Privacy Policy

This Privacy Policy explains how personal data is collected and used when you visit nemili.co (the "Website") or use the Nemili application at app.nemili.co (the "App"), together the "Services".

Nemili helps people find someone who has already walked the career path they want to pursue. To do that well, we ask you to share your story, and some of what you tell us may be personal or sensitive. This policy explains what we collect, why, who helps us process it, and what rights you have.

Nemili is not yet an incorporated company. Until it is, the data controller is:

J.E. Alejandro Sánchez Ibarra
Via Federico Faruffini, 40, 20149 Milano (MI), Italy
Email: alejandro.ibarra@nemili.co

We have not appointed a Data Protection Officer, as we are not currently required to. When Nemili is incorporated, the new company will become the controller; we will update this policy and notify registered users before the change takes effect.

The Services are intended only for people aged 18 or over. By creating an account, you confirm that you are at least 18. If we learn that someone under 18 has created an account, we will delete it and the associated data.

Sensitive data. When people talk about their lives, they often mention things like health, religious or philosophical beliefs, ethnic origin, sexual orientation or political opinions. These are "special categories" of data under GDPR. We only process them with your explicit consent, which we ask for before your first story conversation (Art. 9(2)(a) GDPR). You can withdraw it at any time (see section 9). You are never required to share this kind of information.

How matching works. Nemili analyses your profile and narrative profile to suggest people whose path may resonate with yours. This is a form of profiling. Suggestions are only recommendations: you decide whether to reach out, and the other person decides whether to accept. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

What other users see. Before a connection is accepted, other users may see a partial view of your profile, as shown in the App. Once both of you accept a connection, each of you can see the other's full profile as shown in the App.

Nemili's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data to train AI models.

Legal basis:

• For uses 1 and 2 involving your account, profile and activity data: our legitimate interest in improving the Services (Art. 6(1)(f) GDPR). You can object at any time (see section 9).
• For any use of your story, call transcripts or sensitive data to train AI models: only with your separate, optional, explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR). Refusing or withdrawing this consent does not affect your use of Nemili. If you withdraw it, your data will not be used in any future training.

We do not sell your personal data, and we do not share it with anyone other than the service providers listed in section 5 and the users you connect with.

We currently do not use analytics, advertising or tracking cookies. We only use storage that is strictly necessary for the Services to work, such as keeping you logged in, which does not require consent. If we introduce analytics or marketing tools, we will update this policy and ask for your consent beforehand where required.

We rely on the following service providers ("processors"), who may only process your data on our instructions to provide their service to us:

Under Anthropic's commercial terms, data sent through its API is not used to train Anthropic's models.

LinkedIn is not our processor. If you choose to sign in with LinkedIn, LinkedIn processes your data as an independent controller under its own privacy policy.

When you connect with another user, the profile information described in section 3.4 is shared with them. We may also disclose data where required by law or by a competent authority.

Some of our providers, including Anthropic, Vapi and Fireflies.ai, process data in the United States. Where data is transferred outside the EEA, the transfer is protected either by the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or by Standard Contractual Clauses approved by the European Commission, included in our agreements with those providers. You can ask us for details of the safeguard used for a specific provider.

• Account, profile, narrative profile, conversations, voice audio, call recordings, transcripts and journal: for as long as your account is active. If you delete your account, we delete this data within 30 days, except as described below.
• Payment records: for the period required by tax and accounting law.
• Marketing preferences: until you unsubscribe.
• Anonymised statistics: these no longer identify you and may be kept indefinitely.

Our providers may keep backups for a limited period according to their own retention schedules, after which the data is deleted.

We use technical and organisational measures appropriate to the sensitivity of the data, including encrypted connections (HTTPS), access controls, and storage with providers that apply their own security measures. Access to personal data is limited to the controller. No system is completely secure, but we will inform you and the authorities of a data breach where the law requires it.

Under GDPR you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data;
• Restrict processing in certain circumstances;
• Data portability: receive the data you provided in a structured, machine readable format;
• Object to processing based on legitimate interests, including profiling for improving the Services;
• Withdraw consent at any time, for sensitive data, call recording, AI training or marketing, in your account settings or by writing to us. Withdrawal does not affect processing carried out before it. If you withdraw consent for sensitive data in your story, we will delete that data, which may limit how well Nemili can suggest connections.

To exercise any of these rights, write to alejandro.ibarra@nemili.co. We will reply within one month and may ask you to confirm your identity.

You can also lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it); you can also contact the authority in the EU country where you live or work.

We will update this policy when our Services or the way we process data change, for example when Nemili is incorporated. We will notify registered users of material changes by email or in the App before they take effect.

J.E. Alejandro Sánchez Ibarra
Via Federico Faruffini, 40, 20149 Milano (MI), Italy
alejandro.ibarra@nemili.co