nilo

Your privacy. Your rights.

Nilo Privacy Policy

Effective date: September 28, 2026

Operator and data controller: B9S Labs, Inc.

Business mailing address: 2261 Market Street, Suite 12999, San Francisco, CA 94114, United States

Privacy and support contact: [email protected]

1. Your conversations are private

Nilo cannot read your private conversations, including your messages, attachments, and AI responses. They are protected by cryptography. Your chat history is encrypted, and we do not keep copies of it on our servers or in our account backups.

When you send a message, it goes to Nilo's service to generate a response privately. We do not use your conversations for model training, advertising, or sale. Our AI infrastructure providers cannot read your conversations either.

This policy covers the Nilo iOS app, its account and AI services, the Nilo product website, and support communications (the "Service"). It does not cover the separate browser chat client or other B9S products. "Nilo," "we," and "us" mean B9S Labs, Inc.

We handle some information separately from your conversations, as explained below. Optional web search and messages you choose to send to support have different privacy treatment.

2. Information we handle

We do not sell personal information, share it for cross-context behavioral advertising, or track you across other companies' apps and websites for advertising. We do not perform these activities regardless of Do Not Track or Global Privacy Control signals.

Web search is off by default in new conversations. If you turn it on, queries generated from your conversation and requested web addresses are sent to Exa to retrieve results. Those queries can include personal details from your messages. Exa can read the queries it receives and processes them under our search integration's zero-data-retention arrangement. Your full chat is not deliberately sent as a search query.

You can leave search off and still use Nilo, or turn it off for future requests. Websites you choose to open have their own privacy policies and may receive your IP address and browser information.

4. Providers and other disclosures

We use providers to operate the Service:

Providers acting on our behalf may use information only to perform their agreed services and must protect it consistently with this policy and applicable law. Providers may also keep limited service, billing, or security records for their own legal and operational purposes under their applicable terms and privacy notices. Apple separately handles App Store and device information under its own policies and your settings.

We may disclose information we actually hold when legally required or necessary to protect rights, address abuse, or secure the Service. Relevant information may also transfer in a merger, acquisition, or business transfer, subject to this policy and applicable law. None of these circumstances gives us the ability to read your private conversations.

5. Retention

Your chat history remains encrypted until you delete it. We do not keep copies on our servers or in our account backups. Temporary data used for AI processing can remain until the processing system clears it; it stays protected and unreadable to us and our infrastructure providers.

Where a specific legal obligation requires longer retention, we keep only the necessary records for the required period. Providers' own records and residual backups follow their applicable retention and deletion terms and may take longer to remove than our 30-day account-backup period. Contact us for details about a particular record or request.

6. Your choices and deletion

Delete conversations: Use the conversation menu in the app. Signing out does not delete saved chats. We cannot restore history from a server copy because we do not keep one. Losing access to encrypted history or deleting app data can make that history permanently unavailable. Copies you separately export or share remain under your control.

Delete your account: Contact [email protected] to request deletion of your account and associated personal information. After verifying your request, we delete it as described in section 5. Use the conversation menu to remove saved chats; uninstalling the app does not itself delete your account.

Control optional features: You choose which photos and files to attach and whether to enable web search. You can manage device permissions in iOS Settings. Declining optional attachment permissions does not prevent text conversations.

7. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your personal information; restrict or object to processing, including processing based on our legitimate interests; withdraw consent; or appeal a decision about a request. Withdrawal does not affect processing already lawfully completed. You may use an authorized agent where permitted, and we do not discriminate against you for exercising your rights.

Send requests or appeals to [email protected]. We may verify that you control the account and will respond within the period required by law. Do not email login credentials or recovery codes. We cannot provide a readable copy of conversations we cannot access.

You may complain to your local data protection authority, including an EEA supervisory authority or the UK Information Commissioner's Office, where applicable. You do not need to contact us first.

Where required by law, we rely on our agreement with you to provide the Service; our legitimate interests in security, reliability, abuse prevention, and support, balanced against your rights; legal obligations; and consent where required for optional processing. Basic account and connection information is necessary to provide the online Service. Attachments, web search, and additional support information are optional.

Our account service is hosted in the United States, and providers may process information in other countries. Where required, we use recognized transfer safeguards, such as adequacy decisions, the European Commission's Standard Contractual Clauses, and the UK Addendum. Contact us for information about applicable safeguards or to request a copy.

We do not use conversations to make legally significant decisions about you. You can contact us to request review of an account restriction.

9. Security and age requirements

Cryptography protects your conversations, but no system can eliminate every risk. Rare implementation bugs, security vulnerabilities, or a compromised device could affect those protections. We remain responsible for our obligations under applicable law.

You must be at least 13 and meet any higher local minimum age. If you are under 18, or below the local age of majority if higher, you need permission from a parent or legal guardian who reviews this policy and the Terms of Service with you. You must be truthful about your age and permission.

Nilo is not directed to children under 13, and they may not use it. We do not knowingly collect their personal information. If we learn that we have, we will restrict the account and delete the information as required by law. Parents or guardians may contact us with concerns or requests, subject to the child's legal rights.

10. Changes and contact

We will update the effective date when this policy changes, notify you of material changes before they take effect, and obtain consent where required. An update alone does not authorize a new consent-dependent use or weaken existing conversation protections.

For privacy questions, complaints, or support, contact B9S Labs, Inc., [email protected], 2261 Market Street, Suite 12999, San Francisco, CA 94114, United States.