Version form-privacy-v1 ·
Privacy notice
Operator and scope
Correspondence address: NAADRA LLC — 5830 E 2nd St, Ste 7000, Casper, WY 82609, United States. Registered/correspondence address; not operating premises.
NAADRA LLC, Wyoming, United States, operates Form. Contact support@naadra.co about privacy, access, correction, export or erasure. The initial narrow build-and-review offer covers one business account and one Shopify website. The initial service is intended for invited adult representatives of US businesses. Subscriptions are closed. The existing public demo uses fictional catalog data and no live AI.
Current public marketing website
This website serves static public pages and locally hosted assets. It has no registration, login, payment form, website scanner, AI calls, advertising pixels or analytics scripts. Hosting and DNS providers handle network and security metadata. If you email support@naadra.co, we process your message and contact information to respond.
The Founder Beta account, content, billing, AI and backup descriptions below concern a future service that is not activated here. They do not mean those providers receive merchant data from this website. The provider table identifies the active marketing/contact services only. Future service processing requires separate activation and updated disclosures.
Website-assistant scope — not activated
An owner-authorized initial public HTML review would store page URLs, source snapshots and hashes, fetch timestamps, findings, business-profile confirmations and reviewed artifacts. Public pages may still contain personal data; supply only an authorized origin and avoid unnecessary third-party information. The fetcher observes robots and access restrictions, excludes private network destinations and does not log in or execute page scripts. No merchant account connection is available on this marketing website. No GA4/Search Console account, social/email delivery, voice/video service or website publishing is included. New purposes require a revised processing map and separate approval.
What information is used, and why?
Account/contact details, password hashes, invitations and session/security information support protected access. Brand briefs, product facts, reference images, instructions and reviewed designs support storefront generation, responsive previews, saved history, Undo and export. Bounded usage, reservation and billing records support allowances, access, accounting, security and recovery. Support correspondence is used to answer requests. Information comes from you and your use of Form; no customer/order database is imported for this initial service scope.
Optional descriptions and reference images may be omitted; missing required account or product information may prevent the requested service. Do not upload customer/order datasets, credentials, sensitive personal information, identity documents, people images or unnecessary third-party information. Payment card details are entered with Paddle, not collected by a Form workspace.
Roles and service providers
NAADRA determines purposes for account administration, security, support and usage/billing records. For identifiable merchant content handled on instructions, the merchant may be controller and NAADRA processor. Actual agreements must reflect those roles; the provider brands below do not establish which contract has been accepted.
| Service | Purpose and processing |
|---|---|
| Cloudflare Pages | Static file hosting, global content delivery and connection/security metadata. No Functions or Workers code. Static public pages/assets and connection/security metadata through Cloudflare’s global delivery infrastructure. No Functions, Workers code, application runtime or merchant database. |
| Namecheap DNS | Domain registration and authoritative DNS resolution. Existing registrar and authoritative DNS service for naadra.co. No nameserver or unrelated record change. |
| Namecheap Private Email | Voluntary support and privacy correspondence. Existing naadra.co mailbox and support@naadra.co contact route; voluntary correspondence is reviewed by the founder. No public web form. |
Paddle is the intended authorised reseller and Merchant of Record for a future paid service, with role-specific responsibilities under its own terms. Form is the software supplier. No Live checkout is available. Paddle privacy notice · Buyer Terms.
International access and AI processing
This static website and contact route can involve international processing. Cloudflare Pages provides static hosting and global content delivery; Namecheap provides domain/DNS and Private Email services. Connection/security metadata and correspondence may be processed by these providers. Their independent records follow their applicable policies and legal duties; Form’s support-retention targets do not set provider-wide retention. This website does not send merchant data to AI, payment or analytics integrations.
OpenAI API data is not used for model training by default unless opted in. Form's text adapters do not request response storage; that setting is not Zero Data Retention. Ordinary provider abuse monitoring can retain content up to thirty days with stated legal/safety exceptions; caching and other provider records are separate. Account controls, agreements and actual features must be checked before production AI activation. Only information needed for the requested proposal should be sent.
Each purpose requires the applicable contract, legal-obligation, legitimate-interest or consent basis. No blanket consent is inferred from reading this notice. Where consent or a transfer procedure is required, it must address the actual processing and recipients; a published provider agreement alone does not complete it.
