Privacy Policy

Privacy Policy

We value your privacy and handle data responsibly:

When you create an account: name, email address, and a securely hashed password — or, if you sign in with Google or GitHub, the basic profile data those providers share with us (name, email address, profile picture). When you submit an inquiry: name, email, optional company and phone number, and your message. If you connect Google or GitHub to an existing account, or turn on two-step verification, we store that connection and a short-lived verification code — hashed, never stored as plain text, and expiring within minutes. If you pick an avatar style or earn a badge, we store that choice and which badges you've earned. We do not currently use any payment processors.

To provide the client portal, respond to inquiries, and manage your account.

Access, deletion, and correction of your data at any time — see our Data Deletion page.

Data Sharing

No sharing with third parties for advertising purposes, and your data is never sold. We do share limited data with the operational service providers the site runs on: submitted names, email addresses, and messages (from inquiries, feedback, appointments, and quiz results) are forwarded to Slack, our internal team notification tool, so we can respond promptly. Cloudflare Turnstile receives your IP address and a verification token when you submit a public form, to confirm you're not a bot. Neither is used for advertising. Google, GitHub, and Cloudflare are US-based providers, so data we share with them (this section, and Google/GitHub sign-in and Google Calendar described elsewhere on this page) may be processed outside the EU/EEA. See Google's, GitHub's, and Cloudflare's own privacy policies for how each handles international transfers.

Appointments & Calendar

If our team has connected Google Calendar, booking an appointment adds your name and email as an attendee on a calendar event — necessary to hold the meeting. We store that Google Calendar connection as OAuth access tokens, used only to check availability and manage the events you book; we never read the content of unrelated calendar entries.

Newsletter

Subscribing to our newsletter is a separate opt-in from creating an account. We store your email address and preferred language, and send a confirmation email before adding you to the list (double opt-in) — nothing is sent to an address that hasn't confirmed. Every newsletter email includes a one-click unsubscribe link that takes effect immediately, whether or not you also have an account.

Necessary Cookies

Always active — required for the site to work. These maintain your login session. If you use our Pantheon, Arena, or Color Wheel subsites, the same session cookie keeps you signed in across all of them — it's scoped to nabilvs.com and its subdomains only, and never shared with any other site.

Analytics

Only if you click "Accept all" on the cookie banner, we use Amplitude (data processed in the EU) to understand how the site is used — page views, clicks, and session replay (a recording of on-screen interactions; text typed into form fields is masked by default). This processing relies on your consent (Art. 6(1)(a) GDPR) — choosing "Necessary only," or not deciding yet, means none of it runs. See Amplitude's own privacy policy for their data retention and processing details. For any privacy question or request, contact privacy@nabilvs.com.