Privacy Policy

1. Who We Are

The service is operated by:

For privacy-related requests, contact:

If a Data Protection Officer is appointed later, this Privacy Policy should be updated with DPO contact details.

2. Our Role

Depending on the context, Nevora may act as:

Controller

We act as controller for personal data that we process for our own purposes, such as:

• account registration;
• authentication;
• billing administration;
• customer support;
• website analytics;
• security logs;
• product communications;
• private beta management.

Processor

We may act as processor for Customer Content that users upload or create inside Nevora, such as:

• business documents;
• task records;
• project records;
• money records;
• subscription records;
• workspace comments;
• files and metadata;
• data about a customer's own employees, clients, suppliers, or contractors.

In that case, the organization using Nevora is responsible for having a lawful basis to process that data.

3. Personal Data We Collect

We may collect the following categories of personal data.

Account and identity data

• name;
• email address;
• password authentication data or authentication provider ID;
• organization/workspace membership;
• role and permissions;
• language or interface preferences.

Contact and communication data

• messages you send to us;
• feedback;
• support requests;
• Telegram, email, or social media contact data if you contact us through those channels.

Workspace and Customer Content

Depending on how you use the product, this may include:

• tasks and project data;
• documents and files;
• document text extracted or processed by the system;
• money records entered by users;
• subscription records;
• operational notes;
• business metadata;
• relation links between entities;
• activity and audit history.

You control what Customer Content you upload or create.

Billing and payment data

If paid plans are enabled, billing may be processed by Paddle or another authorized payment provider.

We may receive limited billing information such as:

• customer name;
• email;
• billing country;
• plan purchased;
• subscription status;
• transaction status;
• invoice or receipt reference;
• tax-related information made available by the payment provider.

We do not intentionally store full card numbers in Nevora.

Usage and technical data

• IP address;
• browser type;
• device information;
• pages viewed;
• login timestamps;
• activity logs;
• error logs;
• security events;
• API usage;
• feature usage;
• storage and usage counters.

Cookies and similar technologies

We may use cookies and similar technologies for:

• essential website and authentication functionality;
• security;
• session management;
• preferences;
• analytics;
• product improvement.

Where required by law, non-essential cookies should be used only with consent.

4. How We Use Personal Data

We use personal data to:

• provide and operate Nevora;
• create and manage accounts;
• manage organizations, members, roles, and permissions;
• store and display Customer Content;
• process documents and user-confirmed workflows;
• provide AI-assisted suggestions where enabled;
• manage trials, plans, limits, and billing;
• provide support;
• send service messages;
• improve product reliability and usability;
• protect against abuse, fraud, unauthorized access, and security incidents;
• comply with legal obligations;
• enforce our Terms of Service.

5. Legal Bases for Processing

Depending on the context and applicable law, we rely on one or more of the following legal bases:

Contract

We process data to provide the service you requested, manage your account, deliver workspace functionality, and administer your subscription or trial.

Legitimate interests

We process data for security, fraud prevention, service improvement, internal analytics, support, product development, and business communication, where those interests are not overridden by your rights.

Consent

We may rely on consent for optional marketing communications, non-essential cookies, or certain optional data processing activities.

Legal obligation

We may process data where required for tax, accounting, regulatory, dispute resolution, or legal compliance purposes.

6. AI-Assisted Processing

Nevora may use AI-assisted features to help with:

• document extraction;
• classification;
• summaries;
• recommendations;
• suggested actions;
• operational context.

AI-assisted outputs are reviewable and should be confirmed by users before relying on them.

We do not use AI to automatically post financial transactions or make final business decisions without user confirmation.

Depending on configuration, Customer Content may be processed by third-party AI providers acting as subprocessors. We should document the active AI providers in our subprocessors list.

7. Payments Through Paddle

If Paddle is used for paid plans after private beta or trial access, Paddle may act as Merchant of Record or authorised reseller for payment processing, checkout, receipts, taxes, invoicing, cancellation tools, refund processing, fraud prevention, and buyer support.

Paddle may collect and process buyer data such as name, email, location, billing details, payment information, purchase details, and tax information.

Paddle may share limited buyer and subscription data with Nevora to allow us to provide access to the purchased service, manage subscriptions, provide support, and prevent fraud.

Billing, refund, cancellation, chargeback, and subscription-status events are used for SaaS access, billing state, entitlements, limits, support, and account administration. They do not automatically create, update, or delete Money transactions inside a workspace.

Paddle's processing is also governed by Paddle's own legal terms and privacy documents.

8. Sharing Personal Data

We may share personal data with:

• hosting and infrastructure providers;
• database and storage providers;
• authentication providers;
• email and communication providers;
• analytics providers;
• AI providers, where enabled;
• payment providers such as Paddle;
• professional advisors;
• authorities, courts, or regulators where required by law;
• successors in the event of merger, acquisition, restructuring, or sale of assets.

We do not sell personal data.

9. International Transfers

Some service providers may process data outside the Republic of Moldova, the European Economic Area, or your country of residence.

Where required, we use appropriate safeguards such as contractual protections, data processing agreements, standard contractual clauses, or equivalent mechanisms.

10. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy.

Typical retention principles:

• account data is kept while the account is active;
• workspace data is kept while the organization uses the service;
• billing records may be kept as required for tax, accounting, and legal obligations;
• security logs may be kept for a limited period for fraud prevention and incident investigation;
• support messages may be kept as needed to handle requests and improve service.

When data is no longer needed, we delete, anonymize, or securely archive it unless we are legally required to keep it.

11. Security

We use technical and organizational measures designed to protect personal data, including:

• access controls;
• authentication;
• role-based permissions;
• tenant isolation;
• database security controls;
• encrypted transport where applicable;
• audit and security logs;
• operational monitoring;
• restricted access to production systems.

No system is perfectly secure. You are responsible for keeping your login credentials confidential and for managing access within your organization.

12. Your Rights

Depending on applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• request data portability;
• lodge a complaint with a competent data protection authority.

To exercise your rights, contact us at:

We may need to verify your identity before responding.

If your request concerns Customer Content controlled by an organization using Nevora, we may direct the request to that organization.

13. Data Protection Authority

For users in the Republic of Moldova, the competent authority is the National Center for Personal Data Protection of the Republic of Moldova.

You may have the right to contact the authority if you believe your personal data rights have been violated.

14. Children's Privacy

Nevora is intended for business use and is not directed to children.

We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us so we can take appropriate action.

15. Marketing Communications

We may send service-related messages necessary for account, security, product, billing, or operational purposes.

Marketing communications, where used, should be based on consent or another lawful basis. You may opt out of marketing communications at any time.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If changes are material, we will take reasonable steps to notify users, such as by updating the "Last updated" date, posting a notice, or sending a message where appropriate.

Continued use of the service after the updated Privacy Policy becomes effective means you acknowledge the updated policy.

17. Contact

For privacy questions or requests: