This Privacy Policy explains how [LEGAL ENTITY NAME] (Nunto, we, us or our) handles personal information when you visit our marketing website or use our apps, APIs, MCP connections and related services (the Service). Contact: hello@nuntoapp.com. Mailing address: [BUSINESS MAILING ADDRESS]. The operator's place of establishment is [ENTITY JURISDICTION].
Who this policy covers
The Service is for adults aged 18 or older, for personal or authorized business use. Do not create an account or submit information if you are under 18. If you believe a child has provided information, contact us so we can investigate and take appropriate action.
We determine how information is used to operate accounts, secure the Service, handle billing and improve the product. When a business customer supplies personal information that we process solely on its instructions, the customer's privacy notice and any applicable data processing agreement also apply. A business customer must have authority to provide that information. This policy does not replace a required data processing agreement.
Information we collect
Account information: your email address, a protected password representation, verification status, account and device preferences, and records of your acceptance of the Terms, acknowledgment of this policy, age confirmation and analytics choices, including applicable versions and server-recorded dates. We do not need your full date of birth.
Content and activity: channels, reports, newsletters, catalogs, documents, attachments and previews; questions, answers and approval decisions; publishing and editing history, read state, follows, shares, moderation reports, usage counts and delivery or acknowledgment records. Content can contain personal information about you or other people. Connected agents and their operators can supply this information on your behalf.
Connections and notifications: agent names, scopes, channel permissions, credential and OAuth records, connection use and revocation dates, callback destinations and delivery state, and push registrations. We store API credentials and OAuth tokens in protected forms as appropriate to their use; secrets that must be recovered for delivery are encrypted. Push services process the device tokens or browser endpoints needed to deliver notifications.
Purchases and support: subscription identifiers, store, product, entitlement and transaction status, billing-provider records, and communications you send us. RevenueCat and the relevant checkout, payment processor or app store handle purchases. We do not receive your full payment card number through our checkout integration.
Technical information: the Service and its hosting providers receive network information such as IP addresses and request metadata when you connect. Operational records may include timestamps, status codes, security events, software versions and system activity. Optional analytics and error diagnostics are described separately below.
How and why we use information
We use information to create and verify accounts; authenticate users and agents; store, display and deliver content and responses; enforce connection scopes and sharing choices; manage notifications, subscriptions and quotas; provide support; detect abuse; investigate errors and security incidents; comply with legal obligations; and establish, exercise or defend legal claims.
Where data protection law requires a legal basis, we rely as applicable on performance of our contract with you, legitimate interests in providing and securing a reliable service subject to your rights, compliance with legal obligations, and consent for optional analytics. Where we act on a business customer's instructions, the customer is responsible for identifying its legal basis. Required account processing is separate from optional analytics consent.
We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not use your content to train AI models or authorize our service providers to train AI models on it. We do not send promotional email at launch. Account verification, security, billing, support and other service messages may still be sent.
Connected agents, sharing and other recipients
You choose which agents to connect and the permissions they receive. A permitted agent can publish content, retrieve allowed reports or responses, and receive your answers or approval decisions through authorized polling or callbacks. Information sent to an agent leaves Nunto's control and is handled under that agent operator's and provider's policies. Review those policies before connecting an agent or sending sensitive information. Revocation stops future authorized access; it cannot retrieve copies already received by another service.
You control whether to share a message or make a channel link-only or public within the Service. Shared readers currently need a verified signed-in account. Public channels can be discoverable to other eligible signed-in users. Sharing can expose the message or channel history, files, public creator details and later edits according to the sharing option you confirm. Questions, answers and approval receipts are not shared with readers through these features. Readers may save copies; removing a share cannot erase copies they already obtained.
We use service providers for hosting and databases, private object storage, message delivery, email, push notifications, subscription management, optional analytics and error diagnostics. The planned deployment includes DigitalOcean, Cloudflare R2, CloudAMQP, an SMTP email provider, Expo and the applicable Apple, Google or browser push services, RevenueCat and the applicable stores/payment providers, PostHog and Sentry. Our marketing host is [MARKETING HOST]. The confirmed provider list, processing regions and retention settings are [PROVIDER AND REGION SCHEDULE]. Some providers, including app stores and agent providers, also act under their own privacy policies.
Authorized personnel and service providers may access information only as needed for their permitted work, including support, security and moderation. We may disclose information when reasonably necessary to comply with law or valid legal process, protect rights and safety, prevent fraud or abuse, or in connection with a merger, financing, reorganization or sale subject to applicable confidentiality and privacy protections.
Optional PostHog analytics
PostHog helps us understand which screens and product actions are useful. Analytics is off by default and is enabled only after you opt in. Declining does not prevent you from creating an account or using the Service. The marketing website records its own browser choice; the app records an account preference. These choices are separate and are not used to link your marketing visits to your account.
Our integration sends only named screens and selected product actions, a random analytics identifier and limited technical metadata. We do not attach your email or account ID to these events. Random identifiers are pseudonymous; they are not a guarantee that data is anonymous. We exclude message content, answers, approval decisions, attachments, credentials, form values, share tokens, and raw page URLs or query strings. Session replay, automatic interaction capture, surveys and advertising tracking are disabled. Analytics identifiers and event queues use memory rather than persistent analytics cookies or device storage. PostHog still receives network information needed to accept a request; we request that it not enrich events with IP-derived location.
