Legal information
Privacy policy
Last updated: 9 August 2026
This policy explains what personal data Noki Mind collects, why it collects it, who it is shared with, how long it is kept and which rights you can exercise.
It is written to be read: every processing activity is tied to a purpose and to a legal basis under the General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is Noki Mind, SASU, publisher of this site and of the application it hosts. Full details are in the legal notice.
For any question about this policy, to exercise your rights or to report an incident: contact@nokimind.com. No data protection officer has been appointed: neither the size of the company nor the nature of the processing requires one.
2. What this policy covers
The service comes in three shapes, and this policy covers all three.
- The public site: presentation pages, contact form and discovery questionnaire.
- Online quotes: a quote opens from a private link, and can be read, commented on and signed without an account.
- The signed-in areas: the client area (quotes, task tracking, shared credentials, notifications) and the admin area reserved for the Noki Mind team.
It does not cover the shops we build for our clients: each has its own policy, and the retailer answers for it.
3. What data, what for, on what basis
We only collect what the service needs to work, and nothing more. For each situation: what is collected, what it is used for, and what makes it lawful.
- Contact form: name, email address, phone (optional), shop name, profile and message. To answer your request and prepare a proposal. Legal basis: pre-contractual steps taken at your request.
- Discovery questionnaire: email address and answers. To prepare a diagnosis and a fitting proposal. Legal basis: pre-contractual steps. Progress is saved so you can pick up where you left off.
- Signed-in account: email address, name, profile picture (optional), language, display settings you save yourself (task list views, for instance, with the name you give them), and either a password (never kept in clear) or your Google account identifier if you choose that way in. To open the area, recognise you there and hand it back to you as you left it. Legal basis: performance of the contract.
- Quotes, comments and signature: the signer's declared identity (name, role, email address), selected lines, totals recomputed by the server, date and time, a SHA-256 fingerprint of the document, the verification code sent by email, and the drawn or typed signature. To establish proof of the agreement. Legal basis: performance of the contract and legal retention obligations.
- Running the engagement: tasks, exchanges, call notes and transcripts produced by our video tools. To carry out the work and keep a record of it. Legal basis: performance of the contract.
- Shared credentials: the access to your tools (shop, host, ad account) that you entrust to us so we can work. It is encrypted at rest, every read is logged, and it can be revoked at any time. Legal basis: performance of the contract.
- Notifications: channel preferences, email address and, if you turn it on, your browser's push subscription. To tell you about what concerns you. Legal basis: performance of the contract, and your consent for push, which you can withdraw from your account at any time.
- Technical logs: IP address, timestamp, browser and pages requested, kept by our hosts. For security, abuse prevention and fault diagnosis. Legal basis: our legitimate interest in keeping the service secure.
We collect no special category data under Article 9 GDPR and never ask for any. The service is aimed at professionals: it is not intended for minors, and we do not knowingly collect their data.
5. Who has access to your data
Your data is accessible to the Noki Mind team, limited to what each person needs to see, and to our technical providers, who act on our instructions and on our behalf alone.
- Vercel: hosting of the site and the application.
- Supabase: database, authentication and file storage.
- Resend: delivery of service emails (invitations, notifications, verification codes).
- Google: only if you choose “Continue with Google” to enter your area.
We neither sell nor rent your data, and we pass it to no advertiser. It can only be disclosed to a third party upon a request from a competent authority.
6. Transfers outside the European Union
Some of our providers are established in the United States or may run support operations there. Those transfers rely on the European Commission's standard contractual clauses, complemented where applicable by the provider's certification under the EU - US Data Privacy Framework, and by technical measures such as encryption.
Details of the applicable safeguards are available on request at contact@nokimind.com.
7. How long we keep it
Nothing is kept out of habit: every retention period answers a reason.
- Contact request with no follow-up: 3 years from the last exchange.
- Unfinished discovery questionnaire: 12 months, then deleted.
- Data of a client under contract: for the duration of the relationship, then 5 years under the commercial limitation period.
- Signed quotes, invoices and accounting records: 10 years, as the law requires.
- Shared credentials: until revoked or until the engagement ends; their access log is kept for 12 months.
- Technical logs: 12 months at most.
- Signed-in account: until the access is closed, then deleted within 30 days, except for records the law requires us to keep longer.
8. Your rights
The GDPR grants you rights over your data, and they are all exercised at the same address: contact@nokimind.com.
- Access: know whether we process data about you, and get a copy of it.
- Rectification: have inaccurate or incomplete information corrected.
- Erasure: have your data deleted where no legal ground requires us to keep it.
- Restriction: ask for processing to be frozen while a dispute is settled.
- Objection: object, on grounds relating to your situation, to processing based on our legitimate interest.
- Portability: receive, in a machine-readable format, the data you provided to us.
- Withdrawal of consent: at any time, for whatever rests on it, without affecting what was done before.
- Post-mortem instructions: set what happens to your data after your death.
We answer within one month, extendable by two months for complex requests, in which case we tell you. Proof of identity is only requested where there is reasonable doubt about who is asking.
If our answer does not satisfy you, you may lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr) or with the supervisory authority of your country of residence.
9. How we protect it
Security is not a promise but a set of measures. These are the main ones.
- All traffic runs over HTTPS, without exception.
- Passwords are never stored in clear, and nobody at Noki Mind can read them.
- The credentials you entrust to us are encrypted at rest, under a key that is rotated, and every read is logged.
- The database enforces row-level separation: an account only ever sees the record, quotes and tasks that concern it.
- Team access follows least privilege and is withdrawn when someone leaves.
Should a data breach pose a risk to your rights, we would notify the CNIL within 72 hours and tell you directly in the cases the GDPR provides for.
10. Automated decisions
No decision producing legal effects concerning you is taken solely on automated processing, and we build no advertising profile. The assistive tools that help us draft or summarise are always reviewed by a human before anything reaches you.
11. Changes to this policy
This policy may change as the service or the regulation does. The date of the last update is at the top of the page, and any substantial change is announced by email or on your next sign-in, before it takes effect.
12. Write to us
A question, a request to exercise your rights, a concern: contact@nokimind.com. The publisher's postal details are in the legal notice.