Nanvero
Start free

Privacy Policy.

Nanvero is built to need less of your data, not more. This explains exactly what we collect across our website and our app, why, who processes it, and what you can do about it.

Last updated: 31 August 2026

This policy covers both nanvero.com (our marketing website) and app.nanvero.com (the Nanvero app, where your travel is actually organized). It explains what information we collect, how we use it, the providers who help us process it, and the rights you have. Nanvero is a trading name of NP Labs Ltd, a company registered in England and Wales (company number 16053245, registered office 128 City Road, London, United Kingdom, EC1V 2NX) (“Nanvero”, “we”, “us”). NP Labs Ltd is the data controller, registered with the UK Information Commissioner’s Office (ICO) under reference ZC228854.

The short version

  • We do not sell your data, and we never will.
  • The app reads the travel and loyalty emails you choose to forward to it, and turns them into your balances, trips and reservations. It never signs in to your loyalty accounts and never asks for their passwords.
  • Instead of forwarding, you can optionally connect a Gmail account. Google grants Nanvero read-only access to your mailbox, and Nanvero’s systems are built to inspect only mail from recognized travel and loyalty senders. Nanvero can never send, change or delete anything in your mailbox, and you can disconnect at any time, which revokes the access at Google.
  • Your account and travel data are hosted in the European Union.
  • We use AI only to read a statement our own rules can’t, and data sent to our AI provider is never used to train AI models.
  • We never ask for — and never store — the passwords to your loyalty or airline accounts. No genuine message from us will ever request one.
  • You can export everything we hold about you, or permanently delete your account, at any time from Account → Danger zone in the app.
  • Questions any time: hello@nanvero.com.

Who we are

Nanvero is a trading name of NP Labs Ltd. For anything relating to your privacy or this policy, the data controller is NP Labs Ltd and you can reach us at hello@nanvero.com.

Information we collect

When you visit the website (nanvero.com)

Like most websites, we and our providers collect some technical information:

  • Usage and device data — the pages you view, the site that referred you, and your browser and device type, collected through analytics only if you accept analytics cookies.
  • Approximate location — a rough region derived from your IP address. We do not collect precise location.
  • Server logs — our hosting provider records standard access logs (including IP address and timestamps) to keep the site secure and running.

When you create and use the app (app.nanvero.com)

  • Account details — the email address you sign in with, your name, and the profile details you provide (such as country, city, date of birth, and travel preferences). Sign-in is a passwordless “magic link” — we do not store a password for you.
  • Forwarded emails — when you forward a travel or loyalty email to your Nanvero address, we receive and process the content of that email so we can turn it into a balance, trip or reservation. This can include the sender, subject, body and any attachments of the emails you forward.
  • Connected Gmail (optional) — if you choose to connect a Gmail account, you grant Nanvero read-only access through Google’s official API. Google’s read-only permission covers your mailbox; Nanvero’s systems are designed to inspect only mail from recognized travel and loyalty senders, and process it exactly like a forwarded email. Nanvero never sends, changes or deletes anything in your mailbox. We store the access token Google issues so scans can run, and delete it the moment you disconnect — which also revokes the access at Google.
  • Travel information we derive — the loyalty balances, reservations, trips, redemptions and related notes that Nanvero builds from what you forward or enter.
  • Subscription and payment — if you subscribe to Pro, our payment processor (Stripe) handles your card details; we receive and store a customer reference and your subscription status, not your full card number.
  • Product analytics and logs — how the app is used and standard technical logs, used to run, secure and improve the service.

We do not ask for special-category (sensitive) personal data. Some travel information could indirectly suggest things about you (for example, a destination) — we use it only to provide the service and never to profile you for advertising.

Why we use your information (our legal bases)

Under UK data protection law, we rely on the following:

  • Contract — to create your account and provide the Nanvero service you sign up for, including processing the emails you forward and maintaining your wallet.
  • Consent — for non-essential analytics cookies, and for marketing email (which you can withdraw at any time).
  • Legitimate interests — to keep the service secure and prevent abuse, to understand and improve how it is used, and to respond to your enquiries. We balance these against your rights and keep the data to a minimum.

Cookies and tracking

We ask before we track. When you first visit, a banner lets you accept or decline analytics cookies, and nothing non-essential loads until you accept. If you decline, we do not load analytics at all. You can change your mind at any time using the Cookie preferences link in the footer.

When you accept, we use Google Tag Manager to load analytics — Google Analytics and Microsoft Clarity — which place cookies to measure how our website and app are used (for example, which pages are popular and how visitors move through them). These are analytics cookies, not advertising cookies — we do not build advertising profiles or run retargeting pixels. Our fonts are served from our own domain rather than fetched from Google Fonts, so simply loading a page does not send a request to Google for typography.

You can control or block cookies through your browser settings, and you can opt out of Google Analytics across all sites using Google’s browser opt-out add-on. Blocking cookies will not stop you from using Nanvero.

For the full list of the cookies we set and how long they last, see our Cookie Policy.

