1. Controller
The controller of your personal data is No Cap Ventures, operator of nocapventures.org. For anything related to your data, write to [email protected].
2. Data we process
Account data: your email address and a unique account identifier. If you sign in with Google or GitHub, also the display name those services share. Passwords are handled by Firebase Authentication: we never see or store them.
Preferences: whether you take part as a builder or an explorer, and your language.
Content you publish: name, who made it, type, country, tagline, description, tags, website, social and app store links, and the images (logo, cover, gallery) of each public page you create.
Reviews: the rating, text, language and date of each review you write, the name you choose to show with it, and the replies you write to reviews of your pages.
Technical data: IP address, browser type, date and time of each request, kept in server logs for security.
Visit statistics: Cloudflare Web Analytics counts visits in aggregate (page, referring site, country, browser type and load time). It uses no cookies or local storage, does not identify you and does not follow you across other sites.
We do not process special categories of data (health, beliefs, etc.), we do not profile you and we do not make automated decisions with legal or similarly significant effects.
3. Purposes and legal bases
We only use your data for the following purposes, each with its legal basis under Article 6 GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account | Account data, preferences | Performance of a contract (Art. 6.1.b) |
| Publish the pages you create | Content you publish | Performance of a contract (Art. 6.1.b) |
| Publish your reviews and replies | Reviews, name shown | Performance of a contract (Art. 6.1.b) |
| Tell you about the service you signed up for, e.g. when publishing launches opens | Email, language | Legitimate interest (Art. 6.1.f): keeping members informed about the service. You can opt out at any time. |
| Keep the service secure and prevent abuse | Technical data | Legitimate interest (Art. 6.1.f): protecting the service and its users |
| Know which pages are useful and keep the site fast, in aggregate | Visit statistics | Legitimate interest (Art. 6.1.f): improving the service, without cookies or individual profiles |
| Comply with legal obligations and answer authorities | Any of the above, as required | Legal obligation (Art. 6.1.c) |
4. Providing your data
An email address is required to create an account; without it we cannot provide the service. Everything else you publish is optional.
5. Public information
Pages you publish are public by design: anyone can see them and search engines may index them. Your email and account details are never shown on them. You can edit or delete your pages at any time.
Reviews and replies are public too, together with the name you choose to show, the rating and the date. Use a nickname if you prefer. You can edit or delete your review at any time from the page you reviewed.
6. Processors and international transfers
We use these providers, bound by data processing agreements, who process data only on our instructions:
Google Ireland / Google LLC — Firebase Authentication (sign-in). Supabase Inc. — database, hosted in the United States. Railway Corporation — application hosting. Cloudinary Ltd. — storage and delivery of the images you upload. Resend (Plus Five Five, Inc.) — delivery of your account emails (email confirmation and password reset). Cloudflare Inc. — domain, network, protection against attacks and aggregate visit statistics.
Some of this data is transferred to and stored in the United States. These transfers rely on the EU–US Data Privacy Framework, where the provider is certified, and on the Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of the relevant safeguards.
We do not sell your data and we do not share it with third parties for advertising.
7. Retention
Account data, preferences, pages and reviews: while your account exists. When you delete your account, they are erased immediately from our database, and your images are deleted from our image provider. A review is also erased when you delete it or when the reviewed page is deleted.
Server logs: up to 30 days, unless we need them longer to investigate a specific security incident.
Copies in provider backups are overwritten on their regular rotation, within 30 days.
8. Your rights
You have the right to access your data, rectify it, erase it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest.
From "My pages" you can download all your data and delete your account yourself, at any time. For anything else, write to [email protected]. We answer within one month, free of charge. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority: in the EU, the data protection authority of your country of residence; in Chile, the Personal Data Protection Agency.
10. Security
All connections are encrypted (HTTPS). Access to the database is restricted to our server, and every request to your account is verified against your sign-in token.
11. Minimum age
No Cap Ventures is not intended for people under 16. If you are under 16, do not create an account.
12. Changes
If this policy changes in a meaningful way, we will update the date above and notify registered users by email before the change applies.