Privacy Policy
This policy explains how personal data is processed when you use Nubiss Fusion (the "Platform"), including when you were invited from outside a company as an investor, external auditor, research or other partner.
1. Controller and contact
- Nubiss GmbH, Schreinerstr. 57, 10247 Berlin, Germany
- Registered at the Amtsgericht Charlottenburg, HRB 268902 B
- Managing director: Fabian Cuntze
- Email: info@nubiss.com — please use the subject "Data protection" for anything about your personal data.
2. Who is responsible for what
The Platform holds two kinds of personal data, with different people responsible.
- Your login and the running of the Platform. Your account, sign-in and security records, the acceptance of these terms and the emails we send you are processed by Nubiss as controller.
- What a company keeps on the Platform. The content a company manages here — its financial plan and cap table, HR records, ISO/compliance records, documents, leads, and the record of who it shared material with — is that company's data. The company is the controller; Nubiss processes it only on the company's instructions under a data-processing agreement (Art. 28 GDPR).
If you were invited by a company (as an investor, auditor, partner or employee), that company decided to give you access, can see how you use what it shared, and is your first contact for questions about its content. You can always write to us as well; we will pass your request on where it concerns a company's data.
3. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data — name, email address, username, password (stored only as a salted hash), role, the companies and areas you can access | Providing your login and the access you were given | Art. 6(1)(b); for invited users Art. 6(1)(f) — the inviting company's and our interest in giving named people controlled access |
| Sign-in and security data — session identifier, time of sign-in, failed sign-in attempts with IP address and username, rate-limit counters | Keeping accounts secure, preventing brute-force and abuse | Art. 6(1)(f) — security of the Platform; Art. 32 GDPR |
| Audit trail — who created, changed, approved or signed which record, when, and from which IP address | Tamper-evident records that companies need for ISO certification and electronic-record rules (e.g. 21 CFR Part 11) | Art. 6(1)(c) and (f) |
| Access records for shared material — when you opened or downloaded which document in a data room, audit engagement or partner room, from which IP address; your name and email address printed as a watermark on documents shared with you | Protecting the confidentiality of material a company shares with you, and showing that company who accessed it | Art. 6(1)(f) — the sharing company's interest in protecting confidential information |
| Acceptance and signature records — acceptance of these terms, the privacy policy and any non-disclosure undertaking (version, the name you typed, time, IP address, browser type); electronic signatures you apply | Evidence of what was agreed and signed | Art. 6(1)(b), (c) and (f) |
| Messages and notifications — invitation and notification emails, in-app notifications | Telling you about access you were given and activity you need to act on | Art. 6(1)(b) and (f) |
| AI-assisted drafting — the instructions and the company content needed for a draft are sent to an AI model provider; we keep a log of each call (who, when, which function, token usage) and, for review, the request and answer | Providing AI functions a company has switched on; letting the company review what was generated | Art. 6(1)(b) and (f) |
| Feedback you send through the in-app feedback form | Improving the Platform | Art. 6(1)(f) |
We do not use your data for advertising, we do not sell it, and we do not build marketing profiles. There is no automated decision-making with legal or similarly significant effect on you (Art. 22 GDPR).
Providing your account data is necessary to have a login; without it we cannot give you access.
4. Who receives data
Within Nubiss, only staff who need it for operating and supporting the Platform. Within a company, only the people that company has given the relevant rights. In addition we use these service providers, each bound by a data-processing agreement:
| Provider | What for | Where |
|---|---|---|
| Salesforce, Inc. (Heroku) | Hosting of the application and its database | EU / USA |
| Amazon Web Services EMEA SARL | Storage of uploaded files | Frankfurt, Germany (eu-central-1) |
| Twilio Inc. (SendGrid) | Sending emails | USA |
| 84codes AB (CloudAMQP) | Queue for background jobs (no document content) | EU |
| Anthropic PBC, or another AI provider a company has chosen | AI-assisted drafting, only when used | USA |
| Google Ireland Ltd. (Google Fonts) | Delivering the typeface the pages use; your browser requests it from Google, which sees your IP address | EU / USA |
Data is disclosed to authorities only where we are legally obliged to.
5. Transfers outside the EU
Where a provider processes data in the USA, the transfer relies on the provider's certification under the EU–U.S. Data Privacy Framework (Art. 45 GDPR) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards.
6. How long we keep data
- Sessions end after one hour without activity.
- Account data is kept while you have access. After your access ends we delete or anonymise it within 90 days, unless the records below still require it.
- Audit trail, signatures and access records are kept as long as the company concerned must keep its records (for certified management systems and regulated records this is often several years), and in any case as long as statutory retention under German commercial and tax law applies (up to 10 years).
- Acceptance records (terms, privacy policy, NDAs) are kept for as long as claims based on them can be raised.
- AI call records are deleted after 365 days unless a company sets a shorter period.
7. Cookies and similar technologies
We use only cookies that are strictly necessary to sign you in, keep the Platform secure and remember your language and display settings. Details are in the Cookie Policy.
8. Security
Connections are encrypted (TLS). Passwords are stored only as salted hashes; especially sensitive HR fields such as tax and bank details are additionally encrypted in the database. Access is limited by role, by company and — for external people — by time. Two-factor authentication is available.
9. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent you have given, with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time for reasons arising from your particular situation. We will then stop, unless we can show compelling legitimate grounds or need the data to establish, exercise or defend legal claims.
To exercise a right, write to info@nubiss.com. Where your request concerns content a company holds, we will forward it to that company and support it.
You also have the right to complain to a data-protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
10. Changes
We update this policy when our processing changes. Each version is published here with its date; earlier versions stay available on this page. If a change materially affects you, we will ask you to confirm you have read it the next time you sign in.