Privacy Policy

1. Who processes the data

The operator of the Nola (by Darwin) service processes personal data to provide the service. A specific legal entity and its details are indicated in the payment documents, agreement or support section for the corresponding territory.

This policy applies to site, account, workspace, agent tasks, and support cases.

2. What data do we receive?

• Account details: name, email address, profile and authentication settings.
• Contents of tasks: instructions, messages, files, links, results and feedback.
• Connection data: names of integrations, issued permissions and technical identifiers. Passwords for third-party services should not be included in the task text.
• Payment information: rate, amount, currency, transaction status and payment identifiers; The payment provider processes the full card details.
• Technical data: IP address, device and browser type, request times, error logs, security events and approximate geography.
• Browser settings: theme, close notifications and cookie selection, saved locally.

3. Why and on what basis

• Execution of the contract: creating an account, performing tasks, storing history and issuing results.
• Consent: optional communications and other cases where the law requires separate permission.
• Legitimate interests: abuse prevention, diagnostics, aggregated analytics, and reliability improvements without overriding the user’s rights.
• Legal requirements: accounting, responding to legal requests and protecting the rights of parties.

4. AI Processing

To accomplish a task, content can be shared with providers of models, search, computation, storage, and other tools. Only the volume required for a specific step is transferred. Vendors and models may vary for quality, availability and safety.

Nola does not make fully automated decisions that give rise to legal consequences for the user, without a legal basis and adequate human control.

5. To whom the data is transferred

We do not sell personal information as an independent product.

• Providers of cloud infrastructure, AI models, search, monitoring, communications and payment - on contractual terms and to the extent necessary for the service.
• Organizations whose account the user uses, if this is a corporate workspace.
• To government agencies or other persons when the transfer is required by law or necessary to protect rights and safety.
• To the new business owner during reorganization while maintaining applicable data protection obligations.

6. Shelf life

Account data is retained while the account is active and for as long as necessary for settlement purposes, dispute resolution, and legal compliance. Task contents and files are stored in accordance with the selected plan, workspace settings and technical backup cycles.

Security logs may be retained longer than the main history if necessary for incident investigation. After the expiration date, the data is deleted, anonymized, or isolated until the backup copy is safely deleted.

7. International transfer

Some providers may process data in other countries. In such cases, statutory grounds and contractual protections are used. The user should not upload data whose cross-border transfer is prohibited by their organization or industry.

8. User rights

The request can be sent through the support channel in the interface. We may verify the identity and credentials of the applicant before executing the request.

• Find out what data is being processed and get a copy of it.
• Correct inaccurate information, delete data or restrict processing where permitted by law.
• Withdraw consent without affecting the lawfulness of processing prior to withdrawal.
• Object to processing on the basis of legitimate interest.
• File a complaint with the operator or the authorized body.

9. Safety and children

We use access control, transmission encryption, logging and organizational measures. No storage method guarantees absolute security, so you should not upload unnecessary secrets, passwords, or data that is not necessary for the task.

The Service is not intended for independent use by persons under 18 years of age. If your child's data has been shared without proper justification, please report this through support.