How Nandi handles personal information: yours, as a business using Nandi, and your customers’, when Nandi is answering, booking or taking payment on your behalf.
Draft reference date: 15 October 2026 (rehearsal-aligned draft). No effective date has been set.
Provisional legal content — for design review only. Not approved for publication or customer acceptance.
This page sets out the privacy model the product is built around, in the language it should be explained in. It is not legal advice and it is not a finished policy. Items marked To be completed before launch need a decision or a lawyer, and the list of them is at the end of the page. Nothing here should go live without review by a qualified adviser in each market Nandi operates in.
The full policy is below. This is what it amounts to, in six lines. Where the two disagree, the full policy is the one that counts.
This is the part worth reading properly, because everything else follows from it. Nandi is not in one single legal role across the whole platform. It depends on what the information is being used for. There are two situations, and Nandi’s responsibilities are different in each.
Your account, signing in, your subscription and invoices, support, keeping the service secure, preventing fraud, and Nandi’s own legal and business records.
Nandi decides why this information is used, so Nandi carries the responsibility for it. Where the law uses the word, Nandi is the controller.
Your customers’ enquiries, conversations, bookings, history and payment status. Everything Nandi handles because you asked it to handle it.
You decide why this information is used, so you carry that responsibility and Nandi acts on your instructions. Where the law uses the words, you are the controller and Nandi is the processor.
Nandi deciding what to do next in a conversation does not move that responsibility. Nandi applies the rules you gave it and takes the actions you allowed. It does not become the owner of your customer relationships by doing the work.
Described as categories rather than as a list of every field, because what Nandi holds depends on the business and on how much of Nandi it uses. Not every business provides everything below.
Your name, your business name, contact details, business address, account identifiers, what each person on the account is allowed to do, information used to sign you in and keep the account secure, and your market, language, locale and timezone settings.
What you offer and what it costs, your hours and availability, who is on your team and what they do, and the rules you have given Nandi: notice periods, deposit policy, what to escalate, what it must never promise. Some of this is personal information about the people who work for you.
Their name and contact details, what they said and what Nandi replied, their enquiries, bookings and appointments, their history with you, any membership or block of sessions they hold, preferences they have given you, notes relevant to serving them, and the status of payments they have made. This is the information Nandi holds on your instructions rather than for its own purposes.
Handling customer conversations is the main thing Nandi does, so it is named here rather than buried inside a phrase like “usage data”. Messages received and sent through the channels you have connected are processed so that Nandi can:
You can see the conversations Nandi has had on your behalf. Your customers are talking to your business, and Nandi tells them so rather than pretending to be a person.
Nandi uses AI to interpret messages: to work out that “anything Thursday?” is a request for an appointment, or that a message is really about pain rather than about scheduling. Interpreting is where the AI stops.
What Nandi is then permitted to do comes from your rules, your availability and the state of your business, applied by Nandi’s own logic. So the AI does not decide your cancellation policy, does not invent a price, and does not choose to authorise work you have not approved. If a situation falls outside what you have told Nandi, the answer is to bring it to you, not to improvise.
Some of this interpretation runs on AI infrastructure operated by other companies. Those companies are engaged as Nandi’s subprocessors under terms covering what they may do with the information, and they appear in the list described under who Nandi shares information with.
Your customers’ conversations are not used to train general-purpose AI models. If that position ever changes, it will require a lawful basis, a clear notice, and it will not happen quietly through an updated date at the top of this page.
For these purposes, and not for “any business purpose”: providing Nandi; signing you in and keeping your account secure; running the operations you have configured; handling customer conversations; managing bookings and the work that follows them; enabling payments from your customers where you have chosen that; administering your subscription and invoices; supporting you; preventing fraud and abuse; meeting legal obligations; keeping the service reliable; and telling you about things that materially affect your account or the service.
Two things Nandi does not do with your customers’ information: market Nandi or anything else to them, and treat it as a database of its own to be used for unrelated purposes. Doing either would need its own lawful basis and its own notice, and neither is Nandi’s intention.
