Privacy Policy

This policy applies to personal data we process when you visit our websites, use the Incantly web, mobile or desktop applications, contact us, or otherwise interact with us (together, the “Service”). It does not cover third-party websites or services that the Service links to or lets you sign in with; their own policies apply.

Words such as “personal data”, “processing”, “controller” and “processor” have the meanings given to them in the data-protection laws listed above.

In short: We collect what you give us (your account and your content), what the Service needs to work and stay secure (technical and usage data), and, only if you allow it, analytics and marketing data.

Data you give us

• Account data: your first and last name, email address, and the one-time codes used to verify it. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier, as allowed by your Google settings. We do not receive your Google password.
• Your content: notes and documents, their titles and version history, Spaces, Library sources (uploaded files such as PDFs, audio and documents; web addresses and the pages imported from them; video and audio transcripts; pasted text), sensitivity labels, and anything else you put into the Service. Your content may contain personal data about you or other people, depending on what you write or upload.
• AI interactions: the questions, prompts and instructions you give AI features, the context we send with them, and the Output generated.
• Communications: messages you send us, such as support requests, feedback, survey answers and legal or privacy requests, together with our replies.
• Payment data (if you buy a Paid Plan): billing name, billing address, plan, transaction history and the last digits and expiry of your card. Full card details are collected and stored by our payment processor, not by us.

Data collected automatically

• Technical and log data: IP address, approximate location derived from it (country or city), browser and operating-system type, device type, language, referring page, and the date and time of requests.
• Security data: sign-in events, session identifiers, failed attempts, rate-limit events and signals we use to detect abuse and protect accounts.
• Usage data: features used, actions taken, errors encountered and performance measurements, linked to your account where needed to provide and support the Service.
• Data stored on your device: to make the Service fast and usable offline, your browser stores copies of notes, pending changes, a random device identifier and import progress. See our Cookie Policy.
• Cookies and similar technologies: strictly necessary cookies always; preference, analytics and marketing cookies only with your consent. See our Cookie Policy.

Data from others

• Sign-in providers such as Google, as described above.
• Analytics and advertising partners, only if you have consented to those cookies, such as aggregated information about how you found Incantly.
• Organisations that provide Incantly to you, such as your name, email and role.

In short: We use your data to run Incantly for you, keep it secure, improve it, and meet legal duties. Analytics and marketing happen only with your consent.

Data-protection law requires a lawful basis for each use of personal data. Under the GDPR and UK GDPR these are set out in Article 6, and under the NDPA in section 25. The bases we rely on are:

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations and concluded that they are not overridden. You can ask us for details and object at any time (see Your rights).

Where we rely on consent, you can withdraw it at any time, as easily as you gave it, for example through Cookie settings or the unsubscribe link in an email. Withdrawal does not affect processing that already took place.

Providing account data is necessary to enter into our contract; without it we cannot provide the Service. Everything else you share is up to you.

In short: When you use AI features, the relevant part of your content is sent to an AI provider to produce the answer. It is not used to train AI models, and sources you mark Restricted are never sent.

• What is sent. When you use an AI feature, we send the AI provider only what the request needs: your instruction and the relevant parts of your notes and Library sources.
• Restricted sources. Library sources you label Restricted are never sent to an external AI provider. Label material Sensitive or Restricted to control how it is handled.
• No training. We do not use your content or AI interactions to train general-purpose AI models. Our AI providers act as processors under contracts that prohibit them from using your data to train their models and that limit how long they may keep it.
• Search indexing. To let you search and ask questions about your material, we create derived data such as text extracts and search indexes. These are treated as part of your content and deleted with it.
• No automated decisions with legal effects. We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you within the meaning of Article 22 GDPR or section 37 NDPA.
• Human review. People at Genesis HQ do not read your content or AI interactions, except where you ask us to (for example in a support request), where needed to investigate abuse or a security incident, or where required by law.

We do not ask for sensitive personal data, such as data about health, religion, ethnicity, political opinions, sexual life or biometrics. If you choose to include such data in your content, we process it only to provide the Service as you direct, on the basis of your explicit choice to store it, and you can delete it at any time. Please do not add sensitive data about other people unless you have the right to do so.

In short: We share data only with service providers who help us run Incantly, when the law requires it, or when you ask us to. We never sell your personal data.

