Effective date: 2026-09-15
Last updated: 2026-09-15
This Privacy Policy explains how INMODE EOOD (Еднолично дружество с ограничена отговорност — a single-member limited liability company registered in Bulgaria) ("we", "us", "our") collects, uses, and shares personal data when you visit https://novraz.com (the "Site"), purchase a subscription, activate Novraz desktop software (the "Software"), or contact us.
Data controller: INMODE EOOD, UIC/ЕИК 175103474, 52 Borovo Str., ent. D, fl. 3, Sofia 1618, Bulgaria. Not VAT-registered (deregistered).
Contact: legal@novraz.com | support@novraz.com
1. Key principle — local-first Software
Your Merch catalog stays on your device by default.
Design files, listing data, templates, and the local SQLite database used by the Software are stored on your computer. We do not require cloud upload of your catalog to use the Software.
This Policy describes data we process through the Site, payment provider, license systems, and support — not the bulk of your creative work, which remains local unless you voluntarily send it to us (e.g. in a support ticket).
2. Scope
This Policy applies to:
- Visitors to the Site
- Customers who purchase Subscriptions
- Users who activate the Software with a License Key
- Users of optional account portal features (when available)
- Waitlist subscribers (when the waitlist is open)
It does not apply to third-party websites or services (including Amazon and Lemon Squeezy), which have their own privacy policies.
3. Data we collect
3.1 Website visitors
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Server logs (IP address, browser type, pages visited, timestamps) | Security, troubleshooting, aggregated analytics | Legitimate interest |
| Strictly necessary cookies | Authentication and essential Site functionality | Legitimate interest / necessity for the service |
3.2 Customers (checkout and subscription)
When you purchase through Lemon Squeezy (Merchant of Record — Lemon Squeezy is the seller and handles payment, invoicing, and VAT), they collect payment and billing data (e.g. name, email, billing country, payment method details). We receive limited transaction data via webhooks or exports, such as:
- Email address
- Subscription status and plan tier
- License Key identifier
- Purchase and renewal dates
- Country/region for tax purposes
We do not store full payment card numbers on our servers.
Legal basis: Performance of contract; legal obligation (tax/accounting where applicable).
3.3 License activation (Software)
To enforce Subscriptions, the Software communicates with our license services and may send:
- License Key (or token derived from it)
- Device fingerprint / activation hash
- App version and platform (Windows/macOS)
- Activation, deactivation, and validation timestamps
We do not collect your Amazon credentials on our servers. Amazon session data used for browser automation is intended to remain local on your device.
3.4 Auto-updates
The Software may check for updates and download signed binaries from our CDN (Vercel, and Cloudflare for release downloads). Update checks may include app version and platform.
3.5 Support and contact
If you email us or submit a support request, we process the information you provide (email, message content, attachments you choose to send).
3.6 Waitlist
If you join the waitlist, we collect your email address. Legal basis: consent. You may withdraw consent at any time via the unsubscribe link or by emailing legal@novraz.com.
3.7 What we do not collect at launch (desktop)
At v1 launch, the Software does not send anonymous crash reports or in-app telemetry to us.
4. How we use data
We use personal data to:
- Provide, activate, and enforce licenses
- Process subscriptions via our MoR and sync license status
- Deliver Software updates
- Respond to support requests
- Send transactional emails (license delivery, billing notices) via Resend (transactional) and Cloudflare Email Routing (inbound forwarding)
- Notify waitlist subscribers about launch and related product updates (consent-based)
- Improve and secure the Site and license infrastructure
- Comply with legal obligations
We do not sell your personal data.
5. Data sharing and processors
We may share data with service providers who process data on our behalf:
| Processor | Purpose |
|---|---|
| Lemon Squeezy | Payments, invoicing, VAT, refunds (merchant of record) |
| Vercel | Website hosting |
| Supabase | License and account data storage (EU — eu-central-1, Frankfurt) |
| Resend (transactional) and Cloudflare Email Routing (inbound forwarding) | |
| Vercel (and Cloudflare for release downloads) | Software update binaries / CDN |
Personal data we store is held in the European Union. We require processors to handle data under appropriate contractual safeguards. Where a processor is US-based, transfers rely on standard contractual clauses.
6. Retention
We retain personal data only as long as necessary:
- Account/license records: duration of Subscription plus a reasonable period for legal, tax, and dispute resolution obligations
- Support correspondence: typically up to 24 months unless longer retention is required by law
- Server logs: typically up to 90 days
- Waitlist email addresses: until launch plus 12 months, or until you unsubscribe, whichever comes first
You may request deletion subject to exceptions (e.g. ongoing subscription, legal retention duties).
7. Your rights (EEA/UK and similar jurisdictions)
Depending on your location, you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data ("right to be forgotten") in certain cases
- Restrict or object to processing
- Data portability
- Withdraw consent (where processing is consent-based)
- Lodge a complaint with a supervisory authority
EU/EEA supervisory authority (Bulgaria): Commission for Personal Data Protection (CPDP).
To exercise rights, contact legal@novraz.com. We may need to verify your identity.
8. Security
We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (HTTPS), access controls, and secure handling of license credentials. No method of transmission or storage is 100% secure.
You are responsible for securing your device, License Key, and local database backups.
9. Children
The Site and Software are not directed at children under 16. We do not knowingly collect data from children. Contact us if you believe a child has provided personal data.
10. Cookies
During pre-launch, the Site uses strictly necessary cookies only (for example, authentication cookies required for account sessions). These are exempt from consent requirements.
We do not currently use optional analytics or marketing cookies. When payments go live, Lemon Squeezy and related checkout functionality may set additional cookies; a consent mechanism will be added before those cookies are introduced.
11. Changes
We may update this Policy by posting a revised version with a new "Last updated" date. Material changes may require additional notice where required by law.
12. Contact
INMODE EOOD
52 Borovo Str., ent. D, fl. 3, Sofia 1618, Bulgaria
Email: legal@novraz.com
This document is provided for informational purposes and does not constitute legal advice. Have it reviewed by qualified legal counsel before publication.