Legal documents
Clear, first of all.
How we process data, where we use artificial intelligence and what the rules are. Every document has a plain-language summary and the full text.
This page explains in plain language. Every answer points to the clause it comes from: if in doubt, the full text of the documents prevails (and the Italian version prevails over translations).
Four promises, written into the contracts
Not slogans: each one links to the clause that binds us.
-
Your data is not the product
No advertising, no selling or handing over data for others’ purposes, no marketing profiling.
Where it is written Privacy Notice, art. 4 -
No training on your data
The model provider does not train on anything we send it, and NOK Group does not use your contacts’ data to train any AI.
Where it is written Terms, arts. 7.3 and 5.7 -
AI proposes, you decide
Every AI output is flagged and must be checked: no automated decision about you or anyone else.
Where it is written Terms, art. 5.3 -
Leave whenever you want, with your data
Cancel from settings, export everything to a file, delete your account yourself: no phone calls, no forms.
Where it is written Terms, arts. 8 and 16
Who are you? Your rights and your commitments
Pick the case that applies to you: you only see what applies to you, with the concrete way to exercise each right.
I use Atropox
The service is yours to manage: you export and delete your data yourself, cancel whenever you want, and always know when AI is involved.
Your rights
- See, download and delete your data
From the “Privacy and data” page you export everything to a file (JSON) and delete your account, without asking anyone.
- Correct, restrict, object
For any other request about your data, write to us: we reply within one month (three in complex cases, and we tell you why).
- Try without a card
15 days of Pro, with half of its credits, without giving a payment method; at the end you stay on the Free plan, with no charges.
- Cancel whenever you want
From settings, at any time and at no cost: it takes effect at the end of the month already paid.
- Change your mind within 14 days (if you are a consumer)
You can withdraw without giving a reason within 14 days of purchase with a simple email or certified email; the optional form is on the payment page.
- 30 days’ notice of changes
If we substantially change terms or prices we tell you a month in advance; if you do not agree you can leave at no cost.
- Always know when AI is involved
The assistant says it is an AI, every AI feature is flagged and reports are marked as AI-generated.
- A court near you (if you are a consumer)
Disputes go to the court where you live; you can also use out-of-court settlement (ADR).
Your commitments
- Be at least 18
Atropox is not for minors.
- Keep your access safe
Your password is yours: keep it confidential and tell us if someone uses your account. We recommend two-step verification.
- Check what the AI proposes
AI can make mistakes or mix up two people with the same name: check the sources before using any output.
- Never use reports to decide about people
Never for granting credit, hiring or dismissing, insurance, investigation or surveillance: not even as a secondary factor.
- Enter other people’s data only if you may
For the contacts you upload you decide why and how: you need a legal basis and, where due, a notice to the people concerned.
- Use the service properly
No spam through invitations, no attempts to break security, no reselling the service.
Documents that concern you: Terms and ConditionsPrivacy NoticeArtificial Intelligence Notice
I run a team or a company
For the data of the people you upload you are the controller and NOK Group the processor: the DPA governs it, and you accept it together with the Terms.
Your rights
- A processor bound in writing
We process the data you upload only on your instructions, to run the service for you, with confidentiality and documented security measures.
- Know who else touches the data
The list of sub-processors is in the DPA; every change is notified 30 days in advance and you can object within 15.
- Be notified within 48 hours
If there is a breach affecting your data we notify you within 48 hours of becoming aware of it.
- Help with people’s requests
Export and deletion are built into the service; for the rest we assist you in answering data subjects.
- Get everything back or deleted at the end
When the contract ends the data is returned or deleted, as set out in the DPA.
- Verify
You can ask for the information proving compliance with the DPA and an on-site audit, with 30 days’ notice, once a year.
Your commitments
- Decide why you process the data
You are the controller of the data you upload: you need a legal basis (usually legitimate interest, assessed in writing).
- Inform the people concerned
People in your network have a right to know, in the cases set out in art. 14 GDPR. On request we give you a template notice.
- Answer for the users you invite
Whoever administers the network chooses who joins and with what permissions, and answers for their use.
