Privacy Policy

1. Who is responsible for the data

The leads are yours. As the advertiser you decide why a person’s data is collected and what happens to it — which makes you the controller.

Narwon moves that data from one place to another on your instruction, and stores it while doing so — which makes us the operator (processor). We do not use lead data for our own purposes, we do not analyse it, and we never sell it.

For leads that arrive from Meta (Facebook/Instagram) this split is also what Meta’s own platform terms require.

2. Your account data

When you register we collect:

• first and last name, email address, and an optional phone number
• the name of your workspace (company)
• a cryptographic hash of your password — the password itself is never stored
• sign-in events: time, IP address and browser type — kept for security, so an unfamiliar sign-in can be spotted

3. Lead data

Every lead from a connected source (a Facebook Lead Ads form, a web form) is stored and delivered to the destination you configured.

A lead typically contains a name, a phone number, an email address, and the answers to whatever questions you added to your own form. Which fields arrive is decided by your form, not by us.

The raw request from the source is stored as well, so a failure can be diagnosed and the lead re-sent. That is the core promise of the service: a lead that fails to deliver is not a lead that is lost.

4. Where data is stored

Data is stored in a PostgreSQL database on a server operated by Narwon. Each workspace is isolated at the database level (Row-Level Security): one customer’s query physically cannot see another customer’s rows.

Credentials for your CRM and other services (tokens, passwords) are encrypted separately, under a key unique to your workspace. They are never sent to the browser and are never displayed in the interface.

Under the personal data law of the Republic of Uzbekistan, lead data (name, phone, email) is ordinary personal data, and following the amendments effective 27 March 2026 it may be stored abroad. We do not process biometric, genetic or telecom-subscriber data at all.

5. Who data is shared with

We deliver each lead to the destination you chose. That means the data goes into your own account:

• Bitrix24 — into your portal
• amoCRM (Kommo) — into your portal
• Google Sheets — into the spreadsheet you specify
• Telegram — into the group you added the bot to

6. About two shared technical accounts

We state this openly because it matters technically: the Google Sheets and Telegram integrations run on a single platform-level technical account each.

For Google Sheets: you share your spreadsheet with our service account as an Editor. That account writes only to the spreadsheet you shared and can reach nothing else of yours.

For Telegram: one Narwon bot serves every customer. The bot posts only into a group that you added it to AND confirmed with a binding link. From an unconfirmed group the bot leaves on its own within two minutes. One group can be bound to exactly one account.

The bot’s privacy mode is enabled — it does not and cannot read the group’s conversation.

7. How long data is kept

While your account is open, leads and their delivery history are retained — they are your working history.

There is currently no automatic deletion window. Data does not expire on its own: it is removed when you ask, or when your account is closed. We say this plainly, because promising an automatic policy that does not exist would be a false statement.

How to request deletion is on the Data Deletion page.

8. Your rights

In respect of your own data you have the right to:

• know what is stored and receive a copy of it
• correct data that is wrong
• request deletion
• object to processing and withdraw your consent

9. If you are a lead

If you are not a Narwon customer but a person who filled in some company’s form, that company collected your data and is the controller. Contacting them directly is the most direct route.

You may also write to us: we will pass your request to the relevant customer and delete our own copy.

10. Security

All connections are encrypted over HTTPS. Credentials are stored encrypted. Workspaces are isolated at the database level. Passwords are stored using a modern hashing algorithm.

No system is perfectly secure. If we discover a data breach we will notify affected customers and the competent authority.

11. Changes and contact

When this document changes, the date above is updated. We will notify your account email about material changes.

Questions: nodirmarketer@gmail.com