Privacy policy

Who is responsible

NEVAITRA is operated by its owner as named on the About page. You can reach us through the contact form for any privacy question or request.

Data we process

• Account: your email address, and — if you sign in with Google — your name and profile picture as provided by Google.
• Sign-in sessions: a session cookie, plus the IP address and browser user agent stored with the session to protect your account. Session records expire after 30 days of inactivity or when you sign out.
• Demo workspaces: the records you create while using a demo. Demos are meant for fictional data only. When a demo ends (72 hours by default) all of its data is permanently deleted; we keep a minimal record that the workspace existed (project, dates, features used) for quota enforcement, security and product analytics.
• Requests and messages: what you submit through the request or contact forms (name, email, optional company, your description), together with the project and demo context you attached.
• Usage analytics: first-party, pseudonymous events such as project page views, demos started and features used, linked to a random browser-session identifier. We do not use advertising cookies and do not store IP addresses in analytics.
• Visit source: when you arrive, we note the referring website's domain (never the full address), the first page you opened and any campaign tags in the link (utm_source, utm_medium, utm_campaign). It is kept in a first-party session cookie and attached — without your name or email — to analytics events and to a demo or request you create, so we can see which pages and channels lead to useful conversations.
• Abuse protection: a keyed hash of your IP address is used temporarily to rate-limit forms and demo creation.

Why we process it

• To provide your account and demo workspaces (performance of a contract / pre-contractual steps).
• To answer your requests and messages (pre-contractual steps and legitimate interest).
• To keep the service secure and prevent abuse (legitimate interest).
• To understand which projects and features are useful and improve them (legitimate interest), using pseudonymous data only.

How long we keep it

• Demo workspace data: deleted when the demo ends.
• Sessions: until you sign out or they expire.
• Requests and messages: as long as needed to handle them and any resulting project, after which they are deleted or anonymized.
• Security audit records: kept for a limited period for accountability.
• Your account: until you ask us to delete it.

Who receives data

We use service providers for hosting, the database, and email delivery, and Google if you choose Google sign-in. They process data on our behalf and under our instructions. We do not sell personal data. Some providers may process data outside your country; we select providers that offer appropriate safeguards.

Cookies

• Session cookie (strictly necessary): keeps you signed in.
• Sign-in security cookies (strictly necessary): protect the Google sign-in flow.
• Analytics visitor cookie (first-party): a random identifier that lasts for your browser session.
• Visit source cookie (first-party): the referring domain, landing page and campaign tags of your visit; it ends with your browser session.

Your rights

You can ask for access to, correction or deletion of your personal data, restriction of or objection to processing, and a copy of your data. Use the contact form and we'll respond within the legal time limits. You also have the right to complain to your data protection authority.

Changes

We'll update this page when our processing changes. The date at the top shows the latest version.