Privacy Policy

1. Who is responsible

Naldar is operated by Revel Design LLC, Florida, United States (“Naldar,” “we,” “us” or “our”). Revel Design LLC is responsible for the personal information described in this policy. Contact our privacy contact at support@naldar.com, with “Privacy request” in the subject.

This policy covers the Naldar website, early access registration forms and related CRM records, website accounts and subscription billing, support portal and support email. It does not replace the notices and choices inside the Naldar desktop apps or the privacy policies of services you choose to connect. Visiting these sites does not give us access to chats, files or images on your computer.

2. What we collect and why

Registering for early access

We collect your email address, registration date, consent wording/version and registration status. We use them to maintain the early access list and send the trial-access news and product updates you request. We also record whether the notification to our support inbox was sent.

Your registration is stored in our WordPress database. A copy is emailed to support@naldar.com and becomes a support conversation, so our team can manage your enquiry and reply. We also save your registration as a contact and an “Early access” deal record in our self-hosted CRM to manage the trial-access news and product updates you request. Registration does not create a paid account, take payment or guarantee trial access.

Your Naldar website account

When you create a website account, WordPress and WooCommerce store your email address, account identifier, registration date and the profile details you provide. Passwords are stored as protected hashes, not as readable passwords. We use these records to provide sign-in, password recovery and account services. Creating an account does not itself start a paid subscription or subscribe you to marketing. This website account is separate from the support portal’s email sign-in links.

We create or match a Contact in our self-hosted CRM for new website accounts, using your email, account reference, registration date and the name or profile details you provide. We keep a record of your separate email choices, their date and the wording version. The Updates list contains people who choose “Subscribe to updates”: version releases, new features, notices about outages affecting our online services, and occasional setup check-ins or requests for feedback. Messages come from updates@naldar.com. The News list is the offers channel for people who choose “Subscribe to offers”; messages come from news@naldar.com. Neither option is preselected. An account can be created with either, both or neither selected. Account and security messages are separate from these optional subscriptions.

Subscription payments through Square

If you proceed to subscription payment, we send your account email and a billing reference to Square to create your billing profile. Your card information is entered in Square’s secure payment fields and goes directly to Square. Square stores the card for the recurring charges you expressly authorise. Our checkout does not receive or store your full card number or security code.

We store the identifiers needed to link your Naldar account to its Square customer, saved payment method and subscription, along with your selected plan, recurring-billing consent version/date, payment verification, paid-access period, cancellation date and operational billing status. Square processes payment, device and fraud-prevention information under its privacy notice for customers. Necessary payment scripts and related security technology load when you choose to proceed to secure payment. They are separate from optional website analytics. Our checkout does not send your AI chats, prompts or generated creations to Square.

Customer-app license activation

To verify paid access and the permitted number of Macs, the Customer apps send a persistent hash derived from your Mac’s hardware identifier, which app is checking, a fresh verification code and either the key at activation or a saved activation token on later checks. Activation also sends the label “Mac” to naldar.com. We store the license owner and included apps, payment association, paid-access dates, activation status and these device records. The identifier is persistent and links an activation to a Mac; it is not an anonymous usage statistic. It is not your raw hardware serial number, and activation is not bound to your IP address.

License checks do not send your saved creations, including images and videos. They also do not send your AI conversations, prompts, memories or browser-session content. The server returns a signed access certificate. Rental certificates last at most seven days and are bounded by verified paid access and any eligible failed-renewal grace. You can view licenses, request the same key again and release an old Mac from My account. License emails are account-service messages, separate from optional Updates and Offers subscriptions.

Your license key, activation token and Mac identifier do not give Naldar or anyone else access to creations stored on your Mac. If you upload, share or sync your creations with another service, anyone with access to those copies may be able to view them.

The Customer apps contact naldar.com over HTTPS to confirm that the license is valid and within its device limit. Our hosting server receives the connection’s IP address, and our HTTPS access logs record the source IP and basic request information. An IP address can suggest an approximate location, such as a country or region. The app does not include a separate IP-address field or GPS coordinates. We use the persistent device identifier to enforce the device limit. License requests are separate from website analytics.

You are welcome to use a VPN. When a license check goes through it, our server sees the VPN’s outgoing IP address. Using a VPN does not change which Mac is activated. Internet and VPN providers can see the connection information needed to carry your traffic and handle it under their own privacy policies.

