Privacy Policy

1. Overview

Noiz ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our service at noiz.bio (the "Service").

This policy applies to all users worldwide, with enhanced rights for residents of the European Economic Area (EEA), United Kingdom, Switzerland, and California. We comply with:

• General Data Protection Regulation (GDPR) - EU Regulation 2016/679
• UK Data Protection Act 2018 and UK GDPR
• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• German Federal Data Protection Act (BDSG)
• ePrivacy Directive (Cookie Law)

This policy should be read together with our Terms of Service and Section 11, on what we store on your device.

2. Data Controller

For the purposes of the GDPR and other applicable data protection laws, the data controller responsible for your personal data is:

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data only when we have a valid legal basis under the GDPR. The table below explains the legal bases we rely on for different processing activities:

Consent Withdrawal: Where we rely on consent, you have the right to withdraw your consent at any time by contacting us at privacy@noiz.bio or using the provided mechanisms (e.g., Privacy choices in the footer, unsubscribe links). Withdrawal does not affect the lawfulness of processing before withdrawal.

4. Categories of Personal Data

We collect and process the following categories of personal data, organized according to GDPR-compliant categories:

5. How We Collect Your Data

We collect personal data through the following methods:

5.1 Direct Interactions

Data you provide when you:

• Create an account or register for our Service
• Complete your profile information
• Make a purchase or upgrade to Premium
• Contact us via email, support form, or social media
• Report a problem or provide feedback
• Connect an AI app, such as ChatGPT or Claude, to your account

5.2 Automated Technologies

Data collected automatically when you interact with our Service:

• Local storage on your device, all of it listed in Section 11 (noiz.bio sets no cookies; connecting an AI app is the one step that does, also in Section 11)
• Server logs recording requests to our infrastructure
• Our own server-side analytics, which stores nothing on a visitor's device (Section 11.2); a signed-in creator's browser keeps the note in Section 11.1 that keeps their own visits out of their numbers
• Security monitoring systems

5.3 Third Parties

Data we may receive from third parties:

• Payment Processors: Transaction confirmation and status from Stripe
• OAuth Providers: Basic profile information if you sign up or connect using Google or Discord (we receive only what you authorize. Section 8 lists exactly what Discord gives us)

6. Purposes of Processing

We use your personal data for the following purposes:

7. Data Sharing and Recipients

We may share your personal data with the following categories of recipients:

• Service Providers: Third parties that help us operate the Service, including hosting, payment processing and email delivery. These parties process data only on our behalf and under our instructions.
• AI Apps You Connect: If you connect an AI app, such as ChatGPT or Claude, to your account, we send that app the page data the permissions you chose cover: your page's address, display name, bio, location and links, and, if you allowed it, your page's views and clicks. Never your email address, password, two-factor settings or payment details. The company behind the app (for example OpenAI or Anthropic) receives this as a separate controller under its own privacy policy, which decides what it does with the data and where it processes it; it is not our processor. You can disconnect an app at any time under Settings, Security, and it loses access right away.
• Sites a Creator Links To: When you press a link on a creator's page, the site it opens learns that you came from noiz.bio: your browser sends it the address noiz.bio, never the page you were on. If the creator turned on "Tag links to your sites", a link to their own website or shop also carries utm_source=noiz and utm_medium=link_in_bio. That site handles what it receives under its own privacy policy.
• Professional Advisers: Lawyers, accountants, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
• Law Enforcement and Regulators: When required by law, court order, or governmental authority, or to protect our legal rights.
• Business Transfers: In connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy proceeding. We will notify you of any such transfer and your options.
• With Your Consent: Any other third parties when you have given us explicit consent to share your information.

