Privacy Policy

Who is responsible

Smart Preservation Platform (SPP) is operated by Nursultan Kadirov. Questions about this policy, and any request described in it, go to support@sppbynur.com.

Where a customer is an organisation, that organisation decides what records its staff enter into SPP and why. For those records the organisation is the controller and SPP acts on its instructions. For the account and billing information described below, SPP is the controller.

What is collected

• Account details — the name, email address and role of each person given access, and the company and project they belong to. These are supplied by the customer when their workspace is set up or a colleague is invited.
• A password, stored only as a scrypt hash with a per-account salt. The password itself is never stored and cannot be read back, including by the operator.
• Sign-in activity — the identifier of the current session, so that one login belongs to one person at a time, and the time of the last request, so an idle session can be closed.
• Preservation records — the tags, job plans, schedules, job cards and comments a customer enters. These may contain the names of the people who carried out or signed off an activity.
• Billing details — the name and email on the order, and the invoice history. Card numbers are never seen by SPP: a payment is taken by the payment provider named on the checkout page, and only the outcome is returned.

There is no advertising on this site, no analytics or tracking service, and no third-party script that profiles visitors. Nothing collected is sold, rented or shared for marketing, by SPP or by anyone else.

Where you are, for the clock and the weather

The workspace shows the local date, time and weather for where you are working, because a preservation schedule is read against a local calendar. Where the hosting platform already resolves a coarse location from your connection, that is what is used. Where it does not, your IP address is sent — from the server, never from your browser — to a geolocation service to obtain a town and approximate coordinates, and those coordinates alone are then sent to the weather provider.

Nothing travels with the address: no account, no company, no session. The result is a town, not a street. Neither the address nor the coordinates are stored by SPP, and neither is returned to the browser. Where the lookup fails, the workspace falls back to your device's own time zone and shows no weather.

Why it is used

Account and sign-in information is used to let the right people into the right workspace and keep everyone else out — that is the whole of its purpose. Preservation records are processed to provide the service the customer is paying for: to schedule activities, issue and close job cards, and produce the reports and documents the customer asks for. Billing details are used to take payment, issue an invoice and meet the accounting obligations that follow from it. Support correspondence is used to answer the question that was asked.

The legal basis is the performance of the contract with the customer, the operator's legitimate interest in keeping the platform secure, and, for invoices and tax records, a legal obligation.

Documents stay in the customer’s own storage

A customer nominates their own document store — Google Drive, Microsoft OneDrive or SharePoint, Dropbox, Box, or their own S3-compatible storage — and the files SPP produces are written there, into the customer's own account. They are not copied onto the operator's servers, and the operator cannot browse them.

Connecting a store is done by signing in to it. SPP receives an access token for that account and stores it so the connection survives a restart; it does not receive, and never asks for, the password to that account. The token can be revoked at any time, from within SPP or from the provider's own security settings, and the connection stops working immediately.

Where that store is Google Drive, SPP requests the drive.file scope and nothing else. That scope reaches only the files SPP itself creates. The rest of the Drive — every file that was there before, and every file created by anything else — stays invisible to it. Information received from Google APIs is used only to provide the storage feature the user asked for, is never transferred to anyone except as described in this policy, is never used for advertising, and is never read by a human except with the user's explicit permission or where the law requires it. This use complies with the Google API Services User Data Policy, including its Limited Use requirements.

Cookies

SPP sets no advertising or analytics cookies. The cookies it does set exist to keep a person signed in and to carry them safely through a sign-in: the session cookie, a short-lived cookie during two-factor confirmation, and short-lived cookies holding the one-time state of a sign-in or a storage connection. They are http-only, secure and same-site, and the session cookie expires after ten minutes of inactivity. The Cookie Policy lists them one by one.

Who else sees it

Only the processors needed to run the platform, each under contract and each handling only what their part requires: the hosting provider that serves the application, the managed database that holds the records, the mail provider that delivers invitations and notices, the payment provider that takes payment, and the geolocation and weather providers described above. The customer's own nominated document store holds their documents, under their own agreement with that provider.

One customer's records are never visible to another, and a customer's records are not visible to the operator through the ordinary interface. Where the operator needs to look at a workspace to resolve a fault, it is done with that customer's consent. Information is disclosed to anyone else only where a law or a lawful order requires it.

Where it is kept, and for how long

The application and its database are hosted with providers operating in the European Union. Account and preservation records are kept for as long as the customer's subscription is in force.

When a subscription ends, nothing is deleted. The workspace is locked rather than emptied: every record stays exactly as it was, and the day the subscription is renewed the same screens come back with the same data. There is no automatic deletion on any timetable, because an unpaid invoice is a reason to stop serving somebody and never a reason to destroy their work. A locked workspace cannot be used, so ask us if you need an export — before the term ends, or after it.

Records are removed only in two cases: when you ask us to, or after a prolonged period with no renewal — and in that case we write to the address on the account first, so the removal is never the way you find out. Invoices and the records that support them are kept for as long as accounting and tax law requires. Support correspondence is kept for two years.

Security

Traffic is encrypted in transit. Passwords are stored only as salted scrypt hashes. Workspaces are separated at the database level, so a query made for one customer cannot return another's rows. A sign-in claims the account, so a session left open on a borrowed machine stops working as soon as the owner signs in again, and any session closes after ten minutes of inactivity. Access to production systems is limited to the operator.

No system is beyond failure. Where a breach affects personal information, the affected customers and, where the law requires it, the supervisory authority will be told without undue delay.

Your rights

You may ask for a copy of the personal information held about you, ask for it to be corrected, ask for it to be deleted, ask that its processing be restricted, or object to it. You may withdraw a consent you have given — including a storage connection — at any time, without affecting what was done before. Write to support@sppbynur.com; a reply follows within thirty days.

Where the information was entered by an employer, the request is passed to that organisation, because the records are theirs to decide about. You may also complain to the data protection authority where you live.

Children

SPP is a tool for industrial work. It is not offered to children, and accounts are not knowingly created for anyone under sixteen.

Changes

Where this policy changes, the date at the top changes with it, and a change that materially affects customers is notified by email before it takes effect.