Privacy Policy

Who we are

N3O Studios operates n3os.com and the tool directory at tools.n3os.com. For the purposes of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary, and for the purposes of the UK and EU GDPR we are the data controller.

We are based in India. If you are reading this from the EU, the UK, or anywhere else, the rights described below still apply to you, and we do not make you argue about which law you are covered by: where two of them differ, we apply whichever gives you more.

The short version

You can browse the entire directory and read everything we publish without an account, without giving us an email address, and without us storing anything that identifies you.

We ask for personal data in exactly three places: if you create an account, if you subscribe to the newsletter, and if you send us a message. Each is optional, each is described below, and none of them is a condition of using the site.

We do not sell personal data. We do not share it for advertising. We do not run advertising or behavioural tracking of any kind.

What we collect, and why

Accounts. If you create one, we store the email address you sign in with, a username if you set one, and an identifier from the sign-in provider you chose. We never receive or store a password: sign-in is either a one-time email link or an OAuth provider, so there is no password on our side to lose. The purpose is to let you sign in and to keep anything you save associated with you. The lawful basis is performance of the contract of providing you an account; under the DPDP Act it is the consent you give when you create one.

Newsletter. If you subscribe, your email address goes to Buttondown, who send the emails. The purpose is sending you the newsletter; the basis is your consent, which you can withdraw with the unsubscribe link in every email or by emailing us.

Messages you send us. If you use the contact form or email us, we receive what you wrote and your email address so we can answer. The basis is our legitimate interest in replying to you, and your consent in sending it.

Assistant questions. If you use the assistant, the question you type is sent to a third-party model provider to be answered. Do not put anything confidential into it. We do not store the conversation, and the provider's own retention is theirs rather than ours.

Page views. We count how many times each page is opened, per day, and which site referred the visit. That is the whole record: no cookie, no identifier, no profile, and no record of which pages any individual looked at. Two people visiting once and one person visiting twice are indistinguishable to us by construction. The basis is our legitimate interest in knowing which pages are worth writing.

Security. When you use the assistant or load a page, your IP address is passed through a one-way keyed hash so we can rate-limit abuse. The hash is what the rate limiter sees; the address itself is never written to storage. The basis is our legitimate interest in keeping the service available.

Cookies and local storage

We use no advertising or analytics cookies, and there is no consent banner because there is nothing to consent to.

If you sign in, we set one cookie scoped to n3os.com and its subdomains so that a single sign-in works on both n3os.com and tools.n3os.com. It holds your session and nothing else, and it is removed when you sign out.

Your browser also stores your light or dark theme preference locally. That never reaches us.

Who else processes your data

We use a small number of service providers, each for one job, and each bound to process data only on our instructions:

• Supabase - database, authentication and the account system. Data is held in their Singapore region.
• Cloudflare - hosting and delivery of tools.n3os.com.
• BigRock - hosting of n3os.com.
• Buttondown - newsletter delivery, for subscribers only.
• Formspree - delivery of contact form messages to our inbox.
• Groq and other model providers - answering assistant questions, for the duration of the answer.
• Google - the favicon images shown beside each listing, and Search Console verification.

This list is exhaustive at the date above. If we add a processor that handles personal data, this list changes before it goes live, not afterwards.

Where your data goes

We are in India and our providers are largely outside it, so personal data is transferred internationally. For transfers out of the UK or EU we rely on the European Commission's Standard Contractual Clauses, or on the provider's own adequacy arrangements where one applies.

The DPDP Act permits transfer outside India except to territories the Government restricts. We do not transfer personal data to any restricted territory.

How long we keep it

Account data: for as long as the account exists, and deleted when you delete the account.

Newsletter subscription: until you unsubscribe.

Messages: for as long as we need to deal with what you wrote, and routinely cleared afterwards.

Page view counts: indefinitely, because they contain nothing about any person.

Your rights

Whatever law applies to you, you can ask us to: tell you what we hold about you and give you a copy; correct anything wrong; complete anything incomplete; delete it; or stop processing it. Under the GDPR you may also object to processing carried out on the basis of legitimate interests, and ask for your data in a portable form.

Under the DPDP Act you additionally have the right to nominate another person to exercise these rights if you die or become incapable of exercising them yourself, and the right to a grievance redressal process - which is below, and which you must use before approaching the Data Protection Board.

Where we rely on consent, you can withdraw it at any time, and withdrawing it is as easy as giving it was. Withdrawing consent does not undo what was lawfully done before you withdrew it.

Write to support@n3os.com to exercise any of this, or to grievance@n3os.com if it is a complaint rather than a request. We answer within 30 days, and sooner in practice. We do not charge for it.

Complaints

If we get this wrong, tell us first, because it is faster and we would rather know. Our grievance process is in the Terms, along with the timescales we hold ourselves to.

If we do not resolve it, you can complain to the Data Protection Board of India. If you are in the UK you can complain to the Information Commissioner's Office, and if you are in the EU, to your national supervisory authority. You do not need our permission and you do not have to tell us first.

Children

The site is not directed at children, and accounts are for people aged 18 or over. Under the DPDP Act, processing the personal data of a child requires verifiable parental consent, and we do not have a mechanism for obtaining it - which is why we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

Changes

If we change this policy in a way that affects you, we will say so on the site before the change takes effect, and the date at the top will move. We will not quietly broaden what we do with data you already gave us.