Submit a problem

NikaliSoft legal document

Proposal Privacy Notice

How personal data contained in a business-problem proposal is processed under the GDPR.

Version
1.0
Status
Active
Effective date
2026-08-29
Last updated
2026-08-29

1. Who is the controller

The controller for the processing described here is Nikali Ltd, a Bulgarian single-member limited liability company (ЕООД), registered in the Commercial Register and Register of Non-Profit Legal Entities maintained by the Registry Agency of the Republic of Bulgaria under UIC 207724645, VAT number BG207724645, registered at 8 Belite Borove St., Gorna Banya, Sofia, Bulgaria. NikaliSoft is a commercial brand operated by that company; the controller is Nikali Ltd, not the brand.

Privacy contact: nikalisoft@gmail.com.

2. What this notice covers

This notice covers:

  • data submitted through the proposal form;
  • evaluation of a proposal;
  • proposal-related communication;
  • evidence of the policy versions accepted;
  • abuse prevention;
  • minimal security events.

It does not govern any future independent product. Each product has its own privacy notice.

3. Categories of data

  • company legal name;
  • country of registration;
  • registration or VAT number;
  • company website;
  • company size;
  • contact name;
  • role or job title;
  • business email address;
  • problem description;
  • current process;
  • business impact;
  • who is affected;
  • market reasoning and evidence;
  • existing alternatives;
  • affected industries;
  • described partner contribution;
  • pilot-user availability;
  • readiness statements;
  • additional context;
  • the declaration text and the accepted policy versions;
  • timestamps;
  • the proposal reference code;
  • idempotency data used to prevent duplicate submissions;
  • a pseudonymous, salted, daily-rotating rate-limit fingerprint;
  • minimal security events (for example: received, rejected, rate-limited).

The NikaliSoft application database does not store raw IP addresses or full user-agent strings for proposal submissions.

Hosting and security providers may nevertheless process ordinary connection data in their own infrastructure logs, as is normal for any website.

4. Where the data comes from

  • the submitting representative, through the form;
  • technical security controls operating on the submission;
  • later correspondence about the proposal.

5. Purposes and legal bases

Proposal evaluation and response

To receive, assess and clarify a proposal and decide whether to continue.

Legal basis: legitimate interests under Article 6(1)(f) GDPR in evaluating B2B product opportunities; and Article 6(1)(b) GDPR where processing is necessary for steps requested by a data subject before entering into a contract and that basis applies.

Company and authority verification

To confirm EU-company eligibility, confirm the representative's authority and prevent misleading submissions. Legal basis: legitimate interests under Article 6(1)(f) GDPR.

Policy acceptance records

To prove which terms were acknowledged and accepted at submission, handle disputes and maintain legal records. Legal basis: legitimate interests under Article 6(1)(f) GDPR, and a legal obligation under Article 6(1)(c) GDPR where applicable.

Security and abuse prevention

For rate limiting, bot prevention, duplicate prevention and system security. Legal basis: legitimate interests under Article 6(1)(f) GDPR.

Consent is not used as the general legal basis for the processing required above.

6. Our legitimate-interest assessment in short

NikaliSoft needs to evaluate genuine business opportunities and protect the service from abuse. The data involved is limited professional business-contact information supplied deliberately by a company representative, and confidential material must not be submitted at all. We consider that balance reasonable. You can object to processing based on legitimate interests, and we will stop unless we have compelling legitimate grounds that override your interests, or the processing is needed for legal claims.

7. Required and optional information

Most fields are required, because a proposal cannot be evaluated without a clear description of the company, the problem, the market reasoning and the intended contribution. If required information is not provided, the form cannot be submitted.

Optional fields are the company website, company size, available evidence, affected industries and additional context. Leaving them empty does not prevent submission.

8. Recipients and processors

Data may be made available to the following categories of recipient:

  • the Lovable Cloud platform and the hosting and database infrastructure it uses;
  • Lovable's managed transactional email infrastructure, which processes the internal notification message and its delivery data;
  • Google, as the provider of the Gmail inbox that receives the internal notification;
  • security and technical service providers protecting the website;
  • professional legal, accounting or technical advisers, where necessary;
  • competent authorities, where legally required.

After a proposal has been stored successfully, a minimal internal notification is sent to a mailbox controlled by NikaliSoft. That notification contains only the reference code, the submission date and time, the legal company name, the country, the professional contact name, role and business email address, and the problem title. The full proposal is never sent by email; it is reviewed only inside the secured Lovable Cloud data environment.

Delivery is handled by Lovable's managed transactional email infrastructure. The receiving mailbox is a Gmail inbox controlled by NikaliSoft, so Google may process ordinary email metadata and message content in its role as the receiving email provider. The purpose is internal proposal administration, and the legal basis is NikaliSoft's legitimate interest in reviewing and responding to business-to-business proposals. No automated email is sent to the person submitting a proposal.

