Privacy policy

Last updated: 5 October 2026.

This Policy explains how nozzlo processes users' personal data. We aim to collect only what is needed to run the Service, and we do not sell your data.

Data controller: Serhii Kostrov ("we"). Contact for data matters: support@nozzlo.com.

We act in accordance with the Law of Ukraine "On Personal Data Protection" and, for users in the EU, the EEA and the United Kingdom, the General Data Protection Regulation (GDPR).

1. Data we collect

You provide:

• email, password (stored only as a protected hash), name, nickname, language, country;
• optionally, phone number and Telegram username;
• maker profile: name, description, services, printers and materials, city, map location, address (visible only to you), photos;
• requests, offers, chat messages, uploaded files (models, photos, attachments), reviews and reports;
• messages to support and the correspondence with it;
• notification settings and newsletter consent.

Collected automatically:

• technical data: IP address, device and browser type, language, dates and times of requests, error logs;
• session and security data: session identifiers (only their hashes are stored), sign-in information, two-factor settings (secrets are stored encrypted);
• the device's push-notification token, if you use the app and allow notifications;
• approximate device location — only if you allow it and press "Use my location".

From third-party sign-in: if you sign in with Google or Apple, we receive the account identifier, email and name that service provides. Apple may provide an anonymised address.

We do not deliberately collect payment data or special categories of data; please do not enter them in requests and messages.

2. Why we process it and on what basis

We do not use your data for profile-based advertising and do not share it with ad networks.

3. Who receives your data

• Other users. A maker's profile (name, services, approximate area, rating) is public. A request is visible to makers within your radius. Your email is shown to the other party of an order only after a maker is chosen. Your phone number is hidden by default: the other party sees it only if you have allowed this in your account settings, and only once the maker has taken the order into work; you can withdraw this permission at any time, after which the number is no longer shown. Administrators can see the number for security, support and handling reports.
• Our support and moderation staff. Correspondence in an order is private to its parties. If one of the parties files a complaint about the order, authorised staff may read the correspondence of that order, only to the extent needed to examine the complaint and take measures (for example, a warning or blocking an account). Each such access is recorded in the administrators' action log. We do not read other correspondence, unless the law requires it.
• Service providers (processors) acting on our instructions: hosting and infrastructure, email delivery, Telegram (if you connect the bot), Apple Push Notification service (iOS push), Google and Apple (sign-in).
• Map tiles. Maps outside Ukraine are loaded from openfreemap.org: the service sees your IP address and the requested area, but not your account.
• Public authorities — only where the law requires it.

We do not sell personal data. If data is transferred to a country without an equivalent level of protection, we apply the safeguards the law provides for (including standard contractual clauses).

4. How long we keep data

• Account and profile — while the account exists. After a deletion request there is a 14-day grace period in which you can cancel; afterwards data is deleted or irreversibly anonymised.
• Sessions — up to 30 days or until sign-out.
• Files of closed requests — deleted after 90 days unless you saved the model in your library. Unfinished uploads — after 24 hours.
• Support correspondence and records of reports and moderation — as long as needed to handle them and to defend against claims, but no longer than the law permits.
• Backups — for a limited time, then overwritten.

5. Your rights

You have the right to: access your data and get a copy; have it corrected; have it erased ("right to be forgotten"); restrict processing; object to processing based on legitimate interests; receive your data in a portable format; withdraw consent without affecting earlier processing; and not be subject to a decision based solely on automated processing that has legal effects on you (we make no such decisions).

To exercise your rights, write to support@nozzlo.com from your account email. We will reply within 30 days. The data export is prepared in JSON together with your files.

You may also lodge a complaint with a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the data protection authority where you live.

6. Security

We use encrypted connections (HTTPS), password hashing, encryption of secrets, two-factor authentication and passkeys, antivirus scanning of files, access controls and logs of administrator actions. No system is perfectly secure: use a unique password and enable two-factor authentication.

7. Children

The Service is not intended for people under 16. If we learn that we have received a child's data without proper authorisation, we will delete it.

8. Cookies

We use only necessary and preference cookies; advertising and analytics are not built on cookies. See the Cookie Policy.

9. Changes

We may update this Policy. We will announce material changes on the site or by email. The current version is always here, with its update date.

10. Contact

support@nozzlo.com. See also the Terms of Use and Contacts.

11. Voluntary identity and address verification

Verification of identity and address is entirely voluntary. You do not need it to register, use nozzlo, publish a maker profile, send offers to requests or receive orders, and we do not make any feature, term or priority conditional on it. If you decline, the only difference is that the “Identity verified” and “Address verified” marks do not appear on your profile. There is no other consequence.

What we process if you choose to apply. A photo or scan of an identity document (passport, ID card or driving licence) and/or of a proof of address (residence registration certificate or a recent utility, rent or internet bill); a record of your consent (version of the text, language, date and IP address); and the outcome of the check (decision, reason code, date and the staff member who decided).

Purpose and legal basis. Solely to check that the name and address in your profile match the document and to show the corresponding mark. The legal basis is your consent (for example Article 6(1)(a) GDPR or the equivalent rule of your country's law). We do not use these documents for advertising, profiling, scoring, ranking, automated decisions or any other purpose, and we do not use them against you. We perform no biometric processing: a staff member compares the document with the profile by eye.

Who sees the documents. Only authorised nozzlo staff, after additional authentication; every opening is recorded in an audit log. Customers, other makers, advertisers and other users never see them. We do not sell them or share them with third parties. Storage and infrastructure providers process them only on our behalf and on our instructions. Disclosure beyond that happens only where a mandatory legal requirement that applies to us leaves no choice, and only to the extent it requires.

Retention. Scans are deleted from storage promptly after the decision or after you withdraw the request, and files that were uploaded but never submitted are deleted within 24 hours. Technical backup copies, if any, are overwritten in the regular backup cycle. We keep only the result: whether the mark was granted, when, by whom, the reason code if declined, and the consent record — for as long as the mark or your account exists and afterwards for the period needed to prove consent and defend against legal claims (no longer than 1 year).

Your choices. You may withdraw the request before it is reviewed, withdraw your consent at any time by writing to support@nozzlo.com, and ask us to remove the mark or erase related data. Withdrawal does not affect the lawfulness of processing before it. You also have the rights described in section 5, including the right to complain to a supervisory authority.

Your responsibility. Send only your own documents, and only if the law of your country allows you to copy and send them. Cover what the check does not need (document number, personal identification and tax numbers, signature). Where the law requires it (for example in Germany), mark the copy as a copy, e.g. “Copy — for nozzlo verification only” with the date. Do not send documents by email or chat. We may refuse a document that contains more than necessary and ask you to send it again.

Security. Documents are kept in private storage, scanned for malware, opened only through short-lived signed links, and are unavailable to anyone without the proper authorisation.