Privatlivspolitik
1. Who We Are and What This Policy Covers
Noxtica is operated by Noxart Games Co. (“Noxart Games”, “Noxtica”, “we”, “our” or “us”), a corporation incorporated under the laws of the State of Delaware, United States, with its principal place of business at Erenek Mah. Asmalı Sok. No:44 A1 Blok D:35, Antalya 07230, Türkiye. Contact: [email protected] (subject: “Privacy Request”).
This Privacy Policy explains how we collect, use, disclose, retain and protect personal data in connection with:
- our websites, including noxtica.com, demo.noxtica.com and status.noxtica.com;
- the Backoffice dashboard (backoffice.noxtica.com);
- the hosted verification pages (for example, verify.noxtica.com);
- our SDKs, collectors and monitoring scripts when our customers deploy them on their own websites and applications; and
- our APIs and other services (together, the “Services”).
This policy describes facts about our processing. It is not a contract and it does not ask for your consent. Where we rely on consent, we ask for it separately.
2. Our Role: Controller or Processor
2.1 When We Are the Controller
We decide why and how personal data is processed (we are the “controller”) for:
- visitors to our own websites;
- Backoffice account holders and other users of our customers’ accounts (account, authentication, security and audit data);
- billing, payment and business-contact data of our customers;
- contact-form messages, support requests, newsletter subscriptions and other communications with us;
- the Noxtica Verification ID status page and, only where an individual asks us to email them their Verification ID, the email address they give us for that purpose (Section 3.7);
- the security, fraud prevention and integrity of our own platform; and
- aggregated or de-identified data that we create to operate and improve the Services.
2.2 When We Are a Processor
When our customers use the Services on their own websites, applications and verification flows, the customer is the controller and we process personal data only on the customer’s behalf and instructions (we are a “processor” or “service provider”). This includes device and browser signals, bot and fraud signals, performance and real-user-monitoring data, session replays, and identity, business and merchant verification data that customers collect through the Services. Our processing as a processor is governed by our agreement with the customer, including our Data Processing Addendum.
If your data was collected by one of our customers (for example, when you visited a customer’s website or completed an identity verification requested by a business), please read that customer’s privacy notice and contact that customer to exercise your rights. We will refer requests we receive to the relevant customer and help that customer respond as required by our agreement with them.
The Noxtica Verification ID is the one exception for an email address. When a hosted verification succeeds, we issue the individual a Noxtica Verification ID as part of the verification we perform for the customer. If the individual then asks us to email that ID to them, the email address they give us is not collected for the customer, is never given to the customer, and we are the controller for it (Section 3.7).
3. Personal Data We Process
3.1 Visitors to Our Websites
- Consent choice: your choice about cookies and our collector extensions, stored in your browser (see our Cookie Policy).
- Core security signals (strictly necessary, no consent required): our core collector script runs on every page of our websites, including our legal pages, and in the Backoffice to keep them secure and to prevent fraud and abuse. It sets no persistent identifier and stores only a session token in your browser’s sessionStorage. Only when you submit a protected action (signing in, signing up, sending a contact form or submitting a verification) does it run a minimal device check, which reads a limited set of device and browser characteristics to detect bots and fraud on that action.
- Device recognition, analytics and behavioural signals (only if you accept): if you accept on our consent banner, our collector extensions run on our websites and collect device, browser and network signals (for example, browser and operating-system characteristics, screen properties, time zone, language, hardware capabilities and hashed rendering fingerprints) to recognise returning devices, detect bots and protect our sites, together with real-user monitoring (analytics), session replay and behavioural signals. You can withdraw your consent at any time using “Cookie settings” in our website footer; withdrawing deletes the device data the extensions stored in your browser.
- Server and network data: IP address, approximate location derived from IP address, request headers, timestamps and similar technical data processed by our hosting and security providers when you load a page.
- Privacy-preserving page analytics: our hosting provider’s web analytics measures page loads in aggregate.
3.2 Backoffice Users
- Account data: email address, name (if provided), organisation, role and permissions.
- Tenant memberships: one account can belong to several customer organisations (“tenants”), with a separate membership in each. For every membership we process the tenant, your role there, its status (active or suspended), who invited you, how the membership was created and when you last used it. The administrators of a tenant see your email address, your role, status and last use for that tenant only, and that your account also belongs to other tenants; they are not told which ones. You join an additional tenant only after you sign in to your own account and explicitly accept the invitation, except where a Noxtica platform administrator attaches your account as a recorded support action.
- Credentials: password (stored only as a salted, iterated hash), multi-factor authentication secrets (stored encrypted) and single sign-on identifiers.
- Security data: session data, hashed IP address and hashed user agent, login history and audit logs of actions taken in the Backoffice.
- Legal acceptance records: which legal document versions you accepted, when, and a hashed IP address and user agent.
- Usage data: settings, preferences and feature usage.
- AI assistant data: prompts and responses when you use an AI Feature. Transcripts are not stored unless your organisation enables transcript storage. Short-lived, scrubbed diagnostic logs are kept for operations and security.
3.3 Customers’ Billing and Business Contacts
Names, business email addresses, billing details, invoices, payment status and transaction references. Card details are entered directly with our payment service providers when payment features are used; we do not store full card numbers.
3.4 Contact, Support and Newsletter
- Contact form: name, email address, subject, message, IP address (also stored as a salted hash for rate limiting) and anything you choose to include.
- Newsletter: email address, subscription status, source, time and version of your consent, and IP address.
3.5 End Users of Our Customers (We Act as Processor)
Depending on the Services a customer uses and configures:
- Device and bot signals: browser and device characteristics, hashed canvas, WebGL and audio fingerprints, screen properties, hardware signals, IP address, approximate location, network information (such as ASN), request metadata and behavioural timing signals, and the identifiers and risk scores derived from them.
- Monitoring data: page performance metrics, errors, traces and, where enabled by the customer, session replays (recordings of page structure and interactions, with input masking applied in the configurations we support).
- Identity verification (KYC): images of identity documents (front and back) and the data read from them (for example, name, date of birth, document number, nationality and expiry date), a selfie and liveness images or frames, a short voice sample where the customer’s flow requires it, an email address if the customer requires email verification, device and network signals, and the verification signals and status produced. Facial images and face-comparison results may be biometric data. Face-comparison templates are computed and compared in memory and are not stored as reusable templates; images and the resulting signals are stored as verification evidence. Where age and gender estimation is enabled and you consent, the derived estimate and its comparison with your document are also stored as verification signals.
- Business and merchant verification (KYB/KYM): business details and documents, and information about directors, owners and representatives that the customer or the business provides.
- Optional speech analysis: only where a customer enables it and the individual gives separate, explicit consent at capture time (Article 9(2)(a) GDPR where it applies; the consent is separate from the consent to identity verification and can be declined without stopping the verification). With that consent we analyse the individual’s encrypted speech recording and, where the customer’s flow includes the voice step (the individual reads six digits aloud), the voice-step recording, to produce advisory signals: (a) estimates of language, age band, gender, accent and likely nationality, with confidence levels; and (b) a voice analysis made of audio-property measurements of each recording (duration, loudness, noise level, clipping and silence), speech features (pitch statistics, speaking rate and a spectral summary), a same-speaker consistency comparison between the two recordings, an automated check that the spoken digits match the digits shown to the individual, and an automated risk score for synthetic or replayed audio. The same-speaker comparison uses speaker embeddings that exist in memory only for the comparison; they are never stored, never reused as a voiceprint and never matched against any other person, recording or database. We do not store transcripts or the recognised digits. These results are estimates that may be inaccurate; they are advisory only, never change the verification verdict and are never an automated decision on their own. The recordings and derived results follow the customer’s verification-data retention settings.
