NOCTUS
Privacy Policy
Before you publish this: every [BRACKETED] value below must be replaced with
your real details, and this document should be reviewed by a lawyer qualified in your jurisdiction.
It is a careful starting point written against how Noctus actually works — it is not legal advice and
has not been reviewed by counsel.
Contents
1. Who we are
Noctus is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS] (“Noctus”, “we”, “us”). This policy covers the Noctus website and the Noctus application, which lets you deploy AI agents that run automated workflows against tools you connect.
2. Controller and processor roles
This distinction matters, because Noctus handles two different kinds of personal data:
- We are the controller of your account data — your name, email, company details, billing records and how you use the product.
- We are a processor of the data your agents handle on your behalf. If your agent reads your inbox, writes to your CRM, or calls your customers, the personal data of those customers is yours. You decide what it is used for; we process it only to run the workflows you configure.
You are responsible for having a lawful basis to process the personal data your agents touch, and for informing your own customers as your local law requires. A Data Processing Addendum is available at [CONTACT EMAIL].
3. What we collect
You give us
- Account — name, email address, password (handled by our authentication provider; we never see it), profile photo if you set one.
- Company profile — business name, industry, service area and similar details you enter to give agents context.
- Billing — handled by Stripe. We store a customer ID, subscription status and invoice history. We never see or store your full card number.
- Waitlist — if you sign up from the marketing site, your email address and where you signed up from.
- Content — workflows you build, prompts you write, files and knowledge you upload, and messages you send to our in-product assistant.
- Contacts — contact records your agents create or you import, which may include names, email addresses, phone numbers and notes about third parties.
Generated by using Noctus
- Execution logs — for each agent run: when it ran, whether it succeeded, how long it took, each step's status, error messages, and a sanitised record of step output. Credentials, tokens and passwords are stripped before anything is written to a log.
- Usage records — per-run cost accounting used to bill you.
- Agent memory — key/value state your agents save so they can reference past runs.
- Technical data — IP address, browser and device information, and request logs, kept for security and debugging.
From services you connect
When you connect a tool, we access only the scopes you approve. Depending on the integration, this can include email messages, calendar events, spreadsheet contents, CRM records, store orders and products, chat messages, call and SMS metadata, and accounting records. We access this data to run your workflows and for no other purpose.
4. How we use it
- To run the agents and workflows you configure.
- To operate, secure, debug and improve the service.
- To bill you and to enforce plan limits.
- To notify you about runs that need your attention, including approvals.
- To respond to you when you contact us.
- To meet legal obligations and to detect abuse or fraud.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
We do not use your content, your customers' data, or your execution logs to train our own models, and we do not permit our AI providers to train on it.
5. AI processing
Agent steps that use AI send the relevant context — your prompt, trigger data, prior step output and the company profile you provided — to a third-party model provider (see Subprocessors) so it can generate a response. That content leaves our systems for the duration of the request.
Automated decisions your agents make are decisions you configured. Where a workflow includes an approval step, a human — you — decides before the action runs. If an agent makes decisions producing legal or similarly significant effects for an individual, you are responsible for providing whatever human review your law requires.
6. Third-party credentials
API keys, access tokens and passwords for services you connect are encrypted at rest with AES-256-GCM using a key held only by our servers. They are decrypted only in memory, only while a workflow that needs them is running. They are never written to logs, never returned to the browser, and never shared with any third party other than the service the credential belongs to.
You can disconnect any integration at any time from Integrations, which deletes the stored credential.
7. Who we share with
We share personal data only with:
- Subprocessors that run the service, listed below.
- Services you connect, and only the data required by the workflow you built.
- Authorities, where we are legally compelled. We will tell you unless we are prohibited from doing so.
- An acquirer, if Noctus is involved in a merger or acquisition. You will be notified before your data becomes subject to a different policy.
8. Subprocessors
These providers process data on our behalf. We will update this list before adding a new one.
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, storage | All stored account and workflow data |
| Stripe | Payments and subscriptions | Billing details, payment method (held by Stripe) |
| Groq | AI model inference | Prompt and step context sent at run time |
| Anthropic | AI model inference | Prompt and step context sent at run time |
| OpenAI | AI model inference | Prompt and step context sent at run time |
| Twilio | SMS and voice | Phone numbers, message content, call metadata |
| Telnyx | SMS and voice | Phone numbers, message content, call metadata |
| Railway | Application hosting | All data in transit and at rest |
Tools you choose to connect — Google, Slack, HubSpot, Shopify, QuickBooks, Xero, Jira, Stripe, Instagram, Higgsfield and others — are not our subprocessors. You are the controller of that relationship and their own privacy policies apply.
9. Retention
| Data | Kept for |
|---|---|
| Account and company profile | Life of the account, then deleted within 30 days of closure or of a deletion request |
| Workflows, agents, contacts, memory | Life of the account, then deleted within 30 days of closure or of a deletion request |
| Execution logs | Up to 90 days, then deleted on closure or on request |
| Connected-service credentials | Until you disconnect, or the account is deleted |
| Billing and invoice records | As long as tax and accounting law requires, typically 7 years |
| Waitlist email | Until you ask us to remove it |
10. Security
- Encryption in transit (TLS) and at rest.
- Credentials additionally encrypted with AES-256-GCM at the application layer.
- Row-level security on the database, with tenant isolation by account.
- Secrets stripped from execution logs and error messages.
- Access to production data limited to staff who need it.
No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator within the deadlines the law sets — 72 hours under the GDPR.
11. Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or object to our processing, to receive a portable copy of your data, and to withdraw consent. If you are in California you also have the right to know what we collect and to not be discriminated against for exercising these rights; as stated above, we do not sell or share personal data.
Exercise any of these by emailing [CONTACT EMAIL]. We respond within 30 days. You can also complain to your local data protection authority.
Where an agent of yours holds personal data belonging to your customer, send that request to the business running the agent. If it reaches us, we will forward it to them.
12. International transfers
Our subprocessors operate in the United States and elsewhere. Where data leaves the UK or EEA we rely on Standard Contractual Clauses or another approved transfer mechanism.
13. Children
Noctus is a business tool and is not directed at anyone under 16. We do not knowingly collect their data. If you believe we have, contact us and we will delete it.
14. Changes
We will post any change here and update the date at the top. If a change materially affects your rights we will email you before it takes effect.
15. Contact
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
[CONTACT EMAIL]
[If you have an EU/UK representative or Data Protection Officer, name them here.]