Privacy policy

1. Who is responsible

NUVOBITS is the controller of the personal data described here. The identified legal entity and its registered address are not yet settled and will be published in this section before live accounts launch. Until then, requests reach us through the contact page.

2. What we collect

We try to collect as little as the service allows. Today that is:

• Account data — your name, email address, country of residence, preferred language and a hash of your password. We never store your password itself.
• Verification documents — only if you choose to start verification. Identity and address documents are stored outside the public web root and are served only through an authenticated request.
• Consent records — which cookie categories you accepted or rejected, with the time, your IP address and your browser's user-agent string, so we can show that consent was given.
• Messages you send us — the name, email address, subject, message and IP address submitted through the contact form.
• Attribution data — if you arrive from an advertisement, the campaign parameters in that link.
• Server logs — standard web server records of requests, which include IP addresses.

3. Why we use it

Account data operates your account and lets us contact you about it. Verification documents exist to satisfy identity checks required of financial services. Consent records demonstrate compliance with cookie rules. Contact messages let us answer you. Attribution data tells us which campaigns bring people here. Server logs keep the service secure and let us diagnose faults. We do not sell personal data, and we do not use it to build advertising profiles.

4. Our legal basis

We rely on the performance of our contract with you for account data; on your consent for analytics cookies and for any marketing email; on our legal obligations for identity verification and for records we must keep; and on our legitimate interest in a secure, working, measurable service for server logs, abuse prevention and campaign attribution. You may object to processing based on legitimate interest.

5. How long we keep it

We keep account data while your account is open and for a period afterwards where the law requires it. Verification documents are kept for the period identity records must be retained. Consent records are kept as evidence for as long as the consent is relied on and a reasonable period after. Contact messages are kept while we deal with your enquiry and for a short period after. Attribution data expires from your browser after 30 days. Exact retention periods will be fixed with the operating entity before live accounts launch. Deleting an account does not remove its consent history or its balance record: those are kept in anonymised form, because the balance record cannot be altered once written.

6. Who else sees it

We use a small number of service providers who process data on our behalf: hosting, email delivery, and — only where you have accepted analytics cookies — an analytics provider. A complete, named list will be published in this section before live accounts launch.

At the time of writing the public website loads nothing from a third party: fonts are served from our own domain, and no analytics or tag manager is loaded unless you accept it.

7. Your rights

Under the GDPR you can ask us to:

• Access — give you a copy of the personal data we hold about you.
• Rectify — correct data that is wrong or incomplete.
• Erase — delete your account data. We do this by irreversibly anonymising it: your name, email address and any other identifying details are replaced, and the records we are required to keep — your consent history and the append-only record of every movement on your account balance — remain only in that anonymised form. There is no self-service deletion yet; send the request through the contact page.
• Port — provide the data you gave us in a machine-readable format, or send it to another provider.
• Restrict or object — pause processing, or object to processing based on our legitimate interest.
• Withdraw consent — at any time, without affecting what was done before you withdrew it.

8. How we protect it

Passwords are stored as argon2id hashes. Sessions use cookies that JavaScript cannot read and that are not sent with cross-site requests. Traffic is served over HTTPS. Verification documents are stored outside the public web root. Database access is through parameterised statements only. No system is perfect, and we will tell you and the relevant authority if a breach occurs that requires it.

9. Transfers outside the EEA

We aim to keep personal data within the European Economic Area. Where a provider processes data outside it, we will rely on an adequacy decision or on standard contractual clauses, and will name that provider in the processor list.

10. Making a request

Send data protection requests through the contact page. We will answer within one month. If you are not satisfied with our answer, you may complain to the data protection authority in your country of residence.

11. Changes to this policy

This policy changes when what we do changes. The date at the top shows the last revision. Where a change materially affects you, we will tell you rather than relying on you re-reading this page.