Privacy policy

The essentials

• Napyon stores your data in Frankfurt, Germany. We don’t sell data for money and don’t show ads in Napyon.
• On our website and the pages up to sign-up and payment, we measure only with your consent which of our ads (Meta, and LinkedIn and Google if active) bring people to Napyon. Nothing for this loads without your consent. There is no ad measurement in the app with your content. You can change your choice anytime under “Cookie settings” at the bottom of the page.
• Napyon AI, the AI built into Napyon, only receives content when you explicitly use it. Technically, we use models from Anthropic for it. We label what Napyon AI creates or changes. If you connect Claude or ChatGPT (OpenAI) to Napyon yourself, the AI only sees the content it is working on for you at that moment.
• Conversations you record or upload in a client file are transcribed by our provider Soniox and analyzed by Napyon AI. We delete the audio file right afterwards; the transcript stays in the client file until you delete it. Whether you may record depends on the law where everyone involved is; as a rule, you need everyone’s consent.
• You can export your content anytime and delete your account yourself.

1. Controller

The controller responsible for processing your personal data is:

Wimbex UG (haftungsbeschränkt)
Pulverturmstraße 8, 84028 Landshut, Germany
Represented by its managing director, Felix Wimberger
Local Court (Amtsgericht) of Landshut, HRB 15568
Phone: +49 160 7255274
Email: support@napyon.com

We have not appointed a data protection officer because the legal requirements for one are not met. For questions about data protection, write to us at the address above.

2. What Napyon is and who this policy covers

Napyon is a web app for projects and everyday life: boards, docs, databases, lists, the Today overview and client files. This policy covers the website (landing page, pricing, legal texts, report form), the app at the same address, the installable home screen app, the Web Clipper browser extension, the connection with Claude and ChatGPT, and client areas and share links that our users share with others.

If you use Napyon for your business and store other people’s data there (for example your clients’), you are responsible for that data and we process it on your behalf. Our data processing agreement covers this.

3. Visiting the website and server logs

When you open a page of Napyon, the servers process technically necessary data: your IP address, date and time, the address requested, browser and operating system (user agent) and the referring page. We need this data to deliver the pages, find errors and fend off attacks. From the IP address our host Vercel derives the country you open Napyon from; Napyon only uses it to show prices in the right currency (euros in the EU, the EEA, Switzerland and the United Kingdom, otherwise US dollars) and doesn’t store it. The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR). Vercel deletes the logs of its server functions after one day, Supabase the logs of the database and interfaces after seven days.

If a page violates the browser’s security rules (Content Security Policy), the browser reports it to us. We only store the rule, the blocked source and the address without identifiers or parameters, no IP address and no browser details. We keep at most the latest 1,000 reports.

To prevent abuse, we count requests, for example for sign-up, the waitlist, cancellations, reports, logins and when client areas and share links are opened. We don’t store the IP address or email address in plain text, only as a one-way hash, which is deleted after seven days at the latest.

4. Account and login

For an account, we process your email address, your password (only as a secure hash), your display name, your settings (language, time zone, reminders, notifications) and, if you set it up, your two-factor authentication. For your sessions we store the device or browser, IP address and time, so you can see under Settings › Account where you are logged in and log out everywhere. When you sign up, including through an invitation to a workspace or a page, we also store when you agreed to the terms of service, the versions of the terms and of this privacy policy we showed you, and the language you signed up in.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Without this data we can’t offer you an account.

5. Your content

We process everything you create in Napyon to store it and show it to you and the people you share with: pages, cards, texts, tasks, comments, mentions, databases, client files and uploaded files including file names. Files are kept in private storage and can only be reached through signed links that expire. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Napyon keeps earlier versions of every page in the version history. They are deleted after 90 days. Deleted pages go to the trash and stay there until you restore them or delete them permanently.

For collaboration we process the email addresses and roles of people you invite (members of a workspace or guests on single pages) and share links. We store links and invitations only as a hash, and a link password only as a secure hash. People on the same page can see who else is there (real time). Notifications contain a short excerpt; we delete read notifications after 90 days.

If you export a whole workspace as a backup, Napyon replaces other people’s names and email addresses with random codes.

