Privacy
This page explains what Nagata collects, why, who processes it, and how long we keep it.
What we collect
Data you give us:
- Account data: email address, optional display name, and a password that our authentication provider stores hashed. We never see it in plain text.
- Workspace data: workspace name, members and their roles.
- Vendor spend: vendor names, amounts, dates, and optional categories, departments and notes.
- AI usage: provider, model, workflow, cost, and optionally the user and token counts.
- Contracts: the files you upload and the fields we extract from them.
- Decisions: actions taken on recommendations, with optional notes and savings amounts.
- Support conversations: what you send us through the support assistant or by email.
Data collected automatically:
- Audit log: every change in a workspace records who made it, when, the IP address and the browser. Audit entries never contain document contents.
- AI usage metering: when a Nagata AI feature runs, we record the workspace, model, token counts and cost so we can enforce your plan's AI budget.
- Session cookies: to keep you signed in. They are HttpOnly and Secure.
- Website analytics: on nagata.ai we use Google Analytics, but only after you accept cookies in the banner. Until then it runs without cookies.
We do not collect advertising identifiers, browser fingerprints, or anything from your inbox, calendar, chat tools or SaaS accounts beyond what you choose to upload or connect.
How we use it
Only to run Nagata for you: building your vendor inventory, recommendations, alerts and reports, answering your questions, enforcing plan limits, sending invitations and support updates, and keeping the service secure. We never sell your data and never use it to train AI models.
Subprocessors
These services process customer data on our behalf:
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Database, file storage, authentication | All workspace data, files, accounts | United States |
| Fly.io | API hosting | Data in transit through our API | United States |
| Vercel | Website and app hosting | Page requests | United States |
| Anthropic | AI features (Claude models), including web search for the chat and research assistants | Only the text a feature needs: contract text, chat questions with lookup results, research requests, support messages, and the resulting search queries | United States |
| Resend | Transactional email | Recipient email addresses and message contents | United States |
| Stripe | Billing | Billing contact and payment details (Nagata never sees full card numbers) | United States |
| Google Analytics | Website analytics, only with cookie consent | Pseudonymous usage data on nagata.ai | United States |
Anthropic does not train models on data sent through its commercial API. We'll update this list before adding a new subprocessor that touches customer data.
How long we keep it
| Data | Retention |
|---|---|
| Account and workspace data | While your account is active |
| Spend, AI usage, contracts and extracted fields | While the workspace is active |
| Audit log and AI usage metering | While the workspace is active |
| Demo requests from our website | 12 months, then deleted automatically |
| Session cookies | Cleared when you sign out or the session expires |
Deleting and exporting your data
- Delete a workspace: a workspace owner can delete it from Settings. This permanently removes the workspace and its data.
- Delete your account or request a copy of your data: email privacy@nagata.ai from the address on your account. We acknowledge within 1 business day and complete deletion requests within 14 days.
- Reports can be exported from inside the app at any time.
Security incidents
If we confirm a breach involving your data, we will notify affected customers within 72 hours. Report vulnerabilities to security@nagata.ai. See our security overview for how we protect your data.
Contact
Questions about privacy: privacy@nagata.ai.