Privacy Policy

We take your privacy seriously. Here is exactly what we do with your data.

Operated by Linvium LLC · Last updated: September 21, 2026

1. Introduction

This Privacy Policy explains how Linvium LLC ("we", "us", "our"), operating the Nadya service at nadya.app, collects, uses, stores, and protects personal data. It applies to visitors of our website, to users of the Nadya app, and to people whose comments on a user's LinkedIn posts are handled in the app (section 9).

This policy is written to comply with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

2. Data Controller

The data controller responsible for your personal data is:

As a data controller, we determine the purposes and means of processing your personal data. For Studio Plus company accounts, the company that invites you decides to involve you; see section 10.

3. The Service in Brief

  • Feed. We subscribe to a curated set of third-party AI and technology newsletters and publish AI-generated summaries of their articles. The newsletters are ones we receive ourselves. We do not read your mailbox and you do not connect one.
  • Studio. Tools for drafting, illustrating, scheduling and publishing LinkedIn posts in your name, and for suggesting replies to comments on them.
  • Studio Plus. A company account for several Studio users. Not yet generally available.

4. Data We Collect

4.1 Account Data

  • First and last name, email address and, if provided, profile picture
  • Password (stored only in hashed form by our authentication provider) or your Google sign-in identifier
  • Language, timezone, theme, reading and notification settings
  • Communications you send us

4.2 Feed Activity

  • Categories and sources you follow
  • Articles you save as favourites and content you engage with

4.3 Studio Content

  • Your brand profile: name, role, overview, values, target audience, content themes, tone of voice and call to action, plus any website address or LinkedIn "About" text you paste in so AI can fill the profile for you
  • Writing styles and image styles you choose or write
  • Posts and drafts, their source (an article, a link, a topic or none), your instructions to the AI, schedules, publication status and the LinkedIn identifier of a published post
  • Automation rules and the history of what they produced
  • Images you upload or generate
  • Notifications we show you
  • Your AI credit balance and a ledger of credits granted, spent and refunded, and a technical log of AI requests (model, size, cost) used for cost control

4.4 LinkedIn Connection

If you connect LinkedIn, we receive through LinkedIn's authorisation screen your LinkedIn member identifier, name, profile picture and email address, and an access token that lets us publish posts to your personal profile when you tell us to. We request only the permissions needed for sign-in and for posting on your behalf. We cannot read your LinkedIn messages, connections or feed. Access tokens are stored encrypted, are never sent to your browser, and are deleted when you disconnect LinkedIn or close your account.

4.5 Comments From Other People

When you use the reply feature, Studio stores comments made on your LinkedIn posts: the commenter's name, headline, profile picture address, profile link and the text and time of the comment, together with the replies suggested and sent. Depending on the access LinkedIn grants us, this information is either retrieved through LinkedIn's API for posts you published through Nadya in the previous 14 days, or pasted in by you. See section 9.

4.6 Payment Data

Payments are handled by Stripe. We receive your Stripe customer and subscription identifiers, your plan, billing status and billing dates. We never receive or store full card details.

4.7 Studio Plus Enquiries

If you send the Studio Plus form on our website we collect your name, work email, company name, the number of people you expect to use Studio, your optional message and the language of the page. We use these details only to answer your request.

4.8 Data We Collect Automatically

  • IP address
  • Browser type and version, device type and operating system
  • Pages visited and time spent on the service
  • Referring URLs

5. Sign-In With Google

If you choose to sign in with Google, we use your Google account onlyto authenticate you and to receive basic profile details (such as your name, email address and profile picture) as permitted by Google's policies and your Google account settings. We do not read your Gmail, Google Drive, Calendar, or other Google services. If we ever offer a feature that requires access to a specific Google product, we will explain it clearly, request only the permissions needed, and obtain your consent first.

6. Legal Basis for Processing (GDPR)

We only process personal data where we have a valid legal basis. The bases we rely on are:

  • Performance of a Contract: account, Feed, Studio, LinkedIn connection and payment data, to provide the service you signed up for, including sending your content to AI providers and to LinkedIn when you ask us to.
  • Legitimate Interests: usage and technical data to secure and improve the service, prevent fraud and abuse and control AI costs; comments from other people, so that our users can read and answer responses to their own posts; Studio Plus enquiries, to answer them. We have assessed that these interests are not overridden by the rights of the people concerned.
  • Legal Obligation: where required to comply with applicable law (such as tax regulations).
  • Consent: analytics cookies, marketing communications, fully automatic publishing, and joining a Studio Plus company account. You may withdraw consent at any time.

7. How We Use Your Data

  • To create and manage your account and your free trial
  • To process payments and manage your subscription and AI credits
  • To show you a Feed matched to the categories and sources you follow
  • To generate drafts, images and reply suggestions that reflect your brand profile and instructions
  • To schedule and publish posts to LinkedIn on your instruction, including through automation rules you set up
  • To send service-related notifications (account, billing, publishing results, changes to Terms)
  • To send marketing communications, if you have opted in
  • To analyse usage and improve the service
  • To detect and prevent fraud and abuse
  • To comply with legal obligations

We do not make decisions about you that produce legal or similarly significant effects by automated means alone.

8. AI Processing

8.1 Feed

AI systems summarise, categorise and translate articles from the newsletters we subscribe to. This processing involves newsletter content, not your personal data. The categories and sources you follow are used to personalise which summaries you see.

8.2 Studio

To generate content for you we send the relevant material to AI providers: Anthropic (text drafting, editing, research and reply suggestions) and OpenAI (image generation, and text processing in the Feed). Depending on the action, this includes your brand profile, the selected writing or image style, the source article, link or topic, your instructions, the text of the draft and, for reply suggestions, the comment and the post it belongs to. We do not send your password, payment data or LinkedIn access tokens to AI providers.

