  • Partner code from the link you used: to credit the partner who referred you. Legal basis: consent (Article 6(1)(a)).
  • Messages you send through the support chat, and your email address so we know who is asking: to answer your questions and help you use the Playground. Legal basis: our legitimate interest in answering the support requests you send us (Article 6(1)(f)).
  • Referral programme membership, if you choose to join: to run the programme you asked to join. Legal basis: consent (Article 6(1)(a)).
  • Analytics data (a random device identifier, pages visited and product events, collected by Amplitude and Google Analytics): to understand how the Playground is used. Legal basis: your consent (Article 6(1)(a)), given in the cookie banner.
  • Advertising measurement (a cookie identifier, pages visited and sign-up events, collected by the LinkedIn Insight Tag): to measure our LinkedIn advertising and show our ads to people who visited the Playground. Legal basis: your consent (Article 6(1)(a)), given in the cookie banner.
  • Website visit data collected by the N.Rich tag (such as a cookie identifier, IP address and the approximate location derived from it, pages visited and how far you scroll, time on page and the page you came from, and browser and device details): to see which companies visit the Playground. The N.Rich cookie also recognises your browser on other websites that use the N.Rich tag. N.Rich also uses this data in its own advertising and intent data services, as described in the N.Rich Privacy Notice. Legal basis: your consent (Article 6(1)(a)), given in the cookie banner. You can also opt out of N.Rich's tracking at any time at privacy.nrich.ai/opt-out.
  • IP address of people who open a shared app: to deliver the app and for security. Legal basis: legitimate interest (Article 6(1)(f)).

The Playground uses fictional demo data. Please do not enter personal data in chats or apps.

Who receives your data

  • Hosting provider — all Playground data — France.
  • Provider of the AI model, used through a cloud platform — prompts and AI answers — Luxembourg.
  • Sign-in service provider — email and sign-in identifier — EU.
  • Customer relationship management system provider — email and sign-up source — US.
  • Product analytics provider, only with your consent — random device identifier and product events — US.
  • Referral programme provider, only if you join — email and partner code — Netherlands.
  • Customer support provider, only if you use the support chat — email and chat messages — US.
  • Website analytics provider (Google), only with your consent — device identifier, pages visited and product events — US.
  • Advertising platform (LinkedIn Ireland Unlimited Company), only with your consent — cookie identifier, pages visited and sign-up events — Ireland and US. We are responsible for asking for your consent. LinkedIn is responsible for the data after it receives it. You can use your rights with us or with LinkedIn.

Except for LinkedIn, all of them act on our instructions under data processing agreements.

How long we keep your data

  • Your account. We keep your account and sign-in details while your account exists. If you ask us to delete your account, we delete it, together with your apps, within 90 days.
  • Your apps. We keep everything belonging to an app while the app exists. This includes prompts, AI answers, code, earlier versions, build records and publishing history. When you delete an app or your account, we delete all of it, including earlier versions.
  • Usage records. We keep records of how much of the service you use to apply usage limits and manage the cost of the service. After that we delete them or anonymise them.
  • Technical and server logs. These may contain IP addresses, page addresses and short excerpts of AI conversations. We keep them for 90 days, then delete them automatically. They are not removed earlier if you delete your account.
  • Support conversations, if you use the support chat. We keep them while your account exists. When your account is deleted, we delete them within 90 days.
  • Traffic limiting. We use IP addresses briefly to limit anonymous traffic. We don’t store them for this purpose.
  • Analytics data, only if you consented. Amplitude keeps it for 12 months and Google Analytics for 14 months. We do not keep the data the LinkedIn Insight Tag collects; we only see aggregated reports in LinkedIn. LinkedIn decides how long it keeps the data, as described in its privacy policy. The N.Rich tag sets a cookie (_nauid) that lasts up to 540 days.
  • Referral programme data, if you join, is kept while you are a member and deleted after you decide to leave. If commissions are paid, we keep payment records as long as tax law requires.
  • Service providers and backups. When we delete your data, our service providers delete it from their systems too, including backups.

We may keep data longer where the law requires it, or where we need it to establish, exercise or defend legal claims.

Cookies and similar technologies. Strictly necessary storage (sign-in, session, app previews, your cookie choice and selected demo company) is always on.

Analytics (Amplitude, Google Analytics), advertising (LinkedIn and the N.Rich tag), the tracking script for marketing purposes (HubSpot) and referral tools (Reditus) run only if you accept them in the cookie banner. You can change your choice at any time through "Cookie settings" at the bottom of every page.

Your rights. The rights described under "Data Subject Rights" apply. To delete your account or get a copy of your prompts and apps, write to privacy@n.rich. We answer within one month.

Changes

We may update this notice from time to time in response to changing legal, technical or business developments. When we update this notice, we will strive to inform you in a manner consistent with the significance of the changes we make.

Contact Us

If you have any questions about this Privacy Notice or our data practices, please contact us at:

  • privacy@n.rich for enquiries applicable to the use of the EU platform, referencing N.Rich Technologies Oy;
  • privacy-us@n.rich, for enquiries applicable to the use of the US platform referencing N.Rich US Inc.