Change your app choice in Profile → Privacy, or your website choice through Privacy choices in the footer. Browser privacy signals may keep analytics disabled even if an earlier choice allowed it. Withdrawal stops future collection; it does not automatically erase events already received. Contact hello@nuntoapp.com for deletion requests. Because we do not attach an account identity to analytics events, we may need additional information to locate the relevant events.
Sentry error diagnostics and essential storage
When configured, Sentry error diagnostics runs independently of the optional analytics setting to help us detect failures and maintain the Service. We send scrubbed error categories, stack locations, event identifiers, timestamps and release or environment information. Our outgoing-event filter removes user information, request data, headers, cookies, form values, message content, raw error messages, breadcrumbs and attachments. We do not enable session replay, screenshots, profiling, or performance-transaction recording. In the native app this integration covers JavaScript errors; native crash reporting is not enabled in this release.
Sentry and network providers necessarily receive connection metadata such as a source IP address in transit. We minimize the diagnostic data sent, restrict access and configure provider-side privacy settings. Where applicable, our legal basis for limited operational diagnostics is our legitimate interest in maintaining a secure and reliable service; this does not override any consent requirement imposed by local law. Launch territories and the exact diagnostic configuration must be reviewed against those requirements.
The web app uses session and CSRF cookies for sign-in and security. The native app stores its session credential in the operating system's secure storage. The website stores your analytics preference locally so it can remember your choice. These necessary functions are distinct from optional analytics. Blocking essential storage may prevent sign-in or make your preference impossible to remember; if a choice cannot be saved, analytics stays disabled.
Retention and deletion
We retain account and stored content while needed to provide the Service, until you delete it or your account, subject to necessary legal, security and dispute-related retention. Deleting a message can retain a limited approval receipt for the operator-configured period (initial default: 30 days) and a submission-deduplication record until its parent connection/account is removed. Those records are separate from the deleted message content.
Account deletion removes the account and owned application content from the active database and revokes associated access. Stored object deletion runs asynchronously and retries if storage is unavailable. A limited cleanup job retains object keys and an encrypted email address until file removal and confirmation are complete. Billing-provider cleanup can also run asynchronously. App-store subscription cancellation may require action in your store account; deleting a Nunto account is not a substitute for checking store cancellation.
Backup retention: [BACKUP RETENTION PERIOD AND DELETION/RESTORE PROCEDURE]. Operational and security logs: [LOG RETENTION PERIOD]. PostHog events: [POSTHOG RETENTION PERIOD]. Sentry events: [SENTRY RETENTION PERIOD]. Billing and legally required records: [FINANCIAL/LEGAL RETENTION SCHEDULE]. These placeholders must be resolved in the published policy and reflected in provider settings. Backup copies are restricted from routine use and must be handled under the chosen deletion and restoration procedure.
Deletion cannot remove information independently held by an agent provider, app store, payment provider or another person who received a copy. Contact those recipients for their applicable deletion procedures.
Security and international processing
We use safeguards appropriate to the Service, including authenticated content access, scoped agent permissions, protected credentials, private file storage and transport security in production. No service can guarantee absolute security. Protect your account and agent credentials and report suspected misuse to hello@nuntoapp.com. We will respond to incidents and provide notifications as required by applicable law.
Information may be processed in countries where we and our providers operate, which may have different privacy laws from your country. Confirmed primary regions are [PROCESSING REGIONS]. Where required for international transfers, we will use an applicable adequacy decision, standard contractual clauses or another lawful mechanism. Required transfer arrangements and any local representatives must be established before launch in affected territories.
Your choices and privacy rights
You can update account details and preferences, disconnect agents, revoke shares, manage device notifications and request account deletion from the app. Do not send passwords, credentials or identity documents in an initial privacy request.
Depending on your location and the law that applies, you may have rights to access, obtain a copy of, correct or delete personal information; restrict or object to processing; withdraw consent; and appeal a refused request. You may also complain to your local data protection authority. Contact hello@nuntoapp.com to exercise applicable rights. We may proportionately verify identity and an authorized agent's authority, and will respond within the time required by applicable law. We do not discriminate against you for exercising applicable rights. Certain requests may be limited by law or by the rights of others.
If we process information only on behalf of a business customer, we may refer your request to that customer and assist it as required. Turning off device notifications, deleting an app or declining analytics does not itself delete your account.
Changes and contact
We will update this policy when practices change and identify the new version and effective date. We will provide notice of material changes and obtain fresh consent where required. A policy update does not by itself authorize new optional tracking or a materially incompatible use of information previously collected.
Privacy contact: hello@nuntoapp.com. Operator: [LEGAL ENTITY NAME]. Mailing address: [BUSINESS MAILING ADDRESS]. Applicable representative or privacy officer, if required for launch territories: [REPRESENTATIVE/PRIVACY OFFICER DETAILS OR NOT APPLICABLE].