← Back

Privacy Policy

Last updated: 2 August 2025

Who we are

Nessa ("we", "us", "our") is a workplace incident documentation tool. We help people record, organise, and export details of workplace incidents using AI. This policy explains how we handle your data.

What we collect

  • Account information: your name, email address, and country when you register.
  • Profile details: nationality and job title, if you choose to provide them during onboarding.
  • Conversations: messages you send to Nessa, including voice transcriptions.
  • Incident records: dates, summaries, narratives, people involved, and other details extracted from your conversations.
  • Evidence files: photos, screenshots, or documents you upload as supporting evidence.
  • Usage data: anonymous analytics to help us improve the product (via PostHog).

How we use your data

  • To provide the service: your conversations are processed by AI (Anthropic Claude) to extract incident details and provide supportive responses.
  • To store your records: incidents, evidence, and conversation history are saved so you can access them later.
  • To improve Nessa: anonymous usage analytics help us understand how the app is used. We never use your conversations or incident data for analytics.
  • To communicate with you: verification emails, account notifications, and support responses.

AI processing

Your conversations are sent to Anthropic's Claude API for processing. Anthropic does not use your data to train their models. Your conversations are processed in real time and are not stored by Anthropic beyond what is needed to generate a response. For more details, see Anthropic's privacy policy.

Data storage and security

Your data is stored securely using industry-standard encryption. Evidence files are stored in encrypted cloud storage (Cloudflare R2). Your password is hashed using bcrypt and is never stored in plain text.

We use HTTPS for all data transmission. Access to your account is protected by your credentials and, where applicable, email verification.

Who can see your data

Only you. Your conversations, incidents, and evidence are private to your account. We do not share, sell, or provide your personal data to any third party for marketing or advertising purposes.

We use the following services to operate Nessa:

  • Anthropic:AI conversation processing
  • Vercel: application hosting
  • Cloudflare R2: encrypted file storage
  • PostHog: anonymous product analytics
  • Stripe: payment processing
  • Resend: transactional emails

Your rights

Under GDPR (UK/EU) and CCPA (California), you have the right to:

  • Access: request a copy of all data we hold about you.
  • Rectification: correct any inaccurate information.
  • Erasure: request deletion of your account and all associated data.
  • Portability: export your data in a structured format.
  • Objection: object to processing of your data.
  • Withdraw consent: you can delete your account at any time from Settings.

To exercise any of these rights, email us at privacy@nessa-app.com.

Data retention

We keep your data for as long as your account is active. If you delete your account, all your data, including conversations, incidents, evidence files, and profile information, is permanently deleted within 30 days. We do not keep backups of deleted accounts.

Cookies

We use essential cookies only: a session cookie to keep you logged in and a beta access cookie during the private beta period. We do not use advertising or tracking cookies. PostHog analytics uses localStorage, not cookies.

Children

Nessa is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you via the app or by email. The "last updated" date at the top of this page reflects when the policy was last revised.

Data Protection Registration

Nessa is registered with the Information Commissioner's Office (ICO) under registration number CSN2538921.

Contact

If you have any questions about this policy or how your data is handled, email us at privacy@nessa-app.com.