Privacy Policy

1. Who is responsible for your data

We have two roles, and which one applies depends on who you are.

• We are the controller for our account holders (the people who sign in to our dashboard) and for visitors to our websites. We decide why and how your data is used, and this policy is our promise about it.
• We are the processor for the end users of our customers: the people who sign up or sign in to an application that one of our customers builds with Gate, Passepartout or our other services. The customer decides why that data is used; we only store and process it for them, on their instructions, under a data processing agreement (DPA). Section 5 covers this.

2. What we collect, why, and how long we keep it

This table covers data for which we are the controller. We rely on the legal bases of the GDPR (Article 6); Serbia's Law on Personal Data Protection is built on the same model. We do not sell personal data and do not show advertising. We do not take decisions about you by automated means.

We do not knowingly collect sensitive categories of personal data (health, beliefs and the like). Please do not put them in your account details.

3. Who else receives your data

These companies receive personal data from us or from your browser when you use our services. Each one is listed with what it receives, why, and where. Nothing else is shared except as described below. Customers on Pro and above get the same list, as Annex III of the DPA.

Software we run ourselves. The identity service (Ory Kratos), the webhook engine (Svix), the mail server (Stalwart), our own analytics and our monitoring all run on our servers at OVHcloud. They are software, not outside companies, and receive nothing from us.

Sign-in with Google or GitHub. If you choose to sign in to the dashboard with one of them, that company is a separate controller of your account with it. We receive your email address, name and language from it and nothing else, and we do not pass anything back. Read their privacy policies for what they do with the sign-in.

Authorities and advisers. We disclose data when a court or authority lawfully requires it, and to our accountant and legal advisers to the extent they need it, under a duty of confidentiality.

Business transfers. If we sell or transfer the business, your data may go to the new owner, who will have to respect your rights under the law.

4. Where your data is, and transfers

Our servers, and the database backups, are in France, at OVHcloud. We run the business from Serbia, for which the European Commission has not adopted an adequacy decision. Our own access to data hosted in France is therefore a transfer to a third country. For the data we process for customers, the DPA covers it with the European Commission's Standard Contractual Clauses (Decision 2021/914).

Data also leaves the EEA when it goes to Resend or Polar (both in the United States). PostHog stores its data in the EU, but it is a US company. The safeguard for each is in the table in section 3.

5. Data of our customers' end users

If you are an end user of an application built on Nautilus, the customer who built it is responsible for your data. Ask them first to see, correct or delete it; we help them do it through our API and forward requests that reach us. Per the DPA, we process this data only on the customer's instructions, do not use it for our own purposes, and delete it within 30 days after the customer's services end.

The data can include an email address, profile fields the customer chose, password hashes, one-time codes, sessions (with IP address and browser), for Passepartout the Telegram ID, username, first name and photo link, the audit log of sign-ins, and the content of webhooks and scheduled jobs the customer sends through us. To host it we use OVHcloud. To send authentication emails to end users we use Resend, which stores the content in the United States (section 3). Customers are told before we add or change a processor.

Telegram. Passepartout lets end users sign in through the customer's own Telegram bot. The bot and the choice to offer Telegram are the customer's, and the end user's relationship with Telegram is their own. We are not Telegram's customer and do not engage it as our sub-processor. We do hold the customer's bot token, encrypted, and use it to talk to Telegram's Bot API so the sign-in can complete. According to Telegram, it stores the data of users who registered from the EEA or the UK in the Netherlands. The same applies to other sign-in providers a customer switches on (Google, GitHub and so on): they act under their own terms with the end user.

Customers: the DPA. A DPA, based on the Standard Contractual Clauses, comes with the Pro plan (see pricing). Write to us to get it. Customers can export their end users, including password hashes, and delete them at any time through the API.

6. Cookies and analytics

We use a few cookies and local-storage entries and two analytics systems: our own, and PostHog (EU Cloud). PostHog sets its cookie and records sessions only if you accept the cookie banner, and masks what you type into forms. If you decline, it counts visits without cookies. It never runs in the logged-in dashboard or the admin panel. The full list, what each system receives, and the button to change your choice are in our Cookie Policy.

7. Closing your account and deleting your data

Write to us from your account's email address and ask us to close the account. We then delete it, your projects, keys, jobs, webhook history, end users and the rest listed in section 2 from our systems within 30 days, check that nothing is left, and confirm in writing if you ask. The exceptions are the records we must keep by law, our correspondence with you, and backups, which expire on their own within 35 days of being made. If a backup is ever restored, the deletion is repeated.

Polar and Resend keep their own copies for the periods given in section 3 and their own policies.

8. Security

Our sites and API use HTTPS. Passwords are stored as one-way hashes and API keys as hashes. Databases are not reachable from the internet. Backups are encrypted before they leave our server. Requests pass an attack filter at the edge. We do not hold a security certification, and no system is perfectly secure. If a breach affects your data, we will tell the people and authorities the law requires, and tell customers without undue delay.

9. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict its use, or send it to you in a portable form. You can object to processing based on our legitimate interests, and withdraw consent at any time (the footer's Cookie Settings does this for analytics) without affecting what happened before.

To use a right, email support@vernesoft.com, from your account's address if you have an account. We may ask you to prove who you are. We answer within one month. For data we handle as a processor, we pass your request to the customer who is responsible for it.

Complaints. You may complain to a data protection authority. We have no establishment in the EU, so we have no lead authority there: you may go to the authority in the country where you live or work (in the UK, the Information Commissioner). For data we process for a customer, the DPA names the authority of the EU Member State where that customer is established. You may also complain to Serbia's Commissioner for Information of Public Importance and Personal Data Protection (Poverenik, poverenik.rs). We would be glad to hear from you first.

10. Children

Our services are for people aged 18 and over. We do not knowingly collect data from children. If you think we have, write to us and we will delete it.

11. Changes to this policy

When we change this policy, we change the date at the top. If a change is material, for example a new company in the table in section 3, we email account holders, and customers with a DPA get the notice period the DPA sets.

12. Contact

Questions or requests about this policy: support@vernesoft.com, or by post:

We have not appointed a data protection officer.