Privacy Policy

01 Two roles

Your organization's records. Data an organization enters about its staff, contacts, donors, applicants and others is controlled by that organization. Nocthink processes it on the organization's instructions, as its processor.

Your account. For your own sign-in details we decide how the data is used, as controller.

02 What we collect for your account

Your email address, name, password (stored only as a salted hash), profile details you add, sign-in times, IP address and browser for security, and the date and version of these terms you agreed to.

03 Why we use it

To run the service and keep it secure: to sign you in, confirm your email, send password resets and the notifications you choose, prevent abuse, and keep audit logs your organization relies on.

04 Who else processes it

Nocthink runs on Cloudflare (hosting, database, file storage, email delivery and bot protection). If your organization turns on the AI assistant, the questions and the records needed to answer them are sent to the AI provider it configured. Our public website, but not the app, uses Google Analytics to count visits; see the Cookie Policy.

05 How long we keep it

Account data is kept while your account exists. An organization's data is kept while the organization exists; after an owner deletes it, it is permanently removed 30 days later. Copies already in our nightly database backups and in the database's point-in-time history are not edited; they expire on their own within a further 30 days.

06 Your rights

You may access, correct and delete your account data, and withdraw consent, from your profile settings or by contacting us. Deleting your account is immediate; if you are the only owner of an organization, first make someone else an owner or delete the organization.

For records an organization holds about you, contact that organization; we help it respond.

07 Security and breaches

Data is encrypted in transit, access within an organization follows each member's role, and organizations are isolated from one another. If a breach affects your personal data we will notify you and the authorities within the time UU PDP requires.