Nistor Cloud privacy policy
Last updated: 18 October 2026
Who we are
Nistor Cloud is the managed edition of Nistor: we run a dedicated Nistor instance for a customer organisation (for example, Acme Retail) and give its members a console at nistor.cloud to manage it. Nistor Cloud is in early access.
Nistor Cloud is provided by Nistor (“we”); its publication director is Rémy Larroye.
Nistor is the controller of the personal data this policy describes, which it uses to provide, secure and bill Nistor Cloud, sign-in data included. Where a customer organisation decides who joins its console and what they do there, the customer is the controller of its members’ data in that organisation and Nistor processes it on the customer’s behalf, under the data processing agreement.
This policy covers the Nistor Cloud console and its sign-in. The data a customer’s own Nistor instance reads in the customer’s systems is covered by the customer’s contract and the data processing agreement.
Questions and requests about your personal data: nistor-support@nistor.io.
Signing in with Google
You can sign in to the console with your Google account. Nistor Cloud asks Google for three scopes only: openid, email and profile. With them, Google shares your e-mail address, whether Google has verified it, your Google account identifier, and the name and profile picture of your Google account.
Nistor Cloud uses this to identify you: it checks that your e-mail address is verified and finds your membership of a customer organisation, and the role it gives you, by your e-mail address and account identifier. Our own systems keep only those two. We do not use your name or profile picture.
Sign-in runs on Google Cloud Identity Platform, which keeps a user record for you with what Google shared, name and picture included. That record is deleted with your membership (see Retention).
Nistor Cloud does not ask for, and cannot read, your Gmail, Drive, Calendar, contacts or any other Google data, and it never posts or acts on your behalf in Google services.
Nistor Cloud’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to sign you in to Nistor Cloud. We do not sell it, use it for advertising, use it to train AI or machine-learning models, or transfer it to anyone except as needed to provide the service (Google Cloud hosts it), to comply with the law, or as part of a merger or acquisition. No one at Nistor reads it, except with your consent, to investigate abuse or a security incident, or to comply with the law.
You can also sign in with a one-time link sent to your e-mail address instead; Identity Platform sends that e-mail. You can remove Nistor Cloud’s access to your Google account at any time in your Google account’s permissions; you will then need to sign in again.
What else we collect
Membership: your e-mail address, your sign-in account identifier, your role, whether your membership is active, the date you last signed in (updated at most once a day) and, if you are removed, when.
Invitations: the invited e-mail address, the role, a hash of the invitation token (never the token itself), when it expires (7 days) and when it was accepted. We do not e-mail invitations: the person who invites you sends you the link.
Your organisation: its name, domain and country, its contracts and deployments, the contacts it names (name, e-mail, role, whether they are a billing contact or approve support access), and the notes our staff keep about the account.
Activity: an audit record of who did what, and when, in the console, with the e-mail address of the person who did it, including one sign-in record a day. Members of your organisation who can see its audit log see these records.
Change requests: when a member asks for a change to their organisation’s Nistor instance, the request, their e-mail address and the reason they give are recorded, and are copied into our deployment configuration on GitLab with the e-mail addresses of the people your organisation names as support approvers.
Usage: aggregate usage counts per Nistor instance, such as the number of active users, with no names or e-mail addresses.
Billing: invoices, with your organisation’s billing details.
Technical logs: Google Cloud’s load balancer logs each request to the console (including your IP address, the time and the address requested). We use them to run and protect the service, for example to limit the rate of requests from one address.
Your browser: the console sets no cookies and runs no analytics, advertising or tracking. It keeps your sign-in in memory only, so reloading the page signs you out, and stores one display preference (whether the side menu is collapsed) in your browser. Google’s sign-in pages are covered by Google’s privacy policy.
How we use it
To provide the service under the customer’s contract: to sign you in, give you the access your role allows, carry out the changes your organisation asks for, and support and bill the customer (GDPR Art. 6(1)(b)).
To keep the service secure and to establish or defend legal claims: the audit records and request logs (our legitimate interests, Art. 6(1)(f)).
To meet our legal obligations, such as keeping invoices (Art. 6(1)(c)).
We do not sell personal data, do not use it for advertising, and make no automated decisions about you that have legal or similarly significant effects.
Where it is processed
The console, its database, storage buckets and reports run on Google Cloud in the europe-west1 region (Belgium).
Sign-in uses Google Cloud Identity Platform, a global Google Cloud service: sign-in data may be processed outside the European Union, under Google’s Cloud Data Processing Addendum and its standard contractual clauses.
Our deployment configuration, with the change requests and support approvers described above, is kept on GitLab.com, in the United States.
Subprocessors
Google Cloud: hosting, database, sign-in and the sign-in e-mails. GitLab Inc.: our deployment configuration. The subprocessors page lists them, and we give notice there before adding one.
Retention
Your membership and sign-in account: while you are a member; deleted 30 days after you are removed.
Invitations: 30 days after they are accepted or expire.
Contacts and notes of a former customer: 24 months after the contract ends.
Invoices: 10 years, or longer where the law of the customer’s country requires it.
Audit records: 6 years.
Request logs: 30 days.
Deleted data can remain in our database backups for up to 14 days, until they are replaced.
Security
Data is encrypted in transit (TLS 1.2 or later) and at rest on Google Cloud. The database has no public address, accepts only encrypted connections and uses no passwords: each service signs in with its own Google Cloud identity.
Our staff reach the service only through Google’s Identity-Aware Proxy with their company accounts, with the least access their role needs. Every console action is recorded in an audit log that cannot be changed afterwards.
Your rights
Under the GDPR you can ask for access to your personal data, a copy of it in a portable form, its correction or erasure, and the restriction of its processing, and you can object to processing based on our legitimate interests.
Write to nistor-support@nistor.io from the address concerned, or have an owner of your organisation confirm the request in writing. We answer within one month.
You can also complain to the data protection authority of the EU country where you live or work, or where you think the problem happened.
Deleting your account
An owner or admin of your organisation can remove you on the console’s Team page; your membership and your sign-in account are then deleted 30 days later.
You can also ask us to erase your data at nistor-support@nistor.io. We delete your membership, invitations, contact entries and sign-in account, and remove you from the support approvers in our deployment configuration. We keep the audit records where you are the actor (6 years, to establish or defend legal claims) and invoices (a legal obligation), as described above.
Changes and effective date
We publish any change to this policy on this page and update its date. This version is effective from 18 October 2026.