NolliworksBack

Privacy Policy

Last updated: November 10, 2026

1. Information We Collect

We collect the following types of information:

  • Account Information: Email address and password when you create an account
  • Organisation Data: Organisation names, descriptions, member roles, and project data you create within the Service
  • Usage Data: Actions performed within the Service, recorded in audit logs for security and compliance
  • Technical Data: Browser type, IP address, and cookies necessary for the Service to function

2. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account
  • Enable collaboration within organisations you belong to
  • Process payments and manage subscriptions
  • Send important notifications about the Service
  • Detect and prevent security incidents

3. Data Sharing

We share your information only in the following circumstances:

  • Within Organisations: Your email and role are visible to other members of organisations you join
  • Service Providers: We use third-party services for authentication (Supabase), payment processing (Stripe), and hosting
  • Legal Requirements: When required by law or to protect our rights

We do not sell your personal information to third parties.

4. Data Retention

We retain your data for as long as your account is active. When you delete your account, we remove your organisation memberships immediately. Organisation data (projects, audit logs) may be retained for the organisation's records. We use soft deletion, meaning data is marked as deleted and excluded from queries but retained in the database for a reasonable period before permanent removal.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access: Request a copy of the data we hold about you
  • Rectification: Request correction of inaccurate data
  • Deletion: Request deletion of your data (available via Profile settings)
  • Portability: Request your data in a machine-readable format
  • Objection: Object to certain types of data processing

To exercise these rights, please contact us at [email protected].

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption of employees' contact details and leave notes before they are stored, Row Level Security (RLS) policies at the database level, and secure cookie-based authentication. However, no system is completely secure, and we cannot guarantee absolute security.

7. International Transfers

Your data may be processed and stored in countries outside your jurisdiction. We ensure that appropriate safeguards are in place for any international data transfers in compliance with applicable data protection laws.

8. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service. The date at the top of this page indicates when this policy was last updated.

10. Contact Us

For privacy-related inquiries, please contact us at [email protected].