Privacy Policy

Flick Technology LLC (“Company,” “we,” “us” or “our”) operates Nelvayo. This Policy explains how personal information is handled through this pre-launch website, its email waitlist and related communications. It describes current website activities, not the complete data practices of a future financial app.

At a glance: registering gives us your first name, email, selected country and recorded choices. We use them to manage the waitlist and send the messages you request. We use service providers for storage, delivery and website operations. We do not sell personal information or use the website for cross-context behavioral advertising. You can unsubscribe or contact us about your information.

1. Who is responsible

Flick Technology LLC is responsible for the website and waitlist activities described here. Nelvayo is its product brand. Where applicable law uses the term “controller,” the Company acts as controller for those activities.

Address privacy questions and requests to hello@nelvayo.com, using “Privacy request” in the subject. This is the Company’s privacy contact channel; naming it does not represent that a statutory data protection officer or local representative has been appointed.

2. Scope and future products

This Policy covers visitors, waitlist subscribers, people who contact us and authorized website administrators. It covers information held in our website systems and relevant operational records, including exports used to administer the waitlist.

The website does not open a wallet, connect a bank account, perform financial identity verification or place trades. Product descriptions do not mean that waitlist information is automatically sent to wallet, payment or brokerage providers. Before a future service collects additional data or uses it for a different purpose, the relevant operator, notice and permissions must be provided as required.

A link to X or another external service opens a separate website. That service may receive your IP address, browser information and information you choose to provide under its own policies. Our public social links are links, not embedded social tracking widgets.

3. Information and its sources

• Information you submit: your first name, email address and selected country. If you contact us, we receive your message, contact details, attachments you provide and our correspondence.
• Registration and preference records: subscriber identifier, registration time, subscription status, email permission, confirmation of adult eligibility and Terms acceptance through the form, document versions and acceptance time. The form records an affirmation; it does not verify your date of birth or identity.
• Technical and abuse-prevention information: IP address and request information used to serve pages, limit requests and detect misuse; form-submission timing and a hidden anti-bot field. Hosting infrastructure may process browser or device details, requested URLs, request times, response status and diagnostic logs.
• Email records: address, message content, recipient and provider identifiers, campaign records, sending times, status and errors. Our email provider also processes delivery-related events and may process engagement events depending on tracking settings, as explained below.
• Administrative records: session and sign-in information for authorized administrative access, used to protect registration data and manage authorized actions.

Information comes directly from you, from requests made by your browser, from records created by our systems and from providers performing the activities described here. The waitlist does not currently enrich profiles with purchased marketing lists or data-broker records. Selected country is supplied by you; the form does not request precise GPS location.

4. Required and optional information

The registration form requires a first name, valid email, country, adult/Terms confirmation and permission to receive Nelvayo updates. The waitlist is an email notification service: without those required entries, we cannot complete registration through the form. You can browse the public website without joining or agreeing to marketing emails.

You do not need to provide financial credentials, identity documents or a detailed personal history to join. Information you volunteer in a separate inquiry depends on your request. Please provide only what is needed to handle it.

Terms acceptance and email permission are separate choices. Acknowledging that you have read this Policy is not blanket consent to every possible use of data, international transfer or future financial service. No preselected checkbox is used for those registration choices.

5. Purposes and legal bases

• Manage requested registration: maintain the list, identify duplicate addresses, record preferences and provide the requested notification service.
• Communicate: send a welcome message, product updates and launch notifications with your email permission; respond to your inquiries.
• Plan availability: review registration totals, trends over time and country-level interest. These internal summaries support launch planning rather than advertising profiles.
• Operate and protect the website: deliver pages, troubleshoot failures, authenticate administrators, limit abusive requests and investigate misuse.
• Honor choices and legal duties: process privacy requests, preserve evidence of permissions and agreements, prevent unwanted email, comply with applicable law and establish or defend legal claims where necessary.

Where a legal basis is required, consent supports marketing messages; legitimate interests, subject to the required balancing of rights, may support proportionate security, administration, basic planning and handling inquiries; and legal obligations support processing the law requires. Performance of an agreement may apply only to processing objectively necessary to provide a requested service, not merely because a purpose is mentioned in Terms.

