Privacy Policy

1. Overview

Noiz ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our service at noiz.bio (the "Service").

This policy applies to all users worldwide, with enhanced rights for residents of the European Economic Area (EEA), United Kingdom, Switzerland, and California. We comply with:

• General Data Protection Regulation (GDPR) - EU Regulation 2016/679
• UK Data Protection Act 2018 and UK GDPR
• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• German Federal Data Protection Act (BDSG)
• ePrivacy Directive (Cookie Law)

This policy should be read together with our Terms of Service and Section 11, on what we store on your device.

2. Data Controller

For the purposes of the GDPR and other applicable data protection laws, the data controller responsible for your personal data is:

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data only when we have a valid legal basis under the GDPR. The table below explains the legal bases we rely on for different processing activities:

Consent Withdrawal: Where we rely on consent, you have the right to withdraw your consent at any time by contacting us at privacy@noiz.bio or using the provided mechanisms (e.g., Privacy choices in the footer, unsubscribe links). Withdrawal does not affect the lawfulness of processing before withdrawal.

4. Categories of Personal Data

We collect and process the following categories of personal data, organized according to GDPR-compliant categories:

5. How We Collect Your Data

We collect personal data through the following methods:

5.1 Direct Interactions

Data you provide when you:

• Create an account or register for our Service
• Complete your profile information
• Make a purchase or upgrade to Premium
• Subscribe to newsletters or marketing communications
• Contact us via email, support form, or social media
• Report a problem or provide feedback
• Participate in surveys or promotions

5.2 Automated Technologies

Data collected automatically when you interact with our Service:

• Local storage on your device, all of it listed in Section 11 (we set no cookies)
• Server logs recording requests to our infrastructure
• Our own server-side analytics, which stores nothing on your device (Section 11.2)
• Security monitoring systems

5.3 Third Parties

Data we may receive from third parties:

• Payment Processors: Transaction confirmation and status from Stripe
• OAuth Providers: Basic profile information if you sign up or connect using Google or Discord (we receive only what you authorize — Section 8 lists exactly what Discord gives us)
• Analytics Partners: Aggregated usage insights

6. Purposes of Processing

We use your personal data for the following purposes:

7. Data Sharing and Recipients

We may share your personal data with the following categories of recipients:

• Service Providers: Third parties that help us operate the Service, including hosting, payment processing, analytics, and customer support providers. These parties process data only on our behalf and under our instructions.
• Professional Advisers: Lawyers, accountants, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
• Law Enforcement and Regulators: When required by law, court order, or governmental authority, or to protect our legal rights.
• Business Transfers: In connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy proceeding. We will notify you of any such transfer and your options.
• With Your Consent: Any other third parties when you have given us explicit consent to share your information.

8. Sub-Processors and Third-Party Services

We use the following sub-processors and third-party services to operate Noiz. Each has been reviewed for GDPR compliance and appropriate data protection measures. Where a service does not meet that bar, its row says so plainly and the notes below explain what we do about it:

Links to sub-processor privacy policies:

• Stripe Privacy Policy
• Supabase Privacy Policy
• Cloudflare Privacy Policy
• Resend Privacy Policy
• Fontshare Privacy Policy
• Google Privacy Policy (covers Google sign-in and YouTube)
• Spotify Privacy Policy
• Discord Privacy Policy
• Lanyard (source and documentation) — Lanyard publishes no privacy policy. Its code and what it stores are public, and it is the reason live status is opt-in.

9. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside the European Economic Area (EEA). Our primary data processing occurs in the European Union (Frankfurt, Germany), but some sub-processors operate globally.

9.1 Transfer Mechanisms

When we transfer your data outside the EEA, we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework (DPF): For transfers to US companies certified under the EU-US Data Privacy Framework (e.g., Stripe, Google).
• Standard Contractual Clauses (SCCs): EU Commission-approved contractual clauses that provide adequate protection for data transfers.
• Adequacy Decisions: Transfers to countries that the European Commission has determined provide an adequate level of data protection.
• Binding Corporate Rules: Where applicable for multinational service providers.

9.2 Supplementary Measures

In addition to the above safeguards, we implement:

• End-to-end encryption for sensitive data in transit
• Data minimization - we only transfer data necessary for the specific purpose
• Regular reviews of our sub-processors' data protection practices
• Contractual requirements for sub-processors to notify us of government access requests

You may request a copy of the safeguards we use for international transfers by contacting privacy@noiz.bio

10. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The table below outlines our retention periods:

10.1 Retention Criteria

When determining retention periods, we consider:

• The nature and sensitivity of the personal data
• The potential risk of harm from unauthorized use or disclosure
• The purposes for which we process the data
• Whether we can achieve those purposes through other means
• Applicable legal, regulatory, tax, accounting, or other requirements

10.2 Deletion Procedures

When data reaches the end of its retention period, or upon valid deletion request, we securely delete or anonymize the data. Anonymized data (which can no longer identify you) may be retained indefinitely for statistical purposes.

11. Cookies, Local Storage and Analytics

noiz.bio does not set any cookies. Not for analytics, not for advertising, and not for sign-in. This is a claim you can check yourself: no response from noiz.bio contains aSet-Cookieheader, and your browser's cookie list for this site stays empty.

What we do use is your browser's local storage — a small amount of data kept on your own device and never automatically sent anywhere. Everything in it is listed below. Local storage is covered by the same rules as cookies, so we treat it the same way: each item is either strictly necessary to run the service you asked for, or you can switch it off.

11.1 What We Store on Your Device

All of the above is first-party: it is written by noiz.bio, read only by noiz.bio, and never sold, shared, or used to build an advertising profile. There are no third-party trackers, tag managers, or advertising pixels on any noiz.bio page, including creator profiles.

The record of your choice, kept on our side

One thing is not stored on your device: the record of the choice itself. When you answer the banner we write it down on our server, whether or not you have an account. We have to be able to show that you were asked and what you answered, and a record that exists only in your own browser is not evidence of anything — you can clear it, and so could we.

Here is that record in full. It contains:

• Which choice you made — accept, reject, or the switches you set yourself
• The version of this notice you were shown (currently 1.0), so a later revision can re-ask you
• When you chose, taken from our clock rather than yours, and the date it expires 12 months later
• The random noiz-session-idfrom the table above — and, only if you were signed in at the time, your account ID
• Whether you have since withdrawn it

That is the entire record. No IP address, no user-agent string, no fingerprint of any kind — the database itself refuses a consent record carrying an IP, so this is a property of the system and not only a promise about it. If you were not signed in, the record holds nothing that identifies you beyond a random ID your own browser generated. We keep it for 12 months, the same period as the choice.

These records are readable only by you (when signed in) and by our administrators. Withdrawing via Privacy choices in the footer marks this browser's record as withdrawn rather than deleting it, because when you withdrew is part of the same evidence.

11.2 Analytics Stores Nothing on Your Device

Creators can see how their profile is performing. That measurement is deliberately built so that visiting a profile leaves nothing behind on your device — no cookie, no local storage entry, no identifier of any kind. A view is counted server-side, at the moment of the request, and then the request is over.

What is recorded for a profile view or link click:

• A hashed IP address — hashed before storage, so it cannot be read back or reversed to your address
• The referring site, if your browser sent one, and any campaign parameters in the link you followed
• A coarse device category (mobile, tablet, desktop) derived from your browser's user-agent string
• Which profile or link was viewed, and when

Creators only ever see totals and trends, never individual visitors. Because nothing is stored on your device and nothing follows you to another site, this cannot identify you or track you across the web. Our lawful basis is legitimate interest (GDPR Article 6(1)(f)): creators need to know whether their page works. You can still switch it off — see below, and we honour it.

11.3 Your Choices

The privacy banner shown on your first visit gives you three options:

• Accept: analytics measurement stays on
• Reject: analytics measurement is switched off for this browser; only strictly necessary storage remains
• Customize: set analytics on or off yourself

You can change your mind at any time using Privacy choices in the site footer. Turning analytics off takes effect immediately for every page you load afterwards, including creator profiles.

The strictly necessary and security items in the table above cannot be switched off, because without them you could not stay signed in and we could not protect accounts against automated attacks. They are exempt from the consent requirement for exactly that reason.

11.4 How to Clear It Yourself

Signing out removes the app's own entries. To remove everything, clear this site's data in your browser — the same control that clears cookies also clears local storage:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Clearing site data also removes your saved privacy choice, so the banner will appear again on your next visit.