Client areas, share links and approvals

You can share content without a login: through a share link to a page, a client area for your client or a link to approve a delivery. When someone opens such a link, Napyon only shows the content you shared and stores when it was last opened, approvals and change requests with the message and name the person enters, and files they upload on your behalf. You are responsible for this content and these approvals; we process them on your behalf (DPA). We are responsible ourselves for the security of these pages (server logs under section 3 and counting requests to prevent guessing links); the legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR). We store the links only as a hash, you can revoke them anytime, and search engines don’t index them.

6. Emails

We send you emails that are part of running Napyon: sign-up confirmation, a note if an address already has an account, password reset, invitations and shares, confirmation of a cancellation and of your account deletion. You get task reminders when you set a reminder; the daily digest and email notifications only if you turn them on in the settings. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

When you invite someone, we send that person a one-time invitation on your behalf. The legal basis is our legitimate interest and that of the inviting person in working together (Art. 6(1)(f) GDPR).

We send all emails from the address support@napyon.com through our provider Resend (see section 15). If you reply to an email, your reply lands in our mailbox (section 7). We don’t send newsletters or marketing emails.

7. Contacting us by email

If you email us, we process your email address, your name if you give it and the content of your message to reply to you. If it concerns your contract or account, the legal basis is the performance of the contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). Providing this is voluntary, but without an address we can’t reply. We delete your message once the inquiry is settled, at the latest three years after the end of the year in which it was settled. If it is a business letter, we keep it as long as commercial and tax law require (six years).

8. Plans, payment and cancellation

When you buy a paid plan, payment runs through Stripe. We pass on your email address, display name, language, the name and ID of the workspace, the plan, billing period and currency, and when you agreed to the immediate start and which version of the terms you agreed to. You enter your billing address, payment details and, if applicable, your VAT ID directly at Stripe; Napyon never sees card numbers or bank details. Stripe creates invoices and receipts. At Napyon we store the IDs at Stripe, the status, period and currency of the subscription and the number of seats. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations under tax and commercial law (Art. 6(1)(c) GDPR). Stripe is itself responsible for its own purposes such as fraud prevention; see Stripe’s privacy policy.

If you cancel via Cancel your subscription, we store your name, email address, workspace, the requested date and when the cancellation arrived, and send you a confirmation with date and time. The legal basis is our legal obligation to confirm receipt (Art. 6(1)(c) GDPR in conjunction with Section 312k of the German Civil Code) and our legitimate interest in being able to prove the cancellation later (Art. 6(1)(f) GDPR). We keep this data for three years from the end of the year in which the cancellation arrived (regular limitation period, Sections 195 and 199 of the German Civil Code).

9. Napyon AI, Claude and ChatGPT (AI features and connections)

On the Pro and Team plans and during the free trial you can use Napyon AI, the AI built into Napyon. Napyon AI is part of our service; technically, we use models from Anthropic for it. Napyon only sends content to Anthropic when you explicitly start Napyon AI, and only what the task needs: for example the selected text, the cards of a board (at most 200 cards), a client file or your request. Napyon replaces @-mentions of people with codes such as “@Person1” or “@Member”. Names written in the text itself, as well as transcripts and details in client files, go to Anthropic as they are in Napyon, which includes real names. Files are sent only by name, images never. For each request Napyon itself only stores the type, model, size and cost, not the content.

The legal basis is the performance of the contract, because you request the feature (Art. 6(1)(b) GDPR). Anthropic processes the content as our processor and does not use it to train AI models under its contract terms. Anthropic generally deletes inputs and outputs after 30 days; content Anthropic flags for a suspected violation of its usage policies up to two years later. Napyon AI’s results are generated by a machine; check them before you use them. We label what Napyon AI creates or changes: cards and passages of text carry a marker and the note “Created with Napyon AI”, and the marker is included in exports.

If you connect Napyon to your own Claude (the connector in claude.ai or Claude Code) or your own ChatGPT (a custom connector in ChatGPT), the AI only reads and writes content in Napyon at your instruction and only in the workspace you choose when connecting. It only receives the content it is working on for you at that moment, for example a search result, a page it reads or your tasks for today. Napyon doesn’t send anything to Anthropic or OpenAI on its own. What Claude or ChatGPT processes in doing so happens under your own contract with Anthropic or with OpenAI (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland); whether OpenAI uses this content, for example for training, depends on your ChatGPT plan and your settings there. The legal basis for Napyon providing the content is the performance of the contract, because you set up the connection yourself (Art. 6(1)(b) GDPR). For the connection Napyon only stores which app is connected, since when and when it last accessed Napyon; personal access keys only as a hash. You can disconnect any connection anytime under Settings › Connections; afterwards the app immediately can’t read or change anything.

Conversations in client files

In a client file (Pro and Team plans) you can record conversations, in person with your device’s microphone or during an online meeting via the shared meeting tab plus microphone, or upload audio, video and finished transcripts. Napyon never records secretly and never joins a meeting: before every recording and upload you confirm that everyone involved has agreed; we note the time and person in the client file’s timeline. You or your company are the controller for the content of the conversations; Napyon processes it on your behalf (DPA).

Two questions have to be kept apart. First, whether you may record a conversation at all: this depends on the law where everyone involved is. In Germany, recording privately spoken words without authorization is a criminal offense (Section 201 of the German Criminal Code), and several US states such as California require the consent of all parties; as a rule, you therefore need everyone’s consent (see terms). Second, the legal basis under the GDPR for your conversation partners’ data: you determine it as the controller (for example a contract with them or your legitimate interest), and you inform your conversation partners about the processing. Consent to being recorded is not automatically consent under the GDPR.

While you record, your browser keeps the recording in small parts on your device and continuously uploads them to our private storage in Frankfurt, Germany, so nothing is lost if the connection drops. After the conversation, Napyon joins the parts into one file and has it transcribed: the audio file goes to Soniox, Inc., 1045 Helm Ln, Foster City, CA 94404, USA, which transcribes it in its EU region and doesn’t use it for training; Napyon retrieves the finished transcript and has it deleted at Soniox right away (otherwise Soniox deletes it after 30 days at the latest). Then Napyon AI analyzes the transcript together with the client profile and suggests what has changed; only what you accept goes into the profile. For this, the transcript, the speakers’ names and the client profile go to Anthropic (see above). We delete the audio file and its parts immediately after a successful transcription, after seven days if processing fails for good, and aborted uploads after one day. The transcript stays in the client file until you delete the conversation, the client or your account. For each conversation we also store the duration, billed minutes, provider, model and costs, not the content.

The legal basis for processing your own data is the performance of the contract (Art. 6(1)(b) GDPR). We process the data of the other participants as your processor, following your instructions, on the legal basis you determine.

10. Content from other sites

Link previews: When you add a link, Napyon’s server fetches the linked page (for YouTube, Vimeo and Spotify their preview interface) to read its title, description and preview image. The linked site sees our server’s address, not yours. Your browser loads the preview image and icon of an ordinary website directly from that site, without sending the address of your Napyon page (no referrer); the other provider receives your IP address. The same applies to cover images you add by address. The legal basis is our and your legitimate interest in showing an added link in an understandable way (Art. 6(1)(f) GDPR); if you don’t want this, add the address as text.

Embedded videos, music and maps: For YouTube, Vimeo, Instagram, Spotify and Google Maps, Napyon first shows only a preview. Napyon loads their preview image and icon through its own server, so the provider sees our server’s address, not yours. The same applies to preview images and icons of links to these services. Only when you click “Play” does your browser load the provider’s player; the provider then receives your IP address and may set its own cookies. We embed YouTube in privacy-enhanced mode (youtube-nocookie.com) and Vimeo with “Do Not Track”. The provider is responsible for processing inside its player. The legal basis is your click (Art. 6(1)(a) GDPR and Section 25(1) TDDDG).

Remove background: To cut out images, your browser downloads a model from Hugging Face (Hugging Face, Inc., USA) once, after you explicitly confirm. Hugging Face receives your IP address; no cookies or referrer are sent. Your images never leave your device for this. The model stays in your browser’s storage. Hugging Face is not our processor; your browser fetches the model directly. The legal basis is your confirmation in the dialog (Art. 6(1)(a) GDPR).

Web Clipper: The browser extension stores the Napyon address, your access key and the workspace name in your browser and sends what you select to Napyon. For images, Napyon’s server downloads the image from the original page.

Import from Milanote: For an import, Napyon only reads the file you upload. No data is fetched from Milanote.

11. Cookies, browser storage and ad measurement

Necessary: These cookies and browser storage entries are strictly necessary for the service (Section 25(2) no. 2 TDDDG) and always on.

Marketing (only with your consent): On the website (home page, pricing, switching, legal texts, report form) and on the pages up to sign-up and payment (log in, sign up, password, confirmation, first steps, return after a purchase), a banner asks whether we may measure which ads bring people to Napyon. “Accept” and “Reject” are equal; under “Settings” you can choose the categories “Necessary” and “Marketing” one by one. Before you agree, nothing for ad measurement loads and our server sends nothing to the providers. In the app with your content (boards, documents, client files), in client areas and on share links, these services never load. We store your choice with version and time in the cookie napyon_consent; you can change or withdraw it anytime with effect for the future under “Cookie settings” at the bottom of each of these pages and in the app’s settings. Withdrawing takes effect immediately: no further events go out and the providers’ cookies are deleted. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

With your consent, the following happens:

• Meta Pixel and Conversions API (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland): Your browser loads Meta’s pixel. It reports views of website pages and these events: account created, trial started (address confirmed) and first payment (with amount and currency). Our server sends the same events directly to Meta (Conversions API) with the same event ID, so Meta counts each only once. Meta receives your IP address, browser and operating system (user agent), the page address, the identifiers from the cookies _fbp and _fbc or from the link of an ad (fbclid), and your email address and an identifier of your account only as an irreversible hash (SHA-256). Meta matches this data with Facebook and Instagram accounts to show us which ads work and to deliver ads. We have turned off the pixel’s automatic collection of clicks and page content. For collecting and transmitting data with the pixel, we and Meta are joint controllers (Art. 26 GDPR, Meta’s Controller Addendum, facebook.com/legal/controller_addendum); you can exercise your rights with us or with Meta. Meta alone is responsible for any further processing (Meta Privacy Policy).
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland), only if we have turned it on: measures website page views and the same events (account created, trial started, first payment) with IP address, user agent, page address and the identifier from the link of an ad (li_fat_id) (LinkedIn Privacy Policy).
• Google Ads with Consent Mode (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), only if we have turned it on: measures the same events as conversions, with IP address, user agent, page address and the identifier from the link of an ad (gclid). With your consent, Google is allowed ad cookies, user data and personalized ads, never analytics (Google Privacy Policy).
• Origin: We remember where you first landed (the ad’s UTM parameters, the click identifiers fbclid, li_fat_id and gclid, the referring website without path and the first page without parameters) for 90 days in the cookie napyon_attr and store it with your account when you sign up, together with your choice (version and time). This shows us, in an evaluation without names or addresses, how many sign-ups, trials and paying customers come from which campaign. For events our server sends later (trial started, first payment), we keep your IP address, user agent and the cookies _fbp and _fbc for seven days at most. If you reject, we store none of this, only your choice.

In your browser’s local storage, Napyon remembers interface settings (for example theme, expanded pages, recently visited pages, board viewport, drawing pen) and cached links to your files. Napyon deletes these entries when you log out. The installable app only stores an offline page and an icon. Content shared through your phone’s share menu stays in the browser until it is saved, for one day at most. A recording in a client file stays in your browser’s storage (IndexedDB) until it is fully uploaded and is deleted there as soon as the conversation is finished.

12. Reports of illegal content

Anyone can use our report form to report content they consider illegal, without an account, including copyright infringement under the US Digital Millennium Copyright Act (DMCA). We process the address of the reported content, the explanation, your name and email address, and for copyright reports also the description of the protected work, your postal address, phone number and your statements including your signature (your name). We use this data to review the report, to confirm receipt and tell you our decision, and to give reasons for any content we restrict. The legal basis is our legal obligation under Articles 16 and 17 of Regulation (EU) 2022/2065 (Digital Services Act) in conjunction with Art. 6(1)(c) GDPR, and for copyright reports under the DMCA our legitimate interest in handling them (Art. 6(1)(f) GDPR).

If we restrict content, we tell the affected person which content we restricted and why. We only pass on your name and contact details if you agree or the law requires it; for copyright reports under the DMCA, the affected person can file a counter-notice, which we forward to you. We keep reports and decisions for three years from the end of the year in which we closed the report.

13. Waitlist

While sign-up is closed, you can join the waitlist. We only store your email address and the date, to let you know when we launch. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw anytime by email to support@napyon.com. We delete the list once we have notified everyone at launch. If you create and delete an account with the same address, the entry disappears too.

