Privacy policy.

1. Two different roles — this distinction matters

We handle personal information in two capacities, and your rights differ depending on which applies.

• As a business, for information about our own relationship with you: your account, your use of this website, and our correspondence. This policy governs that information, and you exercise your rights directly with us.
• As a service provider, for personal information contained in workloads our customers run on the platform. We process it only on our customer’s instruction, and we do not retain, use, or disclose it for any purpose other than providing the service. If your data reached us that way, the customer controls it — contact them, not us, and we will help them respond.

2. What we collect, and why

In the last 12 months we collected the following categories of personal information as a business. This is a notice at collection for the purposes of the CCPA.

3. What we do not collect

• Sensitive personal information as defined by the CPRA — we do not collect government identifiers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data, or the contents of your mail, email, or messages.
• Biometric information.
• Personal information from third-party data brokers.
• Behavioural advertising or cross-context tracking data. This site loads no analytics, advertising, or session-replay scripts, and self-hosts its fonts, so visiting it sends no request to any third party.

4. We do not sell or share your personal information

We have not sold or shared personal information in the last 12 months, and we do not do so now. “Share” here carries its CPRA meaning — disclosure for cross-context behavioural advertising — and we do no such advertising.

We have also not disclosed personal information to third parties for a business purpose beyond the service providers described in section 6.

5. Cookies and tracking

This site sets no cookies of its own and loads no analytics, advertising, or session-replay scripts. Fonts are served from our own infrastructure, so simply reading this page sends no request to any third party.

When you sign in, our authentication proxy sets a session cookie that is strictly necessary to keep you signed in. Your browser also stores a single timestamp locally so we can sign you out after a period of inactivity — it holds no personal information.

Because we do not sell or share personal information, a Global Privacy Control signal has nothing to act on here. We honour it regardless if that ever changes.

6. Who else touches it

We use a small number of service providers, each under contract restricting them to processing on our instruction: our cloud infrastructure provider, which hosts the platform and stores the data described above; and, once billing is live, a payment processor. We do not authorise any of them to use your information for their own purposes.

We may disclose personal information where we are legally required to, or to establish or defend a legal claim. If we are compelled to disclose your information we will tell you unless legally prohibited from doing so.

7. Your rights

California residents have the following rights. We extend them to everyone who contacts us, regardless of where you live.

• Know and access. Ask what personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to. You may ask for a copy in a portable format.
• Delete. Ask us to delete personal information we collected from you, subject to exceptions the law allows — for example where we must keep it to complete a transaction, secure the platform, or comply with a legal obligation.
• Correct. Ask us to correct inaccurate personal information.
• Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. If that ever changes we will update this policy and provide a “Do Not Sell or Share My Personal Information” link before the change takes effect.
• Limit use of sensitive personal information. We do not collect sensitive personal information, so this right does not arise.
• Non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

8. How to make a request

Email support@nalej.com, or reach us through the contact page. Tell us which right you are exercising.

We will verify your identity before acting — usually by confirming you control the email address on the account, and for a deletion or correction request by asking for additional detail that matches our records. We will not use what you give us for verification for any other purpose.

We aim to confirm receipt within 10 business days and to respond substantively within 45 days, extendable once by a further 45 days where the request is complex. An authorised agent may act for you with written permission we can verify.

9. Security

We protect personal information with encryption in transit between services, access control scoped to the least privilege needed, network segmentation between tenants, and audit logging. No system is perfectly secure, and we do not claim otherwise.

10. Children

The platform is for business use and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, tell us and we will delete it.

11. Changes and contact

We review this policy at least once a year and will post any update here with a new date. Material changes get notice before they take effect.

NALEJ Corporation, REGISTERED ADDRESS. Effective EFFECTIVE DATE.