8. Sub-Processors and Third-Party Services

We use the following sub-processors and third-party services to operate Noiz. Each has been reviewed for GDPR compliance and appropriate data protection measures. Where a service does not meet that bar, its row says so plainly and the notes below explain what we do about it:

Links to sub-processor privacy policies:

• Stripe Privacy Policy
• Supabase Privacy Policy
• Cloudflare Privacy Policy
• Resend Privacy Policy
• Fontshare Privacy Policy
• Google Privacy Policy (covers Google sign-in and YouTube)
• Spotify Privacy Policy
• Apple Privacy Policy
• Discord Privacy Policy
• Hetzner Privacy Policy

9. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside the European Economic Area (EEA). Our database is in the European Union (Frankfurt, Germany) and uploaded files are stored in Western Europe, but some sub-processors operate globally.

9.1 Transfer Mechanisms

When we transfer your data outside the EEA, we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework (DPF): For transfers to US companies certified under the EU-US Data Privacy Framework (e.g., Stripe, Google).
• Standard Contractual Clauses (SCCs): EU Commission-approved contractual clauses that provide adequate protection for data transfers.
• Adequacy Decisions: Transfers to countries that the European Commission has determined provide an adequate level of data protection.
• Binding Corporate Rules: Where applicable for multinational service providers.

9.2 Supplementary Measures

In addition to the above safeguards, we implement:

• Encryption in transit (TLS) to every sub-processor
• Data minimization - we only transfer data necessary for the specific purpose
• Regular reviews of our sub-processors' data protection practices
• Contractual requirements for sub-processors to notify us of government access requests

You may request a copy of the safeguards we use for international transfers by contacting privacy@noiz.bio

10. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The table below outlines our retention periods:

10.1 Retention Criteria

When determining retention periods, we consider:

• The nature and sensitivity of the personal data
• The potential risk of harm from unauthorized use or disclosure
• The purposes for which we process the data
• Whether we can achieve those purposes through other means
• Applicable legal, regulatory, tax, accounting, or other requirements

10.2 Deletion Procedures

When data reaches the end of its retention period, or upon valid deletion request, we securely delete the data. Aggregated counts that no longer relate to any person (page views per day, for example) may be kept indefinitely for statistics.

11. Cookies, Local Storage and Analytics

noiz.bio does not set any cookies. Not for analytics, not for advertising, and not for sign-in. This is a claim you can check yourself: no response from noiz.bio contains aSet-Cookieheader, and your browser's cookie list for this site stays empty.

One step anywhere on Noiz does use cookies: connecting an AI app to your account. While you approve an app on mcp.noiz.bio, that address sets the two cookies listed at the end of the table below. They tie the approval to your browser, so that nobody else can finish it with your account. They are strictly necessary, hold a random value and nothing about you, are deleted as soon as the step is done, and expire after 10 minutes in any case.

What we do use is your browser's local storage: a small amount of data kept on your own device. Your browser never attaches it to a request on its own; where our own code sends a value (the sign-in token with each signed-in request to our database provider, the session id with your banner choice, the owner note with a view of a page), the row below says so. Everything in it is listed below. Local storage is covered by the same rules as cookies, so we treat it the same way: each item is either strictly necessary to run the service you asked for, or remembers a choice you made yourself (the items marked Functional). Measurement is the only thing you can switch off, and it stores nothing on your device.

11.1 What We Store on Your Device

All of the above is first-party: it is written by noiz.bio, read only by noiz.bio, and never sold, shared, or used to build an advertising profile. There are no third-party trackers, tag managers, or advertising pixels on any noiz.bio page, including creator profiles.

The record of your choice, kept on our side

One thing is not stored on your device: the record of an objection. When you turn measurement off, or change the switch in the settings panel, we write that down on our server, whether or not you have an account. Pressing OK is remembered in your own browser only and is not sent to us: there is nothing about it we need to prove. An objection is different, because we have to be able to show that it was received and honored, and a record that exists only in your own browser is not evidence of anything: you can clear it, and so could we.

