Privacy notice

This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and the Italian Legislative Decree 196/2003 (Personal Data Protection Code), as amended by Legislative Decree 101/2018. We process only the data needed to run the services described here, lawfully, fairly and transparently.

1. Data controller

Alessandro Blason (NuviraHub project), Italy.
Contact for any question about personal data: privacy@nuvirahub.dev.

No Data Protection Officer (DPO) has been appointed, as one is not required for the processing described here: write to the address above for anything.

2. What this notice covers

• the website nuvirahub.dev;
• the public server connect.nuvirahub.dev, used by the NuviraHub app when no other server is set;
• the licence check of NuviraHub Pro, licenses.nuvirahub.dev;
• the Founders Programme and the customer area (nuvirahub.dev/shop/);
• the e-mails you send us.

It does not cover NuviraHub servers installed by others: whoever runs their own server is the controller of the data passing through it, and we have no access to it. The data the app saves on your computer (settings, local address book, saved passwords) stays on your computer and is not sent to us.

3. What data, why and for how long

3.1 Website

The website uses no cookies, analytics, advertising, or third-party fonts or scripts. The web server keeps no record of visits: your IP address is used only for the time needed to deliver the pages.

3.2 Public server

When the app uses the public server, we process:

• for each device: the NuviraHub ID, the public key generated by the app, the computer name, the operating system, and the date of the first and last connection;
• while connected: the IP address, to deliver connection requests, help the two devices connect directly and, when that is not possible, relay their traffic;
• technical logs of the server (connection events with ID, computer name and IP address, amount of traffic relayed each hour), overwritten automatically when they reach a maximum size;
• limits against abuse: to slow down anyone sending too many requests, IP addresses are counted in memory for a few minutes and are not saved;
• blocks: IDs and addresses reported for scams or other abuse may be blocked; the block, with a short note, is kept as long as needed.

We never see the content of sessions (screen, keyboard, mouse, clipboard, chat, files): it is end-to-end encrypted between the two devices, also when it goes through our relay.

Purposes and legal bases: providing the service you ask for (Art. 6(1)(b) GDPR) and protecting it and its users from abuse and scams (legitimate interest, Art. 6(1)(f)). Retention: device data for as long as you use the device with the public server; you can ask for it to be deleted at any time. If you set your own server, none of this data reaches us.

3.3 NuviraHub Pro licence check

A NuviraHub Pro server checks its licence with licenses.nuvirahub.dev at start-up and then once a day, sending: licence key, fingerprint of the server's certificate, server name, operating system; the service also records the IP address the check comes from. Legal basis: performance of the licence contract (Art. 6(1)(b)). Retention: as long as the licence exists.

3.4 Founders Programme and customer area

• Data you give us: e-mail address and name (required); company, country and number of computers (optional); the chosen language; the version and date of acceptance of the terms.
• Data we generate: date of joining, the Pro licence assigned (the key is stored encrypted). In the licence system the licence is recorded as “Founder #number”, with no name or e-mail.
• Purposes: confirming that you join (double confirmation by e-mail), delivering your licence, letting you into the customer area with a link sent by e-mail (no password), and telling you about the Programme and your licence. We send no advertising or newsletters.
• Legal basis: performance of the relationship you ask for by joining (Art. 6(1)(b)). Without e-mail and name we cannot record that you joined.
• Security: to curb abuse of the forms, IP addresses are counted in memory for at most one hour and are not saved.
• Retention: unconfirmed requests are deleted after 24 hours; sign-in links expire after 30 minutes; a Founder's data is kept while they take part in the Programme or until they ask for it to be deleted at privacy@nuvirahub.dev.

When paid purchases become available, this notice will be updated with the billing data and the related legal obligations.

3.5 E-mails you send us

If you write to an @nuvirahub.dev address (support, privacy, abuse reports, security), we process your e-mail address, the content of the message and anything you send us, in order to reply and handle your request (Art. 6(1)(b) or (f)). We keep them for as long as needed to handle it and any consequences.

4. How we protect the data

All communication with our services is encrypted (TLS); remote sessions are end-to-end encrypted; licence keys are stored encrypted; access to the servers is restricted to the controller. A backup of the data is made every day and kept for 14 days.

5. Who receives the data

We do not sell the data and do not use it for advertising or profiling. Only these providers process it on our behalf, as processors (Art. 28 GDPR):

• OVH SAS (OVHcloud, France): the server hosting the website, the public server, the licence check and the Founders Programme;
• Sendinblue SAS (Brevo, France): sending the e-mails of the Founders Programme (address and content of the message);
• Namecheap, Inc. (United States): domain and forwarding of e-mails sent to @nuvirahub.dev addresses;
• Google Ireland Limited (Ireland): the controller's mailbox that receives the forwarded e-mails.

The licence system (Keygen) is installed on our own servers: no third party receives that data. Data may be disclosed to authorities only where the law requires it.

6. Transfers outside the European Union

The servers are currently in the OVHcloud data centre in Beauharnois, Canada, a country for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); they are planned to move to the European Union. Forwarding e-mails through Namecheap and the Google mailbox may involve a transfer to the United States, based on the safeguards offered by these providers (the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework, Art. 45 and 46 GDPR).

7. Cookies

The website uses no cookies. The Founders Programme's customer area uses a single technical cookie, nuvira_shop, needed to keep you signed in after you open the sign-in link: valid only for /shop/, not readable by scripts, sent only over encrypted connections, it lasts 30 days and is deleted when you sign out. As it is strictly necessary, it does not require consent (Art. 122 of the Italian Privacy Code, implementing the ePrivacy Directive).

8. Children

The services are meant for adults and professionals. We do not knowingly collect data of children under 14; if we notice we have received some, or a parent asks us, we delete it.

9. Automated decisions

We make no decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). The automatic limits against abuse slow down, for a few minutes, an address that sends too many requests, and have no other effect.

10. Your rights

Under Articles 15–22 GDPR you can at any time ask for access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Write to privacy@nuvirahub.dev giving the device ID or the e-mail used for the Founders Programme; we reply within one month (Art. 12 GDPR). We may ask you to confirm that the data is yours, so as not to hand it to someone else.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the country where you live or work.

11. Changes

We publish every change to this notice on this page, with the date of the last update. If a change significantly affects the Founders, we also tell them by e-mail.