Nanonets

GDPR overview

GDPR compliance is claimed explicitly rather than merely implied: a dedicated page states that Nanonets complies with the regulation and helps its customers do the same. A Data Protection Officer is appointed and reachable at dpo@nanonets.com, by phone, or by post at the San Francisco office. Transfers rest on certification to the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. framework, under Federal Trade Commission oversight. A Data Processing Agreement can be reviewed and signed online, with Nanonets acting as processor. Permanent deletion can be requested and is answered within thirty days. Two gaps remain worth knowing: no Article 27 representative is designated in the European Union, and the dedicated GDPR page carries a five-year-old update stamp while the privacy notice was rewritten in July 2026.

Who owns the data?

The terms of service are explicit: Customer Data is, and remains, the property of the customer. The customer grants Nanonets a non-exclusive, non-transferable, non-sub-licensable, worldwide and royalty-free licence to use, collect, transfer and process that data for the sole purpose of delivering the service. A separate clause carves out Derived Data — anything Nanonets generates from customer content — which the vendor may freely use for its internal business purposes, including improving, testing, operating, promoting and marketing its own products. Only Derived Data originating from Google Workspace or Microsoft APIs is contractually excluded from developing or training generalised AI models. Under the GDPR, Nanonets acts as processor and the customer as controller.

Reuse rights

Customers keep full rights over what they upload and over the structured output the agents produce: nothing in the terms restricts reusing extracted data, exporting it or writing it into third-party systems, which is precisely the intended workflow. Access to connected accounts is scoped to what the user configures — specific Gmail labels, selected Drive folders — and happens only on a user action or a trigger they set up. The product pages advertise a zero training guarantee, and the July 2026 privacy notice confirms that Google user data is excluded from every training, fine-tuning, evaluation and benchmarking dataset, and never used to improve behaviour for another tenant; third-party model providers act as subprocessors and are barred from retaining that data or training on it. Where a customer asks Nanonets to refine an extraction model, that model stays inside their own tenant and can be deleted at any time. The Derived Data clause in the terms is broader than the marketing promise, so the two documents do not fully align.

Data retention & training

Hosting summary

The security policy is unambiguous on the default: all customer data is stored in the USA, on Amazon Web Services and Google Cloud facilities, inside a virtual private cloud protected by network access control lists. Nanonets runs no routers, load balancers, DNS or physical servers of its own. Data sits in multi-tenant datastores with logical separation enforced in application code and covered by automated tests, and a backup solution protects the datastores holding customer content. Encryption is AES-256 at rest and TLS at 256 bits in transit, with an A+ SSL Labs rating claimed. The declared infrastructure subprocessors — Amazon Web Services, Google Cloud, Microsoft Azure, SendGrid, Auth0 and Imgix — are all US entities, as are the support-side ones, Zendesk, Intercom, Google Workspace, HubSpot and Airtable. Regional residency in the US, EU or APAC exists, along with VPC, single-tenant and on-premise deployment where the customer keeps its own keys and network policies, but these are Enterprise-tier options rather than the standard configuration.