Privacy Policy

1. Data Controller

Purley ("the Service") is operated by Nevado Ltd, a company registered in England and Wales under company number 05805708, whose registered office is at Nevado @ HomeWork, 265-269 Wimbledon Park Road, Southfields, London SW19 6NW ("Nevado","we","us","our").

We are the data controller for the personal data processed through the Service, as defined by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact us at purley@nevado.co.uk.

2. Information We Collect

We collect the following types of personal data:

• Account information: your email address and password when you register.
• Project data: CMS repository details, route configurations, and build log data you provide or we retrieve through integrations.
• Usage data: pages visited, features used, and general interaction patterns. Where you accept analytics cookies, this is collected by Google Analytics along with device, browser and approximate location (derived from your IP address).
• Organisation data: organisation names, member email addresses, and role assignments.
• Payment data: billing information processed by our third-party payment provider. We do not store full card details.

3. Lawful Basis for Processing

Under Article 6 of the UK GDPR, we process your personal data on the following lawful bases:

• Contract: processing your account information, project data, and organisation data is necessary to provide the Service to you.
• Legitimate interest: processing usage data to improve and secure the Service, and to send important service notices.
• Legal obligation: retaining certain data where required by UK law (e.g. financial records).
• Consent: analytics cookies and the usage data Google Analytics collects through them, and any optional marketing. You may withdraw consent at any time, for analytics using Cookie settings in the site footer.

4. How We Use Your Information

• To provide and maintain the Service.
• To authenticate your identity and manage your account.
• To process payments and manage subscriptions.
• To send important notices about the Service (e.g. security alerts, billing updates).
• To improve and develop new features.
• To detect and prevent fraud or abuse.

5. Data Storage & Security

Your data is stored securely using Supabase infrastructure. We use industry-standard security measures including encryption in transit and at rest, row-level security policies, and secure authentication protocols. However, no method of transmission over the internet is 100% secure.

6. International Data Transfers

Some of our service providers (including Supabase, Stripe and Google) may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or the transfer is to a country recognised as providing adequate data protection.

7. Third-Party Services

The Service integrates with third-party platforms including Prismic and Vercel. When you connect these services, we access data through their APIs in accordance with the permissions you grant.

We also use Stripe to take payments, Google Analytics (loaded through Google Tag Manager) to understand how the site is used if you consent, and Cookiebot by Usercentrics to record your cookie choices. We do not sell or share your personal data with third parties for marketing purposes.

8. Cookies

We use a small number of first-party cookies to keep you signed in and to remember interface choices such as your theme. These do not require consent under the Privacy and Electronic Communications Regulations (PECR). We also use Google Analytics cookies, but only if you accept them in our consent banner. We do not use advertising cookies. See our Cookie Policy for the full list.

9. Your Rights

Under the UK GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at purley@nevado.co.uk. We will respond within one month of receiving your request, as required by UK GDPR.

10. Data Retention

We retain your personal data for as long as your account is active and as necessary to provide the Service. When you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain certain records (e.g. financial transaction records for up to 6 years under HMRC requirements).

11. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on you.

12. Children's Privacy

The Service is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the"Last updated" date. Where required, we will seek your consent to material changes.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us at purley@nevado.co.uk and we will do our best to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

15. Contact

If you have questions about this Privacy Policy or your data, please contact us at purley@nevado.co.uk.