Nicco Privacy Policy
DRAFT — NOT YET PUBLISHED. Version number is assigned on approval. A working draft for review, not legal advice, and not reviewed by a lawyer. [COUNSEL] marks clauses that need a decision from someone qualified. Everything in the "how it actually works" column below describes mechanisms that are already built and enforced in the database, not intentions. Where something is not yet built, it says so. Audited against the software on 2026-09-09.
Effective: on publication Applies to: niccohq.com and the Nicco service
The short version
- Nicco sees only what you copy it on or forward to it. It never connects to
your mailbox.
- The fact that you know someone can be shared with other Nicco users, if you
choose. Their email address and phone number never are.
- People who are not Nicco users do not get a public profile because you know
them.
- A conversation you record and send stays between you and the people you
copied. Your own words in it are yours to share; the other person's are theirs.
- Nicco does not sell your data and does not train AI models on it.
- You can export everything and you can ask for it to be deleted.
1. What Nicco collects
From you directly: your name, email address, company, your public professional profile URL, and your role. Any additional email address you add, verified from that address, and what you say it is for. Your answers to the questions Nicco asks you by email.
From emails you copy Nicco on, or forward to it: the sender, recipients and CC list, the subject, the body, and any attachments. Nicco records who was on the message so it knows who is entitled to see it. When you forward emails from your own history, Nicco files only the ones you were a party to and records that you forwarded them.
From recorded conversations you send: the statements each speaker made, each tied to the exact words it came from, and the names of people mentioned.
From connection exports you send: for each connection, their name, employer, job title, public profile URL, the date you connected, and — only where the export contains it — an email address. In practice fewer than 3% of rows carry one, because the source only includes it when that person opted in.
Automatically: basic technical logs needed to run and secure the service.
2. What Nicco does with it
| Purpose | Legal basis [COUNSEL: confirm for GDPR/UK GDPR] |
|---|---|
| Finding and showing introduction paths, and drafting introductions for you to send | Contract |
| Categorizing email you copied Nicco on, and drafting replies | Contract |
| Reading a recorded conversation you send into statements and telling you what it recorded | Contract |
| Asking another Nicco user, at your request, whether they are open to an introduction | Contract |
| Sharing your connection facts, or your own statements, with other Nicco users | Your consent, recorded and revocable |
| Security, abuse prevention, and logs | Legitimate interests |
Where Nicco sends replies
Nicco answers the address a message came from, and only addresses you have verified as yours. Whoever controls that mailbox, for example an employer or a mail administrator, can read what Nicco sends there. Choosing which address to write from is your choice of channel. When you add an address, Nicco records that choice and the purpose you gave, so that "why did this land there" has an answer. Nicco never sends another person's private contact details to any address; see section 3. [COUNSEL: the same question as terms section 3 - responsibility for a user-chosen corporate mailbox.]
3. Information about people who are not Nicco users
This is the part that deserves your attention, because those people did not choose to be here.
When you share your network, Nicco holds information about people who have no account. Nicco applies a hard split, enforced by two independent mechanisms in the database rather than by policy alone:
May be shared with Nicco users you have chosen to share with: the fact that you know them, their employer, their job title, when you connected, and their public professional profile URL — all of it published professional information.
Never shared with anyone, under any setting: their email address, their phone number, and any private note you wrote about them.
Additionally:
- They are not added to any public or shared directory. Knowing someone does
not create a profile of them that other users can browse.
- You can exclude any individual permanently, and that exclusion overrides
every sharing setting you have, now and in future.
- A person can ask what Nicco holds about them and ask for it to be removed. See
section 8.
People on a recorded conversation
When you send a transcript, Nicco holds statements made by and about the people on that call, most of whom are not Nicco users.
- Who can read it: you, and the people you copied on the email that
carried it. Nobody else, and no setting of yours changes that.
- Whose words can be shared more widely: each speaker's own, only by that
speaker. If the other person is not a Nicco user, their words cannot be shared at all; they can still inform which introductions Nicco suggests to people who may read them, and are never repeated to anyone who may not.
- People who were not on the call: Nicco records that they were named and
what was said they do, and does not record negative statements about them.
- Introduction asks: if you ask Nicco to, it tells another Nicco user the
name and public professional profile of a person you spoke with, and a few sentences on what that person is doing from your conversation, to ask whether they are open to an introduction. Nothing about that person goes to anyone who does not have a Nicco account.
4. What Nicco does not do
- Nicco does not sell personal data.
- Nicco does not use your data to train AI models, and its AI provider is
contracted not to train on data sent through its API.
- Nicco does not connect to your mailbox. It receives only messages you
actively copy it on or forward to it. Real inboxes contain tax documents, cap tables and confidential agreements, and Nicco is built so that it never sees them.
- Nicco does not share private contact details between accounts.
