Privacy policy

Nabori is operated by Gaston Cuesta (Gaston David Cuesta Mancuso), CVR 46802055, Østre Teglgade 87, 6. tv, 2450 København SV, Denmark. Contact: appnabori@gmail.com, +45 71 66 55 41. Building administrators determine who may join their buildings and can review residents and reservations; Nabori operates the platform and its accounts and billing. The respective responsibilities for building data must also be agreed with each building operator.

We collect only the data we need to run the service:

• Account data: name, email, apartment, and a hashed password you create.
• Building data: the name and address of buildings you create or join, and the common spaces inside them.
• Reservation data: the dates, times and event reason for the shared spaces you book.
• Approval data: the building administrator reviews and approves or rejects resident requests.
• Billing data: plan, billing period, business name and CVR entered by the buyer; Stripe processes card payments and tax information.
• Authentication tokens: stored in your browser by Supabase Auth so you stay signed in. They are not used for advertising.

• To create and operate your account.
• To let you book shared spaces and let administrators approve requests.
• To send you transactional emails about your bookings, account, and billing.
• To detect fraud, prevent abuse, and keep the service secure.
• To comply with legal obligations.

Depending on the processing, our legal bases under GDPR article 6 are performance of a contract (admin subscriptions and requested service), legitimate interests (operating and securing resident access and bookings, subject to balancing against residents’ rights), legal obligation (accounting), or consent where separately requested. Building administrators may be responsible for their own decisions about resident access and bookings.

• Supabase: database and authentication provider; hosting location and any international access or transfers depend on the configured project and vendor terms.
• Stripe: processes subscription payments; card details are not held by Nabori.
• Resend: sends transactional emails such as booking confirmations and verification codes.
• Authorities: only when required by law.

We keep your account data for as long as your account is active. Residents who no longer need access can be deactivated by the building administrator from the admin dashboard, which immediately prevents them from signing in. Deactivation keeps the email reserved so the same resident can be approved again later without losing their name.

To request erasure, contact appnabori@gmail.com. We assess each request under GDPR and respond without undue delay, generally within one month. Some data must be retained for accounting, legal claims or the building operator’s legitimate needs; we will explain any exception. Deactivation is not deletion.

You can request access, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. Write to appnabori@gmail.com; for decisions made by a building administrator we may refer you to that operator. You may complain to the Danish Data Protection Agency, Datatilsynet.

Nabori is not intended for children under 16. We do not knowingly collect data from children.

We may update this policy. We will notify you of material changes by email or a notice in the app. Continued use of Nabori after the effective date means you accept the updated policy.

Questions? Email appnabori@gmail.com.