Privacy Policy

Nodevory ("we", "us") operates this website. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have under the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, enforced by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

1. Data we collect

• Contact form: name, agency/company name, email address, optional WhatsApp number, and your message.
• Newsletter form: email address.
• Automatically: IP address, used transiently for rate limiting and bot verification. Rate-limit identifiers are irreversibly hashed before storage and expire automatically. We do not use analytics or advertising trackers.

2. Why we collect it (purpose & legal basis)

• To respond to consultation requests and provide the services you asked about — legal basis: your consent, given via the checkbox on the form, and steps necessary prior to entering a contract.
• To send the newsletter after you confirm ownership of your email address — legal basis: consent, which you may withdraw at any time (see Section 6).
• To prevent spam and abuse of our forms (honeypot field, per-IP rate limiting) — legal basis: legitimate interest in keeping the service secure.

3. Who we share it with

We rely on a small number of third-party service providers to operate this website and respond to your requests. We do not sell personal data. These providers fall into the following categories:

• Lead & records management — a data-storage provider we use to keep track of contact form submissions so we can follow up with you.
• Email delivery — a transactional and marketing email provider we use to notify our team of new leads and to manage the newsletter mailing list.
• Website hosting & infrastructure — an infrastructure provider that serves this website and processes incoming requests.
• Security & abuse prevention — bot-verification and short-lived, server-side rate-limiting providers.

Each provider acts as a data processor under its own GDPR-compliant terms, and is contractually restricted from using your data for any purpose other than providing its service to us.

4. International transfers

Some of our service providers may process data outside your country of residence. Where that happens, transfers rely on Standard Contractual Clauses or equivalent legal safeguards recognized under GDPR.

5. Data retention

• Contact form leads: retained for as long as needed to respond to and follow up on your request, and deleted on request.
• Newsletter subscribers: retained until you unsubscribe.
• Rate-limit identifiers: hashed before storage and automatically deleted after approximately ten minutes.
• Pending newsletter confirmations: deleted after confirmation or within 48 hours.

6. Your rights

Depending on your location, you have the right to:

• Access the personal data we hold about you.
• Correct or delete that data.
• Withdraw consent or unsubscribe at any time.
• Object to or restrict processing.
• Request a portable copy of your data.
• (California residents) know what data is collected, opt out of any sale/sharing of data — we do not sell or share data — and not be discriminated against for exercising these rights.
• (Morocco, under Law 09-08) oppose processing on legitimate grounds, and lodge a complaint with the CNDP if you believe your data has been processed unlawfully.

To exercise any of these rights, email contact@nodevory.com. We respond within 30 days. Morocco-based individuals may also file a complaint directly with the CNDP.

7. Security

This site is served over HTTPS with a nonce-based Content Security Policy, HSTS, and standard security headers. Form submissions are size-limited, validated, origin-checked, bot-verified, and rate-limited using expiring hashed identifiers. Access to stored lead data is limited to Nodevory team members who need it to respond.

8. Children

This website is not directed at children, and we do not knowingly collect data from anyone under 16.

9. Changes to this policy

We may update this policy as our practices change. The "Last updated" date above reflects the latest revision.

10. Contact

Questions about this policy or your data: contact@nodevory.com.