5. Who else processes your data
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | [COUNSEL: confirm region] |
| Anthropic | AI processing of email content, written notes and recorded conversations | US |
| Resend | Sending and receiving email | US |
| GitHub | Source code only — no customer data | US |
| Web host for niccohq.com pages | Static pages only — no customer data | [BUSINESS: name the host once chosen] |
Anthropic does not train on data submitted through its API. Content Nicco sends to Anthropic to produce a reply or a suggestion is held by Anthropic for the time its API retains inputs and, where Nicco uses prompt caching, for the cache's lifetime; Nicco's memory tool stores nothing with Anthropic, because the store is Nicco's own database. [COUNSEL: confirm the retention period from Anthropic's current API terms and whether it needs stating here.]
[COUNSEL: confirm whether a DPA is in place with each, and whether standard contractual clauses are needed for transfers.]
Nicco personnel
People who work on Nicco — employees and contractors — can access customer material when they need to. In practice that means building and fixing the system, investigating a problem you have reported, and reviewing how well the matching works.
Two things bound it:
- Everyone with this access is under a written confidentiality agreement
before they get it.
- [NOT YET TRUE — DO NOT PUBLISH THIS LINE UNTIL IT IS] *Access is
recorded. When a member of staff reads material belonging to a customer, the system logs who read it and when, and you can ask us for that record about your own data.*
This is a different door from the sharing you control. When you share a connection with another Nicco user, that is your decision and you can revoke it. Staff access is not something another user can grant themselves or extend to anyone else, and it does not widen what other customers can see.
[BUILD BLOCKER, 2026-08-05: the logging line above is written but is NOT implemented, and this section must not ship until it is. An attempt to log from inside the row-level security check failed outright — PostgREST runs reads in a read-only transaction, so a policy predicate cannot write. Worse than not logging: it broke every admin read (25006) until reverted. Staff read auditing has to live at the query layer — an RPC or the MCP surface — which runs read-write and actually knows what was asked for. The staff_access_log table exists and is empty. Publishing a promise the system does not keep is worse than disclosing the access plainly with no promise attached.]
[COUNSEL: this describes a real access path (platform_admins in the schema, honored by 28 of 50 row-level security policies). It needs to be disclosed rather than discovered. Please confirm the wording meets GDPR Article 13/14 transparency requirements, whether contractors count as processors requiring their own DPA, and whether the logging commitment above should be a stated retention period.]
[COUNSEL: a founder's material here can include cap tables, raise plans and private views about named investors. Consider whether that warrants a higher bar than a standard confidentiality agreement — for example named-individual authorization rather than blanket staff access.]
6. Automated processing
Nicco uses AI to categorize incoming email, draft replies, read recorded conversations into statements, and suggest introductions.
Three safeguards are built in:
- Every extraction must quote its source. If the AI cannot point at the
exact sentence it drew a statement from, the software discards the statement automatically.
- AI output is a suggestion, not a fact. Extracted statements are marked as
proposals. Nicco uses them to suggest introductions to you and to the person who sent the conversation, and each suggestion cites the statements it rests on; Nicco does not suggest what it cannot cite. Nothing is shared more widely or added to the shared graph on a proposal alone: that takes a person's decision — yours, the other person's, or a reviewer's — and the decision is recorded.
- **Nicco records which information came from a model and which from a
human**, and what source text an extraction came from.
Nicco does not make decisions that produce legal effects about you. You may request human review of any automated decision that materially affects you.
7. How long Nicco keeps things
| Account and profile | While your account is open |
| Captured emails, attachments and recorded conversations | [COUNSEL / BUSINESS: propose 24 months from receipt, matching the retention already recorded in the system] |
| Connection exports | Until you delete them or close your account |
| Consent records | Kept after deletion, because they are the evidence of what you agreed to |
| Access logs | [COUNSEL: propose 12 months] |
Nicco archives rather than hard-deletes internally, so that removing one person's data does not corrupt records belonging to others. Archived data is excluded from all processing and access.
8. Your rights
You may access, correct, export, or delete your data, withdraw consent (which suspends sharing and access), and object to processing. Requests go to privacy@niccohq.com and Nicco will respond within 30 days.
If you are not a Nicco user but believe Nicco holds information about you because someone in your network shared it or recorded a conversation with you: write to the same address. Nicco will tell you what is held and remove it on request. [COUNSEL: confirm the process and the response obligation for non-users.]
[COUNSEL: confirm which regimes apply — GDPR, UK GDPR, CCPA/CPRA — and add the specific disclosures each requires.]
9. Security
Data is encrypted in transit and at rest. Access is controlled per user and enforced in the database itself, not only in the application: every record carries who may read it, and a read that crosses accounts is refused there. Nicco's own automated reads across accounts are logged with what was read and why; staff reads are not yet logged, as section 5 says.
10. Children
Nicco is not for anyone under 18 and does not knowingly collect their data.
11. Changes
Each revision is published as a new numbered version with a permanent record of its exact text. Material changes require your agreement before they apply to you.
12. Contact
privacy@niccohq.com
Document fingerprint (sha256)
5e050c7548ceba7f9c135064b03e96c0913e7b46c2411d5317a08ea78749a2f3