We do not sell your personal data, and we do not share it with third parties for their own advertising. We share it only as follows:

• Service providers (processors) that process data on our behalf under written contracts requiring confidentiality, security and use only on our instructions. They fall into these categories: cloud hosting, content delivery and networking; databases and file storage; AI model providers; email delivery for sign-in codes and service messages; authentication; error monitoring; analytics and advertising measurement (only with your consent); payment processing; and customer support tools. A current list of our sub-processors is available on request from [to be confirmed: privacy email].
• Sign-in providers you choose, such as Google, which learn that you signed in to Incantly.
• Organisations that provide Incantly to you, in line with their agreement with us.
• At your direction, for example when you share a note or summary with someone.
• Legal and safety. When we believe in good faith that disclosure is necessary to comply with law or a valid legal process, to protect the rights, property or safety of our users, the public or Genesis HQ, or to detect and prevent fraud or security issues. Where lawful, we will tell you about requests for your data.
• Business transfers. If Genesis HQ is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred under appropriate confidentiality protections. We will tell you before your data becomes subject to a different privacy policy.

Genesis HQ is based in Nigeria, and our service providers may process data in other countries, including in Europe and the United States. When personal data is transferred across borders, we protect it as the law requires:

• From the EU/EEA: to countries with an adequacy decision from the European Commission, or under the European Commission’s Standard Contractual Clauses with supplementary measures where needed.
• From the UK: to countries covered by UK adequacy regulations, or under the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.
• From Nigeria: in line with sections 41 to 43 of the NDPA, to countries or organisations with an adequate level of protection, or on another lawful basis such as appropriate contractual safeguards or your consent after being told of the risks.

You can ask for a copy of the safeguards we use by contacting [to be confirmed: privacy email].

In short: We keep your data while your account is open and delete it after you remove it or close your account, apart from limited records the law or security requires.

We may keep data longer where the law requires it or to establish, exercise or defend legal claims, and only for as long as needed for that purpose.

We use technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS), encryption at rest by our infrastructure providers, access controls based on least privilege, signed and verified requests between our web application and services, monitoring and logging, and staff confidentiality obligations. No system is perfectly secure, so we cannot guarantee absolute security.

If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as required by the NDPA, the GDPR and the UK GDPR. If the risk to you is high, we will also tell you without undue delay, with advice on steps you can take.

In short: You can see, correct, export or delete your data, object to some uses, and withdraw consent. You can also complain to a regulator.

Depending on where you live, you have some or all of these rights under the NDPA, the GDPR and the UK GDPR:

• Access: to get confirmation that we process your data and a copy of it.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted, for example when it is no longer needed or you withdraw consent.
• Restriction: to ask us to limit processing while a concern is resolved.
• Portability: to receive data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another provider where technically feasible.
• Objection: to object to processing based on legitimate interests, and to object at any time to direct marketing.
• Withdraw consent: at any time, without affecting earlier processing.
• Automated decisions: not to be subject to decisions based solely on automated processing that significantly affect you.

You can do many of these things yourself in the Service, by editing, exporting or deleting content and your account. For anything else, email [to be confirmed: privacy email]. We will reply within one month (within 30 days for Nigerian data subjects), and may extend this by up to two further months for complex requests, in which case we will tell you why. Requests are free unless they are manifestly unfounded or excessive. We may need to verify your identity first.

Complaints

We would like the chance to resolve your concern first. You also have the right to complain to a supervisory authority:

• Nigeria: the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng
• European Union: the data-protection authority in the member state where you live or work, or where an infringement took place; a directory is maintained by the European Data Protection Board at edpb.europa.eu
• United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk

Incantly is not intended for children under 13, and we do not knowingly collect personal data from them. Under the NDPA, anyone under 18 is a child, so Nigerian users aged 13 to 17 may use Incantly only with the consent of a parent or guardian. In the EU, users under their member state’s age of digital consent (13 to 16) also need a parent or guardian’s consent. We may take reasonable steps to verify that consent.

If you believe a child has given us personal data without the required consent, contact [to be confirmed: privacy email] and we will delete it.

We use strictly necessary cookies and browser storage to run the Service. We use preference, analytics and marketing cookies only if you allow them, and you can change your choice at any time in Cookie settings, available in the footer of every page. We honour the Global Privacy Control signal as a refusal of marketing cookies. Full details are in our Cookie Policy.

We send marketing emails only where the law allows: with your consent, or, where permitted, about similar Incantly products and features if you are an existing user and have not opted out. Every marketing email has an unsubscribe link, and you can also opt out by contacting [to be confirmed: privacy email]. Service messages, such as sign-in codes, security alerts and important changes, are not marketing and will continue while you have an account.

We will update this policy when our practices or the law change. If we make material changes, we will tell you by email or in the Service before they take effect and, where the law requires, ask for your consent. The “Last updated” date at the top shows when it last changed.

For any question about this policy or your personal data, contact our privacy team and Data Protection Officer at [to be confirmed: privacy email], or write to Genesis HQ, [to be confirmed: registered address], Nigeria.