Privacy policy

Personal data protection · GDPR

Last updated: 17 August 2026

This policy explains how SamionX collects, uses and protects your personal data when you use nTilia, in line with the GDPR, Belgian law and the European framework applicable to artificial intelligence (AI Act).

1. Data controller

Controller
SamionX
Director
David Herreman
Company number
0725.475.371
Registered office
14 rue de Picardie, 6010 Charleroi, Belgique
DPO contact
dpo@samionx.com
General contact
contact@samionx.com
Product support
support@ntilia.com

2. Data we collect

Depending on how you use nTilia, we may process:

  • Account data: email, identifier, password (hashed), profile (username, photo or logo, preferences)
  • Content: notes, articles, metadata (dates, location if enabled), related audio and media
  • Billing data: via Stripe (billing address, name / legal entity, VAT number if provided; payment details are not stored by SamionX beyond necessary references)
  • Technical data: IP address, browser type, security logs, session cookies
  • AI assistance data: text excerpts you voluntarily submit to assisted editing features

In offline mode, drafts may remain stored locally on your device until sync.

3. Purposes and legal bases

  • Providing nTilia (account, sync, public journal) — contract performance (Art. 6.1.b GDPR)
  • Authentication emails (confirmation, magic link, password reset) and welcome email (onboarding) — contract performance (Art. 6.1.b)
  • Payments and subscriptions — contract and legal obligations
  • Security, fraud prevention, logs — legitimate interest (Art. 6.1.f)
  • AI features (assisted editing via Anthropic) — contract and/or consent as applicable
  • Support communications — legitimate interest / pre-contractual steps

4. Retention

  • Account and content: for the life of the account; deletion on request or after closure, subject to limited technical backups
  • Billing: statutory accounting period (generally 10 years in Belgium)
  • Technical and security logs: limited period needed for security
  • Transactional email logs at Mailtrap: limited period per the provider
  • Data sent to AI providers: minimal retention per their policies; SamionX does not use your content for marketing

5. Recipients and processors

We do not sell your data. We use processors to operate the service:

  • Hostinger International Ltd. — application hosting (EU: Paris, France (Union européenne))
  • Supabase Inc. — database and authentication (EU: AWS eu-west-1, Ireland)
  • Railsware Products Studio LLC (Mailtrap) — transactional emails (confirmation, magic link, password reset, email change, welcome) (United States (AWS us-east-1))
  • Stripe Payments Europe, Ltd. — payments
  • Anthropic, PBC (Claude) — provider of the GPAI models and Messages API used for assisted editing and related features

6. AI processing and the AI Act

nTilia’s AI features (Markdown editing help, suggestions, titles, captions, etc.) are provided under the nTilia brand. General-purpose AI models are provided by Anthropic, PBC (Claude) via the Claude API. Excerpts you send to these features are processed only to fulfil your request.

Roles
Anthropic, PBC: GPAI model provider. SamionX: data controller for nTilia and provider of the AI assistance system integrated in the product.
Legal basis (GDPR)
Contract performance and/or consent depending on the feature activated (Art. 6.1.b / 6.1.a).
AI Act framework
Regulation (EU) 2024/1689 (AI Act) — transparency-risk system (Art. 50). Not marketed as a high-risk system (Annex III).
  • Offline dictation uses browser APIs; no cloud transcription is enabled as of this policy
  • The interface states, from first use, that assistance is AI-based (Art. 50(1))
  • Generative outputs are machine-readably marked (Claude watermark and page metadata). Standard editing is not marked (Art. 50(2))
  • You remain responsible for verifying outputs before publishing or using them
  • Do not send sensitive data that is not needed for the requested feature
  • Anthropic privacy policy: https://www.anthropic.com/legal/privacy
  • Anthropic Acceptable Use Policy: https://www.anthropic.com/legal/aup
  • Claude marking and detection: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

If you publish text that is AI-generated or substantially AI-manipulated to inform the public on a matter of public interest, without substantive human editorial review, labelling obligations (Art. 50(4) AI Act) may apply to you as a deployer. nTilia reminds you of this duty when you publish and lets you add a visible label.

7. Your GDPR rights

You have rights of access, rectification, erasure, restriction, portability and objection, under the conditions set by the GDPR.

To exercise them: dpo@samionx.com or by post to 14 rue de Picardie, 6010 Charleroi, Belgique. Include elements allowing us to verify your identity. Response time: one month maximum.

You may also lodge a complaint with the Autorité de protection des données (APD) — Rue de la Presse 35, 1000 Bruxelles, Belgique — https://www.autoriteprotectiondonnees.be.

8. Security

We implement appropriate technical and organisational measures (encryption in transit, access control, RLS where applicable, least privilege). No measure guarantees absolute security.

9. Cookies

  • Essential cookies / storage: auth session, CSRF / security, language, theme
  • No third-party advertising cookies on the marketing site as of this policy
  • You may restrict cookies in your browser; some features (sign-in) may then be unavailable

10. International transfers

The app is hosted in the European Union (Hostinger, Paris data centre). The database and authentication are hosted in the European Union (Supabase Inc., EU: AWS eu-west-1, Ireland). Transactional emails (authentication and welcome) are sent by Mailtrap, whose servers are located outside the EU (United States (AWS us-east-1)). Payments and AI gateways may also involve processing outside the EU. These transfers rely on appropriate safeguards (EU-US Data Privacy Framework adequacy decision, standard contractual clauses, data processing agreement). Mailtrap privacy policy: https://mailtrap.io/privacy/.

11. Minors

nTilia is intended for users able to enter into a contract. If you are under 16 (or the age required in your country), use the service only with parental authority consent.

12. Changes

We may update this policy. The update date appears at the top. For material changes, we will endeavour to notify signed-in users.

13. Contact

DPO: dpo@samionx.com · David Herreman · 14 rue de Picardie, 6010 Charleroi, Belgique