- Optional age and gender estimation: only where a customer enables it for a verification and the individual gives separate consent on the verification page. From the selfie and liveness images already provided for the verification, a model estimates an age range and a female/male probability and compares them with the date of birth and sex on the identity document. The result is an estimate, not a fact: it does not determine your age, your gender identity or whether you are eligible for anything, it never causes a verification to be rejected on its own, and a person reviews any mismatch. We do not infer race, ethnicity, religion, political opinion or any other sensitive characteristic, and we do not store additional images for this purpose. Only the estimate and whether it agrees with the document are kept, with the verification signals; the document’s date of birth and sex are not copied into the estimate. You can untick the option before continuing, and the verification continues without it.
3.6 Information from Other Sources
When customers use screening features, we may compare names and other identifiers against lists published by public authorities (for example, sanctions lists). When customers connect third-party services or provide data through our APIs, we receive data from those sources on the customer’s behalf.
3.7 Noxtica Verification ID (Controller for the Optional Email and the Status Page)
When an identity verification completed on a hosted verification page succeeds, or is submitted for review, we issue the individual a Noxtica Verification ID (for example, NVID-XXXX-XXXX-XXXX-XXXX): a random identifier that is not derived from the individual’s name, documents or any other personal data, valid for 365 days and revocable. The hosted page shows it to the individual together with a link to a public status page (https://verify.noxtica.com/v/ followed by the ID). Unsuccessful, expired and cancelled verifications get no ID.
- The ID as part of the verification record (we act as processor). The ID is stored on the verification record that we process for the customer. The customer can see the ID and its status, and the ID follows the same retention and erasure rules as that record (Sections 2.2 and 8).
- The public status page (we act as controller). Anyone who has the ID can open the link and see whether the ID is verified, pending review, revoked or expired, the verification and expiry dates, and the display name of the business that requested the verification. The page shows no name, document data, image, email address or other personal data of the individual, and the ID cannot be used to look up any of it. The individual decides whom to give the ID to. When the page is opened we process the ID in the request together with basic technical request data (such as the IP address, which we use for rate limiting and abuse prevention, see Section 3.1). The page is not indexed by search engines and is not cached.
- Optional email delivery (we act as controller; consent). On the final screen the individual can ask us to email the ID and the status link to them. This is optional: the verification and the ID do not depend on it, and the box that records the individual’s consent is unticked by default. If the individual does this, we process the email address, the language chosen for the email, the ID, the time and version of the consent (version “nvid-email-v1”), and the time and number of sends. We store the address encrypted and use it only to send that email, including a resend that an authorised user of the customer or our support team triggers from the Backoffice at the individual’s request, who cannot see the address. We do not disclose the address to the customer, we do not use it for marketing or any other purpose, and we send it only to the email providers listed on our Subprocessors page that deliver the message. We keep it only with the verification record: it is deleted or archived when that record is erased or its retention period ends. The individual can withdraw the consent at any time by emailing [email protected] (subject: “Privacy Request”); we then stop sending and delete the stored address, without affecting the emails already sent.
4. Purposes and Legal Bases
Where the EU or UK GDPR or similar laws apply to our processing as a controller, we rely on the following legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Running our core collector on our own websites and in the Backoffice for security, bot detection and fraud prevention (no persistent identifier; minimal device check only on protected actions) | Session token; device and browser characteristics read on protected actions (website visitors and Backoffice users) | Legitimate interests (keeping our websites, accounts and Services secure and preventing fraud and abuse); storing and reading information on your device is limited to what is strictly necessary for that purpose |
| Running our collector extensions on our own websites (device recognition, analytics and real-user monitoring, session replay and behavioural signals) | Device, browser and network signals; interaction data (website visitors) | Consent (you can refuse or withdraw it at any time) |
| Delivering web pages, keeping our websites and platform secure, preventing abuse and fraud against us | Server and network data, security data | Legitimate interests (operating a secure service and protecting us and our customers) |
| Creating and operating Backoffice accounts, authentication, providing the Services to customers | Account data, credentials, usage data | Performance of a contract; legitimate interests (where the user is not the contracting party) |
| Letting one Backoffice account belong to several customer tenants (a separate role per tenant, switching between tenants, member administration by each tenant’s administrators) | Email address, role per tenant, membership status, who invited you, how the membership was created, last use per tenant, audit records of switches and membership changes | Performance of a contract (with each customer whose tenant you are authorised to access); legitimate interests (keeping accounts and tenants secure and auditable). Your explicit acceptance of an invitation, given while signed in to your account, authorises joining a tenant; it is not the legal basis for the processing |
| Audit logging, recording legal acceptance, investigating misuse | Security data, acceptance records | Legitimate interests (accountability, security and evidence); legal obligation where applicable |
| Billing, invoicing, tax and accounting | Billing data | Performance of a contract; legal obligation |
| Answering contact and support requests | Contact data | Legitimate interests (responding to you); steps prior to entering into a contract |
| Emailing an individual their Noxtica Verification ID and status link at their request | Email address (stored encrypted), chosen language, Verification ID, consent record (version and time), send times and count | Consent (explicit, optional and unticked by default; you can withdraw it at any time) |
| Operating the public Noxtica Verification ID status page | Verification ID and technical request data (such as IP address, for rate limiting and abuse prevention) | Legitimate interests (letting the individual and the people they choose to share the ID with check its status, limited to status, dates and business name; keeping the page secure) |
| Estimating age and gender from verification images and comparing them with the identity document, when a customer enables this optional feature | Selfie and liveness images or frames (already provided for verification); the resulting age range, female/male probability and document-agreement result | Consent, including explicit consent for biometric data where required (you can untick the option or withdraw at any time; the verification continues); where we act as a processor, the customer determines the legal basis (Section 2.2) |
| Sending our newsletter | Newsletter data | Consent (you can unsubscribe at any time) |
| Improving and developing the Services using aggregated or de-identified data | Usage, performance and telemetry data | Legitimate interests (improving our products) |
| Complying with law, responding to lawful requests, establishing or defending legal claims | Any relevant data | Legal obligation; legitimate interests |
Where we process data as a processor (Section 2.2), the customer determines the legal basis, including any explicit consent required for biometric data, for the optional speech analysis and for the optional age and gender estimation (Article 9(2)(a) GDPR where it applies); Noxtica never treats a customer’s acknowledgement as an individual’s consent.
Providing account and billing data is necessary to use the Services under a contract; if you do not provide it, we cannot provide an account. Accepting the website collector extensions and subscribing to the newsletter are optional.
5. Automated Processing and Decisions
The Services produce automated, probabilistic signals such as bot and risk scores and verification results. We do not make decisions about individuals on behalf of our customers. Our customers decide how to use these signals and are responsible for providing human review, explanations and the right to contest decisions where the law requires. If you believe a decision about you was made using our Services, please contact the organisation that made it.
Age and gender estimates are advisory and are never the only basis of a decision that has legal or similarly significant effects on you.
On our own websites, the collector’s signals are used to detect bots and protect the site. They are not used to make decisions that have legal or similarly significant effects on you.
6. Who We Share Data With
6.1 We Do Not Sell Personal Data
We do not sell personal data, and we do not share personal data for cross-context behavioural advertising. We do not serve advertising.
6.2 Service Providers and Subprocessors
We use service providers to host, operate and support the Services, including Cloudflare (hosting, content delivery, security, storage, email and AI inference), Google Cloud (data warehousing in the EU), AI model providers (only when an AI Feature that uses them is enabled), payment service providers (only when payment features are used) and email providers. The current list, with purposes and locations, is on our Subprocessors page.
6.3 Customers
When we act as a processor, we make data and Output available to the customer that collected it, and to the people the customer authorises (for example, its reviewers). When your Backoffice account belongs to several tenants, the administrators of each tenant you have joined receive the account details described in Section 3.2 for that tenant only.
