Skip to content
Nooticr
Sign in

Legal

Privacy Policy

Last updated: July 8, 2026

1. Overview & GDPR Roles

This Privacy Policy explains how Nooticr ("we", "us", "our") collects, uses, processes, and protects your personal data when using our marketing dashboard and related services.

Under the General Data Protection Regulation (GDPR / RGPD), Nooticr acts in two capacities:

  • Data Controller: For account information, email registrations, and billing details provided during registration.
  • Data Processor: For campaign operational data, reviews mined from app store pages, and influencer fleet profiles configured inside your workspace.

2. Information We Collect

We process different categories of information depending on your usage:

  • Account Registration: Name, business email, workspace name, and profile photos.
  • Stripe Payment Data: Subscription billing information is collected directly by our third-party payment processor, **Stripe**. Stripe processes payment details (credit card number, expiration, CVV, billing address) in accordance with PCI-DSS compliance standards. Credit card details are encrypted and never pass through or reside on Nooticr's servers.
  • Review Data & App Store Mining: Reviews extracted from public App Store and Play Store listings to build brand playbooks. This data is collected solely from public sources.
  • Influencer Fleet Profiles: Social handles, credentials, contact details, and avatars for human or AI creators in your fleet. Sensitive vault passwords are encrypted client-side in your browser before database transmission.
  • OAuth & Connection Tokens: Revocable access tokens used to publish campaigns to platforms (TikTok, Instagram, YouTube, X).
  • Technical Logs: IP address, user agent, browser types, and timestamp metrics logged for security auditing and server performance.
  • Traffic analytics: Aggregated, privacy-first site metrics via Cloudflare Web Analytics (no cookies). Optional marketing pixels (TikTok / X / Meta) load only after you opt in via our cookie consent banner.

3. Legal Bases for Processing under GDPR

Under Article 6 of the GDPR, we rely on the following legal bases to process your personal data:

  • Performance of Contract: To provision your account, process payments, and connect social APIs.
  • Consent: For non-essential analytics tracking, cookie triggers, or marketing referrals. You may withdraw consent at any time.
  • Legitimate Interests: To detect platform abuses, enforce API rate limits, audit login security, and optimize query matching.
  • Legal Obligation: For financial invoicing compliance and reporting tax details.

4. Data Retention Policy

We retain personal data for as long as your workspace account is active. You can delete individual posts, influencers, or products at any time. Accounts can be terminated self-serve via Settings → Account → Delete account. This permanently purges all workspace records, listing metadata, and media assets from the live database. Backup snapshots are rotated and completely purged within 30 days.

5. Your Rights Under GDPR (RGPD)

If you reside in the EEA, United Kingdom, or Switzerland, you possess the following rights regarding your personal data:

  • Right of Access (Article 15): Right to obtain copies of the personal data we maintain.
  • Right to Rectification (Article 16): Right to correct inaccurate personal data.
  • Right to Erasure (Article 17): Right to request data deletion ("right to be forgotten").
  • Right to Portability (Article 20): Right to receive your personal data in a structured, machine-readable format.
  • Right to Withdraw Consent (Article 7): Right to revoke cookies/analytics tracking consent via Settings or the consent banner.
  • Right to Lodge a Complaint (Article 77): Right to lodge a complaint with a European data protection authority (e.g., CNIL in France, DPC in Ireland).

To exercise these rights, please email [email protected].

6. International Data Transfers

Your personal data is stored in the database region configured for your Nooticr workspace. If data is transferred outside the EEA, we implement Standard Contractual Clauses (SCCs) to ensure equivalent protection standards.

7. Contact

For inquiries regarding our privacy compliance or data protection officer (DPO) details: [email protected].

8. Google API User Data Disclosures & Limited Use Policy

If you connect your Google or YouTube account to Nooticr, our access, storage, and processing of your Google data is subject to the following specific disclosures and rules:

  • Data Collection & Use: We request access to Google APIs (specifically https://www.googleapis.com/auth/youtube.upload and https://www.googleapis.com/auth/analytics.readonly) strictly to provide core product functionality—enabling you to publish short-form video content directly to your YouTube channel and displaying video performance analytics inside your workspace dashboard.
  • Data Sharing Disclosures: We do NOT sell, rent, share, or transfer your Google user data, YouTube channel content, or account credentials to any third parties, data brokers, AI model trainers, or advertising platforms. Data is processed exclusively to execute user-initiated publishing and analytics actions within your Nooticr workspace.
  • Data Protection & Security: All OAuth access and refresh tokens received from Google are encrypted at rest using industry-standard AES-256 encryption and transmitted securely over TLS 1.3 HTTPS. Tokens are logically isolated per workspace and protected by strict database access controls.
  • Data Retention, Deletion & Token Revocation: You can disconnect your Google account at any time via Nooticr Settings → Accounts or revoke access via Google Security Settings. Disconnecting access instantly and permanently deletes all associated stored Google OAuth access and refresh tokens from our database.
  • Google Limited Use Compliance: Nooticr's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.