The notification is attempted only after the proposal has been stored. If the notification cannot be sent, the proposal, its reference code and the record of the accepted document versions are unaffected.

NikaliSoft does not sell proposal personal data.

9. International transfers

The project database holding proposals is hosted in the European Union (AWS eu-west-1, Ireland). Proposal content is reviewed inside that environment and is not exported to other systems. The website itself is delivered from a global edge network, and the internal notification email passes through managed email infrastructure, so some processing — request handling, delivery and technical logging — may take place outside the European Economic Area.

Where a provider or one of its sub-processors processes personal data outside the European Economic Area, the transfer relies on the mechanism set out in that provider's applicable contractual documents — an adequacy decision, the European Commission's Standard Contractual Clauses, or another valid mechanism. NikaliSoft does not claim that all processing remains exclusively within the European Union, and does not claim any transfer mechanism that it has not verified.

10. Retention

The following retention periods apply:

  • Proposals that do not lead to a partnership or product: up to 24 months from receipt, after which they are deleted or irreversibly anonymised.
  • Proposals leading to a signed agreement: the duration of the contractual relationship and up to 5 years after it ends, unless applicable law requires a longer period.
  • Policy acceptance and audit records: the same period as the related proposal, except where minimal information must be kept to establish, exercise or defend legal claims.
  • Salted security fingerprints, rate-limit records and related technical security data: a maximum of 30 days, and shorter where technically sufficient.
  • Financial, accounting and tax documents arising from a later contractual relationship: the longer period required by applicable accounting and tax legislation, and only where a contractual relationship actually arises. Such documents are never part of the initial proposal submission.
  • Session draft in your browser: the current browser session only.
  • Infrastructure logs: the retention period applied by the infrastructure provider.

Deletion and anonymisation are carried out by the operator as a manual administrative step: the records concerned are identified in the secured data environment and removed or irreversibly anonymised there. There is currently no scheduled job that erases expired proposals automatically, so this notice does not claim automatic deletion.

Data may be kept longer where necessary for:

  • establishing, exercising or defending legal claims;
  • investigating fraud or abuse;
  • complying with a legal obligation;
  • handling an active dispute.

11. Automated decision-making

NikaliSoft does not use solely automated decision-making to accept or reject product proposals. Technical validation, spam protection and rate limiting are protective measures and are not commercial acceptance decisions.

12. Your rights

Subject to the conditions and limitations in the GDPR, you may request:

  • access to your personal data;
  • rectification of inaccurate data;
  • erasure;
  • restriction of processing;
  • objection to processing based on legitimate interests;
  • data portability, where that right applies;
  • withdrawal of consent, where processing actually relies on consent.

These rights are not absolute; each has legal conditions and exceptions. You may also lodge a complaint with the competent supervisory authority — see section 15.

13. Security

Protective measures include:

  • authoritative server-side validation of every submission;
  • restricted database access with no public read path for proposals;
  • records of the exact policy version accepted;
  • rate limiting against abuse;
  • data minimisation;
  • no storage of raw IP addresses in the application database.

Operational thresholds, secrets and algorithm details are deliberately not published.

14. How the form actually behaves

  • While you fill the form, your answers are kept only in your own browser, in session-scoped storage, and are cleared when the browser session ends.
  • Declarations and policy acceptances are never saved and never restored from that draft; they must be given again by a person.
  • Nothing is stored in our systems until you actually submit; an abandoned draft never reaches us.
  • The form contains a hidden anti-bot field. Its value is only checked during submission and is never stored.
  • A submitted proposal is stored in the Lovable Cloud database used by this website.
  • After the proposal has been stored, an internal notification email is sent to a mailbox controlled by NikaliSoft. The recipient address is fixed in server code and can never be supplied or changed from the browser.
  • That email is an internal alert only; it never replaces the stored proposal, and if it fails, the stored proposal and its reference code are unaffected.
  • No automatic confirmation email is sent to the person submitting a proposal; any reply is written manually.
  • This website runs no advertising, analytics or tracking services, and processes no payments.

15. Contact and complaints

Privacy contact: nikalisoft@gmail.com.

Competent supervisory authority: Commission for Personal Data Protection (CPDP), Republic of Bulgaria, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, kzld@cpdp.bg, https://cpdp.bg/en/. The controller is established in Bulgaria, so the CPDP is the authority of the controller's establishment. You may also lodge a complaint with another competent supervisory authority in the European Union where the GDPR gives you that right.

Document identity

Document: Proposal Privacy Notice. Version 1.0. Published by Nikali Ltd, which operates the NikaliSoft brand. Contact: nikalisoft@gmail.com.

Each published version keeps its own identifier, effective date and content fingerprint. A version that was accepted with a proposal always remains retrievable at /proposal-privacy?version=1.0.