Privacy policy

Last updated: 3 November 2026

Nowtical sells software, not personal data. This policy explains what personal data we process, why, and the choices you have.

Who we are

Nowtical is a service of Grok Software Unipessoal Lda, Rua António Sardinha, 43, 3830-579 Gafanha da Nazaré, Portugal, tax number (NIF) PT513832700. You can reach us about anything in this policy at hello@nowtical.com.

Our role

Schools and website visitors. When a school creates a Nowtical account, when you contact us or request a walkthrough, or when you visit nowtical.com, we decide how your data is used and act as the controller.
People booking with a school. When you book an activity through a school’s Nowtical booking page or widget, the school decides how your booking data is used and is the controller. We process that data on the school’s behalf as a processor. Questions about how a school uses your data are best sent to the school; we will help where we can.
Payments. Where a booking is paid through Nowtical, we also process the payment and invoicing data needed to collect the payment and meet our accounting and tax obligations.

What we collect

Account data: name, email address, phone number and password (stored only in encrypted, hashed form) of school owners and staff.
School data: school name, contact details, locations, activities, schedules and settings.
Booking data: name, email address, phone number, the activity booked, participants, notes you add, attendance and ratings you choose to give.
Payment data: amount, date, status and the details needed for invoices. Card details are entered directly with our payment provider, Stripe; we never see or store full card numbers.
Messages: emails and walkthrough requests you send us.
Technical data: IP address, browser and device information and server logs, used to run and secure the service.
Usage statistics: the booking app uses Umami, a privacy-friendly analytics tool that does not use cookies and reports only aggregated visit statistics.

Why we use it and our legal basis

To provide the service (accounts, schedules, bookings, booking confirmations, reminders and cancellation notices): performance of a contract.
To collect payments and issue invoices: performance of a contract and compliance with legal obligations.
To keep the service secure, prevent misuse and fix problems: our legitimate interest in running a reliable, safe service.
To understand how the service is used, in aggregate, and improve it: our legitimate interest.
To answer your messages and walkthrough requests: steps taken at your request before a contract, or our legitimate interest in replying.

We do not sell personal data, and we do not send marketing emails without your consent.

We share personal data only with service providers that help us run Nowtical, under contracts that require them to protect it and use it only on our instructions:

Stripe – payment processing.
MailPace (formerly OhMySMTP) – sending emails such as booking confirmations and reminders.
Amazon Web Services – file storage, in data centres in the European Union.
Our hosting providers – servers that run the Nowtical application.
PikaPods – hosting for our Umami usage statistics.
Google – Google Forms, when you request a walkthrough, and Google Fonts on this website.

The school you book with can see the booking data for its own activities. We may also disclose data where the law requires it.

Some of these providers may process data outside the European Economic Area. When that happens, the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework or the decision for the United Kingdom) or by the European Commission’s standard contractual clauses.

How long we keep it

We keep personal data only for as long as we need it for the purposes above:

Account and school data: while the account is active, and then for as long as needed to close it properly.
Booking data: while the school uses Nowtical, unless the school asks us to delete it earlier.
Invoices and accounting records: for the period required by Portuguese law.
Server logs: for a short period, for security and troubleshooting.

Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to how we use it, or to receive a copy in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to hello@nowtical.com. If your request concerns a booking with a school, we will pass it on to the school or help it answer you.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the authority in the country where you live.

Cookies

We only use cookies that are needed for the service to work. See our cookie policy for details.

Security

We use encrypted connections (HTTPS), store passwords only in hashed form and limit access to personal data to the people who need it to run the service.

Children

Nowtical accounts are for schools and their staff. When a booking is for a child, it should be made by a parent or guardian.

Changes to this policy

We may update this policy when the service or the law changes. We will publish the new version on this page and, when the changes are significant, let account holders know by email.