- Respect the prohibited uses of AI
No credit, HR, insurance, public security or surveillance: whoever does so answers as the provider of a high-risk system.
- Read and approve the key clauses
Liability limits, suspension, renewal and the Rome venue are listed and approved separately (arts. 1341-1342 Italian Civil Code).
Documents that concern you: Data Processing Agreement (DPA)Terms and ConditionsPrivacy NoticeArtificial Intelligence Notice
Someone looked me up with Atropox
Only public professional information about you can be there, with sources. You can ask never to be searched again.
Your rights
- Only public professional information
Role, company, public news about your work, with the source of each data point. Never sensitive data: health, religion, political opinions, sexual orientation and the other categories protected by art. 9 GDPR.
- No criminal data, no judgement on your solvency
For individuals, reports contain no convictions, offences or criminal proceedings, and no assessment of creditworthiness or personal finances.
- Object once and for all
Write to us: we add you to the objection list and the service will no longer search for you, for any user.
- The report deletes itself
Reports on individuals are deleted automatically after 12 months.
- Access, rectification, erasure
The controller is the user who ran the search: you can contact them. If you write to us, we tell you how to reach them and help them answer you.
- Complaint to the authority
You can always contact the Italian Data Protection Authority or the authority where you live.
Your commitments
None. You do not have to do anything: these protections apply to you automatically. Minors and members of law enforcement, the armed forces, the judiciary or intelligence services are not searched at all.
Documents that concern you: Terms and ConditionsData Processing Agreement (DPA)Artificial Intelligence Notice
I am just browsing the site
No profiling cookies, no analytics or advertising tools: that is why we do not ask for consent.
Your rights
- Not being tracked
The site only uses technical browser storage (language, preferences). No third-party analytics or advertising tools.
- Know what happens to the email you type
The address you enter in the trial form is used only to create your account; if you do not complete it, we do not use it.
- Ask and get an answer
For any question about data write to us: we reply within one month.
Your commitments
None.
Documents that concern you: Privacy NoticeArtificial Intelligence Notice
Where your data goes
The journey of your data, provider by provider. The core stays in Europe; some services are in the United States, with the safeguards required by the EU.
- Outside EU Vercel Delivers the pages to your browser United States When: Always
- Outside EU Anthropic The AI model (Claude) for the assistant and reports; for web search it relies on Brave (USA). Does not train on your data United States When: When you use an AI feature
- Outside EU ElevenLabs Transcribes voice and reads replies aloud United States When: Only if you use voice
- Outside EU Resend Sends service emails (confirmations, invitations) United States When: When an email is sent
- EU + USA Stripe Handles payments: only Stripe sees your card EU (Ireland) and United States When: Only on paid plans
- EU Openapi Official Company Register data Italy When: When you look up a company
- EU + USA Google Sign-in with your Google account EU and United States When: Only if you choose “Continue with Google”
EU In the European Union Outside EU Outside the EU, with Standard Contractual Clauses EU + USA Between the EU and the United States, with the same safeguards
Supabase technical support may access from the United States and Singapore, always under Standard Contractual Clauses. The full list, with each provider’s legal role, is in the Privacy Notice. Where it is written Privacy Notice, arts. 6-7
Where
The database is in the European Union, in Frankfurt. Some providers (artificial intelligence, e-mail, voice) are in the United States, with the safeguards required by the EU.
Who sees it
You and the people you authorise in your organisation. NOK Group only for support and security, through authorised staff.
How long
For the life of the account. Invoices for 10 years by law. Reports on people 12 months. Technical logs from 90 days to 24 months.
What we don’t do
No advertising, no selling or sharing of data for others’ purposes, no tracking, no marketing profiling.