6.4 Legal Requirements and Protection
We may disclose personal data where we believe in good faith that it is required by law, regulation, legal process or a governmental request, or necessary to protect the rights, property or safety of Noxtica, our customers or others, to prevent fraud or abuse, or to enforce our agreements.
6.5 Business Transfers
If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to this policy or a notice we provide.
7. International Data Transfers
Noxart Games Co. is a U.S. corporation with its principal place of business in Türkiye. Personal data is processed in several countries, including:
- Global: on Cloudflare’s network, which processes requests at locations close to the user worldwide;
- Türkiye: our primary database runs on infrastructure we operate in Antalya, Türkiye;
- Noxtica-operated facilities: our verification models run on servers we operate, reached through secure tunnels;
- European Union: data warehouse and backup storage (Poland and Belgium for Google Cloud; EU-jurisdiction storage for database backups); and
- United States and other countries: where our service providers, including AI model providers, process data.
Türkiye and the United States are not generally recognised by the European Commission as providing an adequate level of data protection (except, for the United States, for organisations certified under the EU–U.S. Data Privacy Framework). Where the law requires a transfer mechanism, we rely on the European Commission’s Standard Contractual Clauses (and the UK and Swiss equivalents), which are incorporated into our Data Processing Addendum for customer data and are included in our major providers’ data processing terms, or on another mechanism permitted by law. You can ask for more information about these safeguards by contacting us.
8. How Long We Keep Data
We keep personal data only for as long as needed for the purposes described above, unless a longer period is required or permitted by law (for example, for tax, accounting, legal claims or security investigations). Typical periods:
| Data | Retention |
|---|---|
| Device, fingerprint and event data processed for customers | Set by the customer’s plan and configuration; by default 1 to 7 days depending on plan, configurable by the customer; then deleted, with a short grace period for hard deletion |
| Aggregated real-user-monitoring metrics | Up to 3 months |
| Session replays, error details and monitoring data | Set by the customer’s retention configuration |
| Data warehouse copies of customer data | Follow the customer’s configured retention; a technical backstop deletes any remaining partitions after about 10 years |
| Identity, business and merchant verification data | Set by the customer, who decides how long verification evidence is kept to meet its own legal obligations; deleted on the customer’s instruction or when its configured retention ends |
| Backoffice account data | While the account is active; deleted after account closure, subject to backup and legal retention |
| Tenant memberships | While the membership exists; deleted when you are removed from that tenant or when the account is deleted, subject to backup and legal retention. Related audit records follow the audit-log retention below |
| Backoffice audit logs | 365 days by default (never less than 90 days) |
| Legal acceptance records | For as long as needed to prove acceptance and defend legal claims |
| AI assistant transcripts | Not stored by default; if enabled by an organisation, 30 days |
| Noxtica Verification ID and its public status page | Kept with the verification record that it belongs to; the page reports “expired” 365 days after completion and stops answering when the record is erased or its retention ends |
| Email address given to receive a Noxtica Verification ID (and its consent record) | Only with the verification record: deleted or archived when the record is erased or its retention ends, or earlier if you withdraw your consent |
| Contact-form messages | Around 90 days, or longer if needed to handle your request or a legal claim |
| Newsletter subscriptions | Until you unsubscribe; unsubscribed records are deleted after about 30 days; unconfirmed sign-ups after about 7 days |
| Billing records | As long as required by tax and accounting law |
| Database backups | Rotated; backups are kept for about 30 days |
9. Your Rights
9.1 Your Rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data;
- restrict our processing;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability (receive data you gave us in a structured, machine-readable format);
- withdraw consent at any time, without affecting processing before withdrawal (for the website collector extensions, use “Cookie settings” in our website footer; for the newsletter, use the unsubscribe link; for the email address you gave us to receive a Noxtica Verification ID, email [email protected] with “Privacy Request” in the subject line);
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where the law gives that right (see Section 5); and
- not be discriminated against for exercising your rights.
