Privacy Notice
Effective 1 November 2026
On this page
- 1. Who we are
- 2. Our two roles
- 3. What we process, why, on what basis and for how long
- 4. AI features and model providers
- 5. Google user data
- 6. Who receives personal data
- 7. Transfers outside the European Economic Area
- 8. Retention in short
- 9. Your rights
- 10. Complaints
- 11. Cookies and similar technologies
- 12. No automated decisions with legal effect
- 13. Children
- 14. Security
- 15. Changes to this notice
- 16. Contact
This notice explains how Immersive Investments B.V. ("n8v", "we", "us") processes personal data when you visit n8v.online, use the n8v web app, iOS app, CLI or API, or contact us. It gives the information required by Articles 13 and 14 of the General Data Protection Regulation ("GDPR").
1. Who we are
The controller is Immersive Investments B.V., a private limited liability company (besloten vennootschap) under Dutch law with its statutory seat in The Hague, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 85865958, trading as n8v, reachable at [email protected]. Correspondence address: Rua Barros Queiroz 20, 1100-076 Lisboa, Portugal.
For anything about this notice or your personal data, write to [email protected]. We have not appointed a data protection officer, because the GDPR does not require one for our activities.
2. Our two roles
We are the controller for the personal data we need to run our business: accounts, invitations, billing, support, security and product analytics. This notice covers that data.
We are a processor for the content our customers put into the service: source code, repositories, prompts, messages, files, agent outputs, environment variables, secrets and the data agents read in the services a customer connects. We call this Customer Content. We process it only on the customer's instructions, under our Data Processing Agreement. If your personal data is in Customer Content (for example your name in a commit history, or an email an agent reads), the customer that brought it into n8v is the controller. Please contact that customer first; we will help them answer your request.
3. What we process, why, on what basis and for how long
When you use n8v on behalf of an organisation, we process your data on the basis of our legitimate interest in providing and securing the service for that organisation (Article 6(1)(f) GDPR). When you are our customer yourself, for example as a sole trader, the basis is the performance of our contract with you (Article 6(1)(b) GDPR). The table uses "contract" for both cases.
| Data | Where it comes from | What we use it for | Legal basis | How long we keep it |
|---|---|---|---|---|
| Account data: GitHub user ID and username, name, email address, profile picture URL | GitHub, when you sign in with it | Creating and securing your account, signing you in, contacting you about the service | Contract | Life of the account plus 30 days |
| Organisation data: organisation name, members, roles, seats, invitations sent | You and your organisation's admins | Running organisation accounts and permissions | Contract | Life of the account plus 30 days |
| Invitation and waitlist data: email address, invitation code or card number, date of use, onboarding answers (for example which tools you use) | You, or the person who invited you | Running invite-only access and the seat cap, planning onboarding | Legitimate interests; steps before a contract | Until the invitation is used and then as account data; otherwise 12 months after our last contact |
| Billing data: company name, billing contact, address, VAT number, plan, invoices, payment status | You; Stripe | Charging fees, invoicing, tax compliance | Contract; legal obligation | Invoices and accounting records: 7 years (Article 52(4) of the Dutch General Tax Act and Article 2:10(3) of the Dutch Civil Code). Other billing data: life of the account plus 30 days |
| Usage data: sandbox time, credits used, model usage, number and status of tasks, API usage, enabled features | Your use of the service | Metering and billing, enforcing plan limits, capacity planning, preventing abuse, improving the service | Contract; legitimate interests | Life of the account plus 30 days; billing records 7 years. Aggregated figures that identify no one may be kept longer |
| Security and log data: IP address, browser and device details, timestamps, request and error logs, sign-in events, rate-limit counters, abuse signals | Your devices and our systems | Keeping the service secure, preventing fraud and abuse, fixing faults | Legitimate interests; legal obligation | 30 days, longer only when needed for a specific incident or legal claim |
| Product analytics and error reports: for signed-in users the user ID; pages and features used, page load times, browser and device type, IP address and the country derived from it, error details | Your use of the service | Understanding which features work and fixing errors | Legitimate interests (you can object, see section 9) | 12 months |
| Support data: name, email address, messages, attachments, feedback and survey answers | You | Answering questions, handling complaints, improving the service | Contract; legitimate interests | 24 months after the conversation ends |
| Notification data: iOS device token, notification settings, linked Telegram chat or Slack user | You and your devices | Sending the task notifications you choose | Contract | Until you turn notifications off or unlink the service, and at the latest when the account ends |
| Integration identifiers: GitHub App installation, Slack workspace and user IDs, Plane workspace, Gmail address, MCP server addresses. Access tokens are stored encrypted | You, and the services you connect | Operating the integrations you set up | Contract | Until you disconnect the service, and at the latest 30 days after the account ends |
| Security reports: name or handle, email address, report content | Security researchers | Handling vulnerability reports | Legitimate interests | 3 years after the report is closed |
| Business contacts: name, email address, company, role | You or your employer | Sales, partnerships, purchasing | Legitimate interests | 24 months after our last contact |
We do not currently send marketing email. If we start, we will only do so where the law allows it and every message will contain an unsubscribe link. Service email, such as sign-in links and messages about your account, is sent through Resend.
4. AI features and model providers
- To run a task, agents send the relevant parts of Customer Content to an AI model provider. If you connect your own provider account or API key, the request goes to that provider under your agreement with it. If you pay with n8v credits, we send the request through our own account with the provider, which then acts as our subprocessor.
- Some features always run under our own OpenAI account: task titles, branch names, commit messages, pull request descriptions, session summaries and voice transcription.
- We do not use Customer Content, or your personal data, to train AI models. OpenAI, Anthropic and Google do not use what we send them under our own accounts for training either. Models reached through OpenRouter are served by upstream providers under their own terms, as explained in section 12 of the Terms of Service.
- Experimental third-party models (for example anonymous preview models whose operator keeps prompts and outputs) are only available after you explicitly enable them, and they are not covered by our Data Processing Agreement.
5. Google user data
If you connect Gmail, agents read the messages you point them to and create or update drafts. They do not send email. n8v's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Gmail data for advertising, do not sell it, do not use it to train AI models, and only transfer it (for example to an AI model provider) to provide the feature you asked for. People at n8v only read it with your permission, for security reasons or when the law requires it.
6. Who receives personal data
- Our subprocessors and service providers: hosting, database, sandboxes, storage, analytics, payments, email and AI model providers. The full list, with locations, is on our subprocessor page.
- The services you connect (GitHub, Slack, Telegram, Plane, Gmail, MCP servers, your own model providers), when you instruct us to exchange data with them.
- Other members of your organisation account, according to the roles your admins set, and anyone you share a task with.
- Professional advisers such as accountants and lawyers, under confidentiality.
- Authorities, when the law requires us to disclose data.
- A buyer or successor of our business, under the same protections as in this notice.
We do not sell personal data.
7. Transfers outside the European Economic Area
Our database runs in Finland and its backups are stored in a bucket restricted to the EU. Our application functions run in Dublin, Ireland (a move to Stockholm, Sweden, is under consideration) and our analytics are stored in Frankfurt, Germany. Some providers are established or process data in the USA. For each of them we rely on one of these safeguards:
- the EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795), for recipients certified under it; or
- the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), with additional measures where needed.
| Provider | What it does for us | Safeguard |
|---|---|---|
| E2B (FoundryLabs, Inc.) | Sandboxes, run in the USA today | Standard contractual clauses |
| OpenAI | AI features under our account, model access with n8v credits | Standard contractual clauses |
| Anthropic | Model access with n8v credits | Standard contractual clauses |
| OpenRouter | Model access with n8v credits | Standard contractual clauses |
| Apple | Push notifications | Standard contractual clauses |
| Model access with n8v credits; the mailbox that receives mail sent to our n8v.online addresses | Data Privacy Framework | |
| Vercel | Hosting | Data Privacy Framework |
| Cloudflare | Network, storage, realtime service, email routing, page-load analytics (Web Analytics) | Data Privacy Framework |
| Upstash | Short-lived coordination data | Data Privacy Framework |
| PostHog | Analytics (stored in the EU; access from the USA possible) | Data Privacy Framework |
| Resend | Sending service email | Data Privacy Framework |
| Stripe | Payments, when paid plans launch | Data Privacy Framework |
Where a provider relies on the Data Privacy Framework, its agreement with us also contains standard contractual clauses as a fallback. Our subprocessor page has the details.
The Data Privacy Framework is being challenged before the EU Court of Justice, and in July 2026 the European Data Protection Board asked the European Commission to assess the effect of a June 2026 US Supreme Court ruling on the independence of the Federal Trade Commission. If the framework stops applying, we will rely on standard contractual clauses. You can ask us for a copy of the safeguards at [email protected].
8. Retention in short
| Data | Retention |
|---|---|
| Account and organisation data | Life of the account plus 30 days |
| Database backups | Rolling, about 35 days. Data we delete from our active systems disappears from backups within that period |
| Application and security logs | 30 days |
| Invoices and accounting records | 7 years |
| Support conversations | 24 months after the conversation ends |
| Product analytics | 12 months |
9. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to processing based on our legitimate interests, including product analytics. Where we rely on your consent, you can withdraw it at any time.
Send your request to [email protected]. We may ask you to confirm your identity, for example by replying from the email address linked to your account. We answer within one month; if a request is complex we may extend this by two more months and will tell you why.
For personal data in Customer Content, please contact the customer concerned (see section 2).
10. Complaints
Please contact us first, so we can try to solve the problem. You also have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens:
- online: https://www.autoriteitpersoonsgegevens.nl/en/submitting-a-tip-off-or-a-complaint-to-the-ap (in Dutch: https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap)
- by post: Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ Den Haag, the Netherlands
You can also complain to the authority in the EU country where you live or work, or where the alleged infringement took place.
11. Cookies and similar technologies
We only store or read information on your device where that is strictly necessary for the service you asked for.
| What | Purpose | Duration |
|---|---|---|
Session cookie (better-auth.session_token, with the __Secure- prefix over HTTPS) | Keeps you signed in | Up to 60 days |
Invitation cookie (access_code) | Remembers the invitation code you opened until you finish signing up | Up to 14 days |
Security cookie set by Cloudflare (cf_clearance), only after it challenges a visitor it suspects of abuse | Protect the site against abuse | Short-lived |
Preference cookies (for example timeZone, list grouping and filters, collapsed sections, panel state) | Remember the settings you choose in the app | Up to 1 year; the sidebar state 7 days |
| Local storage (for example dismissed banners and view preferences) | Remember interface choices you make | Until you clear it |
Our product analytics do not use cookies or local storage: they keep their state in memory only, send only your user ID when you are signed in, and session recording is switched off. Cloudflare Web Analytics loads a script from static.cloudflareinsights.com that counts page views and measures how fast pages load; it sets no cookies and stores nothing on your device. We do not use advertising or social media trackers. Payment pages are hosted by Stripe, which sets its own cookies on its own domain under its own policy. Because we only use these strictly necessary technologies, we do not ask for cookie consent.
12. No automated decisions with legal effect
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Automated rate limits and abuse checks can temporarily restrict what an account can do; you can ask for a human review at [email protected].
13. Children
n8v is a service for businesses and professionals. It is not intended for anyone under 18, and we do not knowingly process personal data of children.
14. Security
We protect personal data with technical and organisational measures that include encryption in transit, encryption of credentials and secrets in our database, isolated sandboxes, restricted access and monitored backups. Our security overview has the details.
15. Changes to this notice
We will update this notice when our processing changes. We tell account admins about significant changes by email or in the app before they take effect. The effective date is at the top.
16. Contact
- Privacy questions and requests: [email protected]
- Postal address: Immersive Investments B.V., Rua Barros Queiroz 20, 1100-076 Lisboa, Portugal