Privacy Policy

Who is responsible

Smart Preservation Platform (SPP) is operated by Nursultan Kadirov. Questions about this policy, and any request described in it, go to support@sppbynur.com.

Where a customer is an organisation, that organisation decides what records its staff enter into SPP and why. For those records the organisation is the controller and SPP acts on its instructions. For the account and billing information described below, SPP is the controller.

What is collected

• Account details — the name, email address and role of each person given access, and the company and project they belong to. These are supplied by the customer when their workspace is set up or a colleague is invited.
• A password, stored only as a scrypt hash with a per-account salt. The password itself is never stored and cannot be read back, including by the operator.
• Sign-in activity — the identifier of the current session, so that one login belongs to one person at a time, and the time of the last request, so an idle session can be closed.
• Preservation records — the tags, job plans, schedules, job cards and comments a customer enters. These may contain the names of the people who carried out or signed off an activity.
• Billing details — the name and email on the order, and the invoice history. Card numbers are never seen by SPP: a payment is taken by the payment provider named on the checkout page, and only the outcome is returned.

There is no advertising on this site, no analytics or tracking service, and no third-party script that profiles visitors. Nothing collected is sold, rented or shared for marketing, by SPP or by anyone else.

Why it is used

Account and sign-in information is used to let the right people into the right workspace and keep everyone else out — that is the whole of its purpose. Preservation records are processed to provide the service the customer is paying for: to schedule activities, issue and close job cards, and produce the reports and documents the customer asks for. Billing details are used to take payment, issue an invoice and meet the accounting obligations that follow from it. Support correspondence is used to answer the question that was asked.

The legal basis is the performance of the contract with the customer, the operator's legitimate interest in keeping the platform secure, and, for invoices and tax records, a legal obligation.

Documents stay in the customer’s own storage

A customer nominates their own document store — Google Drive, Microsoft OneDrive or SharePoint, Dropbox, Box, or their own S3-compatible storage — and the files SPP produces are written there, into the customer's own account. They are not copied onto the operator's servers, and the operator cannot browse them.

Connecting a store is done by signing in to it. SPP receives an access token for that account and stores it so the connection survives a restart; it does not receive, and never asks for, the password to that account. The token can be revoked at any time, from within SPP or from the provider's own security settings, and the connection stops working immediately.

Where that store is Google Drive, SPP requests the drive.file scope and nothing else. That scope reaches only the files SPP itself creates. The rest of the Drive — every file that was there before, and every file created by anything else — stays invisible to it. Information received from Google APIs is used only to provide the storage feature the user asked for, is never transferred to anyone except as described in this policy, is never used for advertising, and is never read by a human except with the user's explicit permission or where the law requires it. This use complies with the Google API Services User Data Policy, including its Limited Use requirements.

Cookies

SPP sets no advertising or analytics cookies. The cookies it does set exist to keep a person signed in and to carry them safely through a sign-in: the session cookie, a short-lived cookie during two-factor confirmation, and short-lived cookies holding the one-time state of a sign-in or a storage connection. They are http-only, secure and same-site, and the session cookie expires after ten minutes of inactivity. The Cookie Policy lists them one by one.

Who else sees it

Only the processors needed to run the platform, each under contract and each handling only what their part requires: the hosting provider that serves the application, the managed database that holds the records, the mail provider that delivers invitations and notices, and the payment provider that takes payment. The customer's own nominated document store holds their documents, under their own agreement with that provider.

One customer's records are never visible to another, and a customer's records are not visible to the operator through the ordinary interface. Where the operator needs to look at a workspace to resolve a fault, it is done with that customer's consent. Information is disclosed to anyone else only where a law or a lawful order requires it.

Where it is kept, and for how long

The application and its database are hosted with providers operating in the European Union. Account and preservation records are kept for as long as the customer's subscription is in force. When it ends they are kept for thirty days, so that an accidental cancellation can be undone and an export can still be taken, and are then deleted. Invoices and the records that support them are kept for as long as accounting and tax law requires, which is longer. Support correspondence is kept for two years.

Security

Traffic is encrypted in transit. Passwords are stored only as salted scrypt hashes. Workspaces are separated at the database level, so a query made for one customer cannot return another's rows. A sign-in claims the account, so a session left open on a borrowed machine stops working as soon as the owner signs in again, and any session closes after ten minutes of inactivity. Access to production systems is limited to the operator.

No system is beyond failure. Where a breach affects personal information, the affected customers and, where the law requires it, the supervisory authority will be told without undue delay.

Your rights

You may ask for a copy of the personal information held about you, ask for it to be corrected, ask for it to be deleted, ask that its processing be restricted, or object to it. You may withdraw a consent you have given — including a storage connection — at any time, without affecting what was done before. Write to support@sppbynur.com; a reply follows within thirty days.

Where the information was entered by an employer, the request is passed to that organisation, because the records are theirs to decide about. You may also complain to the data protection authority where you live.

Children

SPP is a tool for industrial work. It is not offered to children, and accounts are not knowingly created for anyone under sixteen.

Changes

Where this policy changes, the date at the top changes with it, and a change that materially affects customers is notified by email before it takes effect.