Privacy policy
This policy is dated .
Who we are
Virtuability IT Services Limited ("we", "us" or "our") is a company registered in Ireland, company registration number 576802, at Unit 11, ACT Business Development Centre, Parnell Square, Athlone, Co. Westmeath, N37 C8W6, Republic of Ireland.
This policy covers:
- this website, at www.neine.app
- neine, the small business app suite, which we provide to our customers
We are the controller of the personal data this website collects and of the accounts of our customers and their users. The records a customer keeps in neine about the people it works with are the customer's: the customer is their controller and we process them on its behalf and on its instructions.
This website
This website needs no account and sets no cookie.
Request logs
Like every web server, the network that delivers this website records each request it answers: the network address the request came from, the browser string, the page requested and the time. We use these logs to keep the website running and to trace abuse, and they are deleted after a limited time.
Analytics
We measure how this website is used with Plausible Analytics, provided by Plausible Insights OÜ of Tartu, Estonia, which processes the data on our behalf. Plausible:
- sets no cookie and uses no browser storage
- generates no persistent identifier and does not track a visitor across websites or devices
- counts visitors with a hash of the network address and the browser string combined with a salt that is rotated and deleted every 24 hours, and never stores the network address or the browser string themselves
- records the page visited, the referring website or campaign and the browser, operating system and device type
- derives the country, region and city from the network address, which it then discards
- keeps the data in the EU
See Plausible's data policy for the detail.
Email to us
If you write to us, we use your email address and your message to answer you, and keep them for as long as the conversation needs.
neine
What neine holds
Each customer runs in an environment of its own, and its data rests in the region that environment is set up in. An environment holds:
- the customer's own records: in CRM its companies, people, opportunities, touches, tasks and drafts; in Projects its time entries, customers, quotes, projects, invoices and credit notes
- the accounts of the customer's users: their name, their sign-in email and the roles an administrator grants them in the app
- an audit trail of who changed what and when, which names the fields changed and never their values
Users sign in through their organisation's identity provider, or with an invited password held by the instance's sign-in service.
neine carries no tracker, no analytics script and no asset loaded from a third party. Personal data is encrypted at rest and in transit. No log carries a name, an email or postal address, a telephone number or anything a person typed; the request log of a page a browser reaches holds the network address, the browser string, the city and country and the fingerprint of the encrypted connection a request came from, and is deleted after a limited time.
neine sends transactional email only: the invitation and sign-in messages a customer's environment sends its own users. It sends no marketing email.
- No email carries anything that reports its opening, and no link in it is rewritten to report a click.
- A message passes through our email service in the EU, in Ireland, for the length of the request that sends it, and the service stores none of it.
- When an address bounces permanently or its owner marks a message as spam, the address is suppressed, so that customer's environment does not write to it again.
Lawful bases
| What | Why | Lawful basis (GDPR) |
|---|---|---|
| Website request logs | To keep the website running and trace abuse | Legitimate interest, Art. 6(1)(f) |
| Website analytics | To understand how the website is found and used | Legitimate interest, Art. 6(1)(f) |
| Email you send us | To answer you | Legitimate interest, Art. 6(1)(f) |
| Accounts of customers and their users | To provide neine to the customer | Legitimate interest, Art. 6(1)(f) |
| A customer's own records | To provide neine on the customer's instructions | Processed for the customer under Art. 28; the customer sets the basis |
Processors
| Processor | What it does | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosts this website, each customer's environment and the email service | The region of each environment; this website and the email service in Ireland; pages delivered through global edge locations that hold no personal data |
| Plausible Insights OÜ | Analytics for this website | The EU |
A customer's identity provider is not our processor. A customer that signs its users in through its own provider does so under its own agreement with that provider.
We do not sell personal data or share it with advertisers.
Retention
| Data | How long |
|---|---|
| Website request logs | A limited time, then deleted |
| Analytics | Held by Plausible without a network address, browser string or identifier |
| Email you send us | As long as the conversation needs |
| A customer's environment | As long as we provide neine to that customer |
| A person a customer erases | Removed in the next maintenance run after the request; an anonymous note of the erasure and a one-way fingerprint of each erased identifier remain, so the person is not added again |
| A person untouched in CRM for 13 months | Deleted in the maintenance run, unless an open or won opportunity or a pending draft protects them |
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15)
- rectify inaccurate data (Art. 16)
- erase your data (Art. 17)
- restrict processing (Art. 18)
- data portability, receiving your data in a structured, machine-readable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
If a customer of neine keeps a record about you, the customer is its controller: write to that customer, or to us and we will pass your request on.
To exercise a right, email team@virtuability.com. We answer within one month.
You may also complain to the Data Protection Commission, Ireland's supervisory authority, at dataprotection.ie.
Children
This website and neine are for businesses and are not directed at children. We do not knowingly collect personal data from children.
Changes
When this policy changes, we publish the new version on this page with its new date.
Contact
Questions about this policy go to team@virtuability.com, or by post to Virtuability IT Services Limited, Unit 11, ACT Business Development Centre, Parnell Square, Athlone, Co. Westmeath, N37 C8W6, Republic of Ireland.