Support tickets, replies and email

We collect your name and email address, the subject and content of your messages, any attachments you choose to send, and the dates, status and history of the conversation. Email messages may also include delivery headers and technical routing information. We use this information to respond, investigate problems, maintain your ticket history and protect the service from abuse.

Include only what is relevant to your request. Do not send passwords, sign-in codes, payment-card details or unnecessary sensitive information. Redact other people’s private information from screenshots and attachments.

Customer sign-in

We use your email address to send a temporary sign-in link and associate you with your support conversations. The support portal uses an authenticated session to let you view and reply to your tickets. Customers do not need a separate support password.

Technical and security information

Our hosting, email and security systems process connection information such as IP addresses, timestamps, requested URLs, browser information and error or delivery logs to operate, secure and troubleshoot the sites. The website early access form uses a temporary keyed hash of the connection address to limit repeated submissions; it does not store a raw IP address in the registration record. This is separate from hosting and security logs.

3. Your choices and form submissions

Submitting a support request asks us to use the information you provide to handle that request. It does not subscribe you to marketing. We need a working email address to reply or send a customer sign-in link; attachments are optional.

The early access form has a separate, unchecked consent box for trial-access news and product updates. You can withdraw that consent at any time by emailing support@naldar.com or using an unsubscribe link where provided. Withdrawing from updates does not prevent you from requesting support.

You can subscribe or unsubscribe from Updates and News independently under My account → Email preferences. You can also use the unsubscribe link in the relevant email or contact support@naldar.com. Changing one optional subscription does not change the other. Necessary account, security and payment messages may still be sent. The updates@naldar.com and news@naldar.com senders are unattended; an automatic reply directs support requests to support@naldar.com. New accounts receive a CRM welcome email in addition to the separate password-setup email. If you choose Updates, we may send a one-time help check-in after three days when no payment has been verified, and a request for honest feedback after ten days. Review links may open Trustpilot; we do not copy your account or contact details to Trustpilot for these invitations. We record which automated emails were sent to avoid duplicates.

The notices beside our forms explain the relevant use of your information. Agreeing to a notice does not waive your legal privacy rights or authorize unrelated uses of your data.

4. Analytics and cookies

We run Umami analytics on our own hosted service at analytics.naldar.com to understand visits and whether forms work. We record page views, visit times, general browser/device information, approximate location derived from connection information, and successful registration or new-ticket events. The main website records the referring site’s origin, without its path or query string.

On the support portal, reporting uses general labels such as “Support form” and “Ticket conversation.” It does not include ticket numbers, subjects, messages, attachments, email addresses or sign-in tokens. We do not send form contents to analytics, assign account IDs to analytics visitors, or enable session recordings or heatmaps on these sites.

Umami’s analytics tracker does not set tracking cookies. It still receives the network information needed to process a request, so “cookie-free” does not mean that no information is processed. On naldar.com, analytics is on by default for visitors whose connection is identified as United States, unless a saved opt-out or browser privacy signal says otherwise. A country-only lookup uses a database on our server; we do not send your address to an outside geolocation API or save a visitor-location record for this choice. Location estimates can be wrong, including when you use a VPN. Outside the United States, or when location cannot be determined, analytics stays off until you allow it. Support portal analytics remains opt-in everywhere. You can turn analytics off or change your choice anytime using Cookie settings in either site’s footer. Account and payment pages do not use this optional analytics tracker. Our integrations respect Do Not Track and Global Privacy Control signals where your browser provides them; those signals keep analytics off even if an earlier preference allowed it.

Essential cookies are used for sign-in, session continuity and security. The support portal uses laravel_session (an HTTP-only session cookie, normally two hours of inactivity) and may use XSRF-TOKEN to protect form submissions. WordPress and WooCommerce use necessary login, session and security cookies for customer accounts and administrators; registering for early access does not create a WordPress login. Square’s secure payment fields may also use necessary payment and fraud-prevention technology when you proceed to payment. Hosting security services may use necessary security cookies. We also use a first-party preference cookie named naldar_consent to remember your choice across naldar.com and support.naldar.com for six months. It contains the preference and policy version, not your name or email. Blocking essential cookies can prevent sign-in, forms or saved cookie choices from working.

