Data we collect
We may collect account identifiers, email address, authentication metadata, report score, report metrics, context selections, objectives, preferences (including timezone and reminder times), consent records, support messages you send us, internal operational notes our team may record about your account, a log of the operational emails we send you (recipient, subject, content, delivery status), ritual selections and fulfillment records, audit events, and billing references when payments are enabled.
Scan media
Raw camera frames, face images, and image history are not stored by default. Image history requires a separate explicit opt-in and must be capable of withdrawal.
Purpose
We use data to authenticate users, save reports, show progress, manage preferences and entitlements, provide support, secure the service, comply with legal duties, and improve the product with aggregated or minimized information.
Legal basis
Depending on location, processing may rely on contract necessity, consent, legitimate interests, legal obligations, or explicit consent where required for sensitive or biometric-related processing.
Processors
Clerk (authentication), Cloudflare (hosting and database), and Resend (email delivery) process limited data for NOCTIS. Additional providers for analytics, support, or payments will be added to this list before they are used.
International transfers
Data may be processed outside the UAE depending on infrastructure and provider locations. Appropriate safeguards should be maintained where required by applicable privacy law.
Retention
Reports and account records are retained while the account is active. On deletion or an erasure request, account-linked content is erased and the email log is anonymized; consent and audit records are retained where required for security, dispute, or legal reasons. Automated retention schedules will be published as they are introduced.
Your rights
Depending on your location, you may request access, correction, deletion, export, restriction, objection, withdrawal of consent, and portability. Consent withdrawal does not affect prior lawful processing.
Security
Authentication is handled by a dedicated identity provider, access is role-gated, admin actions should be audited, and secrets remain server-side. No internet service can guarantee absolute security.
Children
NOCTIS is intended for adults. Users must confirm they are at least 18 before saving a report.
