Privacy Policy

1. Who we are

Noetava is a service operated by MRD Assets Limited, a company registered in England and Wales (company number 15731565, registered office 62 Duffield Court, Brennan Close, Manchester M15 6NS) and registered with the UK Information Commissioner's Office (registration reference 00015098067). For your account, billing, our website and our own marketing, MRD Assets Limited is the data controller. For the documents and content you upload to train your AI, and for the conversations your own assistant has with your visitors, you are the data controller and MRD Assets Limited acts as your processor under our Data Processing Agreement (available on request). For any privacy question, contact privacy@noetava.com.

2. What we collect, and why

Your account. Your email address, the content you upload, your use of the service, and billing details. Payments are processed by Stripe; we never store your full card details. Lawful basis: performing our contract with you, and our legitimate interest in keeping the service secure.

Website visits. Our hosting provider's cookieless analytics (Vercel Web Analytics) counts visits and page views in aggregate: it sets no cookies, builds no individual profiles and does no cross-site tracking. Our site stores two things in your browser's local storage, not as cookies: your light/dark theme choice, and, if you arrived from an advert or a referral link, the name of that source so that we can tell which channels bring customers if you later sign up. Nothing else is stored on your device, and we use no advertising pixels or third-party trackers. Lawful basis: legitimate interest in understanding how the site is used.

The public demo assistants. When you use a demonstration assistant on noetava.com, the questions you type and the answers given are saved, with a random session identifier and the time, so that we can check answers and improve the demos. No account is involved and we ask you not to type personal details. Lawful basis: legitimate interest in improving the service. Kept for up to 12 months, then deleted.

Enquiries and downloads. If you leave your name and email through a form on our site (for example to receive our AI-use policy template or to ask us to follow up), we use them to send what you asked for and, only if you opted in, a short series of emails you can stop with one click. We record when and how you gave that consent. Lawful basis: consent, which you can withdraw at any time. Kept for 12 months from your last contact with us, then deleted.

Security and operations. Our servers keep request logs (including IP addresses) to protect the service against abuse and to diagnose faults. Lawful basis: legitimate interest in security. Kept for 90 days.

3. How we use your content

To provide the service: to train and serve your private AI, operate your account, take payment, and support you. Your content is never sent to OpenAI or any other third-party AI provider; your AI runs only for you, on infrastructure we operate, and is never shared with other customers. We do not sell your data, and we never use your uploaded content to train, improve or evaluate models for anyone else. We make no decisions about you by automated means that have legal or similarly significant effects.

4. Who processes data for us, and where

Your AI is served from hardware we own and operate in the United Kingdom. Training runs on that hardware or, for smaller jobs, on GPU capacity from Modal in EU datacentres; you can choose UK-only training in your account settings, or for any individual training job. We also rely on: Supabase (authentication and database), Cloudflare (document storage, network and delivery), Vercel (website hosting and analytics), Stripe (payments) and Resend (email, sent from EU infrastructure in Ireland). Each processes data only to provide its part of the service. Where a provider processes data outside the UK, it does so under the UK's international transfer safeguards: the UK Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Extension to the EU-US Data Privacy Framework, as listed in our Data Processing Agreement.

5. How long we keep things

Account data and uploaded content: for the life of your account and 30 days after you delete it, after which it is removed from live systems and overwritten in backups within a further 35 days. Billing records: 6 years, as accounting law requires. Demo conversations: up to 12 months. Enquiry and download contacts: 12 months from last contact. Security logs: 90 days. You can delete your AIs, datasets and chats at any time, delete your whole account from your Account page, and download everything we hold about you from the same page.

6. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to access, correct, erase, restrict and port your personal data, to object to processing based on our legitimate interests, and to withdraw any consent you have given, at any time and without affecting what was done before. Email privacy@noetava.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

7. Changes and contact

We will post any change to this policy here with its date, and email account holders about changes that affect them. Email support@noetava.com with any privacy request.