Privacy Policy

Draft. This document is a draft for review and is not yet in force. [TBD: legal review]

This Privacy Policy explains what personal data Nolatech Ltd ("we", "us") collects through the SpanDock website at https://spandock.com, your account, and the license checks made by the SpanDock software, and how we use it. The SpanDock software itself is self-hosted: the telemetry it processes stays on your machines, and we never receive it.

1. Who is responsible

The controller of your personal data is Nolatech Ltd, Cyprus [TBD: confirm entity, registration number and address]. You can reach us about privacy at privacy@spandock.com. [TBD: data protection officer or EU representative, if required]

2. What we collect

Account data

When you sign up, we collect your email address and, if you give it, your name. We record your sign-in method (an email code or link, or a third-party sign-in such as Google). If you sign in with a third party, we receive your basic profile from it, such as name, email and profile picture.

Purpose and legal basis: to create and run your account and provide your license (performance of a contract).

Billing data

Purchases are processed by our reseller and merchant of record, who handles payment card details and tax calculation. We receive the details needed to manage your subscription: your plan, billing country, invoices, payment status, and the business name and tax ID if you give them. We do not receive or store full card numbers.

Purpose and legal basis: to provide and bill your subscription (performance of a contract) and to keep financial records (legal obligation).

License check metadata

The SpanDock software checks its license with our servers daily, on license changes and after updates. Each check sends:

• a random installation ID;
• the software's role, version, operating system and architecture;
• the reason for the check;
• counts of active clients, servers and satellites for the billing period;
• your license key, which identifies your license.

We also see the IP address the check comes from. We use it for rate limiting, security and abuse prevention.

Purpose and legal basis: to validate your license, bill usage-based plans, and protect the service (performance of a contract and our legitimate interest in preventing abuse).

Contact messages

When you use the contact form or email us, we keep your name, email address and message, so we can answer and follow up.

Purpose and legal basis: to respond to you (legitimate interest, or steps before a contract).

Product analytics

We use analytics to understand how the website and dashboard are used, for example which pages are visited. We use them only with your consent where consent is required. [TBD: consent mechanism and scope, which events are collected]

Purpose and legal basis: to improve the website (consent, or legitimate interest where consent is not required).

Cookies

• Session cookie: keeps you signed in. It is strictly necessary and does not need consent.
• Analytics cookies: set only if you consent where required. [TBD: cookie list, names and durations]

3. What we never receive

The SpanDock software runs on your machines. We never receive the telemetry it collects, your prompts, your code, tool output, or the data stored in its database. That data goes only to the destinations you configure.

4. Who we share data with

We use service providers (processors) to run the website and the service. They process data on our instructions only.

Purpose	Provider
Website and API hosting	[TBD]
Database	[TBD]
Transactional email (sign-in codes, receipts)	[TBD]
Payments, tax and invoicing (reseller and merchant of record)	[TBD]
Product analytics	[TBD]
Bot protection on forms	[TBD]

Our reseller and merchant of record acts as an independent controller for the purchase it processes. We may also disclose data when required by law, to protect our rights, or as part of a merger or acquisition, in which case we will tell you.

We do not sell your personal data.

5. How long we keep data

• Account data: while your account exists. When you delete your account, we delete or anonymise it within [TBD] days, except what we must keep.
• Billing records: as long as tax and accounting law requires. [TBD: period]
• License check records: for the life of the license plus [TBD] months, so usage-based bills can be verified.
• IP addresses used for rate limiting: [TBD] days.
• Contact messages: [TBD] months after the conversation ends.
• Analytics data: [TBD] months.

6. Your rights

If the GDPR or a similar law applies to you, you have the right to:

• access the personal data we hold about you;
• correct it;
• delete it;
• restrict or object to its processing, including processing based on legitimate interest;
• receive it in a portable format;
• withdraw consent at any time, without affecting processing before the withdrawal.

You can delete your account from your dashboard. For other requests, email privacy@spandock.com. We will answer within one month. You also have the right to complain to a data protection authority, in particular in the country where you live or work. [TBD: lead supervisory authority]

7. International transfers

Some of our providers may process data outside the European Economic Area. Where they do, we rely on adequacy decisions or standard contractual clauses. [TBD: list transfers and safeguards]

8. Security

We protect personal data with encryption in transit, access controls, and by storing sign-in codes and secrets only in hashed or encrypted form. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

9. Children

The website and service are not directed at children, and we do not knowingly collect their data.

10. Changes

We may update this policy. For material changes, we will tell you by email or in your dashboard before they take effect.

11. Contact

Nolatech Ltd, Cyprus [TBD: address]. Email: privacy@spandock.com.