You may withdraw consent for future consent-based activity. Where legitimate interests are relied on, the relevant interests are protecting the website and its users, managing requested relationships and operating the pre-launch service. Applicable objection and other rights remain available. New incompatible purposes require appropriate notice and any further lawful basis or permission required by law.

6. Providers and authorized access

• Database storage: Turso stores the waitlist, document acceptance and campaign records used by the website.
• Email delivery: Resend processes recipients, message content and delivery information to send our emails.
• Hosting and delivery: hosting infrastructure, including Vercel when used for deployment, processes web requests and relevant technical logs to deliver and protect the site.
• Abuse prevention: request limits operate in server memory or, when configured, through Upstash infrastructure using IP- or email-based identifiers and request timestamps.

Authorized Company personnel may access information to administer the waitlist, handle requests and perform the purposes described here. The administration tools can export registration records; an export remains personal information subject to this Policy and applicable protections.

Providers may use subprocessors for their services and may separately process limited operational information for their own lawful purposes under applicable terms. Whether a provider acts as a processor or an independent controller depends on the activity and law. A provider’s name is not a guarantee of any particular storage region, certification or legal transfer mechanism.

7. Other permitted disclosures

Information may be disclosed to professional advisers where needed for advice, compliance or claims; in response to valid legal process or an applicable legal obligation; or where reasonably necessary and lawful to investigate fraud, protect rights or address a security incident. We do not treat a general request from another party as automatic authority to disclose personal information.

A proposed or completed financing, merger, acquisition, reorganization or business transfer may involve relevant information, subject to appropriate confidentiality, purpose restrictions and applicable notice requirements. A transfer of business does not cancel existing privacy obligations or automatically permit incompatible uses.

We may also disclose information at your specific direction or with valid permission. Joining the waitlist does not authorize unrelated companies to market to you.

8. Sale, sharing and advertising

We do not sell personal information, share it for cross-context behavioral advertising or use this website for targeted advertising based on activity across unrelated services. We do not offer a financial incentive or differentiated price in exchange for the sale of waitlist information.

Necessary disclosures to storage, email and hosting providers are described above; “we do not sell” does not mean that no provider processes information. If our practices change, the applicable disclosures, opt-out mechanisms and any required consent must be in place before the new activity begins. This Policy does not waive any right to object to marketing.

9. Cookies and browser signals

The public website does not currently implement advertising cookies, visitor profiling through local storage or a third-party behavioral analytics script. The administrative area uses an essential HTTP-only session cookie, nv_admin, with an eight-hour lifetime. It authenticates administrators and is not a public advertising identifier. Hosting services may apply technical security and delivery measures under their configurations.

Our code does not currently change public-site behavior in response to the browser “Do Not Track” signal. We do not conduct the sale or advertising sharing that a Global Privacy Control opt-out would disable. We will respect legally applicable opt-out signals if an activity requiring that response is introduced. Turning off cookies in your browser may affect administrative sign-in or provider functionality.

Visiting a linked third-party site is subject to that site’s own settings. We will not treat acceptance of website Terms as permission to install non-essential tracking where a separate choice is required.

10. Email delivery and tracking

Sending an email requires sharing the recipient address and message with the delivery provider. The provider processes delivery events such as acceptance, failure, bounce or complaint. For launch campaigns, our database stores message identifiers, sending results, errors and timestamps to avoid duplicate sends and investigate problems.

Resend also supports open and link-click tracking when enabled in its sending configuration. Open tracking may use a small remote image; click tracking may route a link through a measurement address. If enabled, those mechanisms can associate an interaction and technical request information with a message. They are distinct from the fact that an email was sent or delivered.

The website’s waitlist administration does not use open or click events to make eligibility decisions. Provider-level engagement settings must be considered separately from website cookies. Any non-essential measurement that requires consent or another permission under applicable law must not be used without it; this notice alone does not supply that permission.

Email illustrations and logos may be loaded from our website when your email client displays remote content. Such a request can generate an ordinary hosting log even without an engagement pixel. Your email client may let you block remote images or link tracking; those controls do not withdraw your subscription by themselves.

11. Unsubscribe and communication choices

Use the unsubscribe link in our emails or write to hello@nelvayo.com to stop waitlist updates and launch messages. You do not need an account, password or payment. Our ordinary link opens a confirmation page; submitting the confirmation removes email permission. Supported email providers can also submit a one-click unsubscribe request.

The unsubscribe link contains a signed subscriber reference that allows the preference change without a login. Treat your link as private: anyone with it may be able to unsubscribe that address. The link does not display your full waitlist record or authorize access to administrative tools.

Once processed, the record is excluded from future waitlist campaigns. A message already transmitted may still arrive. Re-entering the same address in the form does not silently reactivate an unsubscribed record. Contact us if you want to discuss resubscription.

Unsubscribing stops marketing; it does not automatically delete every record. We may retain a suppression record and relevant history to respect your choice. We may still answer an inquiry you initiate or send a communication the law requires, without using that exception to continue marketing.

12. Retention and deletion

Retention is limited by the purposes for which information is needed, applicable requirements and the circumstances of the record. We do not assign an invented universal expiry to all data or treat registration as permission to retain it indefinitely for unrelated purposes.

• Active waitlist records: retained while reasonably needed to operate the waitlist and provide requested communications, considering whether the launch program is active and the person remains subscribed.
• Preference and agreement records: retained as reasonably needed to demonstrate choices, prevent unwanted contact and resolve a relevant dispute. An unsubscribe record may need to outlast active communications.
• Delivery and technical records: retained for delivery reliability, abuse prevention, diagnostics and applicable legal needs, subject to provider settings. A rate-limit window is not a statement that every related log is deleted at that time.
• Correspondence and request records: retained as necessary to respond, document the outcome and address follow-up or legal obligations.

When a purpose ends, information must be assessed for deletion, de-identification or limited retention under a valid exception. Deletion requests may require action in the database, email provider, relevant exports and other affected records. Backup copies may remain until their normal replacement cycle, with appropriate limits on reuse. A deletion request is not a promise that all backups disappear immediately.

We may retain information required by law or reasonably necessary for a specific claim, security issue or opt-out obligation. Such an exception does not authorize unrestricted reuse. Contact us for the criteria applicable to your record or to request deletion.

13. International processing

Information may be processed in the United States and other countries where the Company or its providers operate. Storage location, access location and a provider’s incorporation can be different. This website does not promise that all information remains in the country selected in the registration form.

Where an international transfer is restricted by applicable law, it requires a valid mechanism and any necessary safeguards. Depending on the actual arrangement, these may include an applicable adequacy decision or approved contractual safeguards with any supplementary measures required. This Policy does not claim that a particular mechanism, certification or agreement is already in place for every provider.

You may request information about safeguards relevant to your information and a copy where applicable, subject to lawful redactions. Browsing the site or agreeing to Terms is not a waiver of international-transfer protections or blanket consent to a restricted transfer.

14. Security and incident handling

The website uses restricted administrative access, authenticated sessions, validation and abuse-prevention controls. Sensitive service credentials are kept on the server rather than intentionally exposed in browser code. No system is completely secure, and these measures are not a certification, independent audit result or guarantee that an incident cannot occur.

If you suspect improper access or disclosure, contact hello@nelvayo.com with a description that avoids unnecessary personal data. Do not send passwords or private keys. We will assess relevant reports and comply with applicable incident-response and notification duties. Contractual website limitations do not remove non-excludable privacy or security obligations.

15. Automated processing

Automated validation, hidden anti-bot fields, submission timing checks and rate limits can reject or filter a registration. These measures protect the list and delivery systems; a blocked form is not a credit, investment or financial eligibility decision.

The website does not use waitlist data to make decisions with legal or similarly significant effects solely through automated processing, nor does it build an advertising profile across unrelated websites. Contact us if you believe a legitimate request was filtered so we can review the issue.

