What we hold, and why.

1. Who we are

Naheni is a trading name of Outcomer Limited, a company incorporated in England and Wales (Company No. 17323030) with its registered office at 124–128 City Road, London EC1V 2NX. We provide the Naheni service: AI that maps an organisation's procedures onto the systems it uses and guides its staff through tasks on screen.

For the information described in sections 3 and 6 we are the controller. For the information we process on behalf of a customer organisation, described in section 4, that organisation is the controller and we are its processor, under the Data Processing Terms in our Terms of Service.

You can contact us about privacy through the form at naheni.com/contact, by telephone on +44 20 4577 1442, or by post to the registered office. We do not publish an email address on this website.

2. What this policy covers

There are three kinds of information involved in Naheni, and they are treated differently.

• Website and enquiry information about people who visit this site, book a demo, request a Task Map or contact us. We hold this as controller (section 3).
• Service information that we process for a customer organisation: its procedures, the Task Maps built from them, the staff who use Naheni and the guidance they are given. The customer is the controller; we process it on the customer's instructions (section 4).
• The records held in a customer's systems: client, customer, case, employee, financial and other records. Naheni is designed not to read, collect or store these (section 5). If you are an individual whose information is held in a system used with Naheni, the organisation that runs that system is the controller of your data and any request about it should be made to them.

3. Website visitors and enquiries

Server logs

Our hosting provider records the IP address, browser and device type, pages requested and time of each request. Used for security and to keep the site working. Basis: our legitimate interest in operating a secure website. Kept for twelve months.

Website analytics

We use Vercel Web Analytics to count page views, the pages visited and the site a visitor came from. It sets no cookies, does not identify individual visitors and does not follow anyone across other websites. Basis: our legitimate interest in understanding which pages are read.

Links in our emails

Some of our emails link to a page prepared for your organisation. When that page is opened we record the date and time, the browser type and the page that linked to it, so we know it has been read and can follow up. Basis: our legitimate interest in following up business correspondence. Kept for twelve months.

Task Map requests and other enquiries

When you book a demo, request a Task Map or contact us we collect your name, organisation, work email address, telephone number, the procedure you would like mapped and the systems it uses. We use this to reply, to prepare the Task Map, and to follow up. Basis: taking steps at your request before entering a contract, and our legitimate interest in responding to business enquiries. If no trial follows, we delete it twelve months after our last contact with you.

Business outreach

We write to named people at organisations we believe may benefit from Naheni, using business contact details that are publicly available or that the organisation has published. Basis: our legitimate interest in business-to-business marketing. Every message tells you how to stop further contact; one reply is enough, and we keep your name and address on a suppression list so that we do not write again.

Booking a call

Calls booked through our Calendly link are handled by Calendly under its own privacy policy. We receive the name, email address and time you choose.

We do not collect special category data in the course of these activities and ask that you do not send it to us. We do not carry out automated decision-making about individuals that has legal or similarly significant effects.

4. Information we process for customer organisations

When an organisation uses Naheni, we process the following on its instructions and under the Data Processing Terms in our Terms of Service. The organisation decides who may use Naheni, who may see the training log and how long records are kept. Staff with questions about how their employer uses Naheni should ask their employer; we help employers respond.

Procedures and other materials

The procedures, policies, manuals and resolved support questions the organisation gives us, and the Task Maps our engine builds from them. Used only to map, maintain and support the service for that organisation. Never used for any other customer and never used to train shared AI models.

What Naheni sees on screen

Naheni stays out of the way until a member of staff opens it, or while a task they have started is running. While it is open on a page it reads the structure of that page: the names of buttons, links, menus, fields and headings, and whether a field is empty or filled, so that it can tell which step the person is on. It is designed not to read the values held in records: the contents of fields, tables and documents. It never reads password fields, card numbers or security codes. The page description and the person's question are sent to Naheni's service, and to our AI model provider, to work out the next step. Our AI model provider processes them only to answer and is contractually barred from using them to train its models.

Guidance records (the training log)

For each task we keep who asked (the person's name or work email), the task, the steps given, the addresses of the pages visited within the task, whether each step was completed, and when. These records make the service work, let us fix mistakes, and form the organisation's training log. Retention is set by the organisation; by default records are kept for the life of the agreement and twelve months after it, or deleted earlier on the organisation's instruction.

Tasks recorded by experienced staff

Where an organisation asks us to map a task that is not written down, a member of staff performs it once with Naheni observing. We keep the names of the controls used, their notes, and a picture of each step cropped around the control. Anything typed into a field is blurred out of the picture before it leaves the computer, and nothing typed is recorded as text. These recordings are kept until the organisation deletes them.

Accounts

Name, work email, role, organisation, and login and authentication records for each person given access to Naheni or to its dashboard.

5. What Naheni does not do

• It is designed not to read, collect or store the records held in an organisation's systems.
• It does not click, type or submit anything in those systems. The person performs every step.
• It does not use an organisation's materials, Task Maps or guidance records for any other organisation, and does not use them to train shared AI models.
• It does not sell personal data and does not share it with advertising networks or data brokers.
• It does not profile individuals or make automated decisions with legal or similarly significant effects.

6. Business and customer records

We hold the ordinary records needed to run the service and the company: business contact details of the people we deal with at customer and prospective customer organisations, Evaluation Plans and Order Forms, invoices and bank-transfer remittance details for directly invoiced customers, support correspondence, and correspondence with suppliers and advisers. We do not take card payments and hold no card data. Basis: performance of a contract, our legal obligation to keep accounting records, and our legitimate interest in managing customer relationships.

7. Who we share information with

We share personal data only with providers that help us run the service and the business, each under a written contract limiting what they may do with it:

• website and service hosting and content delivery (Vercel);
• database hosting for the service and our business records (Supabase), in the region agreed with each customer and recorded in its Order Form;
• an AI model provider, which processes page descriptions, questions and procedure text to produce Task Maps and guidance, under terms that prohibit it from using the data to train its models. The current provider is named in the sub-processor list we supply with our confidentiality undertaking and on request;
• business email and calendar (Google Workspace) and call booking (Calendly);
• email notifications of page visits (Resend);
• our professional advisers and insurers; and
• regulators, courts or law-enforcement bodies where we are legally required to disclose.

Customer organisations are given at least thirty days' notice of any change to the providers that process their service information, and may object.

8. International transfers

Service information is held in the region agreed with each customer. Some providers, including website hosting, may process limited technical data such as server logs in the United States or other countries. Where personal data leaves the United Kingdom we rely on the UK's adequacy regulations or on the UK International Data Transfer Agreement or Addendum, and we will provide details on request.

9. How long we keep information

Server logs

Twelve months, then deleted.

Enquiries that do not lead to a trial or contract

Twelve months from our last contact with you, then deleted.

Suppression list

Name and email address only, kept for as long as needed to honour your request not to be contacted.

Procedures, Task Maps, accounts and guidance records

For the life of the agreement and twelve months after it, or as the customer instructs, then deleted or returned. A customer that does not proceed after a demo, Task Map or trial has its materials deleted or returned within thirty days of asking.

Recorded tasks

Until the customer deletes them, and in any case at the end of the agreement.

Billing and accounting records

Six years after the end of the financial year to which they relate, as UK company and tax law requires.

Correspondence

Six years, then reviewed and deleted unless needed for a claim.

10. Security

We apply technical and organisational measures appropriate to the information we hold: encryption in transit and at rest, access limited to named staff, multi-factor authentication on our systems, and logging of administrative access. The Naheni extension never reads password fields, card numbers or security codes, and typed values are blurred from recorded-task images before they leave the computer. As soon as we begin discussions with an organisation we send it a confidentiality undertaking, signed by us, covering its systems and procedures.

11. Cookies

This website sets no cookies, and our analytics works without them. The Naheni dashboard and extension keep a strictly necessary sign-in token so that you stay logged in; it is removed when you sign out or it expires. We do not use advertising or tracking cookies. The website also remembers which country version you are viewing, in your own browser, so it shows you the same version next time. It is not used to track you.

12. Your rights

Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to our processing of it, to receive it in a portable form where we process it under a contract or with your consent, and to withdraw any consent you have given. You may object at any time to business outreach. To exercise any of these rights contact us using the details in section 1; we respond within one month. If your information is processed because your employer uses Naheni, please contact your employer, who controls that information; we will help them respond. You have the right to complain to the Information Commissioner's Office (ico.org.uk) if you are not satisfied with how we handle your data.

If you are outside the United Kingdom you may have similar rights under the law where you live, including in the European Economic Area. Requests from any jurisdiction may be made using the same contact details.

13. Business users only

Naheni and this website are directed at organisations and professionals acting in the course of business. We do not knowingly collect personal data from consumers or from anyone under 18.

14. Changes to this policy

We will post any revised version at naheni.com/privacy with a new version number and effective date. Where a change materially affects people whose data we already hold, we will notify the contacts we have for the organisations concerned.