Privacy Policy

1. Who we are

The controller of the personal data described in this policy is “NOCTUA TEK” LLC (“Noctua Tech”, “we”), registered in the Republic of Armenia.

Privacy contact: info@noctuatech.org. We will reply to written requests by email.

2. Scope

This policy applies to the public website, account registration and sign-in, the legal AI assistant, feedback and early-access forms, and related features such as chat history and feedback.

Legal-change monitoring and company-document features described on the website are still in development. They are not currently an active data-processing activity, and this policy does not yet cover them. We will update the policy and notify you of the changes before any of these features starts processing your data.

3. What data we collect

We collect only what is needed to provide the service. Depending on how you use Noctua Tech, this may include:

• Account data — first name, last name, email address, and a password stored by our authentication provider (we do not see your password in clear text).
• Google sign-in data — if you use “Continue with Google”, we receive the identifier, name, and email that Google shares with the app.
• Chat data — questions you send to the assistant, the assistant’s answers and citations, and session identifiers. Chats are stored so you can return to them. Your questions and the assistant’s answers are sent to Google’s Gemini models to generate a response and to create text embeddings used for legal search (see section 5).
• Feedback — optional ratings and comments on assistant answers, linked to the relevant message and, if you are signed in, your email.
• Contact-form data — name, email, and message when you write to us from the website.
• Technical data — IP address, browser type, device, and request metadata that our API and website hosting may record in server logs to operate and secure the service.
• Local device data — your language preference and a copy of the chat-session list, stored in your browser’s local storage.

We do not knowingly collect special-category data about you (health, biometric, political or religious views, and similar). Please do not include such data in a chat message or form, or confidential information about third parties — see section 9 and the Terms of Use.

4. Why we use your data, and our legal basis

Under Armenian law, your consent is our primary legal basis for processing personal data, except in narrow cases where processing is directly necessary to perform a contract with you or is required by law.

You may withdraw your consent at any time by writing to info@noctuatech.org or by deleting your account. Withdrawal does not affect processing already carried out and may mean we can no longer provide the parts of the service that depend on that data.

5. Whom we share data with

We do not sell personal data and do not use it for third-party advertising. We share data only with service providers that help us operate Noctua Tech, and only to the extent needed to provide the service:

• Our API and authentication infrastructure (including Supabase) — account sign-in, chat history, and related platform data.
• Google Gemini API — generates the assistant’s answers and the text embeddings used for legal search. Chat questions and answers pass through this provider; see section 9.
• Our website hosting provider — serves noctuatech.org.

We may also disclose data where required by law, to enforce the Terms of Use, or to protect the rights, safety, or property of Noctua Tech, our users, or the public. If Noctua Tech is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to the obligations in this policy.

6. International transfers

Some of the providers we use, including Google and Supabase, may process or store data on servers outside Armenia. Under Armenian law, transfers to countries on the Personal Data Protection Agency’s list of countries providing an adequate level of protection are permitted without additional approval. That list includes all EU member states and a defined set of other countries, as well as — only for organisations operating under a specified certified framework — the United States. For countries not on the list, prior Agency approval or a standard contract providing equivalent safeguards is required.

7. Retention periods

We may retain data for a longer period if needed to establish, exercise, or defend legal claims, or to perform a duty required by law.

8. Cookies and similar technologies

We use necessary storage to keep you signed in and to remember your language preference. We do not use analytics cookies.

You can block or delete cookies in your browser. If you do, some features, especially sign-in, may not work.

9. AI processing and automated decisions

The assistant’s answers are generated by a large language model (Google’s Gemini) based on legal texts in our database. No stage of this process makes an automated decision about you that produces legal effects or similarly significant impact — the assistant answers legal-research questions; it does not decide anything about your rights, legal capacity, or duties. Citations in an answer must always be reviewed and verified by a person before you rely on them.

You can read how data sent to Google’s Gemini API is processed in Google’s API terms.

10. Your rights

Under the Republic of Armenia Law “On Protection of Personal Data” (2015, as amended), you may request:

• Access — to know what personal data we hold about you, and how and why we process it,
• Rectification — correction of incomplete or inaccurate data,
• Destruction — destruction of data obtained unlawfully or that we no longer need,
• Blocking — temporary suspension of processing of your data in certain circumstances,
• Withdrawal of consent — see section 4,
• Complaint — to the Personal Data Protection Agency or a court,
• Compensation — for damage caused by unlawful processing, as provided by law.

To exercise these rights, write to info@noctuatech.org from your account email. We may need to verify that the request is really from you. For access/information requests, Armenian law sets a 5-working-day response period; we aim to meet that period for all requests in this section.

If you signed in with Google, you can also manage Google’s sharing of your account data in your Google account settings.

If you believe we have processed your data unlawfully, you have the right to complain to the Personal Data Protection Agency of the Republic of Armenia (a structural unit of the Ministry of Justice) or to the supervisory authority in your country of residence.

11. Children and legal capacity

Noctua Tech is intended for business and professional use. We do not knowingly collect personal data of children under 16. If you believe a child has created an account, contact us and we will delete it.

12. Security

We use industry-standard measures such as encrypted transmission (HTTPS), hashed passwords stored by our authentication provider, and access control for internal tools. No method of transmission or storage is completely secure. Please do not put secrets, passwords, or unnecessary personal data about third parties in chat messages or forms.

13. Security-incident notice

If personal data leaks from any of our electronic systems, Armenian law requires us to act immediately: publish a public statement about the leak and promptly notify the police and the Personal Data Protection Agency. We will follow this procedure and will also try to notify affected users directly if we have their contact details and doing so would not impede a law-enforcement investigation. For any other type of security incident that creates a risk to your rights, we will assess it promptly and notify affected users and the Agency as required by law.

14. Changes to this policy

We may update this policy when the product or the law changes. The new version will be published on this page with an updated “Last updated” date. Continued use of the website after a change means you accept the updated policy. For material changes, we will make reasonable efforts to notify you in advance (for example by email or a site notice).

15. Contact

Privacy questions: info@noctuatech.org.