Legal

Privacy Policy

This is short because we collect very little. There is no analytics, no advertising and no tracking on this site. If you have never subscribed and have never been in touch with us, we hold no personal data about you at all.

Who we are

naderu.com is operated by BytesBrains Pte. Ltd., a company incorporated in Singapore. BytesBrains is the data controller for the purposes of this policy.

For anything on this page — access, correction, deletion, or a complaint — write to contact@naderu.com. That address also reaches the person responsible for data protection, as required under Singapore's Personal Data Protection Act.

What we collect if you subscribe

The site has one feature that collects personal data: subscribing to the weekly model report. If you press Subscribe with Google and complete Google sign-in, we store:

What	Why we need it
Your email address	To send you the weekly report. There is no other purpose.
Your Google display name	So the email can address you by name rather than by inbox.
Your Google account ID	An opaque identifier that lets you unsubscribe and re-subscribe without creating a duplicate record.
The time you subscribed, the page you did it from, and the versions of this policy and the Terms you agreed to	So we can show when you consented and exactly what you were shown when you did. This protects you as much as us.

That is the complete list. We do not ask for or receive your Google password, contacts, calendar, files, or anything else from your Google account.

The other way your address can be here

Subscribing is not the only route onto the list, and it would be misleading to imply it was. If you have corresponded with someone at BytesBrains and we judged the weekly model report relevant to your work, we may have added your address ourselves. In that case we hold only:

What	Why we need it
Your email address	To send you the weekly report. There is no other purpose.
The name it appeared under in that correspondence	So the email can address you by name rather than by inbox.
A note recording that we added you, who added you, and when	So the origin of every address on this list is answerable. It is the honest counterpart of the consent record above.

We do not hold a consent record for you, because you did not give one. The record says you were added, not that you agreed — we are not going to write down a consent that never happened. The lawful basis is our legitimate interest in telling a professional contact about work in their own field, balanced against a one-click exit that we honour permanently and immediately.

If you would rather we had not: the unsubscribe link in any email removes you at once, with no sign-in and no questions, and the address is suppressed for good. If you want the record erased rather than marked, write to contact@naderu.com and we will delete it outright.

If we wrote to you about our training

There is a third route, and it is a different one: we sometimes write to a practice about a course we are running. Those addresses come from a listing the practice published itself — a clinic's own contact page, a firm's own website, an entry a professional body publishes so that people can get in touch. We do not buy lists, we do not scrape the web, and we do not use data brokers.

What	Why we need it
The business email address, and the name of the practice	To write to you once about the course. There is no other purpose.
The page we read it from, and the date we read it	So that if you ask us where we got your details, we can answer precisely rather than vaguely.
Whether you asked us not to write again	So that we do not.

There is no consent record for you, because you did not give one — the same as above, and for the same reason: we are not going to write down an agreement that never happened. The lawful basis is our legitimate interest in telling a practice about training relevant to it, weighed against a one-click exit and a strict limit on how often we may write.

One email, and at most one follow-up. After that we stop whether you reply or not. If you unsubscribe, that address is suppressed across everything we send — the training mail and the weekly report alike, since you should not have to tell us twice. If you would rather the record were deleted than marked, write to contact@naderu.com and we will erase it.

If a mobile number appeared in the same listing we may have stored it alongside the address. We do not call or send SMS to it. It is held so that a colleague can recognise a duplicate entry, and it is deleted on the same request as everything else.

What we do not do

• No analytics or measurement scripts on any page of this site.
• No advertising, no ad networks, no data brokers.
• No tracking pixels in the weekly report — we do not record whether you opened it or which links you clicked.
• We never sell, rent, or trade your personal data. Not now, not as a future business model.
• There is one list and one email a week. No second list, no segments, nothing sold or shared.
• We never buy address lists, never use data brokers, and never run crawlers over the web collecting people. Where we write to a practice, the address came from a page that practice published to be contacted on, and we record which page it was.

Storage in your browser

We set no advertising or analytics cookies. Two things are stored locally in your browser:

• Your light/dark theme choice, in localStorage, so the site remembers it. This never leaves your device.
• If you sign in to subscribe, Google's Firebase Authentication stores a sign-in session in your browser. You can clear it by signing out or clearing site data.

Lawful basis

Your consent, given by pressing the subscribe button, which names the purpose before you press it. You can withdraw that consent at any time, as easily as you gave it, and withdrawing it does not require you to explain why.

Who else can see it

We use service providers who process this data on our behalf and only on our instructions:

• Google (Firebase Authentication, Cloud Firestore, and Firebase Hosting) — sign-in and storage of the subscriber record.
• Google (Google Workspace mail) — the weekly report is sent from notify@naderu.com through Google Workspace, so Google processes your address to deliver it. No other email provider holds it, and we use no mailing-list service.

These providers may process and store data outside Singapore, including in the United States, under contractual terms requiring protection comparable to Singapore's PDPA.

How long we keep it

• While you are subscribed — for as long as you stay subscribed.
• After you unsubscribe — we keep a minimal suppression record (your account ID, address, and the fact that you unsubscribed and when) for 24 months, so an accidental re-import can never put you back on the list, and so we can evidence that consent was given and withdrawn. After 24 months it is deleted.
• If you ask us to erase it — we delete the record outright, sooner than the above.

Your rights

You can ask us to: give you a copy of what we hold about you; correct it; delete it; or stop using it. Write to contact@naderu.com and we will respond within 30 days. You never need an account or a form to make one of these requests.

Every weekly report also carries a one-click unsubscribe link that works without signing in.

If you are in Singapore you may complain to the Personal Data Protection Commission. If you are in the EEA or UK, the GDPR applies to our handling of your data and you may complain to your national supervisory authority. We would rather you told us first, and we would rather fix it.

Children

This site is aimed at people doing engineering work and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

Changes to this policy

This document is versioned by date, shown at the top. When we subscribed you, we recorded which version you agreed to, so we can always tell what you were actually shown. If we change the policy in a way that materially affects subscribers, we will say so in the weekly report rather than change it quietly.

The previous version, 2026-09-02, said we would name the email provider and publish a new version before any email was sent. We did not: the first weekly report went out on 1 October 2026, before this version was published. Nothing about what we hold or how we use it changed; the provider it names is Google, which already stored the subscriber record.