14. Retention and deletion

• Account and content: until you delete them. Under Settings › Account you can delete your account yourself. This deletes all workspaces where you are the only owner, with all content and files. What you contributed to other people’s workspaces stays there without your name (“Former member”).
• After the trial or subscription: If a workspace has neither a subscription nor the free trial, it is read-only and stays readable and exportable for 12 months. If you don’t buy a plan in that time, we delete the workspace with all content and files; we email you 30 and 7 days before. We never delete workspaces with a running subscription, an open invoice or a special grant this way. Your account stays. So that each person gets only one trial, we note on your account that you have used it (deleted together with the account). We keep a log of these steps (workspace ID, time, type of email or deletion, without names or addresses) as proof for three years from the end of the year of each step. The legal basis is the performance of the contract and our legitimate interest in a traceable process (Art. 6(1)(b) and (f) GDPR).
• Server logs: one day (Vercel) or seven days (Supabase).
• Backups: Our database provider creates daily backups that are overwritten after seven days. Deleted data then also disappears from the backups.
• Invoices and accounting data: as long as tax and commercial law require (currently eight years for accounting records and ten years for books and annual accounts).
• Cancellations: three years from the end of the year in which the cancellation arrived.
• Emails to us: until the inquiry is settled, at most three years from the end of the year in which it was settled; business letters six years.
• Reports: three years from the end of the year in which we closed the report.
• Waitlist: until launch (section 13).
• Conversations in client files: audio files and recordings immediately after transcription (seven days if processing fails for good), transcripts until you delete them.
• Ad measurement: your cookie choice and where you first landed, until you delete your account; IP address, user agent and the identifiers _fbp and _fbc for later events for seven days at most or until the first payment has been sent; the event log (type, time, amount, without names or addresses) until you delete your account. What Meta, LinkedIn and Google have received, they store under their own rules.
• Version history: 90 days. Read notifications: 90 days. Abuse-prevention hashes: seven days at most.

15. Recipients and transfers outside the EU

We use carefully selected service providers. Processors only process data on our behalf and following our instructions (Art. 28 GDPR); the other recipients are responsible for their processing themselves. Your content is stored on servers in Frankfurt, Germany. Some recipients are based in the USA or Singapore or access data from there, for example for support and maintenance. These transfers are covered either by an adequacy decision of the European Commission, for the USA the EU-U.S. Data Privacy Framework for certified companies (Art. 45 GDPR), or by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

We send you a copy of the standard contractual clauses on request. Apart from that, data only goes to providers you reach yourself (section 10, for example an embedded player after your click), to the AI services you connect to Napyon yourself (Anthropic for your own Claude, OpenAI for your own ChatGPT, section 9), and to authorities where we are legally required to share it.

16. Security

All connections are encrypted (HTTPS, also when sending emails). The database is encrypted at rest. Every table is secured so that only members of a workspace can see its content; guests, share links and client areas only see the content shared with them. Passwords need at least ten characters and are checked against known data breaches, and two-factor login is available. More in the technical and organizational measures of our data processing agreement.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR; the export under Settings › Export and backup is made for this). You can withdraw consent anytime with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Write to us at support@napyon.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

18. No automated decisions

We don’t make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR). Napyon AI doesn’t decide anything for you either: you choose what to keep from its suggestions. A human reviews reports of illegal content.

19. For users in the United States

Do Not Track: Our website doesn’t respond to the browser’s Do Not Track signal, because there is no binding standard for it. You don’t need it either: without your consent in the banner there is no ad measurement, whichever country you open Napyon from. A Global Privacy Control signal doesn’t change that.

Tracking by third parties: Other companies can only collect data about your activities through our website if you agree to ad measurement; section 11 lists which providers these are and what they receive. We don’t sell personal data for money. Disclosing data to Meta (and LinkedIn and Google if turned on) for ad measurement may count as “sharing” for advertising under the laws of some US states; it only happens with your consent, and you can stop it anytime under “Cookie settings”. There is no ad measurement in the app with your content.

Changes: Section 20 explains how we tell you about changes to this policy.

Children: Napyon is not directed at children. Only people aged 18 or older may create an account. If we learn that we are processing data of a child under 16, we delete it.

20. Changes

We update this policy when Napyon or the law changes. Every version has a number and a date; the current one is always on this page. We tell you about material changes in advance by email or in Napyon.