Privacy

Who we are

Panelworks is the product. Nevid Grupp OÜ is the company behind it, and is the controller of the personal data described here - the one you have rights against and the one answerable for what follows.

• Nevid Grupp OÜ, registry code 14845652
• VAT EE102439100
• Sepa 17c, Tartu 50113, Estonia
• hello@panelworks.eu

We are small enough not to need a data protection officer, and we have not appointed one. Everything below reaches a person at hello@panelworks.eu.

What we collect

When you create an account: your email address, a password we only ever see as a hash, and a name if you give one. If you sign in with Google we receive your email address, name and profile picture URL from Google, and nothing else about your Google account.

When you answer the setup questions: your country, your role, the kind of work you do and any preferred manufacturers. These configure the product - the country decides which standards, conductor colours and earthing system a new board starts from.

When you design a board: your projects, including their names, the devices on them, circuits, wiring and anything else you type. If you record a customer name against a project, that is somebody else's personal data and you remain responsible for it; we process it on your behalf and on your instructions.

When you save a board: the day it was saved, and how many saves that day. Not what changed, not the time of day and not how long you were there - a count per day, so we can see how often Panelworks is actually used.

When something goes wrong: one line of JSON in a server log, and the ordinary request metadata any web host keeps - an IP address, a timestamp, a path.

When you come through a partner's link: a count. A partner link keeps one number per day - how many people opened it - with no identifier of any kind, and puts nothing on your device. If you then create an account, the account is linked to the partner whose link you came through, so that partner can be credited. A partner sees totals by month and by week and never your name, your email address or the day you signed up.

When a partner accepts or declines the Partner Terms: the decision, the version and a fingerprint of the exact text shown, the time, and the confirmed email address of the account at that moment, kept as evidence of what was agreed.

Why, and on what basis

Every purpose needs a lawful basis under Article 6, and they are not interchangeable. Ours are:

• Running your account and saving your work - performance of the contract you entered into by signing up (Art. 6(1)(b)). Without this data there is no service to provide.
• Configuring the product from your setup answers - the same contract. They are answers to questions the software needs in order to be correct for where you are.
• Keeping the service secure and working, including error logs and abuse prevention - our legitimate interests (Art. 6(1)(f)). You can object to this, and the balancing test is short: the logs are redacted at source and hold nothing about your boards.
• Understanding how the product is used - the daily save counts, what is on boards counted across everybody, and opening a board when you ask us for help with it - our legitimate interests (Art. 6(1)(f)). You can object to this at any time by writing to us.
• Crediting the partner whose link brought you, and counting visits to a partner link - our legitimate interests (Art. 6(1)(f)) in running a partner programme and paying partners what they are owed. You can object at any time by writing to us, and we will remove the link between your account and the partner.
• Keeping the record of a partner's decision on the Partner Terms - the contract with the partner (Art. 6(1)(b)) and our legitimate interest in being able to show what was agreed (Art. 6(1)(f)).
• Payments, on the day billing opens - the contract, plus a legal obligation to keep accounting records (Art. 6(1)(c)).
• Analytics, if analytics is ever switched on - your consent (Art. 6(1)(a)), asked for first and withdrawable at any time. Nothing of the kind runs today.

We do not rely on legitimate interests for anything you would be surprised by, and we send no marketing email.

What we do not do

Stated plainly, because most of a privacy notice otherwise describes things that are not happening.

• No session recording, no heatmaps, no tracking of clicks or of time spent. We do not know which buttons you press, and nothing measures what you do inside a board - the one usage fact we keep about your work is which days you saved one.
• No advertising and no tracking pixels. The one third-party script is Google Analytics, and it loads only if you accept it below; refuse, and it is never fetched.
• No profiling and no automated decisions about you.
• Nothing you design trains anything, ours or anybody else's.
• We have never sold your data, and there is no arrangement under which anyone pays for access to it.

What is stored on your device

This table is generated from the same list the application itself works off, so it cannot describe one thing while the code does another.

Nearly all of it is strictly necessary: a session you asked for by signing in, and preferences you set yourself. Storage of that kind is exempt from consent under the ePrivacy Directive, which is why nothing here asks you to accept it - and why there is no banner on a product that would have nothing to put in one.

The one other thing is the short-lived cookie in the table that carries a partner's code through the Google sign-in. It is set only when you press "Continue with Google" on a page a partner's link opened, it lasts ten minutes at most, and it is cleared when you are back. A partner's link itself leaves nothing on your device.

The product has a consent layer regardless, with an analytics category that is denied until somebody grants it. It is the reason a tracking script could not be added quietly: the only route by which one can load is through a consent that was actually given, and the moment such a script is configured you will be asked before it runs.

Who else sees it

Only the providers who run the service for us, each processing your data on our instructions and for no purpose of their own.

• Supabase - the database, authentication, and the account email we send you: confirmations and password resets. Hosted in Ireland.
• Vercel - application hosting and server logs, with functions pinned to Dublin.
• Google - sign-in, only if you choose it. Using an email address and a password avoids it entirely.
• Google Analytics - how many people visit, on a phone or a computer, and which site they came from. Only for visitors who accept it: refuse, and the script is never loaded. Your IP address is shortened before it is stored, and nothing about your boards is sent.
• Stripe - payments. Integrated and switched off: no payment has ever been taken and Stripe holds nothing about you today. When billing opens it becomes a processor of your name, email and card details - which it holds and we do not - and this notice changes on the same day.

Inside the company, a small number of Panelworks staff can open a project read-only - to help when you ask us about it, and to understand how boards are really built so we can make the product better. Nothing can be changed from that view, and every opening is recorded with who opened it and when.

Your account and your boards stay inside the European Economic Area. Two things leave it, and both are yours to refuse: Google sign-in, which you only meet if you choose it, and Google Analytics, which is processed in the United States under the EU-US Data Privacy Framework and only if you accept it.

We also count visits ourselves, under the same consent: a number per day for each kind of device, referring site and page. Those counts hold no identifier of any kind, and they stay in the same European database as everything else.

We use no separate email delivery provider today; account email goes through Supabase. If that changes, the provider is named here before it sends anything.

Errors and logs

When something breaks, one line of JSON is written to our server logs: what failed, where, which build, and the account involved. It does not record your email address, any authentication token, any password-reset code, or any part of a board you were working on. That is enforced in code and covered by tests rather than left to whoever writes the next log line.

How long we keep it

Your account and projects are kept until you delete them. Deleting your account removes the account, the profile, the setup answers, every project you own and every saved version of them - immediately and permanently, because every table hangs off your user row and cascades with it. There is no soft delete and no grace period, so export anything you want to keep first.

The one record that outlives an account is a partner's decision on the Partner Terms: it cannot be changed or removed, and it is kept after the account is deleted for as long as the evidence of the agreement is needed.

Server logs are kept for as long as our hosting provider retains them, which is days rather than months, and are used for nothing else.

Once billing opens, invoices and the accounting records around them have to be kept for seven years under Estonian law. That obligation outlives a deleted account, and it covers the invoice rather than your designs.

Your rights

Under the GDPR you may ask for a copy of what we hold (Art. 15), correct it (Art. 16), delete it (Art. 17), take it elsewhere in a portable form (Art. 20), object to processing we base on legitimate interests (Art. 21), ask us to restrict processing while something is in dispute (Art. 18), and withdraw any consent you have given without that affecting what was done before.

Several of these are buttons rather than requests: most of your details are editable in Settings, every project exports from its own page, and deleting your account is immediate and self-service. For anything else, write to us and we will answer within a month.

If you think we have got it wrong, you can complain to Andmekaitse Inspektsioon - the Estonian Data Protection Inspectorate - at https://www.aki.ee/en. It is our lead supervisory authority because we are established in Estonia. You may also complain to the authority in the EU country where you live or work.

Security

Every table is protected by row level security enforced by the database rather than by application code, so a query for somebody else's project returns nothing even if the application asks for it. Identity comes from a server-validated session on every request rather than from anything the browser claims. Traffic is encrypted in transit, and passwords are hashed by our authentication provider and never visible to us.

Error reports are redacted where they are written: tokens, recovery codes and full email addresses are stripped before a line reaches a log, and a test pins that behaviour rather than trusting the next person to remember it.

No system is perfectly secure. If you find a vulnerability, please write to hello@panelworks.eu rather than disclosing it publicly, and we will work with you.

Changes

If we change this notice materially we will say so in the product before the change takes effect, rather than quietly updating the date at the top.