Signed-in WordPress administrators are excluded from homepage analytics. Support staff pages and staff-authenticated support visits are excluded. Ordinary customer portal visits can be counted.

5. Who can access information

Authorized Naldar administrators and support staff can access records needed for their work. Our hosting, email, backup and security providers process information to operate and protect these services. We use WordPress and WooCommerce for website registrations and customer accounts, Square for payment processing and recurring billing, self-hosted EspoCRM for managing early access registrations, FreeScout for support, self-hosted Umami for analytics, and Cloudflare for DNS and for delivery and protection of the proxied www address, support portal, CRM and analytics service. License requests go directly to naldar.com without passing through Cloudflare’s HTTP proxy.

We do not sell or rent your form or support information, or share it for targeted advertising. We may disclose information when required by law or when reasonably necessary to investigate abuse, protect people or services, or establish or defend legal claims. We limit disclosures to the information needed for the purpose.

The website, CRM records, support records and email are hosted in the United States. Authorized personnel may access them while working elsewhere, and network/security providers may process information in other countries. Information may be subject to lawful access under the laws of the countries where it is processed. Linked third-party sites have their own privacy practices.

6. How long we keep information

• Early access registrations, support conversations and attachments: we do not apply an automatic expiry. These records are retained on an ongoing basis, potentially indefinitely, unless you request deletion or applicable law requires earlier deletion. This supports continuing enquiries and conversation history. You can request removal at any time using the contact details below.
• Unsubscribing and deletion: opting out stops trial-access and product-update emails. It does not by itself erase earlier support conversations. Ask us to delete your records if you also want them removed. We may retain limited information where required by law or needed to establish or defend legal claims, and a minimal opt-out record to respect your choice; we will explain any applicable exception.
• Website accounts and subscription records: retained while the account or billing relationship is in use and on an ongoing basis unless you request deletion or applicable law requires earlier deletion. License and activation records are retained with your account. Canceling renewal does not delete your account or earlier payment records. We may need to keep limited transaction, consent or dispute records for accounting, legal obligations or claims; we will explain applicable exceptions when responding to a deletion request.
• Sign-in links, sessions and anti-abuse records: for their operational lifetime. Customer sign-in links expire after one hour; the early access form’s connection-throttling record is short-lived.
• Security logs and backups: retained separately for service protection and recovery under our hosting and backup cycles. Deletion from active systems may not immediately remove a copy from a restricted backup; those copies remain until overwritten or removed through the applicable backup cycle.
• Usage statistics: our self-hosted analytics currently has no automatic expiry. Reports can therefore remain until administratively removed. The integrations exclude the personal form and ticket contents described above.

We review retention where the law requires it; this policy does not authorize keeping information longer than legally permitted. Closing a ticket does not delete it or its history. When responding to a deletion request, we consider the website registration, CRM contact and early access records, support conversation, attachments and related mailbox copies together, rather than treating removal from one system as removal from all of them.

7. How we protect information

We use HTTPS, authenticated administration and support access, and access restrictions intended to limit records to authorized users. We maintain the services and handle privacy and security issues as they arise. No website, email service or storage system can guarantee absolute security. Avoid including sensitive information that we do not need.

8. Access, correction, deletion and complaints

Email support@naldar.com to ask what personal information we hold about you, correct it, request deletion, withdraw from updates or raise a privacy concern. These requests also cover your website account, subscription records, CRM contact and early access records. We will explain any payment records that must be retained and help you identify records held independently by Square. Use the email address associated with your registration or tickets where possible. We may need to verify that the request is yours before disclosing or changing records; please do not send identification documents unless we specifically arrange a suitable method.

Depending on the law that applies to you, you may have additional rights, including to obtain a copy of your information, restrict or object to certain uses, appeal a decision or complain to a privacy regulator. We will respond within the applicable legal timeframe and explain any lawful reason we cannot fully fulfil a request. We do not penalize you for exercising applicable privacy rights.

9. Children

These website and support services are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has supplied information, contact us so we can investigate and remove it where appropriate.

10. Changes to this policy

We will update this page and its date when our practices change. For a material new use requiring consent, we will provide notice and seek that consent before starting the new use. Future additional account, payment or cloud services will need appropriate privacy information before they collect additional data.

Privacy contact: Revel Design LLC — Naldar
support@naldar.com