Privacy Policy
Last updated 15 September 2026.
What this covers
This policy explains what Nalaras collects, why, where it is stored, and who else touches it. It applies to the application at nalaras.com and to the client portal.
Two kinds of data are involved, and it is worth keeping them apart. Account data is about you — your name, email and settings. Workspace content is the work itself — tasks, comments, files and whatever your connected tools send in. Most of this policy is about the second kind, because that is where your clients' information lives.
What we collect
- Account data — name, email address, avatar, timezone and notification preferences.
- Workspace content — projects, tasks, comments, checklists, attachments, decisions and activity, including anything ingested from a tool you connected.
- Integration credentials — the OAuth tokens a connected provider issues to us, stored encrypted.
- Operational records — authentication events, an audit trail of what the system and the AI did, webhook delivery ids used to avoid processing the same event twice, and error diagnostics.
- Billing data — your plan, subscription status and invoices. Card details go to Stripe and never reach our servers.
We do not run advertising trackers, and the public marketing pages you are reading now load no third-party scripts at all.
How it is protected
Encrypted at rest. Task titles, descriptions and comments are encrypted with AES-256-GCM before they are written to the database, as are the access tokens for your connected tools. Encryption and decryption happen inside the application, so a copy of the database on its own does not reveal your clients' work.
Access control in two layers. The application authorises every request against your project membership, and Postgres row-level security sits underneath it as a deny-by-default second line. Workspace isolation is covered by automated tests rather than assumed.
In transit. Everything is served over HTTPS with HSTS, and the application enforces a Content-Security-Policy that blocks cross-origin data exfiltration, clickjacking and form injection.
No system is perfect. If we ever discover a breach affecting your data, we will tell you.
Who else processes it
We use a small number of sub-processors to run the service. Each one only receives what it needs to do its job.
| Sub-processor | What it does | Notes |
|---|---|---|
| Supabase | Database, authentication and file storage | Postgres in ap-south-1 (Mumbai) |
| Vercel | Application hosting and delivery | Region-pinned near the database |
| OpenAI | AI features you invoke (summaries, Ask, classification) | Not used to train models |
| Anthropic | AI extraction of tasks from ingested content | Not used to train models |
| Resend | Transactional and notification email | Recipient address and message body |
| Stripe | Payments and subscriptions | We never see your card details |
| Sentry | Error monitoring | Diagnostics and error context |
Separately, the tools you choose to connect — GitHub, Slack, Trello, Notion, Asana — receive data because you asked Nalaras to send it there. That exchange is governed by your agreement with them.
On AI. AI features run only when you invoke them or when content is ingested for classification. Content sent to a model is used to answer that request and is not used to train it. If you would rather no content left your workspace at all, tell us — AI features can be disabled for a workspace.
Where it lives and how long we keep it
Workspace content is stored in Supabase Postgres in the ap-south-1 (Mumbai) region, with the application hosted near it. Email, payment and monitoring sub-processors may process data elsewhere.
Most data is kept for the life of your workspace and removed when you delete it — we do not expire your tasks behind your back. A daily sweep does clear operational records that have no reason to persist:
- Webhook delivery ids — 90 days. Just an id and a timestamp, used to avoid processing a provider's retry twice.
- Rate-limit counters — 1 day. Sixty-second counters; anything older is dead weight.
Encrypted infrastructure backups age out on their own retention schedule, so deleted content can persist in a backup for a short window after removal.
Your rights
You can see and correct your account data in the application at any time. You can delete your account and its data yourself, from Settings — it is a self-serve erasure, not a support ticket.
Depending on where you live you may also have the right to a copy of your data, to object to or restrict processing, or to complain to a data protection authority. To exercise any of these, or to request a data-processing agreement, write to security@nalaras.com.
If you are using Nalaras as part of someone else's workspace, that workspace's owner controls the content in it — we will point you to them for content requests.
Cookies
Nalaras sets the cookies needed to keep you signed in and to protect requests against cross-site forgery. There are no advertising or analytics cookies, and nothing is shared with an ad network.
Changes and contact
We will update this policy as the product changes, and will tell you about material changes by email or in the application.
Privacy or security questions: security@nalaras.com. Anything else: hello@nalaras.com.