Where we use artificial intelligence
Always at your request, always flagged in the interface, always with the option to check, accept or discard.
| Feature | What it does | What data it uses | Provider |
|---|---|---|---|
| Assistant | Answers your questions and proposes actions in your network | Your requests and the data in your network needed to answer | Anthropic (USA) |
| Assistant voice | Transcribes what you say and reads replies aloud. Optional | The audio of your voice and the text of the replies | ElevenLabs (USA); without the ElevenLabs voice, your browser’s speech recognition |
| Intelligence Reports | Analyses a company or a professional from public sources, with sources cited | Name, role, company; public professional information | Anthropic (USA) |
| Filling in a card | Proposes public professional data to complete a contact | The contact’s name and company; public sources | Anthropic (USA) |
| Photo and logo | Proposes a contact’s image from public pages, never from social networks | The contact’s name and company | Anthropic (USA) |
| Suggested tags | Proposes labels to organise contacts | Contacts’ role, company and description | Anthropic (USA) |
| Reading documents | Reads a file you upload to propose actions; the file is not kept | The content of the document | Anthropic (USA) |
What Atropox’s AI never does
- Decide for you: it proposes, you accept or discard.
- Social scoring, biometric recognition, inferences on sensitive data.
- Search for minors, law enforcement, armed forces, the judiciary, intelligence services or people who have objected.
- Report criminal data or solvency judgements on individuals.
- Learn from your data: it is not used to train the models.
Real questions, short answers
The questions we actually get. Every answer shows where it is written.
Do you sell my data?
No. We do not sell it, hand it over for others’ purposes or use it for advertising.
Where it is written Privacy Notice, art. 4Do you train AI on my data?
No. Anthropic, the model provider, does not train on anything we send it; NOK Group does not use your contacts’ data to train models and lists no training purpose among those declared in the Privacy Notice.
Where it is written Terms, arts. 5.7 and 7.3Can I delete everything?
Yes: you delete your account and your content yourself, from the “Privacy and data” page. Only invoices already issued (10 years by law) and the minimum records proving we followed the rules remain.
Where it is written Terms, art. 8.2How long do you keep data?
As long as you have the account. Invoices 10 years; reports on individuals 12 months; technical logs from 90 days to 24 months, then they delete themselves.
Where it is written Privacy Notice, art. 8Can I cancel any time?
Yes, from settings, at no cost. The subscription stays active until the end of the month already paid, then you go back to the Free plan with your data.
Where it is written Terms, art. 16What are credits?
Every artificial intelligence feature uses credits according to what it really costs: a report on a person, for example, uses about twenty. Each plan includes a monthly allowance, which does not carry over; if it runs out, the network administrator can buy top-ups, valid for 12 months and non-refundable, save for a consumer’s withdrawal within 14 days for unused credits.
Where it is written Terms, arts. 14.6 and 14.7I changed my mind: can I get a refund?
If you are a consumer you have 14 days to withdraw without giving a reason. If you asked to start straight away, you pay for the part already used (or, for digital content, the right is lost once it starts): art. 17.2 explains it. After 14 days, cancellation applies from the next month.
Where it is written Terms, art. 17What if the AI gets it wrong?
It can happen: it can mix up two people with the same name or use old sources. That is why every data point has its source, nothing is saved without your confirmation and AI output must always be checked.
Where it is written AI Notice, art. 5Can I use a report to decide on a hire or a loan?
No, never, not even as a secondary factor. The Terms forbid it: these are high-risk uses under the AI Act.
Where it is written Terms, art. 5.4Someone looked me up on Atropox: what can I do?
Write to info@nok.business: we add you to the objection list and no user will be able to search for you again. Reports on individuals delete themselves after 12 months anyway.
Where it is written Terms, art. 5.9Where are the servers?
The database is in the European Union, in Frankfurt. Some providers (AI, email, voice, page delivery) are in the United States, with the Standard Contractual Clauses approved by the European Commission.
Where it is written Privacy Notice, art. 7Why is there no cookie banner?
Because we only use technical storage needed for the site to work: no profiling cookies, no analytics. The law requires consent only for those.
Where it is written Privacy Notice, art. 12What if you change the rules?
For substantial changes we notify you at least 30 days in advance. If you do not agree you can leave at no cost before they take effect.
Where it is written Terms, art. 11Do you have a Data Protection Officer?
We assessed in writing that it is not mandatory today and we review this periodically. There is a contact point anyway: info@nok.business.
Where it is written Privacy Notice, art. 2If there is a dispute, who decides?