9.2 How to Exercise Your Rights
Email [email protected] with “Privacy Request” in the subject line. We may need to verify your identity before acting on a request, and we may decline requests where the law allows. You may use an authorised agent where the law permits; we may ask for proof of authorisation. We respond within the time required by applicable law (generally within one month under the GDPR, or 45 days under U.S. state laws, which may be extended where the law allows). If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line.
If your data was collected by one of our customers, please contact that customer first (see Section 2.2).
9.3 Complaints
If you are in the EEA, the UK or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority. Residents of other countries may have similar rights. We would appreciate the chance to address your concern first.
9.4 Additional Information for U.S. State Residents
In the last 12 months we collected the categories of personal information described in Section 3 (identifiers, internet and network activity, approximate geolocation, professional information, commercial information, audio and visual information and, where customers use verification features, biometric information and government identifiers) for the business purposes described in Section 4, and disclosed them to the service providers described in Section 6. We do not sell personal information or share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing personal information of consumers under 16. We use sensitive personal information (such as account credentials) only for purposes permitted by law, such as providing the Services and ensuring security. Our collector on our own websites honours Global Privacy Control and “Do Not Track” signals for real-user monitoring as described in our Cookie Policy.
10. Cookies and Similar Technologies
We use a consent banner on our websites. Our core collector script runs on every page, including our legal pages, because it is strictly necessary for security and fraud prevention; it sets no persistent identifier and keeps only a session token in sessionStorage. We do not load our collector extensions on our websites unless you accept. For details of the cookies and browser storage we use, see our Cookie Policy.
11. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit, encryption of verification evidence before storage, hashed credentials and keys, role-based access control, tenant isolation, multi-factor authentication, rate limiting and audit logging. No system is completely secure, and we cannot guarantee the security of any data. If we become aware of a personal data breach, we will notify affected customers, authorities and individuals where and as required by applicable law.
12. Children
The Services are intended for businesses and are not directed to children under 16 (or the higher age required where you live). We do not knowingly collect personal data from children as a controller. Customers are responsible for meeting the legal requirements that apply if they verify or monitor minors. If you believe a child has provided us with personal data, contact us and we will delete it as required by law.
13. Customer Responsibilities
If you are a Noxtica customer, you are solely responsible as controller for: having a lawful basis (and any explicit consent required, for example for biometric data) for the data you collect through the Services; giving your end users all required notices, including about fingerprinting, monitoring, session replay, verification, automated decision-making and international transfers; configuring retention, masking and other settings appropriately; enabling age and gender estimation only after updating your own privacy notice and data protection impact assessment, giving your end users the transparency required for biometric categorisation (including under Article 50(3) of the EU AI Act), recording a valid basis for it, and never using the estimate as the sole basis of a decision about a person or as an input to eligibility, credit, employment or migration decisions; and responding to your end users’ requests. See our Terms of Service and Data Processing Addendum.
14. Third-Party Websites and Services
Our websites and the Backoffice may link to or load content from third parties (for example, map tiles in the Backoffice). Those third parties process data under their own policies, and we are not responsible for them.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last Updated” date and version number and, for material changes, notify customers through the Backoffice or by email before the change takes effect where practicable. Previous versions are available on request.
16. Language; Controlling Version
Only the English version of this Privacy Policy is legally valid and binding. The controlling version is the English text published at https://noxtica.com/privacy. Any translation of this document (including any machine translation) is provided for reference purposes only, does not have any legal value, should not be relied upon as a legally binding document, and creates no obligation or responsibility for Noxtica. In the event of any discrepancies or inconsistencies between a translation and the English version, the English version shall prevail.
17. Contact Us
For questions, concerns or requests regarding this Privacy Policy or our processing of personal data:
- Email: [email protected] (subject: “Privacy Request”, or “GDPR” for EU/UK matters)
- Post: Noxart Games Co., Erenek Mah. Asmalı Sok. No:44 A1 Blok D:35, Antalya 07230, Türkiye
- Website: https://noxtica.com/contact
This Privacy Policy is effective as of the Effective Date above.