Privacy Policy

1. Who We Are

NAPally.io ("NAPally", "we", "us", or "our") is a citation intelligence platform and bespoke citation building service operated by NAPally Ltd. Our registered contact is [email protected].

For the purposes of UK GDPR and the Data Protection Act 2018, NAPally is the data controller responsible for your personal data collected through this website. For California residents, NAPally is the business responsible under the California Consumer Privacy Act (CCPA).

2. What Data We Collect

We collect personal data in the following ways:

Contact and Enquiry Data

When you submit the contact form on our website, we collect: full name, agency name, business email address, agency website URL, number of client locations, country, and any message you provide. This data is collected with your explicit consent.

Waitlist Data

If you sign up for our waitlist, we collect your business email address.

Usage and Analytics Data

We use Google Analytics 4 to collect anonymised data about how visitors use our website, including pages visited, time on site, browser type, and approximate geographic location (country/region level). This data does not personally identify you. IP addresses are anonymised before storage.

Cookies

Our website uses cookies for analytics purposes (Google Analytics). You can control cookie preferences through your browser settings. Disabling analytics cookies will not affect your ability to use the site.

3. How We Use Your Data

We use collected data for the following purposes:

• To respond to enquiries submitted via our contact form
• To send you information about NAPally services you have requested
• To notify waitlist subscribers when the product is available
• To improve our website and understand how visitors use it (analytics)
• To comply with legal obligations

Our lawful basis for processing contact and enquiry data is consent (you tick the privacy checkbox on our form). Our lawful basis for analytics data is legitimate interests in understanding and improving our service.

4. How Long We Retain Your Data

• Contact form submissions: Retained for up to 3 years, or until you request deletion.
• Waitlist signups: Retained until the service launches and you have been contacted, or until you unsubscribe.
• Analytics data: Google Analytics data is retained for 14 months per Google's default settings.

5. Third-Party Processors

We share data with the following third-party processors, all operating under appropriate data protection agreements:

• Resend (resend.com) — email delivery service used to receive contact form submissions. Data processed in the US under Standard Contractual Clauses.
• Google Analytics (Google LLC) — website analytics. Data may be transferred to the US under Google's data processing terms.
• Hotjar (Hotjar Ltd) — optional session recording and heatmapping (if enabled). Processes anonymised behavioural data.
• Calendly (Calendly LLC) — booking widget for workflow discovery calls. Calendly's own privacy policy applies to data entered on their booking forms.
• Cloudflare (Cloudflare Inc) — website hosting and security. Cloudflare processes request metadata for security and performance purposes.

6. Your Rights

Under UK GDPR and applicable US state privacy laws, you have the following rights:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate personal data.
• Right to erasure: You can ask us to delete your personal data ("right to be forgotten").
• Right to data portability: You can request your data in a machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are in the UK, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

7. California Privacy Rights (CCPA)

California residents have additional rights under the CCPA, including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. NAPally does not sell personal information. To exercise your CCPA rights, contact [email protected].

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Contact form data is transmitted over encrypted HTTPS connections and processed via Cloudflare's secure infrastructure. API keys are never exposed in client-side code.

9. International Transfers

Some of our third-party processors are based in the United States. Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions.

10. Children's Privacy

NAPally is a B2B service for SEO agencies. We do not knowingly collect personal data from individuals under 18 years of age.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be indicated by an updated "Last updated" date at the top of this page.

12. Contact Us

For any privacy-related questions or to exercise your rights, contact:
NAPally.io
Email: [email protected]