Privacy Policy

Last updated: 14 February 2026

1. Introduction

Novilay ("we", "our", or "us") is operated by Cristhian Almora. We are the data controller responsible for your personal data processed through our Service.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use novilay.com and our image rights verification services (the "Service").

This policy applies to:

• Visitors to our website
• Users who perform free scans
• Registered users with accounts
• Subscribers to our paid plans

By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. What Data We Collect

2.1 Submitted Data

Data you actively provide to us:

• URLs for scanning: Website addresses you submit to our scanning service
• Account information: Name, email address when you register
• Payment information: Processed by Lemon Squeezy (we do not store credit card details)
• Support requests: Communications when you contact us

2.2 Scanned Data

Data collected during website scans:

• Image URLs: URLs of images found on scanned pages
• Image metadata: EXIF, IPTC, and XMP data extracted from images (creator, copyright, license information)
• Page structure: Information about where images appear on pages
• Scan results: Verification status, risk assessments, and recommendations

2.3 Account Data

For registered users:

• Email address
• Display name (optional)
• Account preferences and settings
• Project configurations (monitored domains)
• Subscription status and plan tier

2.4 Usage Data

Automatically collected when you use the Service:

• Pages visited and features used
• Scan frequency and patterns
• Dashboard interactions
• Error logs and performance data

2.5 Technical Data

Collected automatically for security and functionality:

• IP address
• Browser type and version
• Device type and operating system
• Time zone and language settings
• Referring website

3. How We Use Your Data

We process your personal data for the following purposes:

Purpose	Legal Basis (GDPR)
Providing the scanning service and generating reports	Contract performance
Creating and managing your account	Contract performance
Processing payments and subscriptions	Contract performance
Sending account-related communications	Contract performance
Automated monitoring and scheduled scans	Contract performance
Improving our Service and developing new features	Legitimate interest
Analyzing usage patterns and optimizing performance	Legitimate interest
Ensuring security and preventing fraud	Legitimate interest
Responding to legal requests and protecting our rights	Legal obligation / Legitimate interest
Sending marketing communications (with consent)	Consent

4. Data Retention

We retain your data only as long as necessary for the purposes outlined in this policy:

Data Type	Retention Period
Free scan reports	7 days after scan completion
Pro/Max scan data	Duration of active subscription + 30 days
Enterprise scan data	Custom retention per agreement
Account information	Until account deletion + 30 days
Payment records	7 years (legal requirement)
Server logs	90 days
Analytics data	26 months (anonymized)

After the retention period, data is either deleted or anonymized so it can no longer be associated with you.

5. Third-Party Data (Scanned Websites)

5.1 What We Access

When scanning a website, Novilay accesses:

• Publicly available pages (accessible without authentication)
• Images embedded on those pages
• Metadata stored within image files

5.2 How We Process It

• Images are downloaded temporarily to extract metadata
• We analyze EXIF, IPTC, and XMP data for rights information
• Original images are NOT permanently stored on our servers
• Only metadata and analysis results are retained

5.3 Your Responsibility

By initiating a scan, you represent that:

• You own the website being scanned, OR
• You have authorization from the website owner to scan it

Novilay processes third-party data solely to provide the scanning service and does not use it for any other purpose.

6. Data Sharing & Third Parties

We do NOT sell your personal data to third parties. We share data only in the following circumstances:

6.1 Service Providers

We use trusted third-party services to operate Novilay:

Provider	Purpose	Data Shared
Supabase	Database, authentication, storage	Account data, scan results, project configurations
Lemon Squeezy	Payment processing (Merchant of Record)	Email, payment information, subscription status
EasyCron	Scheduled task execution	URLs for automated scanning (no personal data)
Google Analytics	Website analytics	Anonymized usage data, IP address (anonymized)
Hosting Provider	Website hosting	Server logs, technical data

6.2 Legal Requirements

We may disclose your data if required by law, court order, or to:

• Comply with legal obligations
• Protect and defend our rights or property
• Prevent fraud or illegal activity
• Protect the safety of users or the public

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

7. Cookies & Tracking

7.1 What Cookies We Use

Cookie Type	Purpose	Duration
Essential	Authentication, session management, security	Session / 7 days
Functional	Preferences (theme, language)	1 year
Analytics	Google Analytics (usage statistics)	2 years

7.2 Managing Cookies

You can control cookies through your browser settings:

• Block all cookies: May prevent the Service from functioning properly
• Block third-party cookies: Disables analytics while keeping essential functions
• Delete cookies: Clear existing cookies from your browser

Most browsers allow you to manage cookie preferences. Consult your browser's help documentation for instructions.

7.3 Do Not Track

We do not currently respond to "Do Not Track" browser signals, as there is no industry standard for this feature.

8. Your Rights (GDPR & Beyond)

Depending on your location, you have the following rights regarding your personal data:

8.1 Rights Under GDPR (EU/EEA)

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time (where processing is based on consent)

8.2 Rights Under UK GDPR

UK residents have equivalent rights under the UK General Data Protection Regulation.

8.3 Rights Under CCPA (California)

California residents have the right to:

• Know what personal information is collected
• Request deletion of personal information
• Opt-out of the sale of personal information (we do not sell data)
• Non-discrimination for exercising privacy rights

8.4 How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: hello@novilay.com

We will respond to your request within 30 days. We may ask for verification of your identity before processing your request.

8.5 Complaints

If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority:

• Netherlands: Autoriteit Persoonsgegevens (Dutch DPA)
• UK: Information Commissioner's Office (ICO)
• EU: Your local Data Protection Authority

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

9.1 Security Measures

• Encryption: All data transmitted over HTTPS (TLS 1.2+)
• Database security: Row Level Security (RLS) policies in Supabase
• Authentication: Secure session management with token-based auth
• Access control: Role-based permissions for all data access
• Infrastructure: Hosted on secure, SOC 2 compliant providers
• Monitoring: Automated security monitoring and alerting

9.2 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours
• We will notify affected users without undue delay if there is high risk
• We will document the breach and remediation steps taken

10. International Data Transfers

Novilay serves users globally, including in the EU, UK, and US. Your data may be processed in countries outside your jurisdiction.

10.1 Where Data Is Processed

• Supabase: Data centers in the EU and US
• Lemon Squeezy: United States
• Hosting: European Union

10.2 Safeguards for International Transfers

When transferring data outside the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs): EU-approved contractual safeguards
• Adequacy decisions: Transfers to countries deemed adequate by the European Commission
• Service provider compliance: Working with providers who maintain appropriate certifications (SOC 2, ISO 27001)

11. Children's Privacy

Novilay is not intended for use by children under the age of 16 (or the applicable age of digital consent in your jurisdiction).

We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete that information promptly.

If you believe a child has provided us with personal data, please contact us at hello@novilay.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

When we make changes:

• We will update the "Last updated" date at the top of this policy
• For significant changes, we will notify registered users via email
• Changes take effect when posted unless otherwise specified

We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.