Privacy Policy

1. Scope of this Policy

This Privacy Policy covers personal information collected through:

• The NobleStark marketing website at noblestark.com
• Sales-contact and inquiry forms
• Customer-facing surfaces (account areas, dashboards) where applicable

Personal information collected from Hatch applicants and contracted experts is governed by the separate Expert Privacy Notice.

For customer engagements, the Data Processing Addendum governs personal data we process on customers' behalf as a processor under GDPR Article 28 (and equivalent provisions of the CCPA/CPRA).

2. Information we collect

Information you provide

• Business contact information (full name, work email, company, role)
• Use case, estimated volume, and timeline you describe when contacting sales
• Communications you send us (email, contact form, calls, meetings)
• Information you provide in customer security questionnaires and procurement diligence
• Billing and tax information from contracted customers

Information collected automatically

• Device, browser, and request metadata (IP address, user agent)
• Consent-gated analytics data via Google Analytics 4 and Google Tag Manager
• Error events via Sentry, with sensitive fields redacted at source
• Cookies as described in our Cookie Policy

3. How we use information

• Sales and support: to respond to inquiries, scope engagements, and deliver services
• Service operation: to operate, monitor, and improve the Site and applications
• Security: to prevent abuse, fraud, and unauthorized access; to investigate incidents
• Billing and contracts: to invoice, collect payment, and meet tax obligations
• Legal compliance: to comply with applicable law, contracts, and regulatory obligations

We do not use personal information for model training. We do not sell or rent personal information.

4. Legal bases (GDPR)

• Contract performance: to enter into and perform engagements with you
• Legitimate interests: to operate and improve the Site, secure our systems, and engage in B2B marketing to relevant business contacts
• Consent: for non-essential cookies and marketing communications
• Legal obligation: to meet tax, accounting, and regulatory requirements

5. Sharing

We share personal information with the sub-processors listed at /subprocessors who help us operate the Services, with Data Processing Agreements in place where applicable. We may also disclose information:

• To comply with a legal obligation, court order, or regulatory request
• To protect rights, property, or safety of NobleStark, our customers, experts, or the public
• In connection with a merger, acquisition, or sale of assets, with appropriate notice

6. International transfers

NobleStark operates primarily from the United States. If you are located outside the US, your information will be transferred to and processed in the US under appropriate safeguards including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.

7. Your rights

Depending on your jurisdiction, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion (subject to legal retention requirements)
• Receive your information in a portable, machine-readable format
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Not be subject to certain automated decision-making (we do not engage in automated decision-making with legal effect on individuals)

Submit requests at /dsar or by emailing support@noblestark.com. We respond within statutory timelines.

8. Retention

We retain personal information only as long as needed to provide the Services and to meet legal, accounting, and reporting obligations. Sales-inquiry records are retained for up to 24 months absent active engagement. Customer-engagement records are retained as required by contract and applicable law (typically 7 years for tax records).

9. Security

We protect personal information using the controls described in our Trust Center, including encryption in transit and at rest, role-based access control with MFA, periodic access reviews, and continuous monitoring.

10. Children

The Site is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes

We may update this Policy from time to time. Material changes are reflected in the legal change history. We will provide notice of material changes by email or in-product where appropriate.

Contact