Who is responsible for your information
nonono is an independently operated service based in Israel. For business discovery, proposals, account administration, payments, support and service security, the operator determines the purposes of processing. This notice concerns nonono.ai, its application and those activities.
For business discovery and outreach, nonono determines why prospect information is collected and used. For enquiries, conversations and appointments handled on behalf of an agreed business customer, that business may determine the purposes and nonono may process information under its instructions. The actual responsibilities depend on the activity and the agreed service; the Data Processing Addendum addresses applicable processor work.
Information we receive
Account information includes your name, email address, password hash, language, memberships, permissions, sign-in and security records. Workspace information includes business briefs, campaigns, research queries, pages, brand assets, provider account identifiers and private authorization credentials.
Business-discovery records can include public listing details, a business website, contact details, source and observation date, staff research notes, a contact-permission decision, communications and meeting notes, proposal versions, electronic-acceptance evidence and payment references. A public listing is not treated as permission to send marketing messages.
If you check your business on the public website, we record the name or URL you enter, the business match you select, your answers, the public sources and observation dates used for the initial findings, and the resulting brief and estimate. If you ask us to save or email the result, we also use your contact details for that request and may follow up about it as explained at collection. Separate optional marketing messages require a separate choice. A time-limited access token lets you resume this journey; it is not a customer account. A purchaser can request a new link through the email address used for the order.
Customer records may include contact details, form answers, enquiry sources, permission choices, messages, notes, uploaded files, tasks, appointments and business outcomes. Connected providers may supply authorized leads, calendar availability, advertising reports and delivery receipts. Support requests include what you send us and the reply history. Please do not send passwords, API keys, identity documents or unrelated sensitive records to support.
When you order research or accept a campaign proposal, we keep the exact order or proposal version, terms acknowledgement, payment status, research and evidence snapshots, delivery receipts and, where applicable, signature evidence. In the separate client portal, we record access and the lead feedback you submit, including status, time and dispute details. The portal does not give you access to the nonono team workspace.
PayPal processes payment credentials. nonono receives the order- or proposal-specific transaction and payment status needed to supply the purchased service; it does not collect your complete card number or PayPal password. Technical requests can include IP addresses, browser information, timestamps and security or error events.
Purposes and legal grounds
We use necessary account and service information to supply the service you request and administer your agreement. Where the GDPR or UK GDPR applies, the relevant grounds are performance of a contract with you; legitimate interests in administering business relationships, security, abuse prevention, troubleshooting and defending claims, balanced against people's rights; and applicable legal obligations for billing and compliance records. These grounds do not replace the requirements of Israeli law: where it applies, collection and use must have informed consent or another applicable legal authority and follow the disclosed purposes.
Optional advertising measurement requires a separate affirmative choice. A privacy-notice acknowledgement is not consent to marketing or to every use of information. Customers must identify the lawful basis for their own lead collection and outreach; importing a contact or accepting a form does not automatically grant permission for every communication channel.
We use the information supplied in the public journey to identify the requested business, produce sourced findings, ask for missing details, prepare a preliminary non-binding estimate and, if ordered, deliver the paid research plan. Contact about that specific request is separate from optional promotional mail. Research assistance can use selected business facts and public-source material with our AI and market-data providers; a source-backed finding is distinct from an inference or an unverified claim.
Providing information is generally voluntary, rather than a statutory duty. Without the fields needed for registration, payment or a requested action, that part of the service cannot be provided. Optional fields and measurement choices should not prevent an ordinary enquiry.
How AI uses information
When you request AI research or content, the relevant brief, approved business facts, instructions and selected assets can be sent to the AI provider. If you enable an approved AI reply policy, relevant conversation text and approved reply options can be sent for classification. Do not include information that is unnecessary for the task. nonono does not use customer lead lists to train its own general-purpose AI model.
AI may be inaccurate. It assists content and workflow decisions; the service is not intended to make solely automated decisions about a person's eligibility for credit, insurance, employment, housing or other similarly significant matters. AI support chat, if introduced, will be identified and its provider and data use disclosed before activation.
How long information is kept
Business-discovery, offer, signature, payment, account and workspace records are retained while needed to provide the agreed service and meet justified legal, security or dispute requirements. Ending a campaign does not itself erase these records. Request deletion or export separately; categories required for billing or a dispute may be retained longer.
An unfinished public business check expires and its access token stops working. We remove expired journey content that has no order after the operational recovery window; an order, payment, refund, delivered plan or signed proposal keeps records needed for recovery, delivery, accounting, security and disputes. Clearing browser storage removes the local resume token but does not itself erase server records; contact privacy@nonono.ai for a rights request.
Raw native lead-source records and outbound webhook payloads are retained for up to 30 days. Deleted lead attachments become unavailable immediately, can be restored for 30 days, and are then purged by retention processing. Advertising-measurement permission expires after 90 days; provider-event payloads can expire sooner. Minimal delivery, security and suppression records may remain without the original content.
Expired or revoked sign-in sessions and expired or used account-verification tokens are removed after a seven-day troubleshooting window. Expired rate-limit records are removed after one day. Completed or failed identity-email delivery records are removed after 30 days; message content is cleared when delivery succeeds or is terminated. These cleanup windows do not delete the account, billing records or terms-acceptance history.
Encrypted backups are isolated from ordinary use. Erasure records are reapplied during recovery so a restored backup does not silently restore erased lead access. Backup expiry, billing-record retention and third-party deletion can follow different schedules. We assess exceptions for a specific request and explain any information that must be retained.
Your choices and rights
Contact privacy@nonono.ai to request access, correction, deletion, restriction, portability or to object to processing, as applicable under the law. You can withdraw consent without affecting processing that was lawful before withdrawal. We may ask for proportionate verification of your identity and authority; do not send identity documents unless specifically necessary and requested through an appropriate channel. Requests are normally free.
For an enquiry submitted to a customer campaign, contact the business identified on that page. If you contact nonono, include the page address and enough information to locate the enquiry; we will assist the responsible customer. An administrator's full-workspace export contains other people's information and must not be sent unfiltered to a single requester.
Where GDPR applies, we respond without undue delay and ordinarily within one month. If a lawful extension is necessary because of complexity or number of requests, we explain it within that first month. Other applicable laws may set different deadlines. You may complain to the Israeli Privacy Protection Authority, your competent EEA supervisory authority or the UK's ICO. Contacting us first is not a condition for a regulatory complaint.
Security, children and updates
We use access controls, encrypted private records, revocable sessions, protected provider credentials and backup safeguards. No internet service can promise absolute security. Report a suspected issue to security@nonono.ai without including unrelated personal data. Account use is intended for adults; do not knowingly submit children's data or special-category information through ordinary lead forms.
We may update this notice when the service or its processing changes. The dated version is shown here. Material changes will be brought to affected users' attention and fresh consent obtained where required. Browser storage and page measurement are explained separately.