Natuqo privacy notice
Version R1.2 — 1 October 2026.
1. Controller and contact
The controller for operating this website and handling correspondence is Bartosz Fiałek, who personally runs the Natuqo project. Contact address: ul. Żołnierzy I Armii Wojska Polskiego 10 lok. B6, 81-383 Gdynia, Poland. Contact, including privacy enquiries: hello@natuqo.com.
This notice covers the presentation website for hotels, the free fictional demo and enquiries about cooperation. The service does not handle payments, bookings, user accounts or real hotel deployments.
2. What data is needed and why
Your browser sends hosting requests when opening pages, downloading files and checking quest status. Technical data may include your IP address, request time, resource address, response code and browser information. It is used to deliver and secure the website and investigate errors. The basis is the controller's legitimate interest — GDPR Article 6(1)(f).
If you email us, we receive your sender address, date, message and any details or attachments you choose to provide. We use these to reply and handle the matter, including communicating with a hotel representative — GDPR Article 6(1)(f). Steps before entering a contract requested by the individual who would be the contracting party rely on Article 6(1)(b). Compliance with legal obligations, including applicable data rights requests, relies on Article 6(1)(c). Necessary establishment or defence of claims relies on Article 6(1)(f).
Providing correspondence data is optional; a reply needs a contact method and the information necessary to handle the matter. Do not send hotel guests' or other people's data unless needed. There is no newsletter, profiling or automated decision-making with legal effects.
3. Progress, notes and browser storage
The demo stores your chosen quest and its version, answers, stage, completion, activity time and optional note locally. This supports resuming quests and making a keepsake. Progress and notes are not automatically sent to the operator or a hotel. Tabs of the same website in the same browser may share progress. There is no cross-device synchronisation.
Progress uses the browser's IndexedDB database; language preferences use localStorage. Downloading content for offline use relies on browser caching. These mechanisms support your selected features, not advertising or tracking.
Progress and notes expire after 30 days of inactivity and are removed when the app next processes stored data. A closed app does not run automatic deletion. The browser may remove data sooner, for example when storage is cleared. Language and downloaded resources remain until removed in the app or browser, or by the browser itself; the 30-day period does not apply to them.
Resetting a quest removes its progress and note. “Delete this property's data” also covers its language and downloaded content. Technical markers without answers or notes may remain to prevent an older tab from restoring deleted content. You can remove all website data in your browser settings.
If persistent storage is unavailable, the app warns you and may work in the current page's memory; progress may disappear on reloading or closing the page. Someone with access to your browser profile may see local data. The operator has no copy, so you manage it on your own device.
4. Keepsakes and sharing
The PNG keepsake is generated on your device. Your note is excluded until you choose to include it. Completing a quest does not send the file. You initiate downloading or choose a sharing app, which processes supplied data under its own terms. Removing Natuqo data does not remove PNG files saved in files, photos, email or recipients' systems.
5. Hosting, email and recipients
We use OVHcloud PRO hosting in the Gravelines region of France (eu-west-gra), without the CDN service enabled. The hosting provider handles technical data. Provider logs relate to the shared hosting service, rather than a separate system collecting Natuqo progress.
hello@natuqo.com is a business mailbox provided by OVHcloud. Current correspondence and replies are handled through this mailbox; forwarding to personal Gmail has been disabled. Message delivery and storage involve processing by the email provider. Displaying an email address or clicking its link does not itself send a message.
Earlier correspondence may remain in the Gmail account previously used by the operator, subject to the retention periods in section 6. Disabling forwarding does not erase historical messages. Any such data remains subject to Google’s privacy policy and data transfer safeguards. We do not claim that all email data is stored exclusively in the EEA.
OVHcloud and its authorised subprocessors process data within the supplied services; the provider may also process necessary data for its own obligations and security. Provider information: OVHcloud data protection. Competent authorities may also receive data where required by law.
6. Retention
- Ordinary enquiry correspondence: no longer than 12 months after the last message concerning the matter. This allows discussions to resume in the next hotel season. The operator reviews correspondence and removes expired messages; archiving is not deletion.
- Records of specific obligations or claims: only as necessary, for the period required by the applicable legal obligation or until the relevant claim's limitation period expires, and where a dispute is ongoing, until its final resolution and expiry of the relevant periods. The need for continued retention is reviewed every 6 months. This does not mean retaining the entire mailbox indefinitely.
- Log extracts downloaded by the operator: we do not maintain a standing archive of raw logs. Extracts needed to investigate a particular error or incident are removed no later than 30 days after the matter is closed and, in any event, within 6 months of downloading. Only material needed for a specific legal obligation or actual dispute is excepted, under the claims rule above.
- Progress and notes: 30 days of inactivity, removed on next use; language, downloaded resources and exported PNG files follow sections 3 and 4.
OVHcloud technical data: its retention is not set by the Natuqo app. Criteria for needing this processing are completion of the particular request or message delivery, resolution of an error or incident, and the provider's applicable obligations. OVH's processing terms link processing to the service scope and contract duration. Public documentation does not specify one rotation period for all raw logs and email delivery queues. Our correspondence and extract deadlines do not mean these infrastructure records are automatically erased by OVH. You may contact the operator about specific data; where necessary, we handle the request with the provider's assistance.
Reports and the end of hosting: under OVH's hosting terms, visit reports based on anonymous, aggregated data are available in the control panel for up to 40 months. This is not a retention period for identifiable logs or quest records. The same terms provide for hosted data to be removed no later than 45 days after the service expires; this does not mean each visit or message is erased after 45 days while the service remains active. Copies of website files do not contain users' progress or private notes, which stay local.
The operator applies the correspondence retention periods to the active OVHcloud mailbox and any historical messages in the previously used Gmail account, including relevant Trash folders and local mail copies. Deleting a message from an account does not necessarily erase all provider backups immediately. Provider processing follows the applicable service terms; for historical Gmail data, see message deletion and Google’s retention policy.
7. Your rights
Where applicable, you have rights of access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests. The rights available depend on the basis and circumstances of processing. You may also complain to the President of Poland's Personal Data Protection Office: uodo.gov.pl.
Send a request to hello@natuqo.com or the address in section 1. An ordinary technical report does not require an identity document. If identity verification is necessary to exercise a specific right, we will ask only for the information needed.
8. Forms, analytics and changes
This version has no external forms, newsletter, advertising cookies or application analytics tools. It does not embed Google Maps or Gmail. We do not collect quest-start or completion statistics from users; hosting logs and reports are described separately. When you follow an external link, that provider's rules also apply.
Changes to this notice are dated and versioned. New features or real hotel deployments will be described before they launch.