Privacy Policy
Last updated 2026-09-27.
1. What we collect from you
When you sign up for NAUT we collect:
- Your name and work email (required).
- Your employer or fund (required).
- Your role (analyst, builder, investor, etc.), if provided.
- Authentication data (hashed password, or the name and email a sign-in provider shares when you sign in through it).
- Payment metadata via our payment processor (we never see full card numbers).
- Server logs: IP address, user agent, route timestamps for security and rate limiting.
- Usage and diagnostic data: how pages are used, collected through cookies and similar tools, and error reports that help us fix faults.
2. What we collect about others
NAUT aggregates publicly available information about crypto entities (companies, projects) and the people associated with them. Sources include public websites, public social media (Twitter, Telegram channels, LinkedIn profiles), and information directly submitted by users.
If you appear in NAUT and would like your record updated or removed, write to compass@mesa.so and we will respond within 30 days.
3. How we use your data
- To operate, secure, and improve the Service.
- To process payments and manage your subscription.
- To send transactional emails (receipts, security alerts, payment reminders).
- To detect and prevent abuse (scraping, fraud, credential stuffing).
- For aggregate, non-identifying analytics about platform usage.
We do not sell your personal data.
4. Sub-processors
We share data with service providers only to run, secure and improve NAUT, in these areas:
- Payment processing.
- Hosting, databases and infrastructure.
- Email delivery.
- Sign-in and account security.
- Analytics and error monitoring.
5. Retention
Account data is retained while your account is active. After deletion, we retain a minimal record of transactions for seven years to comply with tax and accounting requirements. Audit logs are retained 90 days.
6. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. Email compass@mesa.so and we will respond within 30 days.
7. Security
Passwords are hashed with bcrypt. Connections to the Service use TLS. We follow industry-standard practices for access controls and least privilege. No system is perfectly secure; we will notify affected users of a confirmed breach within 72 hours of discovery.
8. Cookies
We use first-party cookies for authentication and session management. We do not use third-party advertising cookies.
9. Changes
We will post material changes 14 days before they take effect and notify active users by email.