This policy explains how Nostello OÜ ("Nostello", "we"), Ahtri Street 12, 15551 Tallinn, Estonia, handles personal data for Accessmith. We are an EU company and apply the GDPR. Privacy contact for Nostello OÜ: Sheldon Halgreen, privacy@noscotek.co.za.
In short: your document content isn't sent to us. Accessmith checks and fixes the open Word document or PowerPoint presentation inside Office and does not send its content to us. We keep only what we need to run your plan: your Microsoft account and organisation identifiers, a monthly count of fixes and billing status. No advertising, no analytics, no cookies.
Text, pictures, alt text, links, titles, file names and the reports you export are processed in the add-in on your device using Microsoft's Office add-in APIs. They are not sent to us, stored on our servers, written to our logs or shared with anyone. Accessmith does not use AI services.
| Data | Why | Basis | Kept |
|---|---|---|---|
| Microsoft account object ID, organisation (tenant) ID and sign-in email, from the Microsoft ID token your add-in sends us (verified with Microsoft's public keys) | Identify your licence, free limit and Team seats | Contract (Art. 6(1)(b)) | While you use the service; deleted on request |
| Monthly count of fixes | Free-plan limit (10 a month) | Contract | 13 months |
| Team settings: rule ids and short ignore texts your Team admin saves, and an audit record (who changed them, when) | Shared Team rules | Contract | While the Team plan is active; audit 13 months |
| Billing: name, email, address, VAT number, payment status (processed by Stripe) | Subscriptions and invoices | Contract and legal obligation (Art. 6(1)(c)) | 7 years (Estonian accounting law) |
| Usage telemetry: event type (for example "scan", "fix", "report exported"), counts, app version, Word or PowerPoint, and one-way hashed account and organisation identifiers | Keep the service reliable and understand usage | Legitimate interest (Art. 6(1)(f)) | Up to 13 months (deleted manually until automatic deletion is in place) |
| Error reports: the technical error message and where it happened, app version and a hashed identifier. Messages are scrubbed of quoted text, web addresses, email addresses and long numbers; no document content and no IP address are stored by us | Fix bugs | Legitimate interest | Up to 13 months (deleted manually until automatic deletion is in place) |
| Licence-code redemption (only if you enter a code): the fact that your account redeemed a code, once | Let reviewers and testers try Pro | Contract | While you use the service; deleted on request |
| Rating-prompt state and, only if you send it, feedback text with your hashed identifier | Ask for a review at a sensible moment; read your feedback | Legitimate interest; consent for feedback | Feedback until you ask us to delete it |
| IP address, inside short rate-limit counters | Protect the service from abuse | Legitimate interest | Minutes (one day at most) |
Telemetry, error reports and feedback go to Nostello's internal admin dashboard (the "appsdashboard", run by Nostello on Cloudflare, access restricted to Nostello staff). Please don't put document content or personal data in feedback.
The fix history used for Undo stays in the add-in for the session. Microsoft's sign-in library keeps your sign-in token in the browser storage of the add-in. We can't read either.
User.Read only (to identify your licence). The add-in's Office permission is "read and write document", used only to check and fix the open document when you ask.
Cloudflare (hosting, licence database) and Stripe (payments). See sub-processors. Processing outside the EEA relies on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the recipient is certified. Microsoft processes your documents under your own agreement with Microsoft. For business customers our DPA applies.
You can ask for access, correction, deletion, restriction or portability, or object to processing based on legitimate interest, by emailing privacy@noscotek.co.za. On request we delete your licence record, counts, feedback and linked telemetry manually, within 30 days of your request; billing records stay as accounting law requires. You can withdraw consent for feedback at any time. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local authority.
Encrypted connections, verified sign-in tokens, signed Stripe webhooks, no storage of document content, no request logging, admin tools behind Cloudflare Access.
Accessmith is not directed at children under 16. We post changes here and email paying customers about material changes.
Accessmith by Nostello. Nostello OÜ, Ahtri Street 12, 15551 Tallinn, Estonia.