Privacy Policy

1. Data Controller

This Privacy Policy describes how we process the personal data of visitors to nabusql.nabu.work and buyers of the NabuSQL software, in accordance with Regulation (EU) 2016/679 (GDPR) and the Croatian GDPR Implementation Act.

2. What Data We Collect and Why

2.1. License Purchase

When you purchase a license we collect: first and last name, e-mail address and device identifier (Machine ID); for business buyers additionally the company name, registered address, city, postal code, country and tax/VAT number (required for issuing a business invoice). We also record your IP address to prevent abuse (rate limiting).

Purpose	Legal basis (GDPR)
Issuing and delivering the license key, performance of the purchase contract	Art. 6(1)(b) — performance of a contract
Issuing and retaining invoices, fiscalisation, tax obligations	Art. 6(1)(c) — legal obligation
Preventing abuse and ensuring system security	Art. 6(1)(f) — legitimate interest
Responding to inquiries and complaints	Art. 6(1)(b) / (c) / (f), depending on the nature of the inquiry

2.2. Payment

Card payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). Card data (number, expiry date, CVC) is entered directly into Stripe's system and we never see or store it. Stripe's privacy policy: stripe.com/privacy.

2.3. Trial Download

The trial version is downloaded without registration and without entering any personal data. As is standard, the server keeps technical logs (IP address, time, downloaded file) for security and operational statistics (legitimate interest).

2.4. E-mail Contact

If you contact us by e-mail, we process your e-mail address and the content of your message in order to respond to your inquiry.

3. Recipients of Data

• Stripe Payments Europe, Ltd. — card payment processing;
• PausalPro (pausalpro.com.hr) — invoice issuing and fiscalisation; receives the buyer data required for the invoice;
• the hosting provider on whose servers the Website and database run;
• Google Ireland Ltd. — visit statistics via Google Analytics 4 (only with your consent; see Section 7);
• competent authorities where required by law (e.g. the Croatian Tax Administration).

When the Website loads, your browser fetches fonts from Google Fonts (Google Ireland Ltd.) and the payment script from Stripe servers; your IP address is technically transmitted to those providers in the process.

4. Transfers to Third Countries

Stripe and Google may carry out part of their processing outside the EEA (USA). Such transfers are based on appropriate safeguards: the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

5. Retention Periods

• Invoices and accounting records: at least 11 years, as required by the Croatian Accounting Act;
• License data (name, e-mail, Machine ID, license key): for as long as the license is valid, to enable re-activation and support;
• Server logs: short-term, as a rule up to 12 months;
• Correspondence: for as long as needed to resolve the inquiry, or until the expiry of limitation periods.

6. Your Rights

You have the right of access to your data, rectification, erasure (within the limits of statutory retention obligations), restriction of processing, data portability, and the right to object to processing based on legitimate interest. You can submit a request to gdpr@nabukodonozor.hr; we will respond without undue delay and at the latest within one month.

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the supervisory authority of your EU member state.

7. Cookies and Analytics

Strictly necessary cookies (always on): a session cookie (PHP session) that remembers your language choice and enables the purchase form to work, and a cookie that stores your cookie-consent choice (nabusql_consent). No consent is required for these. Stripe may set its own cookies necessary for secure payment processing when you use the payment form.

Analytics cookies (with consent): we use Google Analytics 4 (Google Ireland Ltd.) for visit statistics and to improve the site. Analytics is disabled until you give consent via the cookie banner (Google Consent Mode — analytics_storage defaults to "denied"). Only after your consent are analytics cookies set (e.g. _ga, _ga_*) and usage data collected; your IP address is anonymised. You can withdraw consent at any time via the "Cookie settings" link in the page footer.

The legal basis for analytics cookies is your consent (Art. 6(1)(a) GDPR, together with the Croatian Electronic Communications Act). More about Google Analytics: policies.google.com/privacy.

8. The NabuSQL Application

The NabuSQL application runs locally on your computer. Your databases, connection credentials and queries are not transmitted to our servers. The license is verified offline, without sending any data.

If you enable the AI assistant in the application, the text of your prompts (and any schema/context you choose to include) is sent to the AI provider you select (e.g. OpenAI, Anthropic, Google) using your own API key, which is stored locally on your computer. Such processing is subject to the selected provider's terms; the AI features send nothing without your action.

9. Security

We apply appropriate technical and organisational measures: encrypted communication (HTTPS/TLS), restricted database access, no storage of card data, and server-side-only storage of access keys.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always published on this page with the date of the last update.