Privacy Policy
Last updated: [DATE]
This policy explains what personal information Narua Design ("Narua", "we", "us") collects when you use https://naruadesign.com and our design services (the "Service"), why we collect it, and the choices you have.
The data controller is [LEGAL ENTITY NAME], [BUSINESS ADDRESS]. Contact: info@naruadesign.com.
1. Information we collect
Information you give us
| When | What |
|---|---|
| Creating an account | Email address, country calling code, phone number, password (stored only as a one-way hash, never in readable form) |
| Using the contact form | Name, email address, subject, message |
| Working with us | Project requests, task details, comments, files, and your Trello username |
| Subscribing | Your chosen plan and billing period. Card details go directly to Stripe and are never stored by us. From Stripe we receive a customer ID, subscription status, and payment outcomes. |
Information collected automatically
- Technical and security data: IP address, browser and device type, sign-in times, failed sign-in attempts, server logs, and a short-lived activity log of the pages you open and the actions you take in the Service (with your email address and IP address) for debugging. We use these to keep accounts secure and the Service running.
- Website statistics (public pages only): when you open one of our public pages (home, about, pricing, contact, terms, privacy) we count the visit. We record the page, when it was opened, which website or campaign sent you (for example Google or a link tagged by us), your browser, operating system and device type, your browser's language and time zone, your screen width, whether your device prefers a light or dark display, and roughly where you are (country, state or province, and sometimes city), which we work out from your IP address on our own server using an offline database. We do not keep your IP address in these statistics, we set no cookie and we do not build a profile of you (your IP address appears only in the short-lived technical activity log described above, and the statistics requests are left out of that log unless we are investigating a fault): to count a visitor once per day we use a one-way code made from your IP address and browser together with a secret key and the date, which changes every day, so it cannot be traced back to you or followed from one day to the next. We also note when you press buttons that lead to contacting us or signing up (for example "Book a call") and when you send the contact form, create an account or start a trial, and credit it to the source of your first visit that day. We do not count visits to the sign-in pages, your dashboard or the admin area, or visits by our own team, and we respect the "Do Not Track" and Global Privacy Control settings of your browser. You can also switch counting off at the bottom of this page. Location data is provided by DB-IP.com.
- Cookies: see section 4.
We do not intentionally collect sensitive categories of data (such as health or biometric data), and we ask you not to send them.
2. How we use your information
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and securing your account, verifying your email, signing you in | Performing our contract with you |
| Delivering design work, showing task progress, and syncing with Trello | Performing our contract with you |
| Processing subscriptions, renewals, and failed-payment notices (email and SMS) | Performing our contract with you |
| Replying to contact-form messages | Our legitimate interest in responding to enquiries |
| Preventing fraud, spam, and abuse; keeping logs | Our legitimate interest in protecting the Service |
| Understanding how people find and use our public pages (anonymous website statistics) | Our legitimate interest in improving the Service and our marketing |
| Keeping financial records | Legal obligation |
| Product news or offers | Your consent. You can opt out at any time. |
We do not sell your personal information, and we do not use it for third-party advertising.
3. Account emails and text messages
We send emails that are necessary for your account, such as email verification, password resets, billing notices, and project updates. These cannot be turned off while your account is active. If a payment fails, we may also send a text message to the phone number on your account. We only send marketing messages if you have agreed to receive them, and every marketing email includes an unsubscribe link.
4. Cookies
We only use cookies that are strictly necessary for the Service to work:
| Cookie | Purpose | Duration |
|---|---|---|
| Session | Keeps you signed in | Until you close your browser, or up to 400 days if you choose "Remember me" |
| Security (CSRF) | Protects forms from cross-site attacks | Same as session |
Our contact and sign-up forms use Cloudflare Turnstile to block bots, which may process technical data about your browser for that purpose. We do not use advertising or cross-site tracking cookies. Our website statistics (section 1) work without cookies or other identifiers stored on your device.
5. Who we share information with
We share personal information only with service providers who help us run the Service and who are bound to protect it:
| Provider | Role |
|---|---|
| Hetzner Online | Hosts our servers and database ([SERVER LOCATION]) |
| Stripe | Payment processing and subscription management |
| [EMAIL PROVIDER] | Sends account and notification emails |
| [SMS PROVIDER] | Sends payment-related text messages |
| Atlassian (Trello) | Task boards for your project requests |
| Cloudflare | Website security, bot protection, and delivery |
We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of our business, in which case this policy will continue to apply.
6. International transfers
Some providers may process data outside your country. Where data leaves the UK or European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account and project data | While your account is active, then deleted within [30] days of closing it |
| Contact-form messages | [24] months |
| Security and server logs | [90] days |
| Activity log (a plain-text debugging log of requests and actions, including your email address and IP address) | 2 days (today's and yesterday's file; older files are deleted automatically) |
| Website statistics: individual page views (no IP address, no personal data) | [14] months, then only daily totals |
| Website statistics: daily totals (no personal data) | Kept |
| Billing and tax records | As long as the law requires (typically [6–10] years) |
| Unverified accounts | Deleted after [7] days |
8. How we protect your data
We use encryption in transit (HTTPS), strong password hashing, encryption of stored access tokens, limited and audited administrator access, rate limiting, and regular encrypted backups. No system is completely secure, but we work to protect your information and will notify you and the relevant authorities of a breach where the law requires it.
9. Your rights
Depending on where you live (for example under the GDPR, UK GDPR, or California law), you may have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- delete your account and data. You can do this from your account settings.
- receive your data in a portable, machine-readable format;
- object to or restrict certain processing;
- withdraw consent at any time, where processing is based on consent;
- complain to your local data protection authority.
To exercise these rights, email info@naruadesign.com. We may need to verify your identity first, and we will respond within the time the law requires. We will not treat you differently for exercising your rights.
10. Children
The Service is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a minor has given us information, contact us and we will delete it.
11. Changes to this policy
When we update this policy, we will change the "Last updated" date. For significant changes, we will email account holders before the changes take effect.
12. Contact
Questions or requests about your privacy: info@naruadesign.com
[LEGAL ENTITY NAME] [BUSINESS ADDRESS]