16. Privacy requests and verification

Depending on applicable law, you may request access or a copy, correction, deletion, restriction, portability, withdrawal of consent or an objection to particular processing. Rights can have conditions and exceptions. You can raise a question even where a particular statutory regime does not apply; describing a right here does not establish that every regime applies to the Company.

Send requests to hello@nelvayo.com. Identify the email used for the waitlist and the action requested. We may seek proportionate verification or evidence of an agent’s authority before disclosing or changing records. We do not require you to create a financial account or pay to unsubscribe. Do not send government ID unless we explain a specific necessity and a secure method.

We will respond within the timeframe required by applicable law and explain a permitted extension, refusal or exemption. Requests are generally handled without charge; a charge or refusal for an excessive or unfounded request is available only where the law permits it. A response must not disclose another person’s information without authority.

Where an appeal right applies, reply to the decision or email us with “Privacy appeal” and explain your concern. You may also contact a competent regulator or seek a remedy available under law. Contacting us first is not a prerequisite to a protected complaint. We will not retaliate for exercising applicable rights.

17. EEA, UK and Swiss visitors

Where the GDPR, UK GDPR or applicable Swiss data protection law applies, the controller, purposes, recipient categories, retention criteria and transfer information above are relevant to that processing. Lawful-basis analysis and transfer safeguards depend on the actual activity; mentioning a jurisdiction does not certify compliance or establish representation there.

Applicable rights may include access, rectification, erasure, restriction, portability and objection, subject to their conditions. You can withdraw consent for future consent-based processing. For direct marketing, you may object at any time without charge. Where processing relies on legitimate interests, you may object based on your circumstances; any continuation must satisfy applicable legal requirements.

You may complain to the competent data protection authority, including where relevant an authority in your habitual residence, workplace or the place of an alleged infringement. UK visitors may contact the Information Commissioner’s Office; Swiss visitors may contact the Federal Data Protection and Information Commissioner. We will provide legally required local representative or officer details if an appointment is required for the actual operations.

18. California and other U.S. residents

For the website activities described here, relevant categories include identifiers and contact details; selected country; internet or technical activity; correspondence; subscription and agreement records; and email-delivery information. Sources, purposes, recipients and retention criteria are described above. Technical IP addresses may indicate an approximate area, but the form does not request precise geolocation.

Where the California Consumer Privacy Act or another applicable state privacy law covers the Company and the activity, you may have rights to know or access, correct, delete and obtain a portable copy, opt out of sale or specified advertising or profiling uses, and receive non-discriminatory treatment. Authorized-agent, appeal and sensitive-information rights apply where provided by law. We do not claim that statutory coverage thresholds are met solely by listing these rights.

We do not sell information or share it for cross-context behavioral advertising, including information of people known to be under 16. We do not use or disclose sensitive personal information for the purpose of inferring personal characteristics. These statements do not imply that children are eligible for the waitlist or that no sensitive information could arrive unsolicited in correspondence.

Use the request channel in section 16. We do not require a waiver of privacy rights as a condition of submitting a request. If an applicable law requires additional notices, choices or response procedures, those requirements continue to apply.

19. Children and sensitive information

The waitlist is intended for people aged 18 or older and asks registrants to confirm adult eligibility. We do not knowingly solicit children’s information. An age checkbox is not identity verification. If you believe a child registered, contact us so we can investigate and take appropriate steps, including deletion where required.

Please do not provide private keys, recovery phrases, financial credentials, government identification, health information or other unnecessary sensitive details. If you send information about someone else, you must have the authority required to do so. Receipt of unsolicited information does not give us unlimited permission to use it.

20. Changes, versions and contact

This Policy is identified by the updated date above and privacy revision 2026-09-22.2. Registration records the version presented to you. Keeping that record is evidence of the notice shown and choices made, not a replacement for a valid legal basis.

We may update the notice when actual practices or applicable requirements change. Material changes require appropriate notice and any further permission the law requires before incompatible new uses of existing information. A newly posted policy does not retroactively create consent.

Contact Flick Technology LLC at hello@nelvayo.com with questions or requests. The Legal Notice identifies the website operator and product scope, and the Terms of Use address website use. Neither document overrides rights that privacy law does not allow you to waive.