When you give Studio a link, our servers fetch that page to read its text. In research mode, the AI provider runs web searches related to your topic.

We do not use your content to train AI models. AI providers process it on our behalf under their commercial API terms, which do not permit them to use it to train their models.

9. If You Commented on a Nadya User's Post

You may not be a Nadya user yourself. If you comment on a LinkedIn post published by one of our users, that user may see your comment inside Nadya, together with your public LinkedIn name, headline, profile picture and profile link, and may ask our AI to suggest a reply. We obtain this information either through LinkedIn's API or from the user, who pastes it in.

We process this data on the basis of legitimate interests: letting our users read and answer responses to their own posts. We use it for nothing else: we do not build profiles of commenters, contact them, or share their data beyond the AI provider that drafts the suggested reply. The data is deleted when the user deletes the item or closes their account.

You have the rights described in section 14, including the right to object and to have this data erased. Contact us at support@nadya.app.

10. Studio Plus Company Accounts

Studio Plus is not yet generally available. When it is, this is how it will handle your data if a company invites you:

  • You join only by accepting an invitation and a consent screen that lists what the company will see. You can leave at any time without anyone's approval; leaving removes you from the leaderboard immediately.
  • Other members of the company can see your display name, picture, role, join date, the posts you published through Nadya while a member (excerpt, LinkedIn link, publish time) and statistics about them, including your position on a leaderboard. Administrators can also see your email address and the credits you used.
  • The company never sees your drafts, scheduled or failed posts, brand profile, writing styles, images, comments inbox, automation rules, notifications or LinkedIn tokens, and cannot publish on your behalf.
  • Posts you published before joining or after leaving are never linked to the company.
  • If LinkedIn grants us access to post statistics, we retrieve impressions, reach, reactions, comments and reshares for posts linked to the company.

11. Data Sharing and Third Parties

We do not sell your personal data. We share it only as follows.

11.1 Service Providers

These providers process data on our behalf and are contractually bound to protect it and use it only as instructed:

  • Supabase: database, authentication, file storage and server functions
  • Stripe: payments, subscriptions and billing portal (PCI-DSS compliant)
  • Anthropic and OpenAI: AI processing as described in section 8
  • Resend: service emails
  • Google: sign-in, and analytics on our website
  • Website and application hosting providers

11.2 LinkedIn

When you publish or reply from Studio, we send the content to LinkedIn on your instruction. LinkedIn handles it under its own privacy policy.

11.3 Legal Requirements

We may disclose your data if required to do so by law, court order, or government authority, or if necessary to protect our legal rights.

11.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you in advance and you will have the right to request deletion of your data.

12. International Data Transfers

Linvium LLC and several of our providers are based in the United States, so your data is processed outside the European Economic Area (EEA). Where we transfer personal data out of the EEA, we rely on:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Transfers to countries or recipients covered by an adequacy decision of the European Commission

You may request details about our transfer mechanisms by contacting us at support@nadya.app.

13. Data Retention

We retain personal data only for as long as necessary:

  • Account data: for the duration of your account plus 2 years after it is closed
  • Studio content (brand profile, posts, images, rules, comments): until you delete it or close your account
  • LinkedIn access tokens: until you disconnect LinkedIn, the token expires or you close your account
  • Payment records: 7 years for legal and tax compliance
  • Usage logs: 12 months
  • Studio Plus enquiries: for as long as needed to handle your request and any resulting relationship
  • Marketing consent records: until you withdraw consent plus 3 years

When data is no longer needed, we securely delete or anonymise it.

14. Your Rights

If you are in the EU, the EEA or the United Kingdom, you have the following rights regarding your personal data:

  • Right of Access: You can request a copy of the personal data we hold about you.
  • Right to Rectification: You can ask us to correct inaccurate or incomplete data.
  • Right to Erasure: You can request deletion of your data, subject to legal obligations that require us to retain it. To close your account and delete its data, write to us from the email address of the account.
  • Right to Restriction of Processing: You can ask us to limit how we use your data in certain circumstances.
  • Right to Data Portability: You can request your data in a structured, machine-readable format.
  • Right to Object: You can object to processing based on legitimate interests.
  • Right to Withdraw Consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority. In the EU, you can find your authority at https://edpb.europa.eu/about-edpb/board/members_en.

To exercise any of these rights, contact us at support@nadya.app. We will respond within 30 days.

15. Cookies and Tracking

15.1 What We Use

  • Essential cookies and local storage: required for the service to function (login session, language, preferences)
  • Analytics cookies: Google Analytics on our website, to understand how visitors use it (only with consent)
  • Marketing cookies: only if you have opted in to marketing communications

15.2 Your Choices

You can manage cookie preferences through our cookie banner or your browser settings. Disabling essential cookies may prevent you from using parts of the service.

15.3 Do Not Track

We respect Do Not Track (DNT) signals. If your browser sends a DNT signal, we will not use analytics or marketing cookies for your session.

16. Data Security

We implement industry-standard technical and organisational measures to protect your data, including:

  • Encryption of data in transit (TLS/HTTPS)
  • Encryption of LinkedIn access tokens at rest (AES-256-GCM); tokens are readable only by our servers and are never sent to your browser
  • Database access rules that limit every user to their own records
  • Access controls: only authorised personnel can access personal data
  • Regular security reviews

Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at support@nadya.app.

17. Children's Privacy

The service is for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If we become aware that a minor has provided us with personal data, we will delete it promptly. If you believe a minor has submitted data to us, contact support@nadya.app.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The date at the top of this page shows when it was last updated.

19. Contact and Data Protection Inquiries

For any question about this policy or your personal data, contact us at:

Last updated: September 21, 2026