Privacy policy

Who is responsible

The controller of your data is Nabil Kamal Fahmy (Nodik), NIF/NIE Z0824393D, Málaga, España. For anything about your data, write to hello@nodik.dev.

What we collect and why

Contact form and chat hand-off: your name, email address, your phone or WhatsApp number if you choose to give it, the details you write and your choices (type of project, budget, timeline). We use them only to reply to you and, if you ask for it, to prepare a proposal. We store your request in our own database so we can follow it up, and send you one email confirming we received it. Legal basis: your request and steps before a contract (GDPR art. 6.1.b).

Nodik Order pages (nodik.dev/r/...): when you order from a business, we store your name, phone, the address you give (for delivery or for collection), your notes, your order and, if you send it as a gift, the recipient's name, phone and card message, so the business can prepare it. Orders placed at a table need only an optional name. The order is passed to the business on WhatsApp, except table orders, which go straight to its dashboard. The business decides what happens with that data and is responsible for it; Nodik stores it on its behalf. If your note is in another language than the business's, it is translated for them by an AI model run by Cloudflare (Workers AI); the original stays with the order. Each order gets a private status link that shows the order and its progress, never your name, phone or address. Business owners who sign up give us the business's details, their email and WhatsApp number to run the page; photos of a printed menu they upload are read by the same AI model to fill in their menu and are not kept. Legal basis: the order you place (GDPR art. 6.1.b).

Ratings: after an order, you can rate it from its status page. Your stars, your comment and your first name are shown on the business's page (the business can hide the comment); nothing else about you or your order. Delivery priced by distance: if you tap "Use my location", your phone's location is sent once to work out the distance and the fee, and is not stored; otherwise we look up the address you typed on OpenStreetMap's geocoder. A business can let its staff see orders in its dashboard; they sign in with their own email.

If a business runs a loyalty card, your earlier orders there are counted by your phone number, only to tell you and the business when an order earns the reward. Business pages, with the business's name, address, products and prices, are public: they can appear in search engines and in the Nodik Order directory (nodik.dev/places), unless the owner turns that off. Customers' details never appear there.

Maps on Nodik Order pages: the small maps are drawn from OpenStreetMap tiles, so your browser asks tile.openstreetmap.org (OpenStreetMap Foundation, United Kingdom) for the map images and shares your IP address with it, without cookies. To place a business on the map we look up the business's own address with OpenStreetMap's geocoder (Nominatim); no customer data is sent. Opening directions takes you to Google Maps, under Google's own privacy policy.

On your device, a Nodik Order page remembers your chosen language, your latest orders (to show their status and offer "Order again") and, only if you tick "Remember my details", your name, phone and address, in your browser's local storage. Nothing of it is sent to us until you place an order, and you can untick the box to remove it.

Nodik app (Android and iOS): the app asks for your location only while you use it, to show places near you and to guide you to a place. Your position is sent to our server with each search and is not stored or linked to you. When you ask for directions, the start and end points are sent to FOSSGIS's routing service (routing.openstreetmap.de) to draw the route; while you follow it, your position stays on your phone. Spoken directions are made by your phone itself. Map images come from OpenFreeMap (tiles.openfreemap.org), which sees your IP address, without cookies. If you open the route in Google Maps, Waze or Apple Maps, their own privacy policy applies. Visitors need no account: your saved places, your latest orders and your language are kept only on your phone. Orders placed in the app go through the same Nodik Order pages described above. When you open a business's page we count one view for the business, with no detail about you. Business owners sign in with their email and a one-time code we email them; the sign-in lasts 90 days on that phone. If they allow notifications, we store the phone's push token with their email to announce new orders, through Expo's push service and Apple's or Google's; signing out removes it. Owners can delete their business and all its data from the app. Legal basis: your request when you use the app (GDPR art. 6.1.b).

Website monitoring: your email address and the website you want monitored. We check that website about every hour and email you when it goes down, comes back, before its certificate expires, and once a week with a short report. We keep the data until you click "Stop monitoring" in any of these emails, and delete sign-ups that are not confirmed within 7 days. Legal basis: your request (GDPR art. 6.1.b).

Chat assistant: your messages are sent to an AI model run by Cloudflare (Workers AI) to generate the replies. We don't save the conversation on our servers; it stays in your browser tab until you close it. If you tap "Send to Nabil", the conversation, your name and your email are emailed to us and handled like a contact form message. Don't share sensitive data in the chat.

Website check tool: the address you type is sent to Google's PageSpeed Insights service to run the test. We do not store it. Do not enter addresses that contain personal data.

QR codes with scan stats: we store the address the code points to and, for every scan, only the day, the country and the type of device (iPhone, Android or computer). We don't store IP addresses or anything else that identifies the person who scans. Codes are kept while they are in use; write to us to have one deleted. Legal basis: your request (GDPR art. 6.1.b) and, for the scan counts, our legitimate interest in providing the stats you asked for (GDPR art. 6.1.f).

Visit statistics: we count page visits with Cloudflare Web Analytics, which works without cookies, does not follow you across websites and builds no profile. Legal basis: our legitimate interest in knowing which pages are useful (GDPR art. 6.1.f).

Google Analytics, only if you accept cookies: it measures which pages you visit, where you came from and whether you send the contact form or the chat, using the cookies listed in our cookie policy. Advertising features are switched off. If you reject or ignore the banner, Google Analytics never loads. You can change your choice at any time with "Cookie settings" at the bottom of every page. Legal basis: your consent (GDPR art. 6.1.a).

Server logs: like any website, our hosting provider processes technical data such as your IP address and browser to deliver pages and protect the site from abuse. Legal basis: our legitimate interest in running a secure website (GDPR art. 6.1.f).

We do not use advertising trackers or profiling on this site, and we never sell your data.

Who processes it for us

Cloudflare, Inc. hosts and protects the website, stores QR codes and their scan counts, stores Nodik Order pages and orders, counts visits, runs the AI models (chat assistant, translations, reading menu photos) and delivers contact form messages to our inbox.

OpenStreetMap Foundation serves the map images on Nodik Order pages and finds a business's address on the map.

In the Nodik app: OpenFreeMap serves the map images and unpkg.com the map's code, FOSSGIS e.V. (Germany) works out routes, and Expo (650 Industries, Inc., United States), with Apple and Google, delivers order notifications to business owners.

Google LLC provides our email inbox (Gmail) and runs the PageSpeed test when you use the website check. Google Ireland Ltd provides Google Analytics, only for visitors who accept cookies.

Brevo (Sendinblue SAS, France) sends our emails to you: the confirmation of your request and the website monitoring emails.

Some of these providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

Enquiries are kept while we are in contact and for up to two years after the last message, then deleted. If you become a client, invoices and contract records are kept for as long as Spanish tax and commercial law requires.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Write to hello@nodik.dev; we answer within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Children

This site is meant for businesses and is not aimed at anyone under 14. We do not knowingly collect their data.