Privacy Policy
1. Who the controller is
The data controller is IDEAL GENIUS ADVANCE SRL (Tax ID 37213946, J40/3407/2017, EUID ROONRC.J40/3407/2017), registered office Șos. Olteniței nr. 113, bl. 27, sc. 3, et. 8, ap. 108, camera 1, Sector 4, 041304 București, România — which operates neSpus (https://nespus.purceas.com). For any question or request about data: hermes@nespus.online or the contact page.
2. What data we process
Depending on how you use the platform, we may process:
| Category | What it contains | Visibility |
|---|---|---|
| Account (optional) | email + password (stored irreversibly: PBKDF2 hash + salt); optionally a nickname (display name), country (for default language), birthday (day and month only, NOT the year) and the two-factor authentication (2FA) setting | Private |
| Public profile | your username, display name and profile photo (only if you add one) | Public (the /@your-name page) |
| Anonymous device identifier | a random token generated in your browser, which ties reactions and collections to this device — no name, no email | Stays in the browser; accompanies some actions to the server |
| Flow — anonymous usage data | a random session identifier + the cards you have seen, your reactions and saves in Flow, so we do not repeat content and can understand, in aggregate, what works. No personal data. Kept on the server for 90 days, then deleted automatically; deleted immediately if you delete your account. | Internal (aggregated) |
| Reactions, saves and comments on capsules | your reaction (❤ etc.), saved capsules and comment text. Comments can be left only with an account, are public, moderated and linked to your account (for moderation/banning). | Comments are public; reactions/saves are internal |
| Constellations — thoughts | the text of the thought, the chosen relation (e.g. “to my mother”), the chosen constellation, optionally the bond code. Public and anonymous after moderation, with a public link /s/…. | Public, anonymous |
| Constellations — candles (light sent) | which thoughts you supported and the approximate city/country (provided by Cloudflare) the light was sent from; the author sees “someone from …”, without identity | The count is public; no identity |
| Constellations — the oracle | the question you write is sent to generate the AI answer; we do not publish it | Processed for the answer |
| Hermes (chatbot) | the messages you write to the AI guide are sent to generate the reply (Cloudflare Workers AI). We do not save conversations — they remain only temporarily in your session, in the browser. | Private, not saved |
| 1:1 messages (/inbox) | the content of messages between you and another user, plus any blocks/reports | Private, between participants |
| Portals | the text messages in rooms (moderated), access requests and participations. They do not remain public after the room closes. | Visible to participants |
| Weekly email digest (opt-in) | your email + consent, only if you subscribe explicitly (checkbox). Every email has a one-click unsubscribe link. | Private |
| Universe newsletters (opt-in) | optional subscriptions to “film of the week” (The Big Screen) or the Foods bulletin: email + language + explicit consent; unsubscribe anytime | Private |
| Push notifications (opt-in) | your browser's push subscription, only if you enable it; deleted when you delete your account | Private |
| Contact message | if you use the /contact form: your name (optional), email and message, sent by email to the operator. We do not store them in the database. | Private |
| Technical / security data | a fingerprint (hash) of the IP address — not the raw IP — used to limit abuse (rate limiting) and for moderation | Internal |
What we do NOT do: we do not sell data and show no ads; we do not save Hermes conversations; we do not store the raw IP address (only a fingerprint); we do not store the year of birth — only the day and month, and only if you choose to add them to your account; we do not turn your content into semantic “embeddings” and do not use it to train models; we do not use tracking cookies without your consent; we do not build advertising profiles.
3. The public nature of public content
Thoughts in Constellations that pass moderation are public and anonymous — they appear on the shared sky and have a public link. Comments, reviews, poems and Wall fragments are public and appear with your display name. Please do not include personal data (yours or others'). Details in the Terms, section 6.
4. Why we process (legal basis — GDPR)
- Consent (art. 6(1)(a)) — for the content you choose to publish, for digest/newsletter and push subscriptions, for analytics cookies.
- Performance of the service (art. 6(1)(b)) — for your account and the features you request (collections, comments, messages, Flow anti-repetition).
- Legitimate interest (art. 6(1)(f)) — for security, moderation and abuse prevention (e.g. the IP fingerprint for rate limiting), an interest balanced against your rights.
