Privacy
NICO is a concierge. To be useful it has to know things — where you are when you ask for somewhere nearby, what you like, who you are dining with. This policy explains what we hold, why, who else sees it, and what you can ask us to do about it.
Version 1.0/Effective On publication
NICO is a personal and organizational concierge service operated by Nico LLC ("NICO", "we", "us"). For the purposes of the EU General Data Protection Regulation and the UK GDPR, where they apply, Nico LLC is the controller of the personal information described here.
Registered address: [registered address to be published]. Privacy contact: privacy@nicogroup.co.
We have not appointed a Data Protection Officer, an EU Article 27 representative or a UK Article 27 representative. Where one of those is legally required for your jurisdiction, we will publish the details here rather than imply one exists.
This policy covers the NICO concierge service however you reach it: through a supported messaging channel, or through our website. It does not cover the independent processing carried out by the messaging platform you choose to use, or by any business NICO contacts on your behalf.
We collect three kinds of information: what you give us, what is generated as NICO works on your requests, and what is technically necessary to operate and secure the service. Each is described in the sections that follow.
When you message NICO through a third-party platform, two separate things happen. First, that platform processes your message under its own terms and privacy policy — we do not control that processing and cannot change it. Second, the platform delivers to us the information we need to run the concierge relationship: your message and its attachments, an identifier for your account on that platform, your display name or username as the platform provides it, the conversation identifier, and delivery information such as whether a reply was sent.
Telegram is the messaging channel that is live today. Other channels — including WhatsApp, LINE, Viber, Messenger, SMS, RCS, Slack and Microsoft Teams — are prepared in our code but are not enabled, and no data flows through them. When one goes live we will update this policy before it starts processing.
You may link more than one channel to a single NICO account. Linking requires a verified action; we do not merge identities on the strength of a matching name, username or unverified phone number.
NICO uses artificial intelligence service providers to understand requests and generate responses. AI requests are routed through the Lovable AI Gateway, which passes them to the underlying model provider on our instructions. When you send a request, we assemble a prompt containing the relevant part of your conversation, and where relevant the memory and location context needed to answer it. That prompt is sent to our model provider for processing. Prompts are assembled to include what the request needs rather than everything we hold.
AI is not the whole service. A request may also be handled by ordinary deterministic software, by an external API such as a place-search or availability provider, or by an authorised member of our concierge team where a request is escalated. We do not claim your conversations are never seen by a person: authorised support and concierge staff may access them where that is necessary to help you, to investigate a fault, or to meet a legal obligation.
Our AI providers process content on our instructions to return a response. We do not sell your conversations, and we do not use them to train third-party models on our own initiative. Model providers operate their own retention and training controls; where a provider changes what we can configure, we will reflect it here.
NICO remembers things so you do not have to repeat yourself. There are four distinct kinds:
You can ask NICO to forget something in conversation, and you can ask for memory to be deleted through a privacy request. Memory items can carry their own expiry and can be superseded when something changes.
NICO does not track you. It has no background location collection of any kind. It can process precise location only when you supply it or permit it: by sending a location message on a channel that supports one, by granting your browser's location permission, or simply by telling NICO where you are.
Two kinds of location are handled differently:
From a location we may derive a neighbourhood, city, country and time zone, and a coarse coordinate area used to reuse a previous lookup instead of paying for a new one. When we ask a place-search or availability provider a question, we send the search terms and a location area — not your identity.
Concierge requests frequently involve other people: a dining companion, a family member, a fellow traveller, a guest, a colleague. When you ask NICO to do something on their behalf you may give us their name and, sometimes, their contact details or a preference of theirs.
We process that information only to carry out the request you made. Participant information is not used to build a separate profile of that person, and they do not become a NICO member by being mentioned.
You are responsible for having the authority to give us information about another person, and for telling them, where appropriate, that you have done so. If a person named in a request contacts us directly, we will handle their request on its own merits without disclosing your information to them.
NICO's architecture keeps a personal context and an organization context strictly apart. Personal memory, personal requests and personal credits are never readable from an organization context, and organization information is never mixed into a personal one.
Organization and team accounts are not available today. When they are, the organization will control its own context — including which administrators can see organization activity — and a separate Team Terms addendum will govern it. This policy will describe organization processing before that functionality goes live.
We keep a record of what you asked for, what NICO did about it, and how it turned out. That includes searches run with providers, availability that was checked, reservations and their confirmation details, reminders, and evidence that something was completed. These records let NICO honour a commitment, avoid doing the same thing twice, and answer you truthfully about what has and has not been done.
If you send a voice note, we process the audio to produce a text transcript so the request can be understood and acted on. The transcript is stored with the message.
NICO does not place telephone calls to businesses today. No telephony provider is connected. If that changes, we will describe the call data involved — and any recording — before the feature is made available.
We hold your membership plan, its status and its billing period, and the accounting behind execution credits: what was consumed, when, and for which action.
NICO does not store full payment card details. No payment processor is connected to the service at this time. If we introduce one, card details will be handled by that processor and we will hold only the identifiers needed to reconcile your membership.
Amounts charged by a restaurant, hotel, airline or other third party are handled by that business under its own terms, not by NICO.
Our hosting provider processes standard request information — such as IP address and user agent — to deliver the site and protect it against abuse. We record operational telemetry about the service itself: which capability ran, how long it took, what it cost us, and errors. Our internal staff tooling keeps a sign-in session in the browser's local storage.
Where the EU or UK GDPR applies to you, we rely on:
Where you give us information about another person, we rely on our legitimate interest in carrying out the request you made, on the basis that you have the authority to provide it.
These providers process information on our behalf today:
Providers whose adapters exist in our code but which are not enabled — including additional messaging channels, a payment processor and a telephony provider — do not process any information today and are not listed above as current processors.
When NICO helps you with a restaurant, hotel, airline or other business, that business is an independent controller of the information it receives. Its own privacy policy governs what it does with your reservation. The same is true of the messaging platform you choose to reach NICO through.
NICO is operated as an international service and our providers operate globally. Your information may therefore be processed in countries other than your own, including the United States. Where we transfer personal information out of the EEA or the UK, we do so on the basis of an adequacy decision where one applies, or otherwise under the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with such additional measures as are appropriate.
We keep information for as long as it is needed for the purposes described above, and no longer. The following policies apply:
Retention is suspended where a legal hold applies, where a request or reservation is still active, or where a record is required for accounting, fraud-prevention, security or the defence of legal claims. You can ask us to delete information at any time, and we will do so except where one of those requirements applies.
Deleted information may persist for a limited period in database backup and disaster-recovery snapshots managed by our database provider, isolated from ordinary production use, until those snapshots expire.
We do not claim that everything disappears instantly. When you ask us to delete your account, personal content is removed or anonymised, while a small set of records is retained where the law requires it:
We take the following measures, factually:
No service can promise perfect security, and we do not. If we become aware of a breach affecting your information, we will act on it and notify you and the relevant authority where the law requires.
You can ask for a copy of the information we hold about you, ask us to correct anything that is wrong, and ask for a portable export. We verify who you are before disclosing anything, and we will not disclose another person's information in the process.
You can ask us to delete your information. A request is reviewed by an authorised person rather than actioned automatically, so that we can verify your identity and check whether anything must be retained. Where we must keep something, we will tell you what and why.
Where we rely on legitimate interests, you may object to that processing, and you may ask us to restrict processing while an issue is resolved. We will honour the objection unless we have compelling legitimate grounds that override your interests, or we need the information for legal claims.
Where we rely on consent — most notably for precise location — you can withdraw it at any time, without affecting the lawfulness of what we did beforehand. Withdrawing location consent means NICO can no longer answer requests that depend on knowing where you are.
We do not run advertising, and we do not sell or share your information for advertising. If we send you an optional update in future, it will carry a way to stop receiving it. Service messages about your requests and your membership are not marketing and continue regardless.
If you are a resident of California or of another US state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use it, to request access, correction and deletion, to obtain a portable copy, and to be free from discrimination for exercising those rights.
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in California law. We do not use or disclose sensitive personal information for purposes beyond those permitted without an additional right to limit. You may use an authorised agent where the law allows; we will verify the agent's authority. Submit a request at /data-request.
If you are in the European Economic Area, you have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. NICO does not make such decisions about you.
If you are in the United Kingdom, the same rights apply under the UK GDPR and the Data Protection Act 2018, and you may complain to the Information Commissioner's Office.
Where you live somewhere that grants mandatory privacy rights not described above, those rights apply to you and we will honour them, subject to applicable law. Tell us which jurisdiction you are writing from when you make a request and we will handle it accordingly.
NICO is built for adults. It is not directed at children, and we do not knowingly build profiling or location functionality for them.
You must be at least 18 to use NICO. We do not knowingly collect personal information from anyone under that age, and we do not ask for a date of birth. If you believe a child has provided us with personal information, contact us at privacy@nicogroup.co and we will look into it and delete it where appropriate.
We version this policy. Every published version carries a version number, an effective date and a content fingerprint, and previous versions are retained. Formatting and clarity edits do not create a new agreement. Where a change is material, we will say so and, where required, ask you to acknowledge it before continuing.
Privacy: privacy@nicogroup.co. General: info@nicogroup.co. Postal: Nico LLC, [registered address to be published].
The fastest route for a formal request is /data-request, which gives your request a reference and an audit trail.
If you are in the EEA or the UK, you may lodge a complaint with your local data protection authority — in the UK, the Information Commissioner's Office. We would appreciate the chance to resolve the matter with you first.