12. Data Security

We implement appropriate technical and organizational security measures to protect your personal information in accordance with GDPR Article 32:

12.1 Technical Measures

• Encryption in Transit: All data transmitted to and from our servers uses TLS 1.3 encryption
• Encryption at Rest: Sensitive data is encrypted using AES-256 encryption
• Password Security: Passwords are hashed using industry-standard algorithms (never stored in plaintext)
• Two-Factor Authentication: Optional 2FA for enhanced account security
• Secure Payment Processing: Payments handled by Stripe (PCI-DSS Level 1 compliant)
• IP Hashing: Visitor IP addresses are hashed for privacy before storage

12.2 Organizational Measures

• Access Controls: Strict access controls and role-based permissions
• Security Audits: Regular security assessments and monitoring
• Incident Response: Documented procedures for handling security incidents
• Data Minimization: We only collect and retain data necessary for our purposes

12.3 Privacy by Design and Default

In accordance with GDPR Article 25, we implement data protection principles from the design phase of our services:

• Privacy-preserving defaults for all new features
• Data minimization in all collection processes
• Pseudonymization where possible (e.g., IP hashing)
• Regular privacy impact assessments for new processing activities

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

13. Data Breach Notification

In accordance with GDPR Articles 33 and 34, we have procedures in place to detect, report, and investigate personal data breaches.

13.1 Notification to Supervisory Authority

If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Document the breach, its effects, and remedial actions taken
• Provide the authority with all required information as per GDPR Article 33(3)

13.2 Notification to Affected Individuals

If a breach is likely to result in a high risk to your rights and freedoms, we will:

• Notify you without undue delay
• Describe the nature of the breach in clear and plain language
• Provide the name and contact details of our data protection contact
• Describe the likely consequences of the breach
• Describe the measures taken or proposed to address the breach
• Provide recommendations for you to mitigate potential adverse effects

13.3 Our Commitment

We take data security seriously and continuously work to prevent breaches. However, if an incident occurs, we are committed to transparent and timely communication with both authorities and affected users.

14. Your Data Subject Rights (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under data protection law:

14.1 How to Exercise Your Rights

14.2 Response Timeframe

• We will respond to your request within 30 days
• For complex requests, we may extend this by up to 60 additional days (we will inform you)
• Requests are processed free of charge, except for manifestly unfounded or excessive requests

14.3 Right to Lodge a Complaint

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with a supervisory authority (see Section 17).

15. Automated Decision-Making

In accordance with GDPR Article 22, we inform you about any automated decision-making processes that may affect you:

15.1 Automated Processing We Do Use

We use automated processing for the following non-consequential purposes:

• Content Filtering: Automated checks for prohibited content in profile text (human review for any actions)
• Spam Detection: Automated detection of suspicious activity patterns (human review before account restrictions)
• Analytics: Automated aggregation of usage statistics (no individual decisions made)

15.2 Your Rights

If you believe any automated processing has unfairly affected you, you have the right to:

• Request human intervention in any decision
• Express your point of view
• Contest any decision made

16. Children's Privacy

The Service is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13.

16.1 Age Requirements

• Minimum Age: 13 years old (worldwide)
• EU Users: In certain EU member states, users between 13-16 may require parental consent
• COPPA Compliance: We comply with the Children's Online Privacy Protection Act for US users

16.2 If We Discover Underage Users

If we become aware that we have collected personal information from a child under the applicable minimum age without proper consent:

• We will promptly delete that information
• We will terminate the associated account
• We will notify the parent or guardian if contact information is available

If you believe a child has provided us with personal information, please contact us immediately at privacy@noiz.bio

17. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

17.1 Your California Rights

• Right to Know: Request information about the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights
• Right to Limit Use: Limit the use and disclosure of sensitive personal information

17.2 "Do Not Sell My Personal Information"

17.3 Shine the Light

California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

17.4 Removal of Content Posted as a Minor

If you are a California resident under 18 and have publicly posted content on our Service, you may request removal of that content by contacting us. Note that removal may not ensure complete removal if the content has been reposted by others.

18. Supervisory Authority

If you are located in the European Economic Area and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

18.1 German Supervisory Authority

As we are based in Baden-Württemberg, Germany, our lead supervisory authority is:

18.2 Other EU/EEA Authorities

You may also lodge a complaint with the supervisory authority in your country of residence. A list of EU data protection authorities can be found at: European Data Protection Board

We encourage you to contact us first at privacy@noiz.bio so we can try to resolve your concerns directly before you escalate to a supervisory authority.

19. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

19.1 How We Communicate Changes

• We will post the updated policy on this page with a new "Last updated" date
• For material changes, we will provide at least 30 days' advance notice via email to your registered address
• Material changes include: new categories of data collection, new processing purposes, changes to data sharing practices, or changes to your rights

19.2 Your Continued Use

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you should discontinue use of the Service and delete your account.

We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

20. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: