This policy explains how RAGIONE_SOCIALE ("Ninetayl", "we") handles personal data when you visit ninetayl.com, sign up for Ninetayl and use the dashboard at app.ninetayl.com.

1. Who we are

The controller of the personal data described in section 2 is RAGIONE_SOCIALE, INDIRIZZO_SEDE, Italy, VAT PARTITA_IVA. Contact for anything about your data: info@ninetayl.com.

2. Data we handle as controller

Account data: name, e-mail address, password (stored only as a salted hash), the team you belong to and your role, your preferences and notification choices.
Billing data: company name, VAT number, billing address and subscription status. Card details are entered on Stripe's pages and never reach our servers.
Contact form: the name, e-mail, company and message you send us.
Technical data: the session cookie that keeps you signed in, server logs (IP address, time, page requested) kept for security for up to 30 days, and the usage counters of the AI features of your plan.

We use these data to provide the service you subscribed to (contract), to bill it and keep accounting records (legal obligation), to answer your requests and to keep the service secure (legitimate interest). We do not sell personal data, do not use it for advertising and do not use third-party analytics or tracking on the site.

3. Data of your stores: we act as processor

When you connect Shopify stores, ad accounts (Meta, Google) and files from your suppliers, Ninetayl reads and stores data that may include personal data of your own customers (for example names and order details in Shopify orders). For these data you are the controller and we process them only on your instructions, to show you the dashboard and run the features you use. The terms of this processing are those of our Data Processing Agreement, part of the Terms of service and available on request at info@ninetayl.com. Each customer's data is kept in a separate database; the access keys of your connections are stored encrypted.

4. Who else processes data for us

We use carefully chosen providers, bound by data processing agreements. They receive only what they need:

Hosting — FORNITORE_HOSTING (server in the European Union).
Payments — Stripe Payments Europe Ltd. (subscriptions, invoices).
E-mail — FORNITORE_EMAIL (account and notification e-mails).
AI features — OpenAI and/or Anthropic, only for the texts and images the AI features you use send them (for example a product's title and photos). They do not use API data to train their models.
Platforms you connect — Shopify, Meta and Google receive our requests on your behalf, under your authorisation and their own terms.
DNS and network — FORNITORE_DNS.

Some of these providers are based outside the European Economic Area. Transfers rely on adequacy decisions (such as the EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses.

5. How long we keep data

Account and store data: for as long as your subscription is active. After it ends the account stays readable for 90 days, then it is deleted (we e-mail the account owner a week before), unless you ask us to delete it earlier. If Ninetayl is uninstalled from a Shopify store, that store's data is deleted 48 hours later, when Shopify asks us to.
Invoices and accounting records: 10 years, as required by Italian law.
Contact form messages: up to 24 months.
Backups: overwritten within 30 days.

6. Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its processing and to receive it in a portable format, by writing to info@ninetayl.com. We answer within one month. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it) or the authority of your country.

7. Security

Connections are encrypted (HTTPS), passwords are hashed, access keys are encrypted at rest, each customer's data lives in its own database, and access inside a team follows the roles you give.

8. Changes

If this policy changes in a way that matters, we will tell account owners by e-mail before the change applies.

Privacy policy