# Privacy Policy

> Draft policy on what personal data Noptcha collects, why, how long it is kept and your rights. Not yet in effect.

Source: https://noptcha.com/legal/privacy/

> **Draft — not yet in effect:** This is a working draft. It has not been reviewed by a lawyer, it is not in effect, and it may change completely before launch. Text marked \[TBD: …\] has not been decided.

**Last updated:** \[TBD: date\] · **Effective:** \[TBD: effective date\]

This policy explains how Noptcha, LLC (“Noptcha”, “we”) handles personal data when you use the Noptcha API, the console at `app.noptcha.com` and this website. We are the controller of the personal data described here. \[TBD: whether we act as a processor for personal data contained in task content, and whether a DPA is offered\]

## Summary

-   We collect what we need to run accounts, process tasks, take payments and keep the Service secure.
-   We do not sell personal data, we do not use advertising or analytics cookies, and we do not send marketing email \[TBD: confirm, or describe opt-in marketing\].
-   Task content and answers are kept only briefly (minutes). Proxy usernames and passwords in tasks are never stored.
-   The IP address a task came from is kept for 30 days; after that only its network prefix is kept.

## What we collect

### Account and organization

-   **Account:** email address, name (if you give one), a hash of your password, your two-step verification settings (the authenticator secret is stored encrypted; recovery codes are stored as hashes), and the time of your last sign-in.
-   **Sessions and devices:** for each signed-in session, the IP address and a shortened browser description (user agent); for devices you have signed in from, a label such as “Chrome / macOS”, when it was first and last seen, and its last IP address. Device recognition uses a random identifier in a cookie; we store only a hash of it.
-   **Organization:** its name, members and their roles, invitations (the invited email address), country, billing email and, if you enter them, billing details (legal name, address, tax ID).
-   **API keys:** we store a hash of each key, its prefix and last four characters, its settings and when it was last used. We cannot recover a key from what we store.
-   **Security and audit log:** a record of security-relevant actions (sign-ins, key changes, payment actions and so on), with the IP address and browser description.

### Payments

-   Top-ups and refunds: amount, payment method type, status and the payment processor’s order and refund references.
-   Card and wallet payments are handled by the payment processor; **we do not receive or store your full card number**.
-   For cryptocurrency payments we keep the paying address reported by the processor, and for refunds the address and network you ask us to send the refund to.

### Tasks

-   **Task content:** what you send to solve a task, for example the website address and site key, an image, or proxy details. We pass task content to the solving resource that handles the task.
-   **Task records:** for each task, its type, outcome, timing, price, the website’s domain, the IP address the request came from (and its network prefix and country), and the key and organization that created it.
-   **Kept briefly, then gone:** task content is held in short-lived storage while the task is processed and for up to 30 minutes after the task’s deadline. Answers (including tokens) are kept for 10 minutes after the task finishes, so you can fetch them, and for up to 15 minutes in a webhook delivery that is still being retried. Neither is written to our databases or logs. Proxy usernames and passwords are never written to any database or log. \[TBD: if samples (images, requests) are ever kept for quality checks (designed as 3 days), add it here first\]
-   **Webhooks:** the endpoint addresses you configure, and a record of each delivery attempt (time, result, HTTP status, host of the endpoint).

### Support and communication

Email we send you (security notices such as a password change or a new two-step verification setting, balance and payment notices) and anything you send us. \[TBD: support channel and what it records\]

### This website

The documentation site does not use cookies or analytics. Our network provider may record your IP address and browser in its logs for security. \[TBD: confirm, and the retention of edge logs\]

## Why we use it

| Purpose | Data | Legal basis \[TBD: confirm which laws apply (for example GDPR, UK GDPR, CCPA)\] |
| --- | --- | --- |
| Create and run your account and organization; process tasks | Account, organization, keys, task content and records | Performing our contract with you |
| Take payments, issue refunds, keep financial records | Payments, billing details | Contract; legal obligations (tax and accounting) |
| Keep accounts and the Service secure: two-step verification, device recognition, rate limits, blocking abuse, detecting fraud and chargebacks | Sessions, devices, IP addresses, audit log, task records | Legitimate interests (security and fraud prevention) |
| Enforce the [Acceptable Use Policy](https://noptcha.com/legal/acceptable-use.md) and respond to legal requests | The data relevant to the case | Legitimate interests; legal obligations |
| Measure and improve quality and routing | Task records, answer reports | Legitimate interests |
| Send service, security and payment notices | Email address | Contract; legitimate interests |

## Who processes it

We use service providers (“subprocessors”) that process personal data on our behalf, under contracts that limit their use of it. By category:

| Category | What they process |
| --- | --- |
| Cloud hosting (servers in Singapore; backup copies in \[TBD: region\]) | All data we hold |
| Network, DNS and security (content delivery, firewall, access protection) | IP addresses, request metadata |
| Object storage (backups, documents) | Backups of our databases |
| Email delivery | Email address, email content |
| Payment processing (card and wallet payments; cryptocurrency payments; a payment gateway operated by \[TBD: an affiliated company — confirm how to describe it\]) | Payment details, billing email, amounts |
| Human verification on sign-up and sign-in | IP address, browser signals |
| Breached-password check | Only the first 5 characters of a hash of the password (it cannot be reversed to the password) |
| Captcha solving resources: third-party solving providers, AI model providers and an affiliated recognition service | Task content (website address, site key, images, proxy details you supply) |

\[TBD: whether to publish a named list of subprocessors (and where), and how customers are notified of changes\]

We also disclose data when required by law or valid legal process (see the [Acceptable Use Policy](https://noptcha.com/legal/acceptable-use.md#law-enforcement-and-legal-requests)), to protect people, the Service or our customers from fraud or harm, and to a successor in a merger, acquisition or sale of assets.

