Privacy policy

Last updated: 25 October 2026

nancit (“nancit”, “we”, “us”) is a business workspace operated by Salton Sync. It helps businesses keep their clients, contacts, leads, invoices, quotes, documents, email and calendar in one place, with an AI assistant. This policy explains what information we collect, how we use it, who we share it with and the choices you have. It applies to nancit.com, the nancit app and the lead forms our customers put on their websites.

1. Who is responsible

For the account and usage information described below, Salton Sync is the responsible party. For the business records a customer keeps in nancit (their clients, contacts, leads, documents and so on), that customer decides what is stored and why; we process those records on their behalf to provide the service. Contact us at [email protected].

2. What we collect

Account information

Your name, email address, password (stored only as a secure hash), role, time zone and the organisation you belong to.

Business records you add

Clients, contacts, leads, products and services, invoices, quotes, payments you record, notes, files you upload, custom fields and records, workflows, workers and the conversations you have with the nancit assistant.

Connected email and calendar (only if you choose to connect them)

When you connect Microsoft Outlook or Google Gmail, you sign in with that provider and choose what to allow. nancit then reads your email and calendar on demand to show them in nancit, and acts in them only when you ask (for example, sending a reply you approved). We store only a secure, encrypted connection token, your mailbox address and name — not copies of your mailbox. See sections 4 and 5 for Google and Microsoft account data.

Lead form submissions

When someone fills in a nancit lead form on a business's website, the details they enter (such as name, company, email, phone and message) are saved as a lead in that business's nancit account. We also keep a one-way hash of the sender's network address, briefly, to limit spam.

Usage and technical information

In guest mode, a random browser identifier and a secure, HttpOnly guest cookie identify your separate guest workspace. We use keyed hashes of that identifier and the network IP address to enforce 200 guest credits per 24 hours; people on the same network may share this limit. We do not read MAC addresses or use advertising fingerprints. Guest records are kept for up to 30 days of inactivity and are separate from signed-in account records. Guest usage identifiers expire after two days without use. New signed-in Free workspaces receive 400 credits daily.

Basic logs needed to run and secure the service (request times, errors, IP addresses at the network edge), and AI usage counts used to apply daily credit limits. We use a secure, HttpOnly session cookie to keep you signed in. We do not use advertising cookies or sell your data.

3. How we use information

• To provide nancit: store and show your records, create documents, run workflows and workers you set up, and show your connected email and calendar.
• To power the AI assistant and workers: the parts of your records and, when you ask, your email or calendar that are needed to answer a request are sent to our AI provider to produce a reply. Changes are proposed as cards you confirm.
• To send emails you ask nancit to send, workflow emails you set up, team invitations and report emails.
• To keep the service secure, prevent abuse and spam, fix problems, and apply plan and credit limits.
• To communicate with you about your account and the service.

We do not use your saved business records, files, email or calendar to train AI models, and we do not use them for advertising. Conversations with nancit are the exception described below.

Improving nancit’s AI

Your conversations with nancit (the messages you send, including in guest mode, and nancit’s replies) may be reviewed by authorised members of our team and used to improve nancit and our AI models, such as Dawn: for example, to find and fix mistakes, test changes, and train and evaluate future versions. This covers only what is in the conversation itself, including anything from your records, files or email that you or nancit bring into it. Please do not share information in a chat that you do not want reviewed.

If you do not want your conversations used this way, email [email protected] from your account’s email address and we will exclude your future conversations. Conversations used to improve our AI are kept only as long as needed for that purpose and are protected like the rest of your information.

Staff access for support and running the service

A small number of authorised Salton Sync employees can use an internal staff console to run nancit and help customers. It shows account information: organisations and the people in them (names, email addresses, roles, sign-up and last sign-in dates), plans and subscriptions, payment records, AI credit usage, workers and record counts. Staff can change an organisation’s plan, add credits, suspend or reactivate an organisation, resend an invitation and remove a user, for example when you ask us to or to stop abuse.

Staff look at your business records (clients, contacts, invoices and quotes, products and services, custom records) only to give support you asked for, to investigate a problem or abuse, or where the law requires it. That view is read-only. Each time, the employee must give a reason, and every staff action and view is recorded with who did it, when and why; the record cannot be changed. Staff never see your connected mailbox’s contents, your chats, uploaded files, passwords, connection tokens, or bank and payment details on your business profile or documents. Staff access needs a second sign-in step (an authenticator code). You can ask us at [email protected] for the record of staff access to your organisation.

4. Google user data

If you connect a Google account, nancit requests access to Gmail (to read, organise and send email you approve) and Google Calendar (to read events and create, change or respond to events you approve), plus your basic profile (name and email address).

• We use Google user data only to provide and improve the user-facing features you use in nancit: showing your inbox and calendar, letting you reply, forward, send and schedule from nancit, and letting the nancit assistant and your workers read and draft email or events at your request.
• We do not use Google user data for advertising, do not sell it, and do not use it to train generalised AI or machine-learning models.
• We do not allow humans to read your Google user data except with your explicit permission for a specific message, when necessary for security (for example, investigating abuse), to comply with law, or when the data has been aggregated and anonymised for internal operations.
• Google user data is transferred to third parties only as needed to provide the features you use (for example, to our AI provider to answer a request you made), to comply with law, or as part of a merger or acquisition with notice to you.

nancit’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time from the Inbox in nancit, or remove nancit’s access in your Google Account at myaccount.google.com/permissions. When you disconnect, we delete the stored connection token.

5. Microsoft account data

If you connect a Microsoft account (Outlook.com or Microsoft 365), nancit requests the Microsoft Graph permissions to read and organise your mail (Mail.ReadWrite), send mail you approve (Mail.Send), read and change your calendar (Calendars.ReadWrite), read your basic profile (User.Read) and stay connected (offline_access).

• We use Microsoft account data only to provide the features you use in nancit: showing your inbox and calendar, letting you reply, forward, send and schedule from nancit, and letting the nancit assistant and your workers read and draft email or events at your request.
• We do not use Microsoft account data for advertising, do not sell it, and do not use it to train generalised AI or machine-learning models.
• We do not allow humans to read your Microsoft account data except with your explicit permission, when necessary for security, to comply with law, or when it has been aggregated and anonymised for internal operations.
• Microsoft account data is transferred to third parties only as needed to provide the features you use (for example, to our AI provider to answer a request you made), to comply with law, or as part of a merger or acquisition with notice to you.

You can disconnect Outlook at any time from the Inbox in nancit, or remove nancit’s access at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts). When you disconnect, we delete the stored connection token.

6. Who we share information with

We use trusted service providers to run nancit. They process data on our instructions and only to provide their service:

• Cloudflare — hosting and network delivery of the app and API.
• Supabase — database, authentication and private file storage.
• OpenAI — AI processing for the assistant, workers and voice transcription.
• Resend — sending workflow, invitation, notification and report emails.
• Microsoft and Google — only when you connect your Outlook or Gmail account.

We may also share information if required by law, to protect rights and safety, or as part of a business transfer. We do not sell personal information.

7. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where this happens we rely on the providers’ contractual and security safeguards.

8. How long we keep information

We keep your records for as long as your account is active. Deleted records go to Trash for 30 days before they are removed permanently. Email and calendar content is read from your provider when needed and not kept as a copy. If your organisation’s account is closed, we delete its data within a reasonable period, except where we must keep some information for legal, tax or security reasons.

9. Security

Data is encrypted in transit. Passwords are hashed, sessions use secure cookies, email connection tokens are encrypted, files are stored privately, and access within an organisation follows the permissions its admins set. Staff access to the internal console needs a second sign-in step and is logged (see Staff access). No system is perfectly secure, but we work to protect your information and will notify you of a breach where the law requires.

10. Your rights

Depending on where you live (including under South Africa’s Protection of Personal Information Act and the GDPR), you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to complain to a data protection authority (in South Africa, the Information Regulator). Many of these you can do in nancit directly; otherwise email [email protected]. If your information is in a business’s nancit account (for example, you submitted one of their lead forms), please contact that business first; we will help them respond.

11. Children

nancit is a business tool and is not intended for anyone under 18.

12. Changes

We may update this policy. We will post the new version here with a new date, and tell account holders about significant changes.

13. Contact

Salton Sync · [email protected]