Last updated: 5 August 2026
This policy explains what personal data Nodara collects, why, and what rights you have over it. It is written to describe what the software and services actually do — not to describe practices we might adopt later.
The data controller is Bcube Technology Services LLC, registered in Dubai, United Arab Emirates under company number [REGISTRATION NUMBER], at [REGISTERED ADDRESS].
For any privacy question or to exercise the rights described in section 7, contact [PRIVACY CONTACT EMAIL].
We are established outside the European Economic Area but offer services to people within it, so the EU and UK GDPR apply to that processing under Article 3(2). [EU/UK REPRESENTATIVE, IF REQUIRED UNDER ART. 27]
| Data | Why | Lawful basis |
|---|---|---|
| Email address, password (hashed), display name | To create and secure your account, and to sign you in | Performance of a contract (Art. 6(1)(b)) |
| Projects, node graphs, and settings you save | To store your work and sync it between your devices | Performance of a contract (Art. 6(1)(b)) |
| Media you upload | To store and serve the files your projects reference | Performance of a contract (Art. 6(1)(b)) |
| Registered devices: name, platform, last-seen time, playback state | To show your fleet and let you manage devices remotely | Performance of a contract (Art. 6(1)(b)) |
| Subscription tier and billing status | To grant the features you have paid for | Performance of a contract (Art. 6(1)(b)) |
| Server logs: IP address, request path, timestamp, user agent | To keep the service running, diagnose faults, and detect abuse | Legitimate interests (Art. 6(1)(f)) — operating a secure service |
We do not collect special category data, and we ask you not to store it in Nodara projects.
This website (nodara.me) sets no cookies and uses no local storage. It loads no third-party scripts, fonts, or images — the typefaces are served from our own servers precisely so that visiting this site discloses nothing about you to anyone else. No consent banner is shown because there is nothing to consent to.
The web application at app.nodara.me sets one strictly necessary
cookie to keep you signed in. It is exempt from the consent requirement under
Article 5(3) of the ePrivacy Directive because it is essential to a service you
have requested. It carries no advertising or analytics identifier.
Our emails contain the Nodara and Bcube logos. Both are attached to the message itself rather than loaded from a web server, so your mail client displays them without asking permission and without contacting us. We therefore cannot tell whether, when, or from where you opened a message. We use no tracking pixels, open-rate analytics, or click-through redirects.
We use a small number of providers, each under a data processing agreement, each acting only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Application and database hosting | European Union (Germany / Finland) |
| Cloudflare, Inc. | Media object storage (R2) and content delivery | Global edge network |
| Stripe, Inc. / Stripe Payments Europe Ltd | Subscription payments | United States / Ireland |
Payments are handled entirely by Stripe. We never see or store your card number — card details are entered on Stripe's own hosted checkout and never reach our servers. We retain only your subscription status, tier, and Stripe customer reference. Stripe processes your data as an independent controller for fraud prevention and regulatory purposes; see Stripe's privacy policy.
Where a provider processes data outside the EEA or UK, the transfer relies on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or on an adequacy decision where one applies. You may request a copy of the relevant safeguards from the contact address in section 1.
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Projects and uploaded media | Until you delete them, or 30 days after account deletion |
| Device registrations | Until deactivated, or 12 months after last contact |
| Server logs | 30 days |
| Invoices and payment records | As required by tax law, typically 7 years |
When you delete your account we erase your personal data within 30 days, except records we are legally required to keep — principally invoices. Backups are overwritten on their normal cycle.
Wherever you live, you may ask us to:
You can export and delete your data yourself from your account settings. Otherwise write to the contact address in section 1; we respond within one month, as Article 12(3) requires. We do not charge for this and we will not penalise you for asking.
If you are in the EEA or UK you may complain to your national supervisory authority. In the UK that is the Information Commissioner's Office. If you are in California, you additionally have the rights described under the CCPA/CPRA, including the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined.
Nodara is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
If we change this policy materially we will tell account holders by email before the change takes effect. The date at the top always reflects the current version.