Where the law requires a lawful basis, Nandi relies on performing our contract with you, on our legitimate interests in running and securing the service, on legal obligations such as accounting and tax, and on consent where consent is genuinely the right basis. Consent is not used as a catch-all for everything else.
Each processing activity needs to be mapped to a specific basis, and each legitimate-interests basis needs its balancing assessment recorded. That mapping is a legal exercise, not a design one, and it is not attempted on this page.
This is money going from your business to Nandi, and it is a different thing from payments your customers make to you. Nandi processes what it needs to set up your subscription, charge you, keep your billing history and invoices, handle changes to your subscription, prevent fraud, and meet accounting and tax obligations.
Stripe is the provider handling subscription payments at launch. Your card details are collected and held by the payment provider rather than stored by Nandi. What Nandi keeps is the information it needs to know the state of your subscription: what you are on, what was charged, whether it succeeded, and the provider’s reference for it.
When a customer pays a deposit or a balance through Nandi, they are paying your business, not Nandi. You are the one selling the service. Nandi provides the software that makes the payment possible, and the money settles into your own account.
Taking payments through Nandi is optional. If you would rather handle payment yourself, Nandi explains how you take payment instead of collecting it, and none of this section applies to you.
Stripe Connect is the provider at launch. When you connect payments, information is exchanged between Nandi and Stripe so that payments can be created and their status known. Stripe will also ask you directly for things it is required to collect: business identity, details of a representative, verification documents, and information it uses to assess risk and fraud. Stripe does that as a regulated business in its own right, under its own agreement with you, and Nandi does not control that part. You will see Stripe’s own notice at the point you connect.
Nandi is built to work with different providers in different markets, and other providers may be used in future. When that happens they will be named here. Nandi does not list a provider it is not actually using.
Not card numbers or bank details. Nandi keeps what it needs to know the state of the business: what was asked for, how much, in what currency, when, which customer and booking it relates to, whether it succeeded or failed, whether it was refunded, the provider’s reference for it, and where a payout has reached. That record is what lets you and your customer both see the same position.
Nandi does not sell personal information. It is shared with companies that help operate the service, each engaged under terms that limit what they may do with it, in these categories:
A current list of the named companies Nandi uses, and what each is used for, is maintained separately and kept up to date, because it changes more often than this page does. Only companies actually in use appear on it.
The subprocessor list itself, at a stable public address, plus the process for notifying businesses before a new one is added. The categories above are deliberately generic until that list is real.
Nandi and the companies it works with operate in more than one country, so personal information may be processed outside the country your business is in. Where the law requires protections for that, Nandi puts the appropriate mechanism in place.
Being set up in a particular market is not a promise that your data is stored only in that country. Nandi states what actually happens rather than what would sound reassuring.
The actual hosting regions, and the transfer mechanism for each market Nandi launches in, named specifically. Whether any market requires data residency is a legal and infrastructure question that has not been answered yet.
Nandi keeps your market, your preferred language, your locale and your timezone. A language you choose while signed in is saved to your account, so it applies wherever you sign in. Otherwise Nandi follows your browser’s language. A language you choose without signing in is kept on Nandi’s server for up to 24 hours from your last choice, and your browser holds only a random reference to it for that browsing session; it is never copied to an account.
These are separate settings on purpose. Reading Nandi in a different language does not change what country your business operates in, who bills you, in what currency, which payment provider you are connected to, or which rules apply to you. Changing the language changes the words, and nothing else.
You can read this site, including every guide, without an account and without giving Nandi anything. Reading a guide does not put you on a list.
Visiting produces the ordinary technical information any website receives, such as your device and browser type, and server logs kept for security and reliability. If you fill in a contact or interest form, Nandi gets what you typed into it, and uses it to reply to you.
Whether analytics is used at all, and if so which product. This section deliberately does not claim analytics, advertising or tracking, because none is in the design. If any is added, this section and the cookie notice have to change first.
Nandi uses browser storage for two things: keeping you signed in and secure, which the service cannot work without, and a session cookie that refers to a language you choose without signing in, which Nandi keeps on its server for up to 24 hours. The cookie holds a random reference, not the language. Nothing non-essential is set before you have agreed to it, where the law requires you to be asked.
A separate cookie notice listing each item, its purpose and its lifetime, and a consent mechanism if anything beyond strictly necessary and preference storage is ever introduced. No consent banner is designed, because at present there would be nothing for it to ask about. Do not add tracking without adding the banner in the same change.
Different information is kept for different lengths of time, for different reasons. “As long as necessary” on its own is not an answer, so here is what each period actually depends on:
The internal schedule now exists, with the periods the product enforces: message words 30 days after a conversation is over, a customer’s contact number after 30 days without a message, booking answers 30 days after the appointment, at least 90 days after service ends before a business’s data may be deleted (deletion is switched off), and billing records at least six years. Which of them belong in public is still to be decided, and the rows from the design are not carried over: one of them, that a business sets what it keeps, does not match the product.
You can cancel from your billing settings. When that takes effect, and what happens to access in the meantime, is set out in your agreement rather than here. Closing the account does not delete everything the same second, and it would be dishonest to say it did. Some records stay for a while: what the law requires Nandi to keep, accounting records, anything needed for an unresolved dispute or a fraud or security investigation, and copies inside backups until those cycle out.
Your customers’ data is a different case, because it is yours rather than Nandi’s. You can download a copy of it yourself until it is deleted. What happens to it at the end of the contract, including its deletion, is set out in the data processing agreement rather than decided by Nandi afterwards.
Depending on where you are, you may have the right to ask for a copy of the personal information Nandi holds about you, to have it corrected, to have it deleted, to limit or object to how it is used, to receive it in a portable form, to withdraw consent where consent was the basis, and to complain to your data protection regulator.
Which of these you have depends on the law where you are, and Nandi will not pretend otherwise. Where it is practical, Nandi aims to honour the same requests for everyone rather than treating people differently by geography. Contact our team to make a request.
You booked with a business, and that business decides what information it keeps about you and why. Nandi handles it on their instructions. So a request about your information is theirs to answer, and the business is the right place to start.
If you contact Nandi instead, you will not be turned away. Nandi will pass the request to the business and help them deal with it, as the law and our agreement with them require. What Nandi will not do is overrule that business about its own customers, or quietly delete records it holds on their behalf without them knowing.
Nandi uses technical and organisational measures appropriate to the information it holds, including access controls, encryption in transit, and limiting internal access to those who need it.
Nobody can promise absolute security, so Nandi does not, and it claims no certification it has not obtained. What it does commit to is telling you promptly if something happens that affects your information, rather than waiting to be asked.
Nandi is a tool for running a business, and Nandi accounts are for adults. It is not a service aimed at children.
That is separate from who a business serves. A dental practice, a swimming teacher or a family salon may legitimately have young customers, and Nandi is not going to tell them they cannot hold a booking for one. Where a business does, it decides what it collects about that customer and on what basis, in the same way as for any other, and Nandi handles it on their instructions.
You can opt out of marketing from Nandi whenever you like, and opting out is honoured everywhere rather than per message.
Some messages are not marketing and cannot be switched off while you have an account: sign-in and security notices, anything about your billing or a failed payment, changes to your account, and material changes to the service or these terms. Nandi will not disguise marketing as one of those in order to reach you.
Small clarifications will be made with the date at the top updated. For anything material, meaning a change to what Nandi does with your information or your customers’, Nandi will tell account holders directly and in advance, and give the notice the law or our agreement requires. A changed date at the top of a page is not notice, and it will not be treated as though it were.
For anything about privacy, or to make a request about your information, contact our team.
The legal name of the operating entity, its registered address and registration number, a privacy contact address, a representative or data protection officer if one is required, and the regulator a person may complain to in each market. Deliberately left blank rather than filled with a placeholder: an invented entity name in a published policy is worse than an obvious gap.
This page is one document in a set, and on its own it is not a privacy framework. Collected here so the gaps are countable rather than scattered through the page: