Legal
Privacy Policy
- Status
- Storage and retention amendment draft, pending counsel review and publication
- Text last changed
- 8 October 2026
- What changed
- First full policy: the hosted service, its providers, Community and your rights. Revised 28 September 2026: hosted model runs are no longer Enterprise only. Revised 2 October 2026: added counts of where people go first from the account home, and their lawful basis. Revised 8 October 2026: managed uploads, storage credentials and owner-requested deletion, and the Vercel and Modal rows now name the storage keys each one handles; the existing account and workspace-record periods are unchanged.
This policy explains what personal data Nitsor handles on nitsor.com and in the hosted service, who processes it, where it is kept and what you can ask for. It does not cover a Community installation you run yourself, because Nitsor receives none of that data.
Who is responsible
[Legal entity name], company number [Company number], registered at [Registered address], is responsible for this policy and is called Nitsor here. For any question or request about personal data, write to [privacy contact email].
Nitsor's two roles
For website visitors, enquiries, billing and each person's Nitsor account (the name and email address used to sign in, and the organisations the person belongs to), Nitsor is the controller: it decides why and how that data is used, and this policy describes it.
For personal data your organisation puts into a hosted workspace, including the people named in a scan's metadata and the record of which member drew, reviewed or accepted each label, your organisation is the controller and Nitsor is a processor. Nitsor handles that data on your organisation's instructions and only to provide the service.
Enquiries through nitsor.com
The contact form asks for your name, email address, an optional company name and a message. The walkthrough form asks for your name, work email address, an optional organisation or lab, the kind of scans you work with and their file format, optionally how many scans there are and the type of storage they are in, what you need first and optional workflow details.
Both forms send your answers by email, through Cloudflare's email service, to the Nitsor team inbox. The site keeps no other copy, and sending a form does not create an account. To limit abuse, the form counts requests from each IP address in the memory of the server that receives them, and the count is not stored anywhere else.
Do not send patient information, scans, passwords or storage credentials through either form. The website sets no cookies and runs no analytics or advertising tools.
The hosted service
When you sign in, WorkOS handles your name, email address and organisation memberships. If your organisation subscribes to Team, Stripe handles checkout, billing contacts and payment details. Invitation emails are sent through Cloudflare.
If Nitsor refuses a sign-in, it keeps the email address you used for 10 minutes in a signed cookie that page scripts cannot read, so the page that explains the refusal can show which address was refused.
Your workspace records are stored in Convex: events, commits, review decisions, the ledger, account and member records, and your storage connection settings. Owners and admins submit storage keys through the dashboard or a personal token; Nitsor stores them encrypted. Dataset Version manifests, statistics and class indexes are stored in Cloudflare R2.
Scans you register by reference stay in customer storage. Hosted uploads use Nitsor-managed storage by default; the owner can switch it off or use a write-enabled customer bucket. Nitsor-managed storage is subject to fair use. Customer connections start read-only: Nitsor keeps source metadata, point, box and class labels, reviews, audit events and dataset version manifests, never scan pixels or derived files from those connections. Masks, stored previews and model outputs require write access. Uploads also require an owner or admin to enable Accept uploads after the storage checks pass. The browser reads viewed slices through signed links that expire within 900 seconds. Bulk voxels never pass through the control plane.
Scan previews, and the hosted model runs you start, run on Modal. Their inputs are present there only while the job runs. Stored previews require a write-enabled destination and do not change the originals. Nitsor does not use your data to train models.
When this is switched on, Nitsor counts, for each UTC day and account role, where people go first from the account home: the Queue, a project or another page. The stored counts contain no names, email addresses, account IDs, person IDs or page addresses, and counting sets no cookie.
The hosted product uses cookies for sign-in and preferences. The Cookie Policy lists each one.
Self-hosted Community
When you run Community yourself, the data stays on the infrastructure you provide, and telemetry to Nitsor is off. Nitsor receives none of it, so requests about that data go to the organisation that runs the installation. This policy still applies if you send Nitsor an enquiry or create a Nitsor account.
Why Nitsor uses personal data
Where Nitsor is the controller, it relies on these legal bases. It relies on legitimate interests only where your rights do not outweigh them, and if it ever asks for consent, you can withdraw it at any time.
On a narrow screen, scroll the table sideways.
| Purpose | Legal basis |
|---|---|
| Providing and administering the service your organisation signed up for | Contract, or steps you ask for before one |
| Answering enquiries and keeping in touch with account contacts about their service | Legitimate interests in answering business enquiries and looking after customers |
| Limiting abuse of the enquiry forms and protecting accounts | Legitimate interests in keeping the service and its users safe |
| Counting, by role and day, where people go first from the account home | Legitimate interests in improving the service |
| Keeping billing and tax records, and answering binding legal requests | Legal obligation |
For workspace data, your organisation chooses the legal basis, including any condition needed for health data.
Providers that handle personal data
These providers process personal data for Nitsor. Scans in your own bucket reach them only through the bounded reads described above.
On a narrow screen, scroll the table sideways.
| Provider | What it does | Data | Where |
|---|---|---|---|
| Convex | Control-plane database and public API | Events, commits, decisions, ledger entries, account and member records, storage connection records and encrypted storage credentials | US East (N. Virginia) |
| Vercel | Runs the dashboard and hosts nitsor.com | Requests to nitsor.com and the dashboard, session cookies, and customer storage keys in transit when an owner or admin submits them | Functions in Washington, D.C.; static files from Vercel's global edge network |
| Cloudflare | Object storage, request checks, DNS and email delivery | Managed uploaded scans; Dataset Version manifests, statistics and class index; lease checks; invitation recipients' email addresses; enquiry form answers | R2 under the US jurisdiction; Workers, DNS and email on Cloudflare's global network |
| WorkOS | Sign-in and organisation membership | Names, email addresses and memberships of people who sign in | United States |
| Modal | Compute for scan previews, model jobs and Dataset Version jobs | The inputs of a scan preview, model or Dataset Version job, for the length of that job; scan preview and Dataset Version jobs also receive the storage credentials they need, for the length of the job | Region us |
| Stripe | Checkout and the billing portal | Billing contacts and payment details | Stripe's infrastructure, not region-pinned by Nitsor |
Where data is processed
The hosted service stores workspace data in the United States. Requests to the dashboard and to Dataset Versions are first handled at the Vercel or Cloudflare edge location nearest to you, which may be outside the United States, so Nitsor does not claim that processing happens in one country only.
If you are in the UK or the European Economic Area, your personal data is transferred to the United States. Write to [privacy contact email] for the safeguards that apply to a transfer.
Retention and deletion
Nitsor never deletes source scans in customer storage. You manage everything stored there, including masks and preview files. Nitsor-managed uploads are retained until the owner deletes them.
Workspace records are kept for the life of the project. A deleted Dataset Version is kept for a 30-day grace period, after which its unshared and uncited files are removed. Unsaved annotation work is kept in a bounded slot in your browser and, for 7 days, in the workspace, so it can be recovered.
Enquiries are kept as long as needed to answer and follow up. Account records are kept while the account is open, and you can export your workspace records until it closes. To close an account and have its data removed, the account owner writes to [privacy contact email]. Nitsor then deletes or anonymises the account and its workspace records by hand within 30 days, keeping only what the law requires it to keep, such as tax records. Before closing the account, export any scans in Nitsor-managed storage that you want to keep and request deletion of managed uploads when you ask for account closure. This 30-day period covers account and workspace records; it does not set a deletion deadline for managed scan files.
Security
Both nitsor.com and the hosted service redirect every plain HTTP request to HTTPS. Links to your scans expire within 900 seconds. Storage keys submitted by owners or admins are stored encrypted; agents cannot add keys. Only a SHA-256 hash of each agent token is stored. The workspace history is append-only.
If you suspect misuse involving personal data, write to [privacy contact email] and do not include passwords, keys or patient data in the message.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict its use, and to object to uses based on legitimate interests. For your Nitsor account, enquiries and billing records, write to [privacy contact email]. Nitsor may ask for enough information to confirm who you are.
For workspace data, including the record of the labels you drew or reviewed in a customer's workspace, contact that organisation, because it controls that data. Nitsor will help the organisation answer. You can also complain to the data protection authority where you live.
Clinical images and children
Customers may register clinical images. The organisation that registers them is responsible for its right to use them and for de-identifying them where the law requires. Nitsor makes no HIPAA claim, and protected health information must not be put into hosted Nitsor without Nitsor's written agreement.
Nitsor is for organisations and is not directed at children. Scans of patients who are children are the registering organisation's responsibility.
Changes and contact
When Nitsor changes how it handles personal data, it updates this policy and the date above. For a material change, it tells account owners by email or in the product before the change takes effect. Questions go to [privacy contact email] or to [Registered address].