Privacy Policy

1. Who we are

NanoCB provides the NanoCB ERP service. For customer workspace data, you (the customer) are the data controller and we act as processor. For our website and account administration we are the controller. Contact: hello@nanocb.com.

2. Data we process

• Account data: name, email address, company, role, login timestamps.
• Workspace configuration: legal entities, addresses, tax identifiers, bank details, suppliers, document templates.
• Business data you upload: purchase orders, order lines, product data, generated documents, uploaded scans (invoices, customs declarations, receipts).
• Usage and technical data: pages used, import counts, IP address, browser type, audit logs of document actions.
• Support correspondence.

3. Why we process it

• To provide the Service: routing orders through your entity chain and generating documents.
• To authenticate users and enforce role-based access (row-level security is applied per workspace and per company).
• To meter plan limits and issue invoices.
• To provide support and maintain audit trails for compliance purposes.
• To improve reliability and security of the Service.

4. Legal bases

Performance of a contract (providing the Service), legitimate interests (security, reliability, fraud prevention) and legal obligations (tax, accounting, responding to lawful requests). Where consent is required, it is obtained separately.

5. Sub-processors and storage locations

• Supabase — database and file storage, hosted on AWS in the Asia Pacific region (Seoul).
• Vercel — application hosting and content delivery.
• Hostinger — email mailboxes (e.g. hello@nanocb.com).

We will notify workspace administrators before adding a sub-processor that processes Customer Data in a new jurisdiction.

6. Retention

Customer Data is retained for the life of the workspace. After termination we keep it available for export for 30 days, then delete it from production systems; backups rotate out within 30 days thereafter, unless a longer period is required by law. Audit logs are retained for at least 180 days.

7. Security

• Encryption in transit (TLS) and at rest at the infrastructure level.
• Role-based access with PostgreSQL row-level security scoped to workspace and company.
• Per-document visibility: a company only sees documents it issued, holds or is counterparty to.
• Audit logging of document issue, sign, receive and upload actions.
• Private file storage with short-lived signed URLs for downloads.

No system is perfectly secure. Report suspected vulnerabilities to hello@nanocb.com.

8. Your rights

Depending on your jurisdiction you may request access, correction, export, restriction or deletion of personal data, and object to certain processing. Workspace administrators can export workspace data at any time. Requests: hello@nanocb.com.

9. International transfers

Data may be processed outside your country where our sub-processors operate. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

10. Cookies

We use only essential cookies for authentication and session management. We do not use advertising cookies or third-party trackers on this website.

11. Changes

We will post material changes here and notify workspace administrators by email at least 14 days before they take effect.