## How long we keep it

| Data | Kept for |
| --- | --- |
| Task content and answers | Task content up to 30 minutes after the task’s deadline; answers 10 minutes after the task finishes (up to 15 minutes in a webhook delivery being retried) |
| Task records | 90 days; the source IP address is removed after 30 days and only its network prefix is kept |
| Usage totals per organization, hour and task type (no personal data) | As long as the financial records |
| Webhook delivery records | 7 days |
| Security and audit log | \[TBD: 2 years (planned; automatic deletion is not built yet)\] |
| Server logs | \[TBD: 90 days (planned)\] |
| Backups | 30 days |
| Payments, refunds and the ledger | \[TBD: at least 7 years, to be confirmed with our accountant\]; after account deletion they are kept with the organization ID only, without personal details |
| Receipts and credit notes already issued | \[TBD: at least 7 years, to be confirmed with our accountant\]. They keep the billing details printed on them (billing name — or the organization name if no billing name was set — address, country, tax ID and billing email, plus the organization ID), also after account deletion, because financial records must be kept as issued. The billing details you saved in the console are deleted with the organization’s other personal data, 30 days after it is closed |
| Account and organization data | Until the organization is closed or the account is deleted, then deleted 30 days later as described below |

## Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to complain to a data protection authority.

-   **Export:** every member can export their data as a file (JSON) from the console (Account → Export my data): their account, sign-in history and devices, and for each organization they belong to, the organization’s full data if they are an owner or admin (including its billing details and the receipts and credit notes issued to it, without the PDF files), or only the records about themselves otherwise. Activity of other people in the file does not include their IP addresses or browsers. Up to 5 exports a day; very large exports are done by support.
-   **Correction:** some details can be changed in the console (for example your password and two-step verification); for anything else, contact us.
-   **Closing an organization:** an owner can close an organization in the console. Its API keys are revoked and its webhooks turned off at once, and nobody can open it any more. An owner can reopen it within 30 days. After 30 days the personal data in the organization (members, webhook endpoints, key names, the billing details saved in the console, IP addresses and other personal fields in its activity log) is deleted; receipts and credit notes already issued are kept as described above. If something about the organization’s money is still open at that point (a payment dispute, a refund in progress, a negative balance, or a payment that arrived after closing), deletion waits until it is resolved.
-   **Deleting your account:** you can delete your account in the console (Account → Delete account), unless you are the only owner of an organization that is still open (add another owner or close it first). You are signed out everywhere and leave all organizations at once; this cannot be undone from the console. The owners of those organizations that are still open are told by email that you deleted your account, and invitations you sent are cancelled. API keys and webhook endpoints you created belong to the organization and stay there. 30 days later your personal data (email address, name, sign-in history, devices, IP addresses in our logs, invitations sent to your email address and that address in other organizations’ activity logs) is deleted. Until then the email address cannot be used to sign up again. \[TBD: whether support can restore a deleted account within the 30 days\]
-   Financial records (payments, refunds, the ledger) are kept for the period above, with the organization ID only; receipts and credit notes already issued keep the billing details printed on them for their retention period (see the table above). Backups expire within 30 days after deletion. \[TBD: whether payment processor notifications, refund payout addresses and our staff’s activity log are anonymized at the same time\]
-   **Other requests:** write to \[TBD: privacy contact\]. We may need to verify that the request comes from you. We answer within \[TBD: response time, for example 30 days\].

## Cookies and local storage

The console at `app.noptcha.com` uses only cookies that are needed for it to work:

| Name | Purpose | Lifetime |
| --- | --- | --- |
| `__Host-nop_sid` | Your signed-in session (not readable by scripts) | Until you sign out or the session expires |
| `__Host-nop_csrf` | Protects forms against cross-site request forgery | Until you close the browser |
| `__Host-nop_dev` | Recognizes a device you signed in from before, so you are not asked for human verification again | 400 days; removed when you delete the device |

The console and this website keep your light or dark theme choice in your browser’s local storage. Payment pages are run by the payment processor and the human verification check is run by its provider; they may set their own cookies. \[TBD: list them, or link to the providers’ policies\]

## International transfers

We are a US company and our servers are in Singapore; some providers process data in other countries. When we transfer personal data from the EEA, the UK or Switzerland, we rely on \[TBD: transfer mechanism, for example Standard Contractual Clauses\].

## Security

Accounts require two-step verification; passwords are hashed with a modern algorithm; API keys are stored only as hashes; access to production systems is limited and logged. No system is perfectly secure; if a breach affects your personal data, we will notify you as required by law.

## Children

The Service is not directed at children, and you must be at least \[TBD: minimum age\] years old to use it.

## Changes

We will post changes here and update the date above. For material changes we will notify account owners by email \[TBD: notice period\] before they take effect.

## Contact

Noptcha, LLC · \[TBD: company address\] · \[TBD: privacy contact email\] · \[TBD: EU/UK representative, if required\]