Who processes your information

We do not sell your personal data. We share it only with the service providers that help us run Nanvero, acting on our instructions as our processors:

  • Supabase — the database, authentication and file storage that hold your account and travel data. Hosted in the European Union.
  • Vercel — hosting and delivery of the website and app.
  • Stripe — payment processing for Pro subscriptions. Stripe handles your card details under its own terms; we do not store your full card number.
  • Postmark — receives the travel and loyalty emails you forward, and sends account and service notifications (such as the message asking you to approve a new forwarding address).
  • Loops — sends your sign-in (magic-link) emails and, only if you have opted in, occasional product and marketing email.
  • Anthropic — an AI provider used to read the content of the statement emails you forward and extract the balance from them (see “How we use AI” below). Anthropic does not use data sent through its API to train its models.
  • Cloudflare — DNS, content delivery, and bot-protection at sign-in (which processes your IP address and interaction signals to tell humans from bots).
  • Google — if you connect a Gmail account, Google’s Gmail API provides the read-only access Nanvero uses to read mail from known travel and loyalty senders. Separately, Google Tag Manager and Analytics provide website and product analytics, loaded only after you accept analytics cookies.
  • Microsoft (Clarity) — product analytics, loaded only after you accept analytics cookies.

We may also disclose information if the law requires it, or to protect the rights, safety or property of Nanvero and others.

How we use AI

To save you typing, Nanvero can read a forwarded statement email and pull out your current balance automatically. When our own rules can’t confidently read a statement, we send the relevant part of that email to our AI provider (Anthropic) purely to identify the program and extract the number. The result is checked against strict guardrails before it is ever written to your wallet, and it is logged so any change is auditable and reversible. Your data is not used to train AI models. We do not use AI to make any decision that has a legal or similarly significant effect on you.

Google user data and Limited Use

Nanvero’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Data from a Google mailbox you connect is used solely to provide the travel and loyalty features you ask for — turning recognized travel and loyalty emails into your balances, trips and reservations. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to others except as needed to provide these features, to comply with the law, or in connection with a merger or acquisition. Google user data is never used to train generalized or standalone AI models. Google’s read-only permission covers your mailbox; Nanvero’s systems are built to inspect only mail from recognized travel and loyalty senders, and you can disconnect at any time, which revokes the access at Google.

International transfers

Some of these providers are based outside the United Kingdom, including in the United States, so your information may be processed there. Where that happens, we rely on appropriate safeguards — such as UK adequacy regulations, the UK International Data Transfer Agreement, or standard contractual clauses — to protect it.

What happens to the emails you forward

When a forwarded or scanned email creates a booking, we keep the original message as a viewable document filed against that reservation, along with any attachments it carried (such as a boarding pass or PDF confirmation), so you can open the source later. These are stored privately and served download-only, so nothing in them can run in your browser. You can delete any of these documents yourself, and deleting the reservation or your account removes them. A statement that only updates a balance is used to update your wallet and isn’t kept as a stored email, though any attachment it carries may still be filed for you to open later.

Household and delegated access

Nanvero lets you share access with people you trust — a Household puts up to five people on one plan, and Executive lets an assistant or other delegate act in your account. When you use these features, we process the information needed to make them work:

  • Invitations — when you invite someone, we send an invitation email to the address you give and record who invited whom, so the invite can be accepted, declined or withdrawn.
  • Membership and delegate identity — we record that an account belongs to a Household, and which accounts may act as a delegate on another, each with their own separate login.
  • Permissions and sharing choices — we store the specific access and sharing settings you configure. Other members and delegates can see only the categories of information you explicitly share with them; balances can be pooled for planning without anyone seeing another person’s trips, and each switch is yours to set, per person.
  • Activity history — where a delegate acts in your account, we record the change under their name, so there is an audit trail of who did what.

You can revoke delegated access, or remove a Household member, at any time. When access is revoked the delegate can no longer see or act on your data; when someone leaves a Household, their own account simply returns to the free tier and their private data stays with them — nothing of theirs is deleted, and nothing of yours remains visible to them.

How long we keep it

We keep your account and travel data — including the stored emails and documents described above — for as long as your account is open. When you delete your account, we delete that data (removing your account cascades to your profile, wallet, offers, reservations and their documents); limited records may be retained only where the law requires it, such as records needed for tax or to resolve disputes. Emails you send us are kept for as long as needed to deal with your enquiry and any follow-up. Analytics data is retained in line with the limits set in the analytics tools.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to our use of your personal data, to ask for a copy of it in a portable format, and to withdraw any consent you have given. Two of these you can exercise yourself, instantly, in the app:

  • Export a machine-readable copy of your data — Account → Danger zone → Export my data.
  • Delete your account and its data permanently — Account → Danger zone → Delete my account.

For anything else — or if you can’t reach the app — email hello@nanvero.com and we will action it. If you are unhappy with how we have handled your data, you can complain to the UK’s Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.

United States residents

Depending on where you live and the law that applies, you may have additional rights over your personal information — including rights to access, correct, delete, or obtain a portable copy of it, and to not be treated differently for exercising them. Nanvero does not sell your personal information and does not use it for targeted advertising. You can exercise any applicable rights yourself using the controls in your account (Account → Danger zone → Export my data or Delete my account), or by emailing hello@nanvero.com.

Security

We protect your information with measures appropriate to its sensitivity — encryption in transit, access controls, and providers chosen for their security track record. Sign-in is passwordless, so there is no password of yours for us to leak. No system is perfectly secure, but we work to keep the data you trust us with safe, and to collect as little of it as the service needs.

Children

Nanvero is intended for adults: you must be at least 18 to use it (see our Terms), and we do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy as Nanvero develops. When we do, we will revise the “last updated” date at the top, and for significant changes we will make it more prominent.

Contact us

Questions about your privacy or this policy? Email hello@nanvero.com and a real person will reply.