Privacy Policy

1. Who we are

Nyfty.ai, Inc. (“Nyfty”, “we”, “us”, “our”) provides AI safety and compliance software for the construction industry. Our product connects to construction platforms such as Procore and Autodesk Construction Cloud, and communicates with site workers by SMS and web forms.

Nyfty.ai, Inc. is incorporated in the United States and is part of Yakka Labs. Our team works remotely from Australia. All customer data is stored and processed in the United States — see section 8, which explains what that means for you.

For the purposes of the UK and EU General Data Protection Regulation, Nyfty is a processor in respect of the worker and project information our customers put into the product, and a controller in respect of the account, billing and website information we collect for our own purposes.

2. What this policy covers

This policy applies to:

• our websites at nyfty.ai and www.nyfty.ai;
• our web application at console.nyfty.ai and our other product hostnames, including devices, kiosk and mytasks;
• the SMS short links we send to site workers; and
• information we receive when a customer connects Nyfty to a third-party platform.

It does not cover the platforms our customers connect us to. When Nyfty writes information into Procore or Autodesk Construction Cloud under a user’s own authorisation, that platform’s privacy policy governs what happens to it there.

3. Information we collect

3.1 Information you and your users give us

• Account information — name, email address, mobile number, company and role for the people a customer authorises to use Nyfty.
• Worker information — first names and mobile numbers of site workers a customer asks us to communicate with, and the company and trade they are recorded against.
• Message content — the full content of SMS messages sent and received through the product, in both directions, and messages sent through our web forms and chat.
• Records and submissions — pre-task plans, toolbox talks, permits, inspections, attendance and timecard records, manpower logs, incident records, and any photographs or files attached to them.
• Signatures captured on forms and records.
• Billing information — handled by Stripe. Card details never pass through Nyfty’s systems; they are entered directly into Stripe-hosted checkout and payment fields.
• Authorisation for connected platforms — when a user connects Procore or Autodesk, we store the access credential that user’s own account issues to us, so we can act within the permissions they granted.

3.2 Information we collect automatically

• IP address, browser and device type, and operating system.
• Pages and features used, and the date, time and duration of use.
• Product usage events, linked to a user identifier.
• Technical logs generated when the product runs, including request and error records.

3.3 Information we receive from others

When a customer connects a platform such as Procore, we receive information from it under that user’s authorisation — for example the list of people on a project, cost codes, locations and vendors — so the product can present and write back to the right records.

4. Incident and health-related information

However, the purpose of a free-text incident description is to describe what happened, so in practice it may contain information about an injury to a named person. Where it does, that is health-related personal information, and it is treated as a special category of personal data under the GDPR and as sensitive information under the Australian Privacy Act.

It is important to understand where that text goes. An incident recorded in Nyfty may be written into the customer’s connected construction platform, may pass through our AI processing (section 6), may appear in our internal operational messaging where a report was made through chat, and any attached photograph may show an injury. Customers should take this into account when deciding what their workforce is asked to record in free text.

Nyfty is not a HIPAA covered entity and is not a business associate.

5. How we use information

• To provide the product: sending and receiving messages, collecting records, and writing them into the platforms a customer has connected.
• To authenticate users and protect accounts.
• To support customers and respond to enquiries.
• To bill for the service.
• To monitor reliability, diagnose faults and keep the service secure.
• To understand how the product is used so we can improve it.
• To meet legal, tax and accounting obligations.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are used in California law. We do not use customer record content to train AI models — see section 6.

6. Artificial intelligence

Nyfty uses Google’s Gemini Developer API to interpret messages and documents. Information sent to it can include conversation transcripts between the product and foremen or workers, safety documents and PDFs a customer has provided, worker first names, team configuration and knowledge-base content. Where an incident is reported conversationally, the free-text description travels with it.

AI output is assistive. It drafts, extracts and summarises; it does not make safety determinations on its own, and records written into a customer’s platform originate from what a person submitted.

7. Who we share information with

We share information with the service providers below, each for the stated purpose. We do not sell information, and we do not share it with anyone else except where a customer directs us to, where we are required to by law, or in connection with a merger or acquisition of our business — in which case we would require the recipient to honour this policy.

The “who is affected?” column tells you whose information reaches each provider. In this policy, users are the people who use Nyfty itself — the site workers we message, and the supervisors, foremen and safety staff who hold Nyfty accounts. Customers are the businesses that subscribe to Nyfty and the people at them who manage the account and pay for it. A provider marked customers only never receives information about the people using the product. A provider marked metadata only receives technical request data such as IP addresses and page views, and never the records held in the product.

Entity country is where each provider’s company is based. It is not necessarily where that provider processes information, which each determines under its own terms — section 8 covers where Nyfty itself stores customer data. We publish this list so it can be checked, and we will update it when it changes.

8. Where information is stored and processed

Customer data is stored in the United States. Our databases and file storage run in Google Cloud’s us-central1 region, with database replication and backup storage across United States multi-regions. We do not offer a European or Australian hosting option and we do not operate a data-residency split.

If you are in the EU, the UK or elsewhere outside the United States, using Nyfty therefore involves an international transfer of your information to the United States.

Nyfty operates no offices, no corporate network and no on-premises servers. There is no physical filing of customer information.

9. How long we keep information, and deletion

We keep information for as long as an account is active, and after that as set out here.

• On cancellation, we delete customer data within six months. This applies to accounts cancelled on or after this policy’s effective date.
• On an explicit deletion request, we delete the customer data covered by the request within 30 days.
• We keep billing and transaction records for as long as tax and accounting law requires, independently of the above.

10. How we protect information

• In transit — traffic to our web and API services requires TLS 1.2 or higher.
• At rest — data is encrypted using AES-256 by our cloud provider.
• Credentials — we never store passwords for your Nyfty account. Sign-in is by identity token, third-party sign-in, or a one-time link sent by SMS. Application secrets are held in an encrypted store and read at runtime.
• Staff access — two-step verification is enforced on all staff accounts. Access to raw customer data is limited to the two company directors. Each of our production services runs under its own restricted identity.
• Change control — production releases are gated on an automated test suite and an automated secret scan, enforced by configuration rather than convention.
• Dependencies — our code and its dependencies are scanned continuously, and newly introduced vulnerable dependencies are blocked at merge.
• Recovery — databases have point-in-time recovery, customer file storage has object versioning, and recovery was last evaluated on 6 August 2026.

No system can be guaranteed secure, and we do not claim otherwise. Known deviations from our own standards are tracked internally with owners and target dates. If you believe you have found a security issue, please tell us — see section 15.

11. Your rights

Depending on where you are, you may have the right to ask us to give you a copy of the information we hold about you, correct it, delete it, restrict or object to how we use it, provide it in a portable form, or withdraw a consent you previously gave. You also have the right to complain to a data protection regulator.

If you are a worker on a site, the customer who invited you to use Nyfty generally decides what is collected and how long it is kept. We will help you reach them, and we will act on their instructions. If you contact us directly we will not ignore you — we will tell you who holds your information and pass your request on.

If you are in California, you have the right to know what personal information we collect and disclose, to request deletion or correction, and not to be discriminated against for exercising those rights. We do not sell personal information and do not share it for cross-context behavioural advertising.

If you are in Australia, the Australian Privacy Principles give you rights of access and correction, and a right to complain to the Office of the Australian Information Commissioner if you are not satisfied with our response.

To exercise any of these, email privacy@nyfty.ai. We will respond within 30 days. We may need to verify who you are before we act, which protects you as much as us.

12. Cookies and tracking

Our marketing site uses Google Analytics 4 and Google Tag Manager to measure traffic, and the LinkedIn Insight Tag and HubSpot tracking to measure how well our marketing works.

None of it runs until you agree to it. When you first arrive we ask, and nothing but the cookies needed to keep the site working is set before you answer. Our Google tags start in a denied state under Google Consent Mode and only begin storing cookies if you accept. The LinkedIn and HubSpot scripts are not loaded onto the page at all unless you accept, because neither of them can be held to that denied state.

Your choice is remembered in your browser, and you can change it at any time using Cookie settings at the bottom of any page — rejecting is always as easy as accepting. If you withdraw consent we clear the cookies these tools set on our own domain, though cookies already held by LinkedIn or HubSpot on their own domains are outside our reach; you can clear those in your browser settings, and opt out of LinkedIn advertising tracking in your LinkedIn account settings. You can also opt out of Google Analytics using Google’s browser add-on.

This banner covers our marketing site. Inside the product, Userflow provides in-product guidance and Amplitude records usage analytics; these are part of the service itself rather than marketing, and section 7 sets out what each receives.

13. Children

Nyfty is a workplace product and is not directed at children. We do not knowingly collect information from anyone under 16. If a customer authorises a young person as a user — for example a work-experience student — that customer is responsible for obtaining any consent required. If we learn we have collected information from a child without appropriate consent, we will delete it.

14. Changes to this policy

We may update this policy. Every version carries a version number and an effective date at the top of this page. If a change materially affects how we handle your information, we will notify account holders by email before it takes effect. This version supersedes the policy issued on 30 October 2018 under reference 18629-PP-301018-1.

15. How to contact us

For any question about this policy, or about how your information is collected, used, stored, shared or deleted, email privacy@nyfty.ai.

To report a security issue, email hello@nyfty.ai.

You can also write to us at:

Nyfty.ai, Inc.
8 The Green, Suite 11877
Dover, DE 19901
United States

Nyfty.ai, Inc. — a Yakka Labs company.