Privacy Policy

1. Who We Are

NSPBfy.com is operated by NSPBfy ("we", "us", "our"). Our contact email is admin@nspbfy.com.

2. What Data We Collect

We collect only the data necessary to provide our services:

• Account data: username, email address, company code, role, hashed password
• Usage data: which tools were used and when (for audit purposes)
• Content data: tool outputs (requirements, UAT scripts, training guides) saved against your account
• Device data: device identifier used for login security (optional, user-enabled)

We do not collect payment card details directly. We do not sell your data to third parties. We do not use your data for advertising.

3. How We Use Your Data

• To provide and operate the NSPBfy toolkit
• To authenticate your login and maintain session security
• To send transactional emails (login credentials, notifications) via Resend
• To allow your Company Admin to manage your access and audit tool usage
• To improve the Knowledge Base and AI responses

4. Lawful Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and UK, our lawful basis for processing personal data is:

• Contract performance: processing necessary to provide the service you or your employer has engaged
• Legitimate interests: usage logging for security and audit purposes
• Consent: for any optional communications beyond service delivery

5. Data Storage and Security

Your data is stored in Supabase (PostgreSQL database). All passwords are hashed using SHA-256 and are never stored in plain text. Access is restricted by role-based permissions — users can only access data relevant to their role and company.

Transactional emails are sent via Resend. Both Supabase and Resend have signed Data Processing Agreements (DPAs) with us in compliance with GDPR Article 28.

6. Data Retention

• Active accounts: retained while your account is active
• Usage history: retained for 12 months, then deleted
• Deletion requests: fulfilled within 30 days of request
• Inactive accounts: accounts inactive for 24 months may be deleted after notification

7. Your Rights

Under GDPR and applicable data protection law, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data ("right to be forgotten") — available via the Change Password screen inside the toolkit, or by emailing admin@nspbfy.com
• Restriction: request we restrict processing of your data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interests

To exercise any of these rights, email admin@nspbfy.com. We will respond within 30 days.

8. Third-Party Processors

We use the following sub-processors to deliver our service:

• Supabase Inc. — database and authentication storage
• Vercel Inc. — serverless backend hosting
• Netlify Inc. — frontend hosting
• Resend Inc. — transactional email delivery
• Anthropic PBC — AI language model (Claude) for generating tool outputs. Queries are processed by Anthropic but not used to train their models under their API terms.

9. Cookies

NSPBfy.com does not use tracking or advertising cookies. We use only functional browser storage (localStorage) to maintain your login session. No third-party tracking cookies are set.

10. Children's Privacy

NSPBfy is a professional B2B tool. We do not knowingly collect data from individuals under 18 years of age.

11. Changes to This Policy

We may update this policy from time to time. We will notify active users by email when material changes are made. The effective date at the top of this page will always reflect the latest version.

12. Contact

For any privacy-related questions or requests, contact us at admin@nspbfy.com.