Privacy Notice

Version: 1.3-rc.1
Effective date: Not assigned
Last updated: 2026-10-15

Summary

This Privacy Notice explains processing by Brockhaus Ventures UG (haftungsbeschränkt) and the boundary to processing performed for personal and professional Workspace customers.

Full terms

Controller and privacy contact

Brockhaus Ventures UG (haftungsbeschränkt), operating the NOCTRA Intelligence product, is the controller for the activities identified below where it determines purposes and means.

NOCTRA IntelligenceBrockhaus Ventures UG (haftungsbeschränkt)Falgerstraße 748147 MünsterGermanyRepresented by · Managing Director: Alexander BrockhausRegistered office: MünsterCommercial register / court: Amtsgericht MünsterRegistration number: HRB 23872Email the NOCTRA privacy contact: legal@noctraintelligence.com

NOCTRA controller processing

Public website and server logs

Purpose: Deliver the public site, maintain availability, diagnose faults and protect the Platform against misuse.
Data categories: IP and request metadata that may be available to the host, date and time, requested path, response and diagnostic data, browser or device metadata and sanitized application log categories.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in secure, reliable and diagnosable operation. Article 6(1)(c) applies where a specific legal security duty requires processing.
Recipients / providers: Hosting and infrastructure providers where the request reaches their function; competent authorities where legally required.
Source: Automatically from the requesting device and the application or provider runtime.
Retention: For the period necessary to operate and diagnose the service, investigate availability or security events and meet applicable legal-defence needs; Vercel runtime logs are retained for 30 days; longer security evidence needs a documented purpose and review date.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Technical request data is necessary to deliver the requested page; optional analytics is separate.

Support and contact requests

Purpose: Persist, route and answer general contact-form submissions, business, support, ticket-recovery, privacy and security communications.
Data categories: Optional name, email, selected topic, message, Workspace or transaction references supplied by the sender, correspondence and open/resolved status. Ticket recovery additionally uses the buyer email and matching ticket records; rate limiting uses a pseudonymized HMAC-derived request signal rather than storing the raw IP address in the request record.
Legal basis: Article 6(1)(b) GDPR for pre-contractual or contractual requests involving the data subject; otherwise Article 6(1)(f) for business communication and support. Article 6(1)(c) applies to legally required privacy or security handling.
Recipients / providers: NOCTRA personnel handling the request and the relevant hosting, authentication or email provider where technically involved; legal advisers or authorities where necessary.
Source: Directly from the sender or an authorized Workspace contact.
Retention: Until the request is resolved, then for applicable legal retention or limitation periods where the correspondence is needed as contract, compliance or dispute evidence.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Generally voluntary; without necessary contact and request details NOCTRA may be unable to respond or verify authority.

Workspace access inquiries previously submitted through Google Forms

Purpose: Review workspace access inquiries from prospective professional organizers and respond to the request; send future updates only where separately requested.
Data categories: Name, email, optional phone, company or Event-series information, organizer role, Event location and schedule, attendance, current software, operational challenges, product interests, feedback willingness and optional update interest.
Legal basis: Article 6(1)(b) GDPR for the requested pre-contractual workspace access review; Article 6(1)(a) for optional future updates, which can be withdrawn at any time.
Recipients / providers: Google Forms / Google Workspace for the externally hosted form and NOCTRA personnel reviewing the application.
Source: Directly from the applicant in the actively opened external form. The form is linked rather than embedded, so the NOCTRA page does not load the form before the visitor opens it.
Retention: For workspace access review and follow-up, then only for applicable evidence or limitation needs. Optional update contact data remains until withdrawal or the update purpose ends.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Voluntary. Required form fields were necessary to review the workspace access inquiry; optional fields and update interest could be omitted.

Consent-gated Google Analytics 4

Purpose: Measure use of the public landing page and valid public Event pages. The configured event contract is limited to allowlisted public page events; checkout and purchase events, authenticated organizer and Workspace activity, Platform Admin and other protected product surfaces are excluded.
Data categories: Consent state, sanitized public-surface category and public locale, page and interaction events, pseudonymous analytics identifiers and ordinary request or device metadata. NOCTRA does not intentionally send names, email addresses, phone numbers, internal UUIDs, Event, Venue or Workspace names, Event keys or slugs, ticket, pass or reservation identifiers, financial or business metrics, raw query strings or protected URLs.
Legal basis: Article 6(1)(a) GDPR and consent for optional terminal-device access under applicable German law. Consent can be withdrawn through Cookie Settings without affecting processing before withdrawal.
Recipients / providers: Google Analytics where production configuration is valid and the visitor has accepted the current disclosure version. The Google contracting entity and role remain verification blockers.
Source: From the consenting visitor’s browser and limited public-page interactions.
Retention: GA4 event data and cookies follow the configured Analytics property, browser controls and Google’s applicable retention controls. The account-level setting must be confirmed before Production activation. Withdrawal disables further analytics emission and triggers attempted cleanup of NOCTRA Attribution Lite state and GA cookies.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Optional. Rejection or no decision prevents the Google tag from loading and does not limit core Platform or public-page use.

Internal acquisition totals without browser identifiers

Purpose: Understand aggregate demand for the Core offer and overall account, Workspace, Event and Core-test operations.
Data categories: UTC week, fixed page or operation category, coarse ordinary HTTP-referrer category (Facebook, Instagram, search, own site, other or unknown), count. No raw referrer, URLs, query strings, UTMs, click IDs, IP addresses, device details, cookies, browser identifiers or account/Workspace/Event IDs are retained by this measurement.
Legal basis: Article 6(1)(f) GDPR for the transient processing of ordinary request metadata: NOCTRA’s interest in proportionate aggregate service and acquisition statistics. No additional browser tracking is instructed. This is separate from consent-gated UTM attribution and advertising tracking.
Recipients / providers: Authorized NOCTRA Platform Administrators and the existing hosting/database processors. No transmission to Meta or Google Analytics.
Source: Ordinary incoming document/offer requests and server-confirmed database creations. No per-person journey is reconstructed. Missing referrers remain unknown; repeats and bots may be counted. Prefetch/RSC requests and requests carrying DNT or Global Privacy Control are excluded from passive request counters.
Retention: Only weekly sums are stored, for at most 180 days; reporting suppresses counts below five. Creation totals are not reduced by subsequent deletion because they contain no identity link.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: No cookie or analytics consent is required by this implementation. No user-level ad attribution is inferred. You may object to processing based on legitimate interests; DNT/GPC stop passive request counting. Authentication and the offer remain available.

Authenticated first-party Product Analytics

Purpose: Understand product usage and improve NOCTRA through internal Platform Administrator analytics.
Data categories: Authenticated user UUID, server-resolved sessions using the existing Supabase Auth session, coarse device class, timestamps, active session time, normalized major product areas/features and activation milestones such as Workspace and Event creation. Email lookup is restricted to authorized administrators; email is not duplicated in telemetry. No IP analytics, precise location, fingerprinting, session replay, screen recordings, form/text contents, keystrokes or mouse coordinates.
Legal basis: Article 6(1)(f) GDPR: NOCTRA’s legitimate interest in understanding authenticated product usage and improving the platform. Product Analytics is on by default and can be switched off in Settings → Account → Preferences. It does not use Marketing/Meta or public analytics consent, and those choices remain separate.
Recipients / providers: Authorized NOCTRA Platform Administrators and Supabase as the hosting/database processor. Product Analytics telemetry is not sent to Meta or marketing analytics systems.
Source: Authenticated product navigation, coarse interaction activity and authoritