Privacy policy
Last updated: 9 August 2026.
This policy explains what personal data we collect on this website, what we use it for, who we share it with, and what rights you have over it. It is written to be read, not to be worked around.
1. Who is responsible
NILG.AI, Lda., registered at Rua de Santa Justa 228G 2CEP, 4200-479 Porto, Portugal, is the controller of the personal data collected through nilg.ai and its associated subdomains.
For anything about this policy or about your data, write to privacy@nilg.ai.
This policy does not cover third-party sites we may link to. Once you leave here, their rules apply.
2. What we collect and why
We collect the minimum each purpose needs, and we never repurpose data for something other than what it was given for.
Browsing the site. IP address, device and browser type, pages visited and where the visit came from. Used to understand what gets read, detect abuse and keep the site up. Legal basis: legitimate interest, plus your consent for non-essential cookies. See the Cookie Policy.
Contact and enquiries. Name, email, phone and whatever you write in the message. Used to reply to you. Legal basis: pre-contractual steps at your request, and legitimate interest.
Newsletter. Name, email and company. Used to send you what you subscribed to. Legal basis: your consent, which you can withdraw from any email we send.
Store and training. When you buy a course or a service we collect name, company, email, VAT number and billing address. Payment is handled by a specialised provider and card details never pass through us. Legal basis: performance of the contract and compliance with legal obligations. Accounting records are kept for as long as Portuguese law requires.
Job applications. Name, contact details, CV and the answers you give. Used to assess the application. Legal basis: pre-contractual steps.
Instant analysis of your company. Covered in detail in section 3, because it is the one that most deserves an explanation.
The site's AI assistant. When you talk to the assistant in the corner of the screen, we store the conversation. Used to answer you and to improve those answers. Do not give the assistant sensitive data, yours or anyone else's: it is not the right channel for that. Legal basis: legitimate interest.
We do not collect special categories of data (health, beliefs, racial origin, sexual orientation, union membership). If you include any on your own initiative, we delete it as soon as we notice.
The site is not intended for people under 18 and we do not knowingly collect data from minors.
3. The instant analysis of your company
If you leave your contact details to see an analysis of your company, this is what happens.
What we get from you: your name, your work email and, if you choose to go all the way, your phone number and the answers to the qualifying questions.
What we fetch ourselves: the domain of your email tells us your company's website. From there we read public information: the site's pages, its stylesheets, web search results, and the public posts of the company pages on the social networks that the site itself links to. We do not access anything private, we never sign in anywhere, and we do not guess at profiles: we only follow the links your company published.
What we do with it: we generate, using artificial intelligence models, a reading of the business and of what we could do together. The site temporarily takes on your company's colours, typography and name.
This is a simulation. The result is generated automatically from public information, has not been reviewed by a consultant, and does not represent any existing partnership between NILG.AI and your company. The page is neither shareable nor indexable.
Why we keep your data: to contact you about what the analysis showed. It is recorded in our CRM as a business contact.
Legal basis: legitimate interest in business-to-business development, weighed against the reasonable expectation of someone who voluntarily submits their contact details in order to be contacted. You can object at any time and we will stop.
Automated decisions. The analysis is generated by a model, but it produces no legal effects and does not significantly affect you: it is a commercial reading meant as a starting point for a conversation with a person. No decision about you is taken automatically.
Third-party data. The public posts we read may contain people's names. We use them only to understand the company's positioning, we keep the reference to the original post, and we do not build profiles of individuals from them.
4. Who we share with, and where it goes
We do not sell personal data. We share it only with those who need it to provide us a service, always under a processor agreement and on our instructions.
| Who | What for | Where |
|---|---|---|
| Anthropic | AI models behind the analysis and the assistant's answers | United States |
| Apify | Collection of public social media posts | European Union and United States |
| Vercel | Website hosting | European Union and United States |
| Supabase | Our platform's database | European Union |
| Resend | Email delivery | European Union and United States |
| Google and Meta | Audience measurement and campaigns, where consented | United States |
We also share data where the law requires it, or to exercise and defend legal claims.
Transfers outside the European Economic Area. Some of these providers process data in the United States. Those transfers rely on the Standard Contractual Clauses approved by the European Commission or, where applicable, on the EU-US Data Privacy Framework adequacy decision, with supplementary technical measures.
5. How long we keep it
- Enquiries and assistant conversations: up to 2 years after the last contact.
- Business contacts, including those from the instant analysis: up to 3 years after the last interaction, or until you object.
- Newsletter: until you unsubscribe.
- Job applications: 1 year after the process closes, unless you allow us to keep it for future roles.
- Accounting records: 10 years, as required by law.
- Browsing and analytics data: 14 months.
After that, data is deleted or anonymised.
6. How we protect it
We encrypt data in transit and at rest, limit internal access to those who need it to do their job, log access to sensitive information, and review our practices periodically. No system is infallible; if a breach occurs that puts you at risk, we will tell you and the supervisory authority within the legal deadlines.
7. Your rights
You have the right to access your data, correct it, erase it, restrict or object to its processing, and to port it to another controller. Where processing relies on consent, you can withdraw it at any time without affecting what was done before.
To exercise any of these, write to privacy@nilg.ai. We reply within one month.
If you believe we did not handle it as we should, you can lodge a complaint with the Portuguese supervisory authority (CNPD) at cnpd.pt, or with the authority in your own country of residence.
8. Cookies
We use cookies that are essential to the site working and, with your consent, measurement and marketing cookies. You can manage them at any time. The detail is in the Cookie Policy.
9. Changes
We may update this policy. The version in force is always the one on this page, with the update date at the top. If a change is material and we have your email, we will tell you.