Privacy Policy

Znaak ("we," "us," "our") operated by Vlado Spasov, sole proprietor, based in Skopje, North Macedonia, respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding it.

• Account information. When you sign up, we collect your name, email address, and password (stored securely and never in plain text).
• Third-party sign-in. If you sign up or log in using Google, Microsoft, or Apple, we receive basic profile information from that provider (typically your name and email address) to create and secure your account. Using one of these sign-in methods also means your use of that provider is subject to their own privacy policy and terms.
• Project content. Design files, images, project names, and version history you upload, stored via our infrastructure provider (Supabase Storage).
• Workspace branding. Studio-tier workspaces may upload a logo, used to customize their own Certificates of Approval.
• Reviewer information. When you invite a reviewer via a tokenized link, we collect the reviewer's name and email (if provided), their comments/approval decisions, and — where an approval decision is made — a typed electronic signature and a cryptographic hash of the approved design file, scoped to that project version. Reviewers do not need to create an account.
• Payment information. We do not collect or store your payment card details. Payments are processed entirely by Paddle.com, our Merchant of Record. Paddle collects and processes your billing information (name, billing address, payment method) under its own Privacy Policy. We receive only confirmation of payment/subscription status from Paddle, not your card details.
• Usage data. Basic technical data such as browser type, device type, and general usage patterns within the app, used to maintain and improve the Service.

Approved Certificates of Approval can be independently verified via a public certificate lookup tool using a unique certificate code. This lookup displays limited approval details — including the reviewer's typed signature, the decision, and the date of approval — to anyone who has the certificate code. Certificate codes are not guessable or publicly listed; they are only known to parties who received or generated the certificate.

We use the information above to:

• Provide, operate, and maintain the Service (including account management, project hosting, and reviewer access)
• Generate Certificates of Approval and maintain project/version history
• Process subscription billing (via Paddle)
• Communicate with you about your account, transactional matters (e.g., password resets, plan changes), and — where you've opted in — product updates
• Detect and prevent abuse, fraud, or security issues
• Comply with legal obligations

• Application data and files are stored via Supabase (our backend infrastructure provider), including dedicated storage buckets for project images and client logos.
• Access to project data is controlled through row-level security policies and scoped tokenized links for reviewers — reviewers only see the specific project version they were invited to.
• We do not sell your personal information to third parties.

We share information only with service providers necessary to operate Znaak:

• Paddle.com — payment processing, billing, tax compliance, and Merchant of Record services
• Supabase (Lovable Cloud) — application hosting, database, and file storage

We do not share your data with advertisers, and we do not sell personal information.

Znaak uses only essential/functional cookies required for authentication and basic app functionality. We do not currently use third-party advertising or tracking cookies. [If this changes — e.g., analytics tools are added — this section will be updated accordingly.]

We retain your account and project data for as long as your account is active. When you delete an individual project or client, it is retained in a recoverable state for 30 days before being permanently deleted. Approval records (Certificates of Approval, including signatures and certificate data) are retained permanently as an audit trail, even after their associated project has been deleted, consistent with their purpose as a permanent record of an approval decision.

You can request deletion of your entire account at any time via the "Request account deletion" option in your account settings. Upon a verified account deletion request, we will delete or anonymize your personal data within a reasonable period, except where retention is required by law (e.g., transaction records for tax purposes, typically retained by Paddle as Merchant of Record) or where retention is necessary to preserve the integrity of Certificates of Approval already issued.

Depending on your location, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at spaski@thehgc.xyz.

Znaak is not directed at children under 16, and we do not knowingly collect personal information from children.

Znaak is operated from North Macedonia. If you use the Service from another country, your information may be processed in North Macedonia or wherever our service providers (e.g., Supabase, Paddle) operate infrastructure.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice. The "Last Updated" date above reflects the most recent revision.

Questions about this Privacy Policy can be sent to spaski@thehgc.xyz or via our Contact page.