Privacy policy

1. Who we are

Corentis ApS, CVR 46654897, A.P. Møllers Allé 43B, 2791 Dragør, Denmark, trading as nthparty ("nthparty", "we"), is the controller for the processing described here. We have not appointed a data protection officer; write to privacy@nthparty.io with any question about this policy, including a request to exercise the rights in section 8.

2. What we process, and why

Account data. Your email address, a name if you give one, your language and timezone settings, the time of your last sign-in and the browser (user agent) that completed it — only the most recent sign-in is kept, each one overwriting the last — and, if you sign in with Google, the identifier of your Google account. It also covers the alert destinations you add (email addresses, Slack workspace and channel identifiers, webhook URLs) and the addresses of people you invite to your account. We process it to give you an account and to send the alerts you asked for. The legal basis is performance of a contract.

Your vendor inventory and rules. The companies you chose to watch and the conditions you wrote. This is business information rather than personal data, but it is linked to your account and we treat it with the same care. The legal basis is performance of a contract.

Billing data. Handled by our payment processor, which hosts the card form, the invoices and the payment method itself. We receive the plan and its status, and we never see the card number. The legal basis is performance of a contract and, for the invoice records, a legal obligation.

Security records. The IP address of each request, in our server logs and in the counters that rate-limit sign-in and the API. When you ask for a sign-in link, the IP address and browser (user agent) of that request are written into the sign-in email, so you can tell whether it was you who asked; they therefore pass through the background job that sends the email and through our email provider, Sweego. If you work for us, what you do in our staff console is recorded in an audit trail, and so is any staff action on your account. The legal basis is our legitimate interest in keeping the service secure and available.

Mail delivery records. When an email we send bounces or is reported as spam, we keep the address and the reason (hard bounce, soft bounce or complaint) so that we stop mailing it. The legal basis is our legitimate interest in protecting the deliverability of mail every customer depends on, including sign-in links.

Support correspondence. What you write to us, whether by email or through the contact form, and our reply. A contact-form message is relayed to us by a background job. The legal basis is our legitimate interest in answering you.

Status updates. If you subscribe to updates at status.nthparty.io, the address you give is held by Better Stack, which hosts that page, and used only to send those updates. The legal basis is your consent, which you withdraw by unsubscribing.

3. What we do not process

We do not run advertising or analytics, we do not sell or share personal data, we do not build profiles, and we do not make automated decisions with legal effect. We ask that you do not send us special-category data, because we have no use for it.

4. The graph dataset

The subprocessor graph is compiled from disclosures companies publish themselves, on their own websites, for the purpose of being read. It describes relationships between legal entities. Where a published list happens to contain a person's name — a data protection officer, a contact address — we do not need it and we do not retain it in the dataset.

5. Cookies

Three cookies, all strictly necessary, with no consent banner because there is nothing to consent to. _nthparty_session is set on your first page view, signed in or not, because it carries the token that protects our forms against cross-site request forgery; once you sign in it also holds your session. It is encrypted and kept until you close your browser; a signed-in session inside it ends when you sign out, and after 30 days at most. XSRF-TOKEN carries a copy of that same anti-forgery token which the page's own script reads and sends back with each request, so it is readable by JavaScript and holds nothing else. np_ref is set only when you arrive from a shared referral link. It is encrypted, remembers the referral code for 90 days so the company that referred you is credited, carries no identifier of yours, and is deleted when you sign up. Your browser's local storage keeps a few interface preferences, such as the colour theme, which never leave your browser. There are no analytics or advertising cookies.

6. Who we share it with

The subprocessors listed on our own subprocessor page, which is published, dated, and given 30 days' notice before it changes. We also disclose data where a law requires it, and we tell you when we are permitted to.

7. Where it is processed

Account and application data is stored and processed in the European Union, on servers in Germany. One subprocessor, Sentry, is established in the United States; it stores our error events in its EU region in Frankfurt, and any access to them from the United States relies on standard contractual clauses and the measures described in our DPA. Stripe's transfers within its own group rely on that group's standard contractual clauses. The current list, with each subprocessor's country, is on the subprocessor page.

8. Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, and ask for it in a portable format. Your name and settings can be corrected in the product, and you can leave an account yourself; for anything else, including a copy of your personal data, write to privacy@nthparty.io and we will answer within a month. You can also complain to your supervisory authority; in Denmark that is Datatilsynet.

9. How long we keep it

• Account data for as long as the account is open. An owner who deletes the account deletes its data immediately. Your own user record is deleted 30 days after your last account membership ends.
• An account where no member has signed in for 12 months is dormant. Its owners are emailed and given 30 days' notice, after which we may delete it. Accounts on a paid plan are never treated as dormant.
• Invitations to join an account until they are accepted; one that is declined, revoked or expires is deleted 30 days after it closed.
• Alerts for the life of the account; records of their delivery for 90 days; webhook delivery history for 30 days; digest runs for 90 days; the history of syncs to a connected GRC platform for 90 days.
• Generated exports for 30 days, and the unmatched rows of a CSV import for 90 days. A stored file that no record refers to any more is deleted after a day.
• Mail delivery records — an address that bounced or complained — for as long as the suppression is active, because deleting it would mean mailing a dead mailbox or somebody who reported us. A suppression released by staff, and a soft-bounce count that never led to a suppression, is deleted after 90 days.
• The staff audit trail for 12 months.
• Server logs, including IP addresses, for about 30 days.
• A background job that fails keeps its arguments — which can include a contact-form message or the details in a sign-in email — while it is retried, and for up to 30 days after its last retry.
• Backups for 7 days, after which deleted data is gone from them too.
• Records of processed payment events for 90 days, and invoice records for five years, as the Danish Bookkeeping Act requires.
• Support correspondence for two years.

10. Changes to this policy

Material changes are emailed to every account before they take effect. The date at the top of this page is the date of the current version.