Privacy policy

1. Who we are

HYPE MEDIA SYSTEM SRL, a company registered in Romania (VAT ID RO17068477), operates the Nango contract-management platform and associated services. For the purposes of this notice, we act as a controller for data we process about visitors to our marketing site, account holders, billing contacts and other business representatives, where we determine the purposes and means of processing.

When your organisation uses Nango workspaces, we may also process personal data as a processor on your organisation’s instructions—see your organisation’s documentation and our data-processing terms for that relationship.

2. Data we collect

We may process: business contact details (name, work email, phone, role), company name and identifiers, account and authentication data, technical and usage data (IP address, device/browser type, approximate location from IP, timestamps, pages viewed, referral URL), cookies and similar technologies as described in our cookie practices, billing and payment-related metadata processed by payment providers, and communications you send to us (support tickets, emails).

We do not seek to collect special categories of data through the marketing site. If you provide such information voluntarily, we will use it only as needed to respond and in line with law.

If you provide personal data about other persons (for example colleagues, representatives, or company contacts), you are responsible for informing them in advance and for having a valid legal basis for sharing that data.

3. Purposes and legal bases (GDPR)

We process personal data to: present our website and measure its performance; respond to enquiries and provide demos or trials where offered; create and administer accounts; fulfil contracts with your organisation (performance of a contract); invoice and recover fees (contract / legitimate interests in recovering payments); secure our services, prevent abuse and prove compliance (legitimate interests, legal obligation); comply with accounting, tax and regulatory obligations (legal obligation); and improve our product in aggregated or pseudonymised form where appropriate (legitimate interests).

Where we rely on legitimate interests, we balance these against your rights. You may object to processing based on legitimate interests as described below.

4. Recipients and transfers

We use trusted infrastructure and service providers who may act as processors (for example: cloud hosting, email delivery, SMS delivery for electronic signing OTP codes, payment processing, support services, monitoring, and security), under appropriate data-processing agreements.

We may also disclose data to public authorities where legally required, and to professional advisers (legal, tax, audit), strictly as needed.

If data is transferred outside the European Economic Area, we implement appropriate safeguards (such as the European Commission’s Standard Contractual Clauses or other GDPR-recognised mechanisms). Upon request, we can provide additional information about the safeguards relevant to applicable transfers.

5. Retention

We retain personal data only as long as necessary for the purposes above, including statutory retention for invoices and tax records, dispute resolution, and security logs.

Retention periods vary by category and purpose (for example: contractual/tax data, technical logs, support requests, and marketing data), and at the end of applicable periods data is deleted or anonymised, unless longer retention is required by law.

6. What happens if you do not provide data

In general, you are not legally required to provide personal data to us. However, some data is necessary for us to enter into or perform a contract, create accounts, respond to requests, or comply with legal obligations.

If you do not provide data marked as necessary, we may be unable to provide the services in full, process your request, or continue certain support, billing, or compliance operations.

7. Your rights

Subject to applicable law, you may have the right to access, rectify, erase, restrict processing, object, data portability and withdraw consent where processing is consent-based. You may lodge a complaint with a supervisory authority (in Romania, the National Supervisory Authority for Personal Data Processing).

To exercise your rights, you can contact us using details shown in the product, in the contact section of our website, or in official correspondence we send. We may need to verify your identity before responding.

8. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Optional AI-assisted contract review in the workspace generates orientative suggestions only; it does not produce legally binding outcomes or replace professional advice. Your organisation remains responsible for contractual decisions.

9. AI-assisted contract review (where enabled)

When your organisation’s plan includes AI contract review and the feature is enabled, we process document text you submit for analysis (for example contract or annex content, which may include personal data of signatories or counterparties) to return assistive summaries and attention points.

This processing uses a European AI provider (currently Mistral AI SA) as a subprocessor, under appropriate contractual safeguards. We do not use AI review outputs to train public models for unrelated purposes beyond providing and securing the Service as configured.

Retention of review runs and results follows product settings in your workspace. You should only submit content you are entitled to share and for which you have a valid legal basis under GDPR.

10. Electronic signing (Nango Sign, where enabled)

When your organisation’s plan includes electronic signing and the feature is enabled, we process signers’ contact details (name, work email, mobile phone), technical logs (IP address, timestamps, browser metadata), and document hashes to operate the Nango Sign flow.

For advanced electronic signature (AES) under eIDAS Art. 26 we also process one-time verification codes (email and, when enabled, SMS).

For qualified electronic signature (QES), available on eligible plans, identification and the qualified certificate are processed by a partner qualified trust service provider (QTSP) in the signing portal. Nango orchestrates sending, credits, and evidence; Nango is not a QTSP and does not issue qualified certificates. Your organisation remains controller towards signers; we and, where applicable, the QTSP act as processors for data in this flow on your organisation’s instructions.

SMS OTP delivery (AES path) may use messaging subprocessors configured by the platform (for example SMSO for Romanian numbers or Vonage for international routes). Email OTP uses our email infrastructure.

Audit logs and signed documents are retained according to product backup and retention settings. We recommend organisations archive signed PDFs and proof records for at least ten years where aligned with contract retention policies.

11. Security

We implement technical and organisational measures appropriate to the risk, including access controls, encryption in transit where standard for the service, monitoring and resilience practices. No online service is completely secure; please use strong credentials and protect your devices.

12. Changes and contact

We may update this notice from time to time. Material changes will be indicated by revising the date above and, where appropriate, by additional notice.

Questions about this privacy notice may be directed to HYPE MEDIA SYSTEM SRL using contact details shown in the product, on invoices, or on our website.