Legal
Privacy Policy
This Privacy Policy explains how Nepselens collects, uses, stores and shares information when you use our website, dashboard, analytics tools and AI assistant. Nepselens is operated by Yama Technologies Pvt. Ltd., Tirtha Ghar, Srijananagar, Bhaktapur-01, Bhaktapur, 44600, Nepal. Yama Technologies is the operator responsible for the processing described here.
1. Data We Collect
Account and authentication data
Sign-in is currently provided through Google. When you authenticate, we receive and store your Google subject identifier, email address, name, profile picture and authentication timestamps. We use this information to create and identify your account, prevent duplicate accounts and support account access.
Session data
When you sign in, we create a random session token. The raw token is stored
only in the HttpOnly nl_session cookie in your browser. We
store a SHA-256 hash of the token, the associated user ID, creation time
and expiry in our database. Sessions are used to keep you signed in and
are deleted on logout or expiry.
Technical, security and rate-limit data
We may process IP address, browser or device metadata, request timestamps and security-related request information. Authentication rate-limit counters are currently kept in process memory rather than in the account database. Our hosting and edge infrastructure may also keep standard access and security logs.
Plan and browser storage data
If you select a plan before signing in, we may temporarily store the plan
name and post-sign-in destination in browser sessionStorage.
This information is used only to complete the sign-in flow.
AI assistant data
When you use the AI assistant, the messages you submit and the dashboard data returned by the assistant's tools are sent to the configured third-party AI model provider to generate a response. The current Nepselens server does not persist assistant conversations in its account database, although the AI provider may retain data under its own policy.
Payment data
Paid plans currently use a manual order process. We store the plan, billing period, amount, order reference, status, bank/wallet transaction ID, payer name, phone number, optional payment note and timestamps so we can match the payment to your account and contact you about verification. We do not store full card, wallet PIN or bank credentials. When automated Khalti, eSewa, ConnectIPS or other gateway checkout is enabled, those providers will handle payment credentials and we expect to store only transaction identifiers, status and receipt metadata.
2. Google User Data
We use information received from Google only to authenticate you, create and manage your account, maintain your session and protect the service. We do not sell Google user data, use it for advertising, or use it to train unrelated models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
3. Cookies and Browser Storage
- nl_session: an essential authentication cookie. It is HttpOnly, SameSite=Lax, Secure in production and normally expires after 30 days.
- Google Identity Services: Google may set cookies or process data when you use its sign-in button. Google's own privacy policy applies to that processing.
- sessionStorage: temporary sign-in destination and plan selection data used during the current browser session.
Nepselens does not currently use advertising cookies or third-party analytics. If these are introduced, this policy will be updated and any required consent mechanism will be provided.
4. How We Use Information
- create, authenticate and manage your account;
- maintain your signed-in session and remember applicable preferences;
- provide charts, analytics, reports and the AI assistant;
- protect accounts and infrastructure through rate limits and security controls;
- respond to support, privacy and legal requests;
- process payments and manage plans when paid checkout is enabled;
- comply with legal obligations and enforce our Terms of Service.
5. Sharing and Processors
We do not sell personal information. We may share information with service providers that help us operate the service, including Google for authentication, hosting and database providers, the configured AI model provider, and payment processors when paid checkout is enabled. These providers process information under their own terms and privacy policies.
We may also disclose information if required by law, to protect rights or safety, to investigate abuse, or as part of a merger, acquisition or transfer of the service. We do not share Google user data for advertising or with data brokers.
6. International Processing
Our service providers may process information in countries other than Nepal. Where required, we will use appropriate safeguards for international transfers. By using the service, you understand that information may be processed outside your country of residence.
7. Retention
Account data is retained while your account is active and for a reasonable period afterward for security, legal and operational purposes. Sessions are deleted on logout or expiry and expired sessions are periodically removed. Rate-limit counters expire quickly and are not used as a permanent account record. Access logs are retained according to our hosting and security practices.
Assistant requests are processed to generate a response; the current app does not store conversation history in its account database. Payment and tax records, when applicable, may be retained for the period required by law. Backup copies may remain for a limited period after deletion.
8. Your Rights and Choices
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal information, or to request a portable copy. You may also withdraw consent where processing is based on consent. Contact [email protected] to make a request. We may need to verify your identity before acting. You may also complain to your local data protection authority.
You can log out of your current session from the account menu. To request deletion of your Nepselens account, contact us at the address above.
9. Security
We use HTTPS in production, hashed session tokens, restricted database access and rate limiting for authentication. No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed or lost. Protect your Google account with strong authentication and notify us if you believe your Nepselens account has been compromised.
10. Age and Children
Nepselens does not impose a strict minimum age, but we recommend that users be at least 16 years old. If you are below the age of majority in your jurisdiction, use the service only with the consent and supervision of a parent or legal guardian. If you believe a minor has provided personal information without appropriate consent, contact us so we can review and, where appropriate, delete it.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes to the service, law or our data practices. The revised policy will be posted here with a new effective date. If a change materially affects your rights, we will take reasonable steps to notify you.
12. Contact
Privacy questions and requests can be sent to [email protected].
Yama Technologies Pvt. Ltd.
Tirtha Ghar, Srijananagar, Bhaktapur-01
Bhaktapur, 44600, Nepal