Retention and erasure
The retention periods below describe the Founder Beta service. They do not override mandatory legal requirements or independently controlled provider records.
| Record or action | Clock start | Period |
|---|---|---|
| Export-only grace after expiry | Recorded paid-period expiry after ordinary cancellation. | 168 hours exactly; the cutoff is shown in UTC. |
| Raw diagnostic logs | Original event timestamp. | Up to seven days. |
| Temporary plaintext backup work | First creation of that plaintext material. | Maximum twenty-four hours. |
| Encrypted Form backups, including provider snapshots | Original creation of the backup or provider snapshot. | Maximum thirty days. |
| Minimized audit and security records | Recorded creation timestamp in UTC. | Up to one year, where lawful and necessary, subject to legal obligations and documented lawful exceptions. |
| Support messages | Recorded closure of the support case. | Up to seven days after closure, unless a documented exception applies. |
| Verified eligible active-data erasure | Receipt of a valid, verified request. | Seven-calendar-day target for eligible active data, subject to applicable requirements and exceptions. Verification cannot extend an applicable legal deadline. |
Each retention category requires an accountable owner and an authorized procedure covering timestamp-based inventory, scope, holds, preservation checks and a minimized completion record. Rights requests can be made through support@naadra.co.
Copying, moving, re-encrypting or restoring an existing record does not restart its retention age. Preserve original timestamps and backup/snapshot provenance. Missing age evidence requires review; it does not create a new retention period or count as successful compliance. An authorized rights-response route must be ready before merchant admission.
Necessary financial, tax, legal-hold and provider-controlled security records can have different applicable requirements. Each exception needs a specific lawful basis and necessity, exact affected records and scope, responsible owner, review date and release or end conditions. Labels such as fraud prevention or security investigation do not justify indefinite retention of every workspace. Stricter applicable requirements prevail. The above periods do not promise deletion of independently controlled provider records.
For eligible verified erasure, access/jobs stop, exceptions are assessed and eligible active content is removed, with a seven-calendar-day operational target. This is not a promise that every copy disappears within seven days. Restricted, encrypted Form backup copies can remain until their maximum thirty-day retention expires; they are not used for ordinary service. Any stricter applicable deletion deadline overrides that proposed backup window. Minimized liabilities and a protected suppression record prevent an old backup from reintroducing erased content. Recoverable copies remain quarantined until suppression is replayed and release is authorized. The target never extends a stricter legal deadline. Automated real-data deletion, pruning and restore release are not enabled.
Cleanup and deletion require separately approved procedures, verified authority and recorded evidence. Policy adoption does not itself authorize a destructive operation.
We must separately verify each provider's deletion and retention terms and handle applicable rights requests with them. Form's thirty-day backup limit does not control a separate controller's statutory payment/tax records or authorize indefinite retention. Any legal or operational hold must be necessary, documented, limited to the relevant records and reviewed; an unapproved exception is not a successful erasure.
Rights, contact and security
Email support@naadra.co without sending passwords, card details or identity scans in an initial message. Any required identity verification must use the applicable protected procedure. Rights can include access, correction, opposition, erasure, withdrawal and complaint, depending on applicable law. A refusal or exception should explain the reason and review route; NAADRA assists a merchant controller where appropriate. Applicable authority contacts and references are included in the processing disclosure. Additional US state requirements depend on the actual states, roles and NAADRA-wide activity.
Routine support acknowledgement is targeted within two business days. Staffed coverage is Monday–Friday, 10:00–18:00 Africa/Casablanca. A thirty-minute critical response target applies only during explicitly staffed coverage; there is no 24/7 support or uptime guarantee. These targets do not defer rights or incident deadlines. Access controls, encrypted transport, bounded usage and encrypted backups reduce risk; perfect security or 24/7 service is not promised.
Browser storage and changes
This marketing website has no analytics, forms, account or payment scripts, advertising cookies or uploads. Website hosting handles connection metadata. The private app uses essential session/security mechanisms and local storage for the selected project ID. Clicking an external demo, email or Paddle link opens that separate service. No sale of personal information or advertising tracking is proposed.
The version and effective date for this notice appear above. Material changes require appropriate notice.