Privacy Policy
Last updated: October 20, 2026
This policy describes how NASEBANAL (the "Service") handles personal information. By using the Service, you agree to the practices described here.
1. Information We Collect
We collect: (1) Account information — your email address and name, obtained through our authentication provider Auth0. We do not collect, store, or display the profile picture held by your sign-in provider, such as Google. (2) Service data — the values, tags, goals, and comments you record, any images, video, or audio you attach, and your organization membership and sharing settings. (3) Contact enquiries — the name, email address, and message you submit through the contact form. (4) Technical information — access logs including IP address, browser type, and timestamps. The Service does not offer online payments and we collect no payment information. The Enterprise plan is provided under a direct contract and invoicing with an organization. If we introduce online payments, credit card numbers will be collected directly by our payment processor Stripe and never stored on our servers.
2. How We Use It
We use this information to provide and maintain the Service, to authenticate you, to store and display your records, to answer your enquiries, to prevent abuse, and to detect faults and improve quality. We also use the email address on your account to send service announcements and update notifications, which you can opt out of at any time via the link in those emails. If you have an Enterprise contract, we also use it to manage the contract and billing. We do not use it for advertising and we do not sell it to third parties.
3. Cookies and On-Device Storage
We use an authentication cookie to keep you signed in, nb_active_org to remember the organization you are working in, and nb_theme to remember your appearance setting. The mobile app stores your authentication token in the device secure store and keeps a local database for offline viewing. All of these are necessary for the Service to function; we do not use advertising or tracking cookies.
4. Third Parties and Processors
We rely on the following processors to operate the Service: Auth0 (Okta, Inc.) for authentication; Cloudflare, Inc. for hosting, database, file storage, analytics, and bot protection; Resend for sending contact emails and service announcement emails; GitHub, Inc. for tracking bug reports and feature requests submitted through the contact form (name, email address, and message) in a private repository; New Relic, Inc. for uptime monitoring and log retention; and Stripe, Inc. for online payments if we introduce them — no information is sent to Stripe today, as we take no online payments. These providers may process information on servers outside your country. We do not disclose personal information to any other third party except where required by law.
5. Retention
We retain your information for as long as your account is active and for any period required by law. Records, tags, and attachments you delete are removed from our database and storage. Operational logs expire according to our monitoring provider's retention period.
6. Your Rights
You may request access to or correction of your personal information. You can export your own records at any time using the CSV export in Recorder. You can delete your account yourself from the settings screen in the web app or the mobile app. Deleting your account permanently removes all of your data across the Service, including records, goals, attachments, and sharing settings. This action cannot be undone. To request access or correction, please contact us through the contact form.
7. Security
Traffic is encrypted with TLS and access to data is scoped per account. Attachments are served only through expiring signed URLs. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.
8. Information About Children
The Service is not aimed at any particular age group, and we expect guardians to use it to keep records about their children. If you record information about a child, you confirm that you have the authority as their guardian to handle that information. Creating an account and agreeing to this policy is limited to those old enough to enter into a contract on their own, or minors who have their guardian's consent.
9. Changes to This Policy
We may revise this policy as the law or the Service changes. We will announce material changes within the Service.
10. Contact
For questions about this policy, or to make a request regarding your personal information, please contact us through the NASEBANAL contact form.