Here is that record in full. It contains:

• Which control you used: Turn off measurement, or the switch in the settings panel (stored as objected or custom; older records may read acknowledged, accept_all or reject_all)
• The version of this notice you were shown (currently 1.1), so a later revision can show it to you again
• When you chose, taken from our clock rather than yours, and the date it expires 12 months later
• The random noiz-session-idfrom the table above, and, only if you were signed in at the time, your account ID
• Whether a later choice replaced it: each change is a new record, and the one it replaces is marked, so the history is complete

That is the entire record. No IP address, no user-agent string, no fingerprint of any kind: the database itself refuses a choice record carrying an IP, so this is a property of the system and not only a promise about it. If you were not signed in, the record holds nothing that identifies you beyond a random ID your own browser generated. We keep it for 12 months, the same period as the choice.

These records are readable only by you (when signed in) and by our administrators. Turning measurement off via Privacy choices in the footer writes a new record and marks the earlier one as replaced rather than deleting it, because when you objected is part of the same evidence.

11.2 Analytics Stores Nothing on Your Device

Creators can see how their profile is performing. That measurement is deliberately built so that visiting a profile leaves nothing behind on your device, no cookie, no local storage entry, no identifier of any kind. A view is counted server-side, at the moment of the request, and then the request is over.

What is recorded for a profile view, a link click or a play:

• A hashed IP address: hashed before storage, so it cannot be read back or reversed to your address
• The referring site, if your browser sent one, and any campaign parameters in the link you followed
• A coarse device category (mobile, tablet, desktop) derived from your browser's user-agent string
• The browser and operating system names, the country and, where available, the region, the page address, and a keyed hash of the user-agent string
• Which profile was viewed, or which link was clicked or played, and when

Creators only ever see totals and trends, never individual visitors. The daily rotating hash is pseudonymous data used to deduplicate aggregate counts. It is not shown to creators, is not linked across days and is not connected to the privacy-choice identifier. Our lawful basis is legitimate interest (GDPR Article 6(1)(f)): creators need to know whether their page works. We do not ask for consent, because measurement places no analytics identifier on your device and works on pseudonymous data. Instead you have the right to object (Article 21), the switch described below is how you exercise it, and we honor it immediately.

11.3 Your Choices

The privacy notice shown on your first visit is a notice, not a consent request. It offers:

• OK: you have read it, and measurement stays on
• Turn off measurement: you object; measurement is switched off for this browser and only strictly necessary storage remains
• Settings: the same switch, next to the strictly necessary items

You can change your mind at any time using Privacy choices in the site footer. Turning measurement off takes effect immediately for every page you load afterward, including creator profiles.

The strictly necessary and security items in the table above cannot be switched off, because without them you could not stay signed in and we could not protect accounts against automated attacks. No choice is offered for them, and none is needed: they are strictly necessary.

11.4 How to Clear It Yourself

Signing out removes the app's own entries. To remove everything, clear this site's data in your browser: the same control that clears cookies also clears local storage:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Clearing site data also removes your saved privacy choice, so the banner will appear again on your next visit.

12. Data Security

We implement appropriate technical and organizational security measures to protect your personal information in accordance with GDPR Article 32:

12.1 Technical Measures

• Encryption in Transit: Noiz uses modern TLS encryption for data in transit. Connections currently support TLS 1.2 or later
• Encryption at Rest: Our database and file-storage providers encrypt stored data at rest (AES-256); this is their control, applied to everything we store with them
• Password Security: Passwords are hashed using industry-standard algorithms (never stored in plaintext)
• Two-Factor Authentication: Optional 2FA for enhanced account security
• Secure Payment Processing: Payments handled by Stripe (PCI-DSS Level 1 compliant)
• IP Hashing: Visitor IP addresses are hashed for privacy before storage

12.2 Organizational Measures

• Access Controls: Strict access controls and role-based permissions
• Security Reviews: Internal reviews of the code; the date of the last one is published on our Security page
• Incident Response: If we learn of a breach, we act as Section 13 describes
• Data Minimization: We only collect and retain data necessary for our purposes

12.3 Privacy by Design and Default

In accordance with GDPR Article 25, we implement data protection principles from the design phase of our services:

• Privacy-preserving defaults for all new features
• Data minimization in all collection processes
• Pseudonymization where possible (e.g., IP hashing)

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

13. Data Breach Notification

In accordance with GDPR Articles 33 and 34, we have procedures in place to detect, report, and investigate personal data breaches.

13.1 Notification to Supervisory Authority

If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Document the breach, its effects, and remedial actions taken
• Provide the authority with all required information as per GDPR Article 33(3)

13.2 Notification to Affected Individuals

If a breach is likely to result in a high risk to your rights and freedoms, we will:

• Notify you without undue delay
• Describe the nature of the breach in clear and plain language
• Provide the name and contact details of our data protection contact
• Describe the likely consequences of the breach
• Describe the measures taken or proposed to address the breach
• Provide recommendations for you to mitigate potential adverse effects

13.3 Our Commitment

We take data security seriously and continuously work to prevent breaches. However, if an incident occurs, we are committed to transparent and timely communication with both authorities and affected users.

14. Your Data Subject Rights (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under data protection law:

14.1 How to Exercise Your Rights

14.2 Response Timeframe

• We will respond to your request within 30 days
• For complex requests, we may extend this by up to 60 additional days (we will inform you)
• Requests are processed free of charge, except for manifestly unfounded or excessive requests

14.3 Right to Lodge a Complaint

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with a supervisory authority (see Section 17).

15. Automated Decision-Making

In accordance with GDPR Article 22, we inform you about any automated decision-making processes that may affect you:

15.1 Automated Processing We Do Use

We use automated processing for the following non-consequential purposes:

• Content Filtering: An automatic word filter refuses usernames that contain slurs and hides such words from public pages
• Sign-up checks: A sign-up is refused automatically when another Noiz account uses the same inbox, or when the email address's domain cannot receive mail
• Spam Detection: Automated detection of suspicious activity patterns (human review before account restrictions)
• Analytics: Automated aggregation of usage statistics (no individual decisions made)

15.2 Your Rights

If you believe any automated processing has unfairly affected you, you have the right to:

• Request human intervention in any decision
• Express your point of view
• Contest any decision made

16. Children's Privacy

The Service is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13.

16.1 Age Requirements

• Minimum Age: 13 years old (worldwide)
• EU Users: In certain EU member states, users between 13-16 may require parental consent
• COPPA Compliance: We comply with the Children's Online Privacy Protection Act for US users

16.2 If We Discover Underage Users

If we become aware that we have collected personal information from a child under the applicable minimum age without proper consent:

• We will promptly delete that information
• We will terminate the associated account
• We will notify the parent or guardian if contact information is available

If you believe a child has provided us with personal information, please contact us immediately at privacy@noiz.bio

17. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

17.1 Your California Rights

• Right to Know: Request information about the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights
• Right to Limit Use: Limit the use and disclosure of sensitive personal information

17.2 "Do Not Sell My Personal Information"

17.3 Shine the Light

California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

17.4 Removal of Content Posted as a Minor

If you are a California resident under 18 and have publicly posted content on our Service, you may request removal of that content by contacting us. Note that removal may not ensure complete removal if the content has been reposted by others.

18. Supervisory Authority

If you are located in the European Economic Area and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

18.1 German Supervisory Authority

As we are based in Baden-Württemberg, Germany, our lead supervisory authority is:

18.2 Other EU/EEA Authorities

You may also lodge a complaint with the supervisory authority in your country of residence. A list of EU data protection authorities can be found at: European Data Protection Board

We encourage you to contact us first at privacy@noiz.bio so we can try to resolve your concerns directly before you escalate to a supervisory authority.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

19.1 How We Communicate Changes

• We will post the updated policy on this page with a new "Last updated" date
• For material changes, we will provide at least 30 days' advance notice via email to your registered address
• Material changes include: new categories of data collection, new processing purposes, changes to data sharing practices, or changes to your rights

19.2 Your Continued Use

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you should discontinue use of the Service and delete your account.

We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

20. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: