Privacy Policy
Effective date: October 29, 2026.
This policy explains how Nelamoya handles personal data on its public website and waitlist. It does not cover a future member account, age-verification service or paid learning platform.
1. Who is responsible for your data?
The data controller is Northpeak Projects s. r. o.. Company identification is available on our Company details page. Privacy contact: hello@nelamoya.com.
2. What data do we collect?
When you join the Nelamoya waitlist, we collect your email address, your confirmation that you are 18 or older, your consent to receive waitlist and launch updates, the version of the consent text, and timestamps associated with registration and email confirmation. Our hosting and security providers may also process basic technical information, such as your IP address and connection data, to protect the service against automated abuse. If you contact us by email, we process your contact details and the content of your message. We do not require your real name, date of birth or other profile information to join the waitlist.
3. Why do we process your data?
Your email address is used to confirm your subscription, inform you about the development and launch of Nelamoya, and provide early-access information and relevant updates. The legal basis is your consent under Article 6(1)(a) GDPR.
If you contact us by email, we process your contact details and message content in order to respond to your enquiry. Depending on the nature of the enquiry, the legal basis is our legitimate interest in handling communications under Article 6(1)(f) GDPR or, where applicable, steps taken at your request before entering into a contract under Article 6(1)(b) GDPR.
Security and abuse prevention rely on our legitimate interest in protecting the service under Article 6(1)(f) GDPR.
4. How long do we keep your data?
- Unconfirmed registrations: 7 days from registration. Confirmation links expire after 48 hours; requesting another link does not restart the 7-day period.
- Confirmed registrations: 24 calendar months from email confirmation, or 90 days after the public launch of the Nelamoya service, whichever comes first. Publishing this landing page is not the service launch.
- Unsubscribed registrations: 30 days from unsubscribing, to administer the withdrawal and handle related enquiries. Marketing consent is withdrawn immediately; these records are not used for further marketing.
An automated daily job deletes expired records from the active waitlist database. Under normal operation, deletion takes place within 24 hours after the applicable period ends. We investigate and correct failures if a scheduled deletion does not complete.
You can unsubscribe using the link in our waitlist emails, or write to hello@nelamoya.com to withdraw consent or request deletion. Withdrawal does not affect the lawfulness of earlier processing. You do not need to wait for automatic expiry to exercise your rights.
Recovery copies: deleted database records may remain in Cloudflare D1 recovery copies for up to 30 further days. Recovery copies are not used to send marketing. After a restoration, withdrawals and deletion requests must be reconciled before email sending resumes.
Technical records: standard Cloudflare Workers Logs are retained for 7 days under our current plan. Separate email-delivery and security records are not covered by that 7-day limit. Their retention depends on the provider's operational, abuse-prevention and legal purposes; see the provider information below.
Sent email copies: Cloudflare Email preview is currently enabled and retains message content for approximately 7 days. Delivery metadata is separate; its display range is not a guarantee of deletion. Cloudflare may also maintain a separate list of blocked recipients following delivery failures or spam complaints. Some entries have no automatic expiry and are not removed by deleting a waitlist registration. We review related deletion requests in light of the purpose and applicable obligations. See email records and blocked-recipient rules.
Messages sent to us: we retain correspondence for handling your enquiry and any related obligations or claims, according to its purpose and whether the matter remains open. The waitlist deletion job does not delete email correspondence.
5. Service providers and international data transfers
The waitlist is operated using services provided by Cloudflare, Inc., including Cloudflare Workers, a D1 database configured for the European Union jurisdiction, hosting, and bot protection through Cloudflare Turnstile.
Transactional confirmation emails are delivered using Cloudflare Email Service.
Emails sent to our contact addresses are processed using Google Workspace, provided by Google Cloud EMEA Limited.
Cloudflare and Google process data on our behalf where applicable. Providers may also process certain service and security data for their own purposes, as described in their privacy notices. We do not sell waitlist data.
An EU database location does not mean that all processing stays within the European Economic Area. Processing or support access outside the EEA may occur. The providers' published data-processing terms include transfer safeguards, including the European Commission's Standard Contractual Clauses where applicable. See the Cloudflare Data Processing Addendum, Cloudflare Standard Contractual Clauses, Cloudflare Privacy Policy and Google Data Processing Addendum. Contact us for information about the safeguards applicable to your data.
6. Your rights
- Access your personal data.
- Correct inaccurate personal data.
- Request deletion of your personal data.
- Restrict certain processing.
- Receive your data in a portable format where applicable.
- Withdraw consent at any time.
- Object to processing based on legitimate interests, where applicable.
- Lodge a complaint with the competent data-protection authority.
You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, or a competent EU/EEA supervisory authority, particularly where you habitually reside, work or believe an infringement occurred.
7. Adults only
Nelamoya is intended for adults aged 18 and over. The waitlist age checkbox is a self-declaration, not independent verification of age or identity. If we become aware that personal data has been submitted by a person under 18, we will remove the waitlist registration once identified, subject to any applicable legal obligation to retain specific information.
8. Cookies, security and abuse prevention
We use reasonable technical and organisational measures and reputable service providers to protect personal data against unauthorised access, loss, misuse or disclosure. The waitlist also uses Cloudflare Turnstile to help prevent automated abuse. Turnstile processes technical signals, including IP address and browser information, to assess whether a request is automated or legitimate. Cloudflare also acts as a separate controller when using these signals to improve its bot detection, as explained in its Turnstile Privacy Addendum.
Turnstile is a security technology, distinct from advertising tracking. Depending on the security configuration, Cloudflare may use security cookies. See the Turnstile Privacy Addendum.
The public website does not use advertising or audience-analytics scripts. Security processing by Cloudflare is separate; this is not a claim that the website can never use security cookies.
9. Changes to this Privacy Policy
We may update this Privacy Policy as Nelamoya develops or when our data-processing practices change. The latest version will be available on this page.
10. Contact
For privacy-related questions or requests, contact hello@nelamoya.com.