Privacy Policy
Last updated: 1 November 2026
1. Who we are
Ninety8 Compliance is a trading name of Ninety Eight Technova Limited, a company registered in Ireland (company no. 820476), with its registered office at Woodfield, Tuam, Co. Galway, H54 DK22 ("we", "us", "our").
This policy explains how we collect, use and protect personal data when you:
- visit our website, ninety8compliance.com, or use our free tools and guides;
- use our online app, Ninety8 Product Compliance, at app.ninety8compliance.com (the "App");
- upload documents to the App through a link a customer has sent you, as a supplier; or
- work with us on a consultancy engagement.
Contact: hello@ninety8compliance.com
2. Our role
We are the data controller for personal data about our website visitors, App account holders, enquirers and consultancy clients.
When an App customer uploads or collects documents about their own products, including documents from their suppliers, we process any personal data in those documents on the customer's behalf, as their data processor. The customer decides what goes into their files. A data processing agreement is available on request.
3. What we collect
a) Website, contact form and free tools
- Your name, email address and company name
- Anything you include in a message to us
- Your answers to the EU rules checker (product type, where you sell and similar)
- Whether you ask to receive occasional emails from us
b) App accounts
- Your name, company name, email address and password (stored in encrypted form; we cannot see it)
- Company details you add, such as address and logo, which appear on your own documents
- The names and email addresses of colleagues you invite to your team
- Your plan and billing history. Card details are handled by Stripe; we do not see or store full card numbers
- Basic usage and security records, such as sign-in times and an audit log of changes to your files
c) Product files and supplier documents
- Product information, test reports, declarations, labels, photos and other documents you or your suppliers upload
- The upload link for each product, which you share with your supplier yourself. We do not ask for or store your supplier's contact details
- Records you keep in the App, such as vulnerability registers and update logs
These documents are mainly about products, not people, but they can include names, signatures and business contact details.
d) Consultancy engagements
- Business contact details
- Information you share with us for compliance, quality or audit work
- Our correspondence with you
4. How we use it, and our legal basis
- To provide the App and our services, including account set-up, storing your files, sending supplier upload links, checking documents and producing your outputs. Legal basis: performance of our contract with you.
- To take payment and keep accounting records. Legal basis: contract, and our legal obligations under Irish tax law.
- To answer enquiries and send the reports and guides you ask for, and to follow up once afterwards. Legal basis: our legitimate interest in responding to people who contact us.
- To keep the App secure and prevent misuse. Legal basis: legitimate interests.
- To send occasional emails about EU product compliance, only if you tick the box. Every email has an unsubscribe link. Legal basis: your consent. The Compliance Brief itself is published on LinkedIn. If you subscribe there, LinkedIn handles your subscription under its own privacy policy.
- To send service emails about your account, such as sign-in codes, invoices and changes to the App. Legal basis: contract.
We do not sell, rent or trade personal data, and we do not use your files to advertise to you.
5. Automated document checks
The App uses an AI model to read uploaded documents and suggest whether each one meets a fixed checklist: for example, whether a test report matches the model and refers to a current standard. The result is shown as Accepted, Query or Rejected, with notes.
These checks are about documents and products, not about you as a person, and they do not produce decisions with legal or similarly significant effects on individuals. They are guidance only. They are not legal advice, certification or approval.
To run the checks, the relevant document is sent to our AI provider, Anthropic, which processes it to return the result. Under its commercial terms, Anthropic does not use our customers' data to train its models.
6. Who we share data with
We use a small number of service providers to run the website and the App. They process personal data only on our instructions and only as needed to provide their service:
- Supabase: sign-in, database and document storage, hosted in Ireland (EU)
- Vercel: hosts the App, running in its Dublin (EU) region
- Stripe: subscriptions, invoices and card payments
- Resend: sends App emails, such as sign-in codes, upload notifications and team invites
- Anthropic: AI processing for document checks, drafting and translations
- Hostinger: hosts this website and sends checker reports
- Google Workspace: our business email
- Formspree: receives messages sent through the contact form on this website
- Web3Forms: receives your details when you download a guide from this website
- Calendly: books calls with us, if you choose to book one
- Google Fonts: serves the fonts on this website, which means your browser shares its IP address with Google
We may also share data with our accountant and professional advisers where needed, or where the law requires it.
7. Transfers outside the EU
We keep App data in the EU wherever we can. Some of our providers, including Anthropic, Resend, Vercel, Formspree, Web3Forms and Calendly, are based in the United States and may process data there. Where that happens, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
8. Cookies
Our website stores one setting in your browser to remember that you have seen the cookie notice. It does not use analytics or advertising cookies. The App uses essential cookies to keep you signed in, and nothing else. You can clear these at any time in your browser settings.
9. How long we keep data
- Enquiries and free tool data: up to 24 months, unless you become a client or ask us to delete it sooner.
- App accounts and files: for as long as your account is open. If your paid plan ends, your files stay available to you read-only for at least 12 months. We will not delete them without emailing the account owner at least 30 days beforehand. You can ask us to delete your account and files at any time.
- Billing and accounting records: six years, as Irish tax law requires.
- Backups: deleted data may remain in secure backups for up to 30 days before it is overwritten.
- Marketing emails: if you unsubscribe, we stop sending them straight away.
10. Security
We protect data with encryption in transit and at rest, access controls so that each account sees only its own files, private document storage, supplier upload links that cannot be guessed and an audit log of changes. No system is completely secure, but we take reasonable technical and organisational measures to protect your data.
11. Your rights
Under data protection law you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict or object to our processing
- receive your data in a portable format
- withdraw your consent at any time, where we rely on consent
To exercise any of these, email hello@ninety8compliance.com. We will reply within one month. If your data is in a customer's product file, we may pass your request to that customer, as they control those files.
You also have the right to complain to the Data Protection Commission in Ireland (dataprotection.ie).
12. Changes to this policy
We may update this policy from time to time. We will post changes on this page with a new date, and tell App account holders by email about any significant change.
13. Contact us
Ninety8 Compliance (Ninety Eight Technova Limited)
Woodfield, Tuam, Co. Galway, H54 DK22
Email: hello@ninety8compliance.com
