Privacy Notice

Who we are #

Nayto is provided by FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore ("we", "us"). We are responsible for the personal data described in this notice, except where it says we process data on a customer's behalf.

Our data protection officer can be reached at dpo@nayto.io. Questions and requests about your personal data go to privacy@nayto.io.

What this notice covers #

This notice covers people who use the Nayto console, people invited to it, and people who visit our website or write to us.

Customers also use the Service to hold personal data of their own: their content - a photograph of a member of staff in a campaign, for example - and the team data they manage, such as who belongs to their organization, each person's role, and what each did there. For that data the customer decides what is collected and why, and we process it on their behalf under the Data Processing Addendum. Ask your organization about it.

We do not collect personal data about the people who see the screens. Screens running our player have no camera or audience measurement from us, and the advertising on Free plan screens is chosen without any information about viewers.

What we collect #

• Account details: your email address, your password (stored only as a one-way hash that nobody can reverse), your name if you give it, and when your account was created, verified and last changed.
• Organization details: the name of each organization you create or join and its country or region. Your role in it, who invited you and what you did there are your organization's team data, which we hold on its behalf.
• Sign-in records: when each session started, was last used and ends, and digests of the network address and browser it came from; and a record of each sign-in, wrong password and change to how your account is secured, with a digest of the network address and the kind of device and browser in a few words (for example, Chrome on macOS), which you can see under Sessions in the console. The address itself is not kept, and session credentials are stored only as digests.
• Agreement records: which version of these documents you accepted, when, and a digest of the network address you accepted from.
• Billing details: for a paid plan, the Stripe customer and subscription that belong to your organization, its plan and payment status. Your card details and billing address are entered on Stripe's pages and held by Stripe; we do not receive card numbers.
• Mail records: the address each message we send goes to, whether it was delivered, and addresses that bounced or complained, so we stop sending to them.
• Correspondence: what you write to us, and our replies.
• Screen details: each screen's name and location, what its hardware reports about itself, when it last checked in, and what it is playing. A screen is not a person, but its location and schedule may say something about a business.
• Website and security data: the network address and browser details every web request carries, held briefly in our server logs; and, when you sign up or sign in after many wrong passwords, the signals Cloudflare Turnstile reads to tell a person from an automated script.

Why we use it #

• To provide the Service you or your organization asked for: to create and secure your account, let you sign in, run your organization's screens, and show its members what happened.
• To take payment for paid plans and keep the accounting records the law requires.
• To send messages the Service needs to send: invitations, address confirmations, password resets, security notices, and notices about billing and changes to these documents.
• To keep the Service and its users safe: to detect and stop abuse, investigate errors and outages, and protect accounts.
• To answer you when you write to us.
• To meet our legal obligations and to establish or defend legal claims.

We do not sell personal data, we do not use it to profile you or for advertising, and we do not send marketing email unless you have agreed to receive it.

Your consent, and when we rely on something else #

Under Singapore's Personal Data Protection Act 2012 (the PDPA) we collect, use and disclose personal data with your consent - which you give by creating an account or accepting an invitation, and which can be deemed where you give us data for an obvious purpose - or where the PDPA allows it without consent, for example where it is needed for our legitimate interests in keeping the Service secure, or to meet a legal obligation.

You may withdraw your consent at any time by writing to privacy@nayto.io. We will tell you what withdrawing means - usually, that we can no longer provide the Service to you - and stop within a reasonable time, unless the law requires or allows us to carry on.

For people in the European Economic Area or the United Kingdom, the legal bases we rely on are listed in our GDPR Statement.

Who we share it with #

We use a small number of companies to run the Service. They process personal data only on our instructions and under contracts that require them to protect it. They are listed, with what each does and where, on our subprocessors page: DigitalOcean, Neon and Amazon Web Services host the Service in Singapore, and Amazon Web Services sends its email; Stripe takes payments; Sentry receives error reports; Better Stack monitors availability and holds server logs; and Cloudflare Turnstile checks sign-ups, and sign-ins after many wrong passwords, for automated abuse.

Other members of an organization see your name, email address, role and the actions you take in that organization.

We may disclose personal data where the law requires it, to protect people from harm, or to a company that takes over the Service, which would be bound by this notice.

Where it is held #

The Service is hosted in Singapore: its servers, database and file storage all run in Singapore data centres. Its email is sent from Amazon's data centres in the United States.

Some of our providers process data outside Singapore - Stripe and Cloudflare in the United States and elsewhere, Amazon SES in the United States, and Sentry (in Germany) and Better Stack in the European Union. Where personal data leaves Singapore, we make sure it stays protected to a standard comparable to the PDPA, as the PDPA's transfer rules require, through contracts with each provider. The subprocessors page says which data goes where.

How long we keep it #

We keep personal data only as long as we need it for the purposes above or the law requires. Account details are kept while your account exists; within 30 days of it being closed, your name and email address are removed. Records that must outlast the account - what you did in an organization, your organization's billing records, and your acceptance of these documents - are kept without them, so they no longer identify you. Sign-in records are kept for up to a year. The Data Retention Schedule sets out every category.

How we protect it #

Passwords are stored as one-way hashes, and every credential the Service issues - sessions, invitation links, reset links, screen credentials - is stored only as a digest. Every connection is encrypted. Access within an organization is decided by explicit permissions, and only the staff who run the Service can reach its systems. Our Security page describes what is in place.

No system is perfectly secure. If a breach of your personal data is likely to cause you significant harm, we will tell you, and we will tell Singapore's Personal Data Protection Commission when the PDPA requires.

Your rights #

You may ask us for a copy of the personal data we hold about you and how it has been used or disclosed in the past year, and to correct anything that is wrong or incomplete. You can change your name and password in the console yourself.

You may ask us to close your account. Within 30 days your name and email address are removed. Some records are kept after that, without them, for the periods the retention schedule gives: what you did is part of your organization's history, billing records are kept for tax law, and a record that you accepted these documents is kept as evidence of the agreement.

Write to privacy@nayto.io, or use our privacy request form; if you have an account, you can also ask under Settings in the console, where you can download a copy of your data yourself. We may ask you to confirm who you are. We answer within 30 days, and if we need longer we will tell you when to expect an answer. We may charge a reasonable fee for a copy of your data where the PDPA allows; we will tell you first.

People in the EEA, the UK and California have further rights, described in our GDPR Statement and California Privacy Notice. Our PDPA Statement sets out how we meet each PDPA obligation.

Cookies #

The console uses one cookie, to keep you signed in, and the website uses none for tracking. The Cookies page lists everything we store in your browser.

Children #

The Service is for businesses and for people aged 18 or over. We do not knowingly collect personal data from anyone younger. If you believe a child has an account, write to privacy@nayto.io and we will close it.

Complaints #

If you are unhappy with how we have handled your personal data, write to our data protection officer at dpo@nayto.io and we will respond within 30 days. You may also complain to Singapore's Personal Data Protection Commission, or to the data protection authority where you live.

How this document changes #

Every version of this document has a number and the date it applies from, both printed under the title. A change is published as a new version rather than an edit to this one, so what the document said on any day can be checked.

When a change matters to what you have agreed or to how we use your data, we tell you before it takes effect. Earlier versions are available from legal@nayto.io.