Privacy

Who we are

This service is operated by NAKO AGENCY SRL, registration number (IDNO) 1020600005334, str. Mălina Mică 14, Chișinău, Republic of Moldova. For your data, we are the controller. Write to us at hello@nakoagency.com.

What we collect when you create an account

• your email address — the account identifier;
• your password, which we never keep as such: we store only a cryptographic form it cannot be reconstructed from;
• the workspace name you choose (this is your project's name, not yours);
• the language you use the interface in;
• technical data any server records: IP address, time of the request, browser type — in logs and error reports.

We do not ask for your name, phone number, address or payment details at sign-up.

The sites you publish — there, you are the controller

This notice is about your data, as the account holder. For what is collected on the sites you publish — where you are the controller and we act on your instructions — see the notice in your panel, on the Pages screen. It states what reaches us from a visitor's error, what does not, and what is derived from the IP address.

Why, and on what basis

• To create and run your account and workspace, and to send you the address confirmation email — the basis is performance of the contract between you and us (Art. 6(1)(b) GDPR).
• To keep the service secure and working — logs, error and abuse detection — the basis is our legitimate interest (Art. 6(1)(f) GDPR) in a service that stays up and cannot be attacked.

We do not use your data for advertising, we do not sell it, and we do not hand it to anyone to profile you.

Who else sees it

We work with providers who process the data on our behalf, on our instructions:

• Supabase — database and authentication; the data is held in the European Union (region eu-central-1);
• Sentry — error reports, on infrastructure in Germany;
• Resend — sending the confirmation email;
• Vercel — hosting the application;
• PostHog (PostHog Inc., hosted in the European Union) — measuring visits and page performance, only if you accept. PostHog does not record your session and does not automatically capture clicks.
• Google — usage analytics, only if you have given consent (see the section below).

Separately, only on the public website and only if you accept session recording: Microsoft Corporation (Microsoft Clarity, United States) receives browsing data and also uses it for its own purposes, including advertising.

Transfers outside the EU

Supabase processes our data within the European Union. Sentry (Functional Software, Inc., USA) stores error data in Germany; as a United States company, the transfer relies on the EU-U.S. Data Privacy Framework, which the provider states it complies with, with the EU Standard Contractual Clauses as the fallback. Vercel and Resend are United States companies and may process data outside the EU; where they do, the transfer relies on the EU Standard Contractual Clauses. PostHog hosts the data in the European Union; if PostHog Inc. accesses it from the United States, the transfer relies on the Standard Contractual Clauses in our data processing agreement.

Microsoft Clarity data goes to Microsoft Corporation in the United States, which processes it as an independent controller; Microsoft states that it complies with the EU-U.S. Data Privacy Framework.

Cookies

When you are only browsing the pages, we set a single cookie, which remembers the language you picked. We set no advertising cookies. For statistics we use Google Analytics (the _ga cookies) and PostHog (no cookie), and on the public website, separately, Microsoft Clarity for session recording (the _clck and _clsk cookies) — each only if you agree; until then it is not loaded. Microsoft may also set its own cookies, on its own domains, which it also uses for advertising. Once you are signed in we use strictly necessary cookies to keep you logged in.

Usage analytics

To understand which pages are used and where people get stuck, we use Google Analytics and PostHog (PostHog Inc., hosted in the European Union). We only turn them on if you agree — until then they are not loaded and nothing is sent to them.

If you accept, we collect: pages visited, time, device and browser type, your IP address (shortened by Google) and a cookie identifier. The basis is your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time, from the same dialog — withdrawing is as easy as agreeing.

PostHog does not record your session and does not automatically capture clicks.

Google may process the data outside the European Union. Such transfers rely on the GDPR safeguards the provider states in its data processing terms — a recognised protection framework or, failing that, the Standard Contractual Clauses approved by the European Commission. You can ask for a copy of those safeguards at any time.

If you decline, the product works exactly the same — you lose nothing.

Microsoft Clarity — public website only, only if you accept. Clarity records your browsing session (what is shown on screen, cursor movement, clicks, scrolling) and builds heatmaps. What you type into fields and dropdowns is not captured — Microsoft masks it in all modes. The data goes to Microsoft Corporation (United States), which also uses it for its own purposes, including advertising. Recordings are kept for 30 days, and some (favourites and a random sample) for up to 9 months. Details: Microsoft Privacy Statement. You can decline at any time.

How long we keep it

We keep account data for as long as the account exists, plus the short window in which a deletion can be undone. After the account is deleted we erase or anonymise it, except for what applicable law requires us to keep (accounting records, for instance) or what we need to defend a legal claim, until the statutory periods run out. Technical logs and error reports are short-lived and are deleted automatically.

Google Analytics keeps the data about your visit for 2 months; after that, only aggregated statistics remain, which do not identify you.

PostHog keeps usage events for up to 7 years; they do not contain your IP address and are not linked to your account or identity.

Microsoft Clarity keeps session recordings for 30 days; a randomly selected sample of recordings, recordings we mark and heatmaps are kept for at most 9 months.

Your rights

You can ask for access to your data, its rectification, its erasure, restriction of processing, and portability in a machine-readable format, and you can object to processing based on our legitimate interest. Write to hello@nakoagency.com — we answer within one month at the latest.

If you are in the European Union and believe we have infringed your rights, you may lodge a complaint with the data protection authority of the country where you live.