Privacy Policy
Last updated: September 1, 2026 • Effective immediately for all Nuvailo workspaces
1. Overview and Core Philosophy
At Nuvailo (nuvailo.com), we believe your company's financial estimates, bill of quantities (BOQ), subcontractor rates, and site attendance records belong exclusively to you. We do not sell your business data, train public AI models on your private project information, or monetize your usage through advertising.
2. Information We Collect
We collect only the information necessary to provide and secure the Nuvailo service:
- Account Credentials: Full name, verified work email address, encrypted password hashes (bcrypt), and mobile authorization tokens.
- Workspace & Operational Data: Organization details, project milestones, BOQ lines, double-entry financial transactions, site visit notes, and worker attendance logs.
- Site Photographs & EXIF Metadata: Photos captured via the Nuvailo mobile or web apps may store timestamp and geolocation (GPS coordinates) to substantiate progress audit trails.
- Technical & Security Telemetry: IP addresses, browser types, and API access logs for rate-limiting, brute-force defense, and threat monitoring.
3. How Your Data Is Stored & Protected
All data in transit is encrypted using modern TLS 1.3 cryptographic standards. Database storage operates in isolated multi-tenant schemas guarded by strict row-level and foreign-key isolation barriers. Automated daily backups are encrypted and stored with rolling retention schedules.
4. Third-Party Service Providers
We only share data with essential infrastructure providers strictly required to deliver the service:
- Transactional Email Delivery: Resend (DKIM/SPF-signed notifications, invites, and password resets).
- Server & Database Hosting: Dedicated VPS infrastructure with host-level firewall protection and Fail2ban intrusion defense.
5. Data Ownership & Export Rights
You retain full ownership of your data at all times. Organization administrators can export their projects, BOQs, attendance logs, and ledger statements in structured spreadsheet format (Excel / CSV) at any time. Upon workspace termination, all operational records can be permanently deleted upon request.
6. Contacting Our Privacy Team
For privacy inquiries, data deletion requests, or compliance documentation, contact our Data Protection Officer at: