Privacy Policy

1. Who we are

Nook is run by [Company name], [Street address], Thimphu, Bhutan. We are responsible for the information described here. You can reach us at [contact email].

2. What we collect

Information you give us:

• Your account: name, email address and a password. We keep only a scrambled (hashed) form of your password, never the password itself.
• Your profile, if you fill it in: birthday, gender, phone number, address, interests, and how you want to be contacted. All of this is optional.
• Things you do: promotions you save, places you follow, and reports you send.
• If you run a business: your business profile, opening hours, contact details, photos, promotions, banners, and your coin wallet and its history.
• If you write to us through the Contact page: your name, email address and message. We use them only to reply.
• If you apply for a job with us: what you send, such as your CV and contact details. We use it only to consider you for a role.
• If you choose to verify your business: your name as on your ID, your ID number, your trade licence number, and photos or PDFs of your ID, licence and shop.

Information we collect as you use Nook:

• Views and clicks on promotions and banners. These are counted without your name or account, together with the page you came from (for example the home page).
• Technical details, such as your IP address and browser, which are kept with your sign-in session and used for security. Failed sign-in attempts are recorded briefly so we can stop people guessing passwords.
• A cookie that keeps you signed in (see Cookies below).

3. How we use it

• To run Nook: create and protect your account, show promotions and places, and let businesses and customers use their dashboards.
• To send you account emails, such as confirming your email address and security messages.
• To send you updates about places you follow or promotions, only in the ways you chose in your notification settings. We only send promotional messages to people who agreed to them, and you can change your mind at any time.
• To make suggestions that suit your interests, if you allow personalisation in your settings.
• To keep Nook safe: stop fraud, spam and abuse, review reports, and check that businesses are real.
• To count how ads perform, so businesses can see how many people viewed and clicked.
• To follow the law and to answer lawful requests.

4. Who can see your information

Public: the information a business puts on its page and promotions is visible to everyone. Your own name and profile are not shown to other customers or businesses.

Businesses you follow see only totals and groups, such as how many followers they have, which areas they live in, which interests are common, and how many agreed to emails. They never see your name, email or phone.

Our team: a small number of Nook admins can see account details when they need to, for example to help you, review a report or stop abuse.

Service providers who help us run Nook, and who may only use your information for that purpose:

• our database and file storage provider (Neon);
• our email provider (Resend), which sends our emails;
• our hosting provider;
• a payment provider, once buying coins is switched on.

We do not sell your personal information or give it to advertisers. We may share information when the law requires it.

5. Verification documents

Your ID and licence are the most sensitive information we hold, so we handle them with extra care:

• They are kept in private storage that is not reachable from the public website.
• Only Nook admins who review verifications can open them. The business owner's own page and every other customer or business can't.
• Every time an admin opens a document, it is written to a log.
• We use them to check your business and for nothing else. They are never shown on your page.
• We keep them while your business account exists, and for a short time afterwards where needed for security or the law. You can ask us to delete them (see Your choices).

6. Cookies

We use one essential cookie to keep you signed in. It can't be read by scripts on the page and is sent only over a secure connection on the live site. We don't use advertising cookies or third-party trackers.

7. How we protect it

• Passwords are stored in hashed form.
• The live site uses an encrypted (HTTPS) connection.
• Different people can see different things: customers, business owners and admins each have their own access, checked on the server every time.
• We limit sign-in attempts and sign-up requests to stop guessing and abuse.
• Important admin actions are logged.

No website can promise perfect security. If something happens that puts your information at risk, we will tell the people affected and the authorities as the law requires.

8. How long we keep it

• Your account and profile: until you delete your account. Your saved promotions, follows, notifications and reports are deleted with it.
• Business information: while the business account exists.
• Coin and wallet history: kept for our records, as it shows what a business paid for.
• Contact messages: kept while we deal with your request, and for a short time after. Ask us to delete yours at any time.
• Job applications: kept only as long as needed to consider you. Ask us to delete yours at any time.
• Admin logs: kept for security and accountability.
• Failed sign-in records: about a day.
• View and click counts: kept as totals; they don't identify anyone.

9. Your choices and rights

• See and change your details and notification settings in your profile.
• Turn promotional messages and personalisation off at any time.
• Delete your customer account in your profile settings. A business owner should remove their business first, or contact us.
• Ask us for a copy of your information, to correct it, or to delete it, by writing to [contact email]. We will answer within a reasonable time, and we may need to check it is really you.

If you are unhappy with how we handled your information, please tell us first so we can put it right.

10. Children

Nook is not meant for children under 16 without a parent or guardian's permission. If you believe a child has given us information without permission, contact us and we will delete it.

11. Where your information is kept

Our service providers may store or process information outside Bhutan. We only use providers who protect it and who may use it only to provide their service to us.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change matters to you, we will tell you, for example by email or on the site.

13. Contact us

Questions about privacy? Write to [contact email], or to [Company name], [Street address], Thimphu, Bhutan.