Privacy

Privacy Policy

This policy explains what personal data Naebula processes, why it is processed, how public and private areas work, and what rights you have under GDPR and related laws.

Last updated: September 4, 2026

Public profiles, public projects, and the media you choose to publish can be visible to other users and, where the app supports it, to guests.

Private features such as favourites, friend-request workflows, account settings, and direct messages are generally limited to the relevant users and administrators who need access to operate or protect the service.

Naebula uses essential cookies for sign-in and security, optional preference cookies for interface settings, and optional Google Analytics and PostHog analytics only after your consent choice.

If you use optional features such as Google sign-in, identity verification, Pro billing, or Albums, we process the additional data needed to provide those features.

1. Controller and contact details

Aczél Dániel Zoltán EV. is the controller for the personal data processed through Naebula.

Business address: 1136 Budapest, Tátra utca 29/B., Hungary. Email: photostudio.aether@gmail.com. Tax number (adószám): 90515211-1-41. Entrepreneur registration number (EV nyilvántartási szám): 42604886.

2. Scope of this policy

This Privacy Policy explains how Naebula collects, uses, stores, shares, and protects personal data when you browse the site, create an account, build public profiles, publish projects, exchange messages, use social features, request verification, submit support messages, use Albums by Naebula, or purchase paid features.

Albums is a connected service operated by the same controller. It uses Naebula for authentication, account identity, user lookup, notifications, and subscription entitlements. Albums has separate Terms & Conditions and a separate Privacy Policy for its album storage, sharing, recipients, access events, and uploaded media.

3. Personal data we collect

The exact data we process depends on how you use Naebula.

Account and sign-in data, such as name, email address, password hash, locale, Google account identifier when Google sign-in is used, two-factor authentication data, and account status timestamps
Onboarding and eligibility data, such as date of birth, accepted-terms timestamps, username choices, profile type, and location information
Profile and public-content data, such as profile bios, usernames, profile images, gallery images, cover images, featured images, project details, feed posts, comments, likes, tags, and other content you choose to upload or publish
Social and messaging data, such as favourites, friend requests, conversation membership, messages, attached message images, notification preferences, and notification history
Verification and support data, such as identity verification images you submit voluntarily, support or feedback messages, incident references, and moderation or review status information
Billing and subscription data, such as customer and subscription identifiers, plan information, payment status, and invoice-related records handled through our payment providers
Albums data, such as shared-gallery identifiers, album titles and descriptions, recipient identifiers, share URLs, preview images, storage entitlements, and notifications relating to Albums activity
Technical and usage data, such as IP-related request logs, session identifiers, security events, cookie values, unread-state tracking, device or browser data, campaign parameters in notification links, and analytics or email-interaction events where enabled

4. Why we process personal data and our legal bases

We process personal data only where we have a valid legal basis under applicable data-protection law.

To provide the service you request, including account creation, authentication, profile hosting, messaging, social features, and billing administration. Legal basis: performance of a contract or steps at your request before entering into a contract.
To keep Naebula safe, prevent abuse, review reports, moderate content, verify account activity, enforce our rules, and protect users and the platform. Legal basis: legitimate interests.
To comply with legal obligations, including accounting, tax, fraud-prevention, security, and lawful-request handling. Legal basis: legal obligation.
To manage optional features such as Google sign-in, identity verification submissions, and promotional or product-update emails where enabled. Legal basis: performance of a contract, legitimate interests, and consent where applicable.
To understand which parts of Naebula are being used and improve the product when you opt in to analytics cookies. Legal basis: consent.
To measure notification-link and email-campaign performance where enabled. Legal basis: consent where required, or another lawful basis assessed for the particular communication and tracking method.
To maintain internal records, backups, troubleshooting logs, and evidence relevant to disputes or claims. Legal basis: legitimate interests and legal obligation where applicable.

5. Public and private visibility

Naebula includes both public and private areas. Public profiles, public projects, and public-facing media can be seen by other users and, in some cases, guests. Please only publish content you are comfortable making visible in that way.

Private favourites are intended to remain visible only to the account that created them. Friend requests, account settings, and direct messages are generally limited to the relevant participants, except where access is reasonably necessary for moderation, support, abuse prevention, or legal compliance.

