This policy explains which personal data Nordova processes, why, and what rights you have. In short: we process only what is needed to run your account and write your listings, we keep it in the EU wherever we can, and we do not use tracking, analytics or advertising cookies.
1. Controller
The controller within the meaning of the GDPR is:
- Operator
- Danil Galeev, trading as Made By Expert
- Address
- Peter-Behrens‑Str. 1A, 14469 Potsdam, Germany
- [email protected]
Further details are in the imprint.
2. Hosting and server logs
Nordova runs on a server of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in a data centre in Germany. netcup processes the data as our processor on our behalf under a data processing agreement (Art. 28 GDPR). Privacy policy: netcup.com/en/contact/data-privacy.
When you open our pages, the server briefly records technical access data: IP address, date and time, the requested path (without query parameters), the HTTP status and the browser’s user agent. Cookies, passwords and payment details are never logged.
We use these logs only to operate the service and to detect and fend off attacks (legitimate interest, Art. 6 (1) (f) GDPR) and delete them as soon as they are no longer needed for these purposes.
3. Your account
To use Nordova you need an account. We process:
- your email address and, optionally, your name;
- your password, stored only as a salted Argon2id hash — we never see it in plain text;
- your interface language, your plan and your monthly usage;
- if you sign in with Google: your Google account ID, email address and name;
- the canonical form of your email address (without a +tag and, for Gmail, without dots), so that the same address cannot be used for several accounts (legitimate interest, Art. 6 (1) (f) GDPR);
- before you buy a paid plan: the time, version and language of your express request that we start performing before the withdrawal period ends, and the chosen plan. We also pass the time and version to Stripe as part of the checkout.
Unless stated otherwise, the legal basis is the performance of the contract with you (Art. 6 (1) (b) GDPR). We keep this data for as long as your account exists. You can delete your account at any time in the account settings; your data is then erased unless we are legally required to keep it (see section 7).
Abuse prevention at sign-up: so that free credits are not misused through many accounts, we count sign-ups per network and day. We do not store your IP address for this, only a counter for your network address (IPv4 address or IPv6 /64 prefix) in the form of a hash, salted with a secret key and the day. We delete these counters after 7 days. Legal basis is our legitimate interest in preventing misuse of the free credits (Art. 6 (1) (f) GDPR).
4. Product data and generation history
When you create a listing, we process the product data you enter (for example name, features, material and care), the URL of any listing you ask us to improve together with the text we extract from that public page, and the generated results.
Your runs are stored in your history so you can copy them again later. You can delete individual runs or your whole account at any time. Legal basis is Art. 6 (1) (b) GDPR.
Product data rarely contains personal data. Please do not enter personal data of third parties into the product form.
5. Contact and cancellation forms
When you write to us through the contact form, we process your name, email address, the optional subject and your message; if you are signed in, also your account ID and language.
The purpose is to handle your request. The legal basis is Art. 6 (1) (b) GDPR where the request concerns a contract with you or steps before one, and otherwise our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).
The message is delivered to us as an email via Resend, Inc. (USA); the transfer relies on the EU standard contractual clauses in our data processing agreement (DPA) with Resend. Nothing of it is stored in the Nordova database. We keep the email as long as needed to handle your request.
When you cancel through Cancel contract here, we process your name, the email address you enter, the optional plan, the type of termination and any reason given. If the address belongs to an account with a running subscription, we end it via Stripe at the end of the billing period. We send the confirmation of receipt via Resend to the address entered and a copy to ourselves. The legal basis is Art. 6 (1) (c) GDPR in conjunction with § 312k BGB and Art. 6 (1) (b) GDPR. We keep the emails as evidence for as long as claims under the contract can be raised.
6. Service providers
We use the following providers. Each receives only the data it needs for its task:
- Nous Research, Inc. (Delaware, USA) — runs our standard model “GPT-6.1 Sol” through its inference API (Nous Portal). To generate your listings, Nous Research receives the product data you enter and our instructions; your name and email address are not sent. Privacy policy: portal.nousresearch.com/privacy.
- OpenRouter, Inc. (USA) — fallback when the standard model is unavailable: routes your product data and our instructions to a substitute AI model, which may be operated by a provider outside the EU. Your name and email address are not sent. Privacy policy: openrouter.ai/privacy.
- Stripe Payments Europe, Ltd. (Ireland) — payment processing and subscription management. Checkout and the billing portal run on Stripe’s pages; we never receive your full card details. We store only your Stripe customer and subscription IDs, the plan, its status and the end of the current period. Privacy policy: stripe.com/privacy.
- Resend, Inc. (USA) — sending transactional emails such as address verification and password reset, and at most weekly notices when new EU rules affect your stored listings (can be turned off in the account settings). Resend receives your email address and the content of the email and processes them in the USA; the transfer relies on the EU standard contractual clauses in our data processing agreement (DPA) with Resend. Privacy policy: resend.com/legal/privacy-policy.
- Google Ireland Limited (Ireland) — only if you choose “Sign in with Google”. Privacy policy: policies.google.com/privacy.
Where data is transferred to a country outside the EU/EEA, the transfer is based on an adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified) or on the EU standard contractual clauses (Art. 46 (2) (c) GDPR).
7. Retention
We delete personal data as soon as it is no longer needed for the purposes above. Account data and history are erased when you delete your account. Invoices and records relevant for tax purposes are kept for the statutory periods (up to ten years under § 147 AO and § 257 HGB; Art. 6 (1) (c) GDPR).
9. Your rights
You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, write to the email address in section 1.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: the Brandenburg Commissioner for Data Protection and Access to Information (Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg).
10. Security and automated decisions
All connections are encrypted with TLS. Passwords are stored only as hashes, and access to production systems is restricted to the people who operate the service.
We do not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR). The AI writes texts; you decide what to publish.
11. Changes to this policy
We update this policy when the service or the law changes. The current version is always available on this page.