Privacy Policy

Effective date: July 28, 2026

1. Who we are

ASMY Co. operates Nezmaro and is the data controller for the personal data described here. Contact: support@nezmaro.com.

2. What we collect

• Account data — your name, email address and a securely hashed password.
• Company data — company name, subdomain, branding and profile details you provide during onboarding.
• Tenant data — whatever you and your users enter into your own ERP instance. It is stored in your instance's isolated database and we access it only to operate the service or at your request.
• Billing data — handled entirely by Paddle, our Merchant of Record. We never receive or store card numbers; we receive subscription status and transaction metadata.
• Technical data — server logs (IP address, request metadata) kept for security and troubleshooting.

3. How we use it

To provision and operate your ERP instance, process your subscription, send transactional email (invitations, billing lifecycle notices), provide support, and keep the service secure. We do not sell personal data or use it for third-party advertising.

4. Processors we rely on

• Paddle — payments, tax and invoicing (Merchant of Record).
• Hostinger — server infrastructure hosting the service.
• Resend — transactional email delivery.
• Google Drive — encrypted off-site backup storage.

5. Cookies

We use a session cookie to keep you signed in and a short-lived attribution cookie that remembers how you found us (e.g. a campaign link) when you sign up. We do not use third-party advertising or tracking cookies.

6. Retention

Account and company data are kept while your subscription is active. We take an automated backup of every instance nightly and keep backups for approximately 90 days, after which they are deleted automatically. When a subscription ends the instance is locked rather than deleted and kept, still backed up, for a grace period of 30 days (or, where the subscription ends after a failed payment, until the later of 30 days after that failed payment and 7 days after it ends). After termination at the end of that period we keep a final backup for 90 days (see our Terms), then delete it. Logs are kept for a limited period for security purposes.

7. Your rights

You may request access to, correction of, or deletion of your personal data, and an export of your tenant data, by emailing support@nezmaro.com. If you are in a jurisdiction with statutory data-protection rights (such as the GDPR), we honor those rights accordingly.

8. Security

All traffic is encrypted with TLS. Instance credentials are encrypted at rest. Every customer's ERP data lives in its own isolated database — no shared tables, no cross-tenant access.

9. Children

The service is for businesses and not directed at children under 16.

10. Changes

We may update this policy; material changes will be announced by email or in-app.