6. Cookies, local storage, and similar technologies

Naebula currently uses a limited set of cookies and similar storage technologies. Essential cookies are used for core functionality. Optional preference cookies, Google Analytics, and PostHog analytics should only be stored or enabled after your consent choice.

Essential session and security cookies used by Laravel to keep you signed in, protect forms, and maintain secure sessions
Optional preference cookies such as the appearance setting and sidebar state so your interface choices can persist across visits
Optional local storage for appearance preferences used by the frontend experience
Optional Google Analytics and PostHog analytics cookies and similar technologies used to understand page visits and feature usage, which remain disabled until you consent
Notification links may contain campaign parameters, and some communications may use interaction measurement where enabled. These are used to understand whether a notification link was opened or used and are subject to the applicable consent and privacy controls.

7. Who we share data with

We do not sell your personal data. We may share it only where reasonably necessary to operate Naebula, provide requested features, or comply with law.

Infrastructure, hosting, storage, and technical service providers that support the application
Payment and subscription providers such as Stripe when you purchase or manage paid plans
Authentication providers such as Google when you use Google sign-in
Email-delivery providers used to send account, notification, verification, or support-related messages
Albums by Naebula, for connected authentication, account identity, user lookup, notifications, storage entitlements, gallery shares, and related account services
Location, translation, analytics, and other feature providers used when you use the relevant functionality, such as GeoNames, Azure Translator, Mapbox, Google Analytics, and PostHog
Administrators, moderators, and support personnel who need access to review reports, process verification requests, handle support issues, or protect the service
Authorities, courts, counterparties, or advisers where disclosure is required by law or reasonably necessary to establish, exercise, or defend legal claims

8. International transfers

Naebula and Albums are operated from Hungary, but some connected services and providers may process data in countries outside Hungary or the European Economic Area. Where that happens, we aim to rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, contractual commitments, or other lawful transfer mechanisms. You may contact us for information about the relevant safeguard where applicable.

9. How long we keep data

We keep personal data only for as long as it is needed for the purposes described in this policy, unless a longer retention period is required or justified by law, dispute handling, security, fraud prevention, or record-keeping obligations.

Account and profile data are generally kept while your account is active and for a reasonable period afterward if needed for backups, abuse prevention, or legal obligations
Public content and messages may remain available until you delete them, your account is deleted, or we remove them under our policies
Deleting your Naebula account is intended to remove or anonymize account-linked content and connected records that we control, but some data may remain in backups, legal holds, accounting records, abuse-prevention records, or records that must be retained by law. Albums content and files are also subject to the Albums deletion and expiry rules.
Billing and tax records may be retained for the periods required by accounting or tax law
Verification, moderation, support, and security records may be retained for as long as reasonably necessary to handle the relevant process, resolve disputes, or protect the platform

10. Security

We use technical and organizational measures intended to protect personal data against unauthorized access, accidental loss, misuse, or unlawful disclosure. No internet-based service can guarantee absolute security, so you should also protect your account credentials and use the service carefully.

11. Your rights

Depending on applicable law, including the GDPR, you may have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, portability, or objection to certain processing. Where processing is based on consent, you may withdraw that consent at any time for future processing. To exercise these rights, email photostudio.aether@gmail.com with enough information for us to understand and verify the request. We normally respond within one month, subject to lawful extensions or exceptions.

We may use automated checks, including image-safety or moderation checks, to flag content or account activity for review. These checks are intended to support safety and enforcement; where an automated process has a legal or similarly significant effect, we will provide the information and safeguards required by applicable law. You may also lodge a complaint with your local supervisory authority. In Hungary, that authority is the National Authority for Data Protection and Freedom of Information (NAIH).

12. Adults only

Naebula is intended only for adults. You must be at least 18 years old to create or use an account. If we learn that an account does not meet that requirement, we may restrict or remove it.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide notice in the app, by email, or by updating the date at the top of this page.

Manage cookie choices

You can reopen the cookie banner to switch between essential-only usage and optional preferences or future analytics consent.

Related legal page

Read the Terms & Conditions for the rules on content, collaborations, payments, and use of the service.

Terms & Conditions