Privacy Policy

1. Controller

Referent Software S.L., trading as Nobs, NIF B93952711, is the data controller. Address: Carretera Matanza, 6, 42330 San Esteban de Gormaz, Soria, Spain. Contact: hello@nobsengineers.com; +34 711 286 187.

2. Data we process

Depending on how you use Nobs, we process:

• contact, identity, organisation, billing, tax and country information;
• the fixed-price build you select and information you provide for discovery;
• checkout acceptance, legal-document versions, timestamps, payment status, invoice and booking information;
• security and technical data such as IP address, user agent, session identifiers, request logs and Turnstile signals.
• on selected build and discovery pages and with your consent, page paths, referrer, campaign labels, browser and device information, and selected site actions used for audience analytics.
• on the same pages and with the same consent, a sampled recording of your visit and aggregated click and scroll positions; what you type into input fields is masked and is not recorded.

3. Why and on what legal basis

We process data to take pre-contractual steps; prepare the selected offer and discovery agreement; perform the discovery contract; process payment, invoicing and booking; secure the service; comply with tax, accounting and legal duties; and establish or defend claims.

• Contract and pre-contractual steps: selected offer, discovery, booking and service communications.
• Legal obligation: tax, accounting, invoicing and lawful requests.
• Legitimate interests: security, abuse prevention, service reliability and B2B communications, balanced against your rights.
• Consent: self-hosted audience analytics, session replay and heatmaps on selected build and discovery pages, and any other optional processing for which consent is requested; you may withdraw it prospectively.

4. Service providers and recipients

We use processors only as needed to operate the service:

• Cloudflare for hosting, storage, security, queues, logs and Turnstile bot protection;
• Stripe for checkout, fraud prevention, tax calculation, payment and invoices;
• Google Workspace for transactional email;
• Cal.com for calendar booking, scheduling and related service communications;
• our self-hosted Umami instance at umami.referentsoftware.com for consented website analytics; it is operated by the same legal entity as Nobs rather than an independent analytics provider.

5. International transfers

Some providers may process data outside the EEA. Where required, we rely on an adequacy decision, EU Standard Contractual Clauses and supplementary safeguards. Contact us for information about the applicable safeguard.

6. Retention

We keep data only as long as needed, subject to legal holds and claims:

• active booking session identifiers: up to 24 hours;
• unpaid or unconverted offer and booking records: up to 90 days after the last activity;
• paid discovery, payment, invoice and accepted agreement records: generally six years under Spanish commercial recordkeeping rules, and longer only where required for a claim or legal duty.
• aggregate Umami analytics: up to 12 months;
• session replay recordings and heatmap data: up to 30 days;
• your analytics preference in your browser: up to 180 days, after which we ask again.

7. Cookies, local storage and analytics choices

We use storage and cookies necessary for session security, offer continuity, checkout and bot protection. We also store your analytics choice in your browser for up to 180 days so we can respect it.

Umami analytics loads only after you accept analytics on selected build and discovery pages of the production website. It does not load on the homepage, work pages, blog, legal pages or transactional pages. Umami does not identify you by name, and we do not send form values, Cal booking details, full query strings, advertising click identifiers or arbitrary search parameters. Campaign reporting uses only short, allowlisted UTM labels. You can change your choice at any time using the Analytics preferences control at the end of this section. Withdrawing consent stops future analytics processing on your next page load.

On those same pages, and only after you accept, we also record a sample of visits and collect aggregated click and scroll positions. A recording captures page content and pointer and keyboard activity, with input fields masked so that what you type is not recorded. Roughly one visit in seven is recorded, a recording stops after five minutes, and the booking and checkout screens are supplied by Cal.com and Stripe and are not captured. Recordings are reviewed only to understand how the build and discovery pages are used.

We do not sell personal data, build advertising profiles or use analytics for cross-context behavioural advertising.

8. Proposal decisions

Published build pages use predefined scope, price, timeline and milestone configuration. They do not use automated systems to price or scope your project. An engineering engagement requires discovery and a separate written agreement.

9. Your rights

You may request access, rectification, erasure, restriction, portability, or object to processing, and may withdraw consent, by emailing hello@nobsengineers.com. We may need to verify your identity. Rights can be limited where we must retain records or establish or defend claims.

You may complain to the Spanish Data Protection Agency (AEPD) at aepd.es, or to the competent supervisory authority where you live or work. Please contact us first if you would like us to resolve a concern.

10. Security and required information

We use access controls, encryption in transit, short-lived booking sessions, isolation, rate limiting and audit records appropriate to the service. No system is completely secure. Fields marked as required are needed to provide the requested service; without them we may be unable to prepare the agreement, take payment or book discovery.

11. Children and third-party data

The service is intended for adults and business users, not children. If you provide another person’s data, you must have authority and give them this policy where required.

12. Changes

We may update this policy to reflect legal, provider or service changes. The current version and effective date appear on this page; the version linked to a paid checkout is retained with that agreement.