This Privacy Policy explains what data Minimal Instruments collects through nagi.app and the nagi application, and how it is used.
Last updated: 26 July 2026
Who is responsible
Minimal Instruments, , Japan, is the controller of the personal data described here. Questions and requests: support@nagi.app, or the Contact page.
What we collect
Account data — your email address and name, and a hashed form of your password, when you create an account or purchase a licence.
Order data — order number, email address, name, amount, currency, tax amount, the payment provider used and its transaction reference, and any coupon code applied. We never receive or store your card number.
Licence activation data — a machine identifier and an optional device label for each activated seat, stored against your licence so the three-seat limit can be enforced.
Newsletter data — if you subscribe, your email address, name, language preference, and a record of your consent (date and time, IP address, browser user agent) kept as proof that the subscription was requested.
Community board data — the community board uses its own separate account (email address, name, hashed password). Topics and replies you post there are visible to other signed-in members.
Support correspondence — the contents of emails you send us.
Security data — failed sign-in and licence activation attempts, stored only as a SHA-256 hash of the email address or IP address involved, never in readable form.
What we do not collect
The AI assistant runs on-device: your projects and prompts are never uploaded. After activation, nagi does not contact us to re-check your licence.
nagi does ask our server whether a newer version is available. That request tells us the platform, processor architecture and version you are running, and — as with any request to any web server — your IP address is visible while it is served. We keep only a per-release counter of how many times each release was checked. Nothing in that counter identifies you or your machine.
Payment data
Card and PayPal details are handled directly by Stripe and PayPal — we never see or store your full payment credentials.
Why we are allowed to use this data
For customers in the EEA and the UK, the GDPR requires us to state a legal basis for each use:
Performing our contract with you (Art. 6(1)(b)) — issuing and activating your licence, providing downloads and updates, running your account, answering support requests, and operating the community board.
Your consent (Art. 6(1)(a)) — sending the newsletter. You can withdraw consent at any time using the unsubscribe link in any newsletter or by contacting us; withdrawal does not affect mailings already sent.
Our legitimate interests (Art. 6(1)(f)) — preventing fraudulent purchases and licence abuse, rate-limiting sign-in attempts, and keeping the site and download service secure.
Legal obligations (Art. 6(1)(c)) — retaining sales and tax records as required by Japanese law.
How long we keep it
Order, invoice and tax records — seven years from the end of the business year, as required for Japanese tax record-keeping. This is a legal obligation, so these records are kept even if you ask us to delete your account.
Account and licence records — while your account is open, and for twelve months after you ask us to close it or after your last licence expires.
Licence activation records — until the seat is deactivated, then twelve months.
Newsletter subscription and its consent record — until you unsubscribe, then twenty-four months so we can show the subscription was consented to.
Community board account and posts — until you ask us to close your account. We then erase your account details and detach your posts from your name and email address, so that existing discussions remain readable. If you want the text of a post removed as well, say so and we will remove it.
Security (rate-limiting) records — the counter stops applying twenty-four hours after the last failed attempt, and the hashed record is deleted the next time that address signs in successfully.
Download links — until the link expires.
Who else handles your data
Stripe and PayPal — payment processing.
— hosting of this site and of the download and licence services.
— delivery of account, order and licence emails.
Our newsletter runs on phpList installed on our own server, so subscriber lists are not passed to a third-party mailing service. We do not sell personal data, and we do not share it for advertising.
Where your data is stored, and international transfers
Our servers are located in Japan. If you are in the EEA or the UK, your data is therefore transferred to Japan. The European Commission decided in January 2019 that Japan provides an adequate level of data protection, and the UK recognises that decision, so no additional safeguards are required for this transfer. Transfers to Stripe and PayPal are covered by their own standard contractual clauses.
Your rights
If you are in the EEA or the UK, you have the right to ask us to give you a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
To exercise any of these rights, write to support@nagi.app from the email address held on your account. We will reply within one month. You also have the right to complain to your local data protection supervisory authority.
For customers in Japan
We handle personal information in accordance with the Act on the Protection of Personal Information (APPI). The purposes of use are those described above. Requests for disclosure, correction, or suspension of use can be sent to support@nagi.app. Complaints may also be directed to the Personal Information Protection Commission.
Cookies
This site uses only cookies that are necessary for it to work: a session cookie when you are signed in, a security token that protects forms from cross-site request forgery, and a cookie that remembers your language choice. We do not use analytics, tracking, or advertising cookies, which is why you are not asked for cookie consent. If that ever changes, this policy will be updated and consent will be requested first.
Children
nagi is not directed at children under 16, and we do not knowingly collect their data.
Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change affects how we use data you have already given us, notify account holders by email.
Contact
Questions about this policy can be sent to the address on the Contact page.