Privacy Policy

What Nopal is

Nopal is a knowledge system for reasoning: your team records decisions, claims, knowledge, and discussions, and connects them. We process data to provide exactly that service; nothing is sold, and nothing is used to advertise to you.

What we collect

• Account data: your name, email, and authentication identity (managed by Clerk).
• Workspace content: the artifacts, comments, topics, relations, and files your team creates.
• Billing data: handled by Stripe; we never see or store full card numbers.
• Operational data: request logs, error reports (with personal data scrubbed), and a small set of manually chosen product events (e.g. “artifact created”). No advertising trackers, no session recording, no autocapture.
• Behavioral product signals: to improve Nopal, we record content-free interaction events, meaning an event kind (for example “a citation was clicked” or “an answer was rated”), timing, and internal record identifiers. These records are incapable of holding your text: never your questions, answers, titles, or documents. We read them only as aggregate counts and timings, never as any individual person’s activity.
• Aggregate counts: we compute totals across all workspaces (for example the number of artifacts on the public landing page). These are plain counts and can never be traced back to any workspace, person, or content.

AI features

AI is on by default for new workspaces, and an organization admin can turn it off at any time in Settings. While it is on for a workspace, two providers are involved, and only the second waits for each person’s consent:

• Voyage AI computes embeddings, which Nopal uses to find related work, of the workspace’s artifacts, signals and initiatives, and of the title you type while creating an artifact. This runs for the whole workspace while AI is on and does not wait for anyone’s consent.
• Anthropic (Claude) answers /ask and writes a reading of an artifact’s notices when you ask for one. Each person sees a disclosure and accepts it before their first question or reading is sent. Then the question and the workspace content relevant to it go to Anthropic, and an /ask question also goes to Voyage AI to find related work.

Anthropic’s commercial terms do not allow it to train its models on what we send, and we have opted out of Voyage AI training its models on what we send.

Who processes data for us

We use a small set of processors: Supabase (database, files, realtime), Clerk (authentication), Vercel (hosting), Stripe (billing), Typesense Cloud (search index), Upstash (rate limiting), Anthropic and Voyage AI (AI features), Resend (account emails such as approval or decline, replies to your support requests, and share links you send by email), Sentry (error monitoring, scrubbed) and PostHog (product analytics). Each one is bound by its published terms, and we are putting data-processing agreements in place with them. Data is hosted in the United States. The beta is offered to non-EU organizations.

Your rights and controls

• Export: a machine-readable export of your data is available at any time from your account, whatever its state, until the account is erased.
• Erasure: you can ask us to erase you, and an organization can ask us to erase a former employee. We act once we have verified the request. Our staff carry it out, and first produce an export of the person’s data. The export is for the person alone: we send it to them, never to the organization, even when the organization made the request. Nopal deletes the copy it stores when the erasure runs. Erasure cannot be undone. It works like this:
  • Your identity is removed: your name, email, picture and sign-in are overwritten, and your notifications, preferences, push subscriptions and usage signals are deleted.
  • What is yours alone is deleted, with its files, search entries and embeddings: your Personal Graph, your private /ask conversations, your personal trails and Cart, signals you captured as personal, and your support requests.
  • A workspace where you are the only member is deleted entirely, with everything in it, once the export has been produced, and its subscription is cancelled.
  • A workspace that continues keeps its own billing record at Stripe, and erasure leaves that record alone. If you set up that workspace’s billing, your email and any payment details you entered may still be there, for its admins to change.
  • Shared work stays with your organization, which controls it: artifacts others can read, comments, decisions, contributions, approvals and activity. It is attributed to “an erased member”. Where Nopal’s own words name you, in notices, activity and project history and the audit log, your name becomes “an erased member”, and an @mention that can only mean you becomes “@erased member”. A name too short or too common to tell apart from other words, such as “Team”, is left as it is. Your name written as ordinary words in someone else’s writing is left for your organization to edit.
  • Your sign-in account at Clerk is deleted, and your entries are removed from the search index. A step outside our database that fails, such as removing a file, a search entry or a subscription, stays on our list of work still owed, and our staff run it again until it is done.
  • Product analytics never identify a person, so no profile of you exists there to remove.
  • We keep a record that the erasure took place and whether you or your organization asked for it, and any record that you saw a design partner program’s data notice (its version and when you saw it). Once every step is done, these hold nothing else about you beyond internal identifiers.
  • Database backups age out on their normal schedule, so erased data leaves them then.
• Retention: content is never deleted because of billing state; if your subscription lapses, your account becomes read-only and export remains available.
• Notifications: browser push is strictly opt-in and per-browser; in-app updates can be marked read at any time.

Security

Every database table is protected by row-level security so organizations are isolated from one another; access to gated features is enforced server-side; and webhooks are signature-verified. Nobody can edit the audit log of changes from inside Nopal. Only two things change it. An artifact left in the recycle bin for more than 30 days is deleted for good, and its history goes with it. Erasure, described above, puts “an erased member” where the log’s own words name the erased person and “@erased member” in place of an @mention that can only mean them. Where a colleague’s history names one of the erased person’s private artifacts, which erasure deletes, its title becomes “an artifact that has since been removed”. The entries for what erasure deletes go with it. Transport is encrypted (HTTPS with HSTS). Our own operators can technically reach the databases and file storage that hold your content, the way any infrastructure operator can; we do so only for operations, incident response, support you ask for, and erasure requests, and our providers log that access. Our in-product staff tools are built to show aggregates rather than any member’s activity, with three exceptions: the support requests you send us; the people roster, which shows when each person last acted on an artifact and how many artifacts they have created; and an erasure, whose preview and export cover the one person being erased.

Contact

Questions or requests (including export and erasure): privacy@nopal.info.