Privacy Policy

Nola ("we," "our," or "us") operates the Nola mobile application and associated services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and services.

By using Nola, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

You can create or access your Nola account with Google Sign-In. Sign-in is handled by our authentication provider, Privy — Nola never sees or stores your Google password.

What we receive from Google

• Your Google email address, and a Google account identifier used to recognise you when you sign in again

Your email address is the only field from your Google account that Nola reads and stores. We do not read or store your Google profile photo, your contacts, your calendar, your files, or any other Google service data.

How we use it

• To create your Nola account and identify you when you return
• To send you service email about your account, such as security and transaction notices
• To reach you if you contact support

We do not use Google user data for advertising or marketing profiling, we do not sell or rent it, and we do not send it to the AI service described below. It is shared only with the providers listed under "Third-Party Services" that need it to operate your account, and where we are required to disclose it by law.

How we protect it

Your Google email address is transmitted over TLS, encrypted in transit and at rest, and held in access-controlled systems. Only the Nola systems that need it to operate your account can read it. See "Data Security" below for the measures that apply to all of your information.

Artificial intelligence and machine learning

Nola does not use Google user data to develop, improve or train any artificial intelligence or machine learning model, personalised or non-personalised. Google user data is never sent to the third-party AI service described under "AI Assistant & Data Sharing" below. We do not use Google user data for advertising, we do not sell or rent it, we do not transfer it to data brokers or information resellers, and we do not use it to assess credit-worthiness or for lending decisions.

Retention and revoking access

We keep your email address for as long as your Nola account exists, and delete it when your account is deleted, except where we must retain records by law. You can revoke Nola's access to your Google account at any time at myaccount.google.com/permissions. Revoking access stops you signing in with Google; to have the data we already hold deleted, contact privacy@nola.money.

Nola's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Account Information

• Email address and name (provided during registration)
• Authentication credentials managed through our authentication provider (Privy)
• Profile information you choose to provide

Financial Information

• Blockchain wallet addresses generated for your account
• Transaction history and balances
• Card usage data and spending patterns
• Deposit and withdrawal records

Device & Usage Information

• Device type, operating system, and app version
• Usage patterns and feature interactions
• Error logs and performance data

• Provide, maintain, and improve our services
• Process transactions and manage your account
• Create and manage your embedded wallet on the blockchain
• Facilitate yield generation through DeFi protocols
• Process card transactions through our card issuing partner
• Provide AI-powered financial insights and recommendations
• Send service notifications and updates
• Detect and prevent fraud or unauthorized activity
• Comply with legal and regulatory requirements

We work with trusted third-party service providers to deliver our services:

• Privy — Authentication and wallet management
• Google — Sign-in, when you choose Google Sign-In (see above)
• Rain.xyz — Card issuance and payment processing
• Morpho — Decentralized yield generation via the Steakhouse Prime USDC vault
• Base Network — Blockchain transaction processing
• Cloudflare — Infrastructure and data processing
• OpenRouter — AI request routing for the Nola assistant

Each third-party provider has its own privacy policy governing how they handle your data. We encourage you to review their respective policies.

The Nola assistant is powered by a third-party AI service. When you use the chat or request suggestions, we send the information needed to answer you to OpenRouter, Inc. (United States), which routes it to the large language model that generates the response:

• Your chat messages and voice transcriptions
• Your first name
• Wallet and vault addresses
• Transaction history, balances, and card details (never your full card number or CVV)
• Savings goals and spending insights

We ask for your permission in the app before any of this data is shared, and we record your consent. This data is used solely to generate assistant responses and suggestions and, per OpenRouter's data policy, is not used to train AI models. If you do not consent, no data is sent to the AI service.

Nola uses public blockchain networks. Transactions executed on-chain are publicly visible and immutable. While your Nola account information is private, blockchain transaction data (wallet addresses, transaction amounts, timestamps) is publicly accessible by nature of the technology.

We do not control and cannot delete data recorded on public blockchains.

We implement industry-standard security measures to protect your information, including encryption in transit and at rest, secure key management, and access controls. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We retain your information for as long as your account is active or as needed to provide services. We may retain certain information as required by law, to resolve disputes, or to enforce our agreements. You may request deletion of your account data by contacting us.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability

To exercise these rights, please contact us at privacy@nola.money.

Nola is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the app or by email. Your continued use of Nola after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, please contact us at privacy@nola.money.