Privacy Policy

1. Data Controller

The seller and data controller for website-related processing is:

Alina Onopriichuk, registered as a sole proprietor in Ukraine

Website: https://os.trellares.com
Privacy and support contact: https://os.trellares.com/en/contact

“NIK Project OS” is the product name and “TRELLARES” is the public brand. They are not separate legal entities.

2. Scope

This Privacy Policy applies to personal data processed through:

• https://os.trellares.com;
• the website contact form;
• support communications;
• product purchase and delivery interactions where we receive or process relevant information.

Payment processing itself is handled by Paddle as Merchant of Record.

3. Contact Form Data

When you submit the contact form, we process:

• your name;
• your email address;
• your selected topic;
• your message.

The submission is:

1. received by our server;
2. checked using Cloudflare Turnstile for abuse and bot prevention;
3. delivered to our support mailbox through Postmark.

We do not store contact-form submissions in a separate application database.

After delivery, the message may remain available in our support email system.

4. Purchase and Payment Data

Payments are processed by Paddle.

Paddle may process information necessary to complete and administer the transaction, such as:

• buyer identity and contact information;
• billing information;
• payment method information;
• tax-related information;
• transaction details.

We do not receive or store full payment-card details on our own servers.

For our own fulfillment system, we may process limited transaction and entitlement information needed to verify a purchase and provide protected product access.

This may include:

• Paddle transaction identifiers;
• approved product/price identifiers;
• fulfillment status;
• entitlement-related technical records.

5. Entitlement and Delivery Data

To securely deliver the product, our system may create an opaque browser entitlement token.

The raw token is stored in an HttpOnly browser cookie. Only a cryptographic hash of that token is stored in our fulfillment system.

The token is used only to determine whether the browser is entitled to access the purchased digital product.

A transaction identifier by itself is not used as authorization.

6. Cookies and Similar Technologies

The website may use:

Essential cookies

Necessary for security, checkout flow, entitlement and protected delivery.

Examples include the HttpOnly entitlement cookie used to authorize a verified buyer’s browser.

Third-party checkout technologies

Paddle Checkout may use its own cookies or similar technologies as necessary to provide payment and transaction services.

Optional website analytics

When configured, we use Google Analytics 4 to measure page visits and a limited set of product-funnel interactions. Under our configured country policy, analytics storage is enabled by default for visitors outside the listed consent-required regions. In listed regions, or when the country cannot be determined, analytics storage remains denied until the visitor accepts analytics. If analytics storage is denied, cookieless measurement data may still be sent to Google.

An explicit accept or reject choice is stored in the browser’s localStorage under a site-specific key and remains until local site data is cleared. The stored value contains only the consent choice and no contact details or other directly identifying information.

Advertising storage, advertising user data and advertising personalization remain denied in every region. Google Signals and advertising-personalization signals remain disabled. We do not use this implementation for Google Ads, remarketing or advertising analytics.

Analytics data is limited to page path and location, interface locale, CTA location, checkout stage, successful purchase-page and download-start interactions, and the selected contact topic after a successful submission. We do not send contact-form content, names, email addresses, Paddle transaction identifiers, entitlement tokens or signed download URLs to analytics. Analytics remains disabled unless a Google Analytics measurement identifier is configured.

7. Cloudflare

We use Cloudflare infrastructure and services for hosting, security, abuse prevention and protected product delivery.

Cloudflare may process technical request information necessary to provide those services.

The website uses the request country code supplied by Cloudflare only to apply the analytics-consent policy described above. We do not collect or store an IP address for this consent decision.

Cloudflare Turnstile is used on the contact form for abuse prevention.

8. Postmark

We use Postmark to deliver contact-form submissions to our support mailbox.

Postmark processes the contact-form content and email delivery metadata necessary to provide the email-delivery service.

9. Why We Process Personal Data

Depending on the context, we process personal data to:

• respond to contact requests;
• provide customer support;
• process and verify purchases;
• deliver the purchased digital product;
• prevent abuse and fraud;
• maintain security;
• understand aggregate website use and the purchase funnel when analytics is enabled;
• comply with legal and tax obligations where applicable.

10. Legal Bases

Where laws such as the GDPR apply, processing may rely on one or more of the following legal bases:

• performance of a contract;
• steps taken at the user’s request before entering into a contract;
• legitimate interests, such as security, fraud prevention and service operation;
• compliance with legal obligations.

11. Data Sharing

Personal data may be shared with service providers only as needed for the purposes described above.

Relevant providers include:

• Paddle;
• Cloudflare;
• Postmark;
• Google Analytics, when analytics is enabled.

We do not sell personal data.

12. International Processing

Some service providers may process personal data in countries other than the user’s country of residence.

Where required, such processing should be subject to appropriate contractual or legal safeguards provided by the relevant service provider and applicable law.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was processed, including:

• support correspondence;
• fulfillment and entitlement records;
• transaction-related records;
• legal, accounting or fraud-prevention requirements.

We do not currently store contact-form submissions in a separate application database.

Retention performed by Paddle, Cloudflare, Postmark or Google Analytics is governed by their own applicable policies and service configuration.

14. Data Security

We use reasonable technical and organizational safeguards appropriate to the service, including:

• server-side secret handling;
• private product storage;
• short-lived signed download URLs;
• HttpOnly entitlement cookies;
• cryptographic token hashing;
• payment-webhook verification;
• abuse prevention through Cloudflare Turnstile.

No method of transmission or storage can be guaranteed to be completely secure.

15. Your Rights

Depending on your location and applicable law, you may have rights including:

• access to personal data;
• correction;
• deletion;
• restriction;
• objection;
• portability;
• withdrawal of consent where processing relies on consent.

To exercise a privacy right, use the Contact page:

https://os.trellares.com/en/contact

We may need to verify your identity before acting on a request.

16. Children

NIK Project OS is not directed to children.

If we become aware that personal data has been submitted by a child in circumstances where consent or processing is not lawful, appropriate steps may be taken to delete or restrict that data.

17. Changes to This Policy

This Privacy Policy may be updated when:

• the website changes;
• new service providers are added;
• legal requirements change.

The current version will be published on the website.

18. Contact

Privacy questions may be submitted through:

https://os.trellares.com/en/contact

Website:

https://os.trellares.com