Privacy Policy

This policy explains how Narona handles personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679) and Albanian Law No. 9887 "On the Protection of Personal Data", as amended.

• As controller: data about our own users and visitors, such as account holders, people who submit forms on our website, and support correspondence.
• As processor: data an agency puts into its workspace, such as guests, owners, cleaners and technicians. The agency decides why and how that data is used; we act on its documented instructions and these terms serve as our data processing agreement.

• Account data: name, work email, agency name, role, password hash and sign-in metadata. Basis: performance of a contract.
• Workspace content: properties, bookings and guest details, staff and contractor names and phone numbers, inspections, photos and payout figures entered by the agency. Basis: the agency's own lawful basis; we process on its instructions.
• Website and form data: name, agency, email and city submitted to download a resource or request contact. Basis: consent, which you can withdraw at any time.
• Technical and security data: IP address, device and browser information, log and error records. Basis: our legitimate interest in keeping the service secure and working, and in preventing abuse. Optional analytics events (page visits, lead submissions, downloads, WhatsApp clicks and checkout initiations) with pseudonymous visitor and per-tab session identifiers are processed only with your consent.
• Billing data, where a paid plan applies: company details, invoices and payment status. Basis: contract and legal obligation.

We do not run advertising trackers or profiling, and we do not sell personal data. We do not knowingly collect data from children.

Essential session tokens and browser storage keep you signed in and remember your language and interface preferences. If you allow analytics, we set a first-party pseudonymous visitor cookie for 180 days and a per-tab session identifier in browser storage. These measure visits and actions by language and are not used for advertising. You can refuse or withdraw consent at any time by clearing your browser storage and cookies, or with the button below; without the optional cookie, we do not record analytics events. Contact us to request deletion of previously recorded analytics identifiers.

We share personal data only with service providers that help us run Narona, under written contracts and only as needed:

• Cloud hosting, database and file storage providers that run the application and store workspace data.
• Email delivery providers for account and transactional messages.
• Error and performance monitoring providers.
• Payment providers, where a paid plan applies.
• Public authorities, where we are legally required to disclose.

Messages you send through WhatsApp are sent from your own device and account; Narona only prepares the draft text and does not transmit it. Anything you send there is handled by WhatsApp under its own policy.

We aim to keep data in the European Economic Area. Where a provider processes data outside the EEA or Albania, we rely on an adequacy decision or on Standard Contractual Clauses together with appropriate technical and organisational safeguards. You can ask us for details of the safeguards in place.

• Account and workspace data: for as long as the workspace is active, then 30 days after closure to allow export, then deletion or anonymisation.
• Form and marketing contacts: until you unsubscribe or ask for deletion, and in any case no longer than 24 months without further contact.
• Security logs: normally up to 12 months.
• Invoices and accounting records: for the period required by Albanian tax and accounting law.

Data is encrypted in transit. Each agency workspace is isolated at database level with row-level access rules, and access to financial records is restricted to agency administrators. Access by our staff is limited to what support and operations require and is logged. No system is perfectly secure, but we will notify you and the competent supervisory authority of a personal data breach where the law requires it.

You have the right to access your personal data, to correct it, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. Where we act as processor for an agency, contact that agency first; we will assist it in responding.

To exercise your rights write to privacy@narona.app. We respond within one month, and will tell you if we need longer for a complex request.

If you believe we have handled your data unlawfully you may complain to the Albanian Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale, Tirana), or to the data protection authority of your EU country of residence or work.

We update this policy when our practices change. The date at the top always shows the current version, and we give notice of material changes by email or in the app before they take effect.