5. Where we store data
The platform runs on Cloudflare infrastructure:
- Cloudflare D1 (database) — accounts and profiles, capsules and reactions/saves/comments, the thoughts and lights of Constellations, poems, 1:1 messages, portals, subscriptions (digest, newsletters, push) and the anonymous Flow usage data.
- Cloudflare KV — temporary rate-limiting counters (with the IP fingerprint) and live “presence”, which expire automatically.
- Cloudflare Workers AI — the AI models (Hermes, the oracle, capsule generation, moderation) run on Cloudflare; your text is processed there to generate the response/decision, in real time.
- Cloudflare Vectorize — contains only the knowledge base (cultural capsules, works of art), not users' personal content.
6. External services (processors / recipients)
- Cloudflare, Inc. — hosting, database, AI, delivery network. As a network provider, Cloudflare processes IP addresses and may generate technical logs according to its policies.
- Cloudflare (Email Service) — sending emails (login, password reset, notifications, digest, contact). Receives the email address and the content of the transmitted message. Only if you use email.
- Google Analytics 4 — anonymous traffic statistics, only if you accept cookies (banner + Consent Mode); with anonymized IP.
- Wikimedia — artwork images and audio files are loaded from Wikimedia servers; on loading, they may see your IP address.
- Open Library — book covers load from covers.openlibrary.org; on loading, their servers may see your IP address.
- TMDB (The Movie Database) — the source of film data (titles, ratings). Data is requested from our server; posters load in your browser from image.tmdb.org. We use the TMDB API but are not endorsed by TMDB.
- YouTube — trailers can play in the page via a youtube-nocookie.com player (only if you tap “watch the trailer”). Until then, nothing loads from YouTube.
Some of these providers may process data outside the EU (e.g. the USA), based on standard contractual clauses or applicable adequacy frameworks.
7. Artificial intelligence
We use AI (Cloudflare Workers AI) to generate and verify the cultural capsules (anchored on cited sources), for the Hermes guide, for the oracle in Constellations and for moderation. Your content is not turned into embeddings and is not used to train models.
Hermes — the AI guide (chatbot). The messages you write to it are sent to generate the reply and are kept only temporarily in your session, in the browser — we do not save the conversations in the database. Replies may contain errors and are not professional advice. Please do not write sensitive personal data to it.
8. How long we keep data
- Public content (thoughts, comments, poems) stays on the platform for as long as neSpus exists or until you request its deletion.
- The account and email — until you close the account / request deletion.
- Anonymous Flow usage data — at most 90 days, then deleted automatically; immediately, on account deletion.
- Digest/newsletter subscriptions — until you unsubscribe (one-click link in every email).
- Reset codes expire in 15 minutes.
- Rate-limiting counters and presence expire automatically (seconds–days).
- Analytics statistics are retained by Google according to GA4 settings.
9. Data security
We apply technical measures: irreversibly hashed passwords, optional two-factor authentication (2FA), cryptographically signed sessions (HttpOnly/Secure cookie), HTTPS-only traffic (HSTS), security headers (CSP, anti-clickjacking), IP fingerprinting instead of raw storage, abuse limiting and content moderation.
10. Your rights (GDPR)
You have the right to: access, rectification, erasure (“the right to be forgotten”), restriction of processing, objection, portability and withdrawal of consent at any time (without affecting prior processing). For any request, write to us at hermes@nespus.online; we reply within the legal deadline. You also have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP) or your local supervisory authority.
11. How to delete or access your data
- Full self-service deletion: from “My Universe” → Account → “Delete account” you can permanently and immediately erase your account and associated data: your profile and photo, capsules and thoughts, comments, reactions and saves, collections, 1:1 messages, portal participations, follows, notifications and the push subscription, plus the anonymous Flow usage history — irreversible, with no email needed.
- The email digest is a separate, email-based subscription: you unsubscribe with one click directly from any email received.
- For any other deletion/access request (including for an anonymous thought), write to us at hermes@nespus.online, ideally with the content link.
12. Data about other people and children
Do not enter personal data of other people without their consent. The platform is not directed at children under 16.
13. Cookies and local storage
Full details in the Cookie Policy.
14. Changes
We may update this policy. The current version, with the date of the last update, is the one on this page.
Document drafted in good faith based on how the application actually works; legal review in progress.