If you are a consumer, the court where you live, and you can use out-of-court settlement. For business customers the Court of Rome has jurisdiction.
Where it is written Terms, art. 20The documents
- For anyone using Atropox Terms and Conditions The rules of the contract between you and NOK Group: plans, payments, proper use, artificial intelligence, liability. Read →
- For anyone using Atropox Privacy Notice Which data we process when you use Atropox, why, with whom, where, for how long, and how to exercise your rights. Read →
- For everyone (AI Act, art. 50) Artificial Intelligence Notice Where Atropox uses artificial intelligence, with what limits, with what safeguards for people, and what it never does. Read →
- For businesses and professionals Data Processing Agreement (DPA) The contract that governs other people’s data you enter in Atropox: you are the controller, NOK Group the processor (art. 28 GDPR). Read →
What changed
Every version, with what is new in one line. Substantial changes are announced 30 days in advance.
- 16 October 2026 Terms and Conditions · version 2.3 The new plans (Free, Pro, Max; Base for teams from 2 seats), credits and top-ups, the trial on the Pro plan; the withdrawal form is no longer at the end of the Terms but on the payment page.
- 16 October 2026 Privacy Notice · version 1.2 Service communications listed one by one; no marketing and no profiling, without exceptions.
- 12 October 2026 Terms and Conditions · version 2.1 More protection for people analysed (no criminal data, no solvency, objection list, deletion after 12 months), sharper prohibited uses of AI, key clauses approved separately.
- 12 October 2026 Privacy Notice · version 1.1 All providers with their location (including voice and the Company Register), retention of technical logs, browser speech recognition.
- 12 October 2026 Artificial Intelligence Notice · version 1.1 Each AI feature described one by one, with the data it uses and the protections for people.
- 12 October 2026 Data Processing Agreement (DPA) · version 1.1 Updated list of sub-processors and security measures.
The words, explained
The technical terms you find in the documents, in one line.
- Controller
- Who decides why and how data is used. For your account it is NOK Group; for the contacts you upload it is you.
- Processor
- Who processes data on behalf of the controller and only on its instructions. NOK Group, for the data you upload.
- Data subject
- The person the data is about: you, or someone in your network.
- Legal basis
- The reason, set by law, that makes using data lawful: a contract, a legal obligation, a legitimate interest, consent.
- Legitimate interest
- A concrete and lawful interest that justifies processing, provided it does not override the person’s rights. It must be assessed in writing.
- DPA
- Data Processing Agreement: the contract (art. 28 GDPR) obliging NOK Group to process the data you upload only for you.
- Sub-processor
- A provider to whom the processor entrusts part of the work (for example the database), with the same obligations.
- Standard Contractual Clauses
- Standard contracts approved by the European Commission that protect data when it leaves the EU.
- Public sources (OSINT)
- Information anyone can find online, such as company websites, official registers, the press.
- Intelligence report
- The analysis the AI prepares on a company or professional, at your request, from public sources and with sources cited.
- AI Act
- The EU regulation on artificial intelligence (Reg. EU 2024/1689): it sets what AI may do and how it must be disclosed.
- Consumer
- Someone using the service for personal purposes outside their professional activity: they have extra protections (withdrawal, venue).
- Specific approval
- For business customers some onerous clauses must be signed separately (arts. 1341-1342 Italian Civil Code): they are listed in art. 31.
Got a problem? Three steps
- 1 · Write to us
info@nok.business, or certified email nokgroup@legalmail.it. One sentence is enough: who you are and what you need.
- 2 · We reply within one month
Three at most in complex cases, and in that case we tell you within the first month why.
- 3 · If that is not enough
You can contact the Italian Data Protection Authority (or the one where you live) and, if you are a consumer, out-of-court settlement (ADR).
Cookies and browser storage
Atropox only uses technical browser storage needed to work: your sign-in session, language, theme and assistant preferences. No profiling cookies, no third-party analytics or tracking tools. That is why we don’t ask for consent.
Contacts
NOK Group S.r.l. — Via Cassia 1280, 00189 Rome, Italy — VAT IT17725341006 — info@nok.business — PEC nokgroup@legalmail.it