Privacy policy

Who is responsible

Naam. Contact: support@naamapp.com.

Data about users

At sign-in: the email address, and from a Google account when used to sign in: name and picture. To protect sign-in by code: the code, stored in a form that does not reveal it and expiring within minutes, and how many codes each email address and network address asked for, stored in a form that reveals neither. From the workspace: business name, profession, country, the business WhatsApp number, the payment details it shows, and its logo. Quotes and their items, and clients' names and email addresses when added. Session records (IP address and browser type) to protect the account, and support messages. When notifications are turned on for a device: the device's address at its browser's push service and the keys that encrypt messages to it; that service carries each notification encrypted and cannot read it, and the address is deleted when notifications are turned off, the device signs out, or its user leaves the workspace.

Account emails

A new account's address gets a welcome email, then one reminder if no quote has been sent yet, and nothing else. For this we keep the account's language when it was created, when each email was sent, and the choice to stop them if made; all of it is deleted with the account. Every email carries a “Stop these emails” link that works without signing in. The sign-in code is not one of these emails and still arrives when asked for. We send no newsletters or advertising, and we never write to a user's clients.

Connecting an AI assistant

The owner of a workspace on the Pro plan can connect an AI assistant with a connection key. That assistant is then sent what it asks for from the workspace's quotes and its clients' names, at the owner's request, and what reached it is covered by the policy of the company that provides the assistant. What clients wrote in change requests and the links of quotes never reach it, and it cannot send a quote or change a sent one. Of the key we keep only a one-way fingerprint, with its name and when it was last used; it stops the moment it is revoked and is deleted with the workspace.

Drafting a quote from a client's message

When a draft is asked for from a client's message inside an account, the message, voice note or photo of the message is sent, with the names and units of the price list's services but not their prices, to an AI model run by Cloudflare, or by Groq when Cloudflare cannot (never the photo), which picks the services and quantities asked for. Neither trains on it. We neither store nor log the message, the recording or the photo; what is kept is the draft the user then reviews, with how many drafts were made and what they cost, never their content.

On the site's try page, without an account: the typed message is sent with the chosen profession's services to the same model, and is neither stored nor logged. Cloudflare Turnstile checks that the visitor is not a bot, and tries are counted per network address in a form that does not reveal it. The resulting draft (the profession, the client's name if given, the services and quantities) is kept in a cookie on the visitor's device for 1 day; only the request that keeps it as the first quote after sign-up reads it, and then it is deleted.

Data about a client who opens a link

The name typed when approving, the choice made and its date, change-request messages, a transfer reference if a payment is reported, and how many times the quote was opened. We do not keep a client's IP address, only a one-way fingerprint of it, enough to stop abuse.

And, when a client writes a review after the job is done: the review's text and the name they chose to show with it. The service provider may show both to other clients in their quotes and on their request page on Naam, and can hide them at any time.

And, from anyone who sends a quote request from a user's request page: the name they typed, the description of the job and their answers to the page's questions. The page asks for no phone number and no email, and we keep neither. The request reaches the page's owner only; it is deleted 90 days after the owner ignores it or makes it into a quote, and with the owner's account.

And, when a client asks about a quote on its page: the question is sent, with the quote as the client sees it and the provider's ready answers, to an AI model run by Cloudflare, or by Groq when Cloudflare cannot. Neither trains on them; Cloudflare keeps none of it after answering, and Groq only in a log for detecting abuse that is deleted within 30 days. The question and the answer shown, or that it was passed to the provider, are kept in the quote's agreement record for as long as the quote is.

Visitors to the site's pages

We count visits to the site's public pages as daily totals: the page, the site the visitor came from (its name only), the country as the network reports it, and the kind of device (phone or computer). No cookie is set for this, and no IP address or visitor identifier is kept, so a visit cannot be tied to a person. These totals are deleted after 400 days.

What we do not keep

Clients' phone numbers: the WhatsApp message is sent from the user's own phone. Card details: Paddle processes them and they never reach us.

What is typed into the site's quote maker, which needs no account: it is read once to work out the totals and draw the quote, and is neither stored nor logged.

Why we use data

To run the service, protect accounts and prevent fraud, answer support requests, bill subscriptions, and count usage in aggregate to improve the service. We do not sell data or use it for advertising.

Who processes data for us

These companies process data only to provide the service:

• Cloudflare (hosting, the database, logo storage, the check that a visitor is not a bot, and running the model that drafts a quote from a client's message) - cloudflare.com
• Google (sign-in with a Google account, and carrying encrypted notifications to Chrome) - google.com
• Apple (carrying encrypted notifications to Safari on iPhone, iPad and Mac) - apple.com
• Mozilla (carrying encrypted notifications to Firefox) - mozilla.org
• Microsoft (carrying encrypted notifications to Edge on Windows) - microsoft.com
• Groq (running the AI model, in the United States, when Cloudflare cannot) - groq.com
• Paddle (payments and billing, as the Merchant of Record) - paddle.com
• Resend (sending sign-in codes by email, and carrying support messages to the support inbox) - resend.com
• Sentry (technical error reports so we can fix them, without IP addresses or the contents of quotes) - sentry.io
• Amplitude (analysing visitors' steps through the site and an account's setup and subscription steps, without IP addresses, names, email addresses or the contents of quotes) - amplitude.com

Cookies

The sign-in session cookie, a cookie that remembers the light or dark choice, and one that carries a draft tried on the site without an account until it is kept as a first quote; there are no advertising or tracking cookies. The browser also keeps small choices on the device itself, such as putting off the invitation to turn on notifications. Paddle may set cookies needed to complete a payment when its checkout opens.

How long we keep data

Data is kept while the account exists. When an account is deleted, its data is removed from the database at once and disappears from backups automatically within 30 days at most.

One trace stays after deletion so the same email address cannot start a second free trial: a keyed fingerprint of the address from which the address cannot be recovered, with the day the trial started and how many quotes it sent, and nothing else.

Your rights

Anyone may see, export, correct or delete their data and object to its processing, from the settings or by writing to support@naamapp.com; we answer within 30 days.

Children

The service is for business owners and is not directed at children.

Changes

Any change to this policy is posted on this page with the date of the last update.