Notice: Data Protection Transparency & Pending Legal ReviewThis Privacy Policy truthfully reflects the actual third-party processors, cookies, and data retention schedules of Nature Authentic Georgia. Official Tax ID and registered address disclosures are pending owner verification.

Data Protection & Privacy

Privacy Policy

Version 2026.1 · Effective October 2026 · Nature Authentic Georgia (NAGEORGIA)

1Data Controller Identification

Under the Law of Georgia on Personal Data Protection, the data controller for personal information collected via NAGEORGIA is:

Entity Name: Ani Mdvinishvili, Individual Entrepreneur (I/E)

Activity Code: 79110 (Tourist agency activities)

Tax Status: Small Business Status, Not VAT-registered

Location: Tbilisi, Georgia

TIN / Tax ID: [Pending Owner Disclosure / Legal Verification]

Privacy Contact: info.nageorgia@gmail.com

2Driver Contact Privacy Policy & Public Confidentiality

To protect independent drivers from unsolicited direct contact and maintain operational dispatch integrity, drivers’ personal phone numbers and direct WhatsApp links are never published on the public website.

Before booking confirmation, travelers only see verified public profile data: driver first and last name, professional portrait, vehicle specifications, languages spoken, and verified customer ratings. Full driver contact information is securely dispatched only after administrative booking confirmation.

3Personal Data We Collect

Contact Information: Customer full name, email address, telephone / WhatsApp number.
Travel Details: Pickup and dropoff points, flight numbers, pickup schedule, passenger headcounts, luggage volumes.
Customer Account Credentials: Cryptographically hashed passwords (bcrypt with salt rounds $\ge 12$). Plain-text passwords are never stored or logged.
Operational Audit Trail: Timestamp of policy consent (version 2026.1), IP-derived submission audit fingerprints, and communication delivery status.
Driver Onboarding Documents: Driving licenses, vehicle registration certificates, and ID cards uploaded by prospective drivers are stored in private Cloudinary storage accessible only to authorized fleet administrators.

4Audited Third-Party Data Processors

NAGEORGIA works exclusively with verified technology providers necessary for operating our marketplace:

MongoDB AtlasFrankfurt, Germany (AWS eu-central-1)

Stores booking records, customer accounts, and administrative audit trails with TLS 1.3 in-transit and AES-256 at-rest encryption.

CloudinaryUnited States / EU CDN

Stores publicly displayed tour and vehicle photos. Driver ID and driving license documents are restricted and never served via public CDN URLs.

MapboxGlobal Edge Network

Calculates transfer driving distances, durations, and map coordinates via encrypted HTTPS API requests. No customer personal details are sent to Mapbox.

Gmail SMTP / NodemailerGoogle Workspace EU / Global

Delivers booking confirmation emails, account verification links, and operational updates. Customer emails are transmitted securely over TLS.

VercelGlobal Edge / Frankfurt

Hosts Next.js web application and executes serverless API handlers with automated TLS encryption.

5Cookies & Local Storage Disclosure

We classify cookies into 4 transparent tiers: Strictly Necessary, Functional (Preferences), Analytics, and Marketing. Non-essential tracking cookies remain strictly disabled until you provide consent via our unified consent banner.

1. Strictly Necessary Cookies (Essential)

Required for secure platform functionality, including NextAuth session tokens (next-auth.session-token) and CSRF protection tokens. These cookies cannot be switched off.

2. Functional & Preferences Cookies (Optional)

Remembers your chosen language (na_lang) and display currency (na_currency) across browsing sessions.

3. Analytical & Marketing Cookies (Optional)

Internal visitor metrics (/api/track) and Google Ads conversion tags (gtag.js, AW-18405396295). Blocked by default until user consent.

For a full audited list of every cookie, provider, and duration, read our dedicated Cookie Policy.

6Customer Rights & Data Deletion (DSAR)

Under the Law of Georgia on Personal Data Protection and international principles, you possess enforceable rights to:

Request full disclosure of personal records retained about you.
Request immediate rectification of inaccurate or outdated information.
Request erasure (“Right to be Forgotten”) of your customer account and personal data, subject to legal and financial retention holds.
Withdraw consent to receiving optional marketing or promotional communications.

Statutory Financial Retention Notice: Active reservations cannot be deleted until journey completion. Under the Tax Code of Georgia, completed financial transaction invoices and accounting ledgers must be retained for at least 3 years and are exempt from premature erasure.

To exercise any of these rights, contact our Privacy Desk at info.nageorgia@gmail.com or submit a request via your Customer Account. Requests are responded to within 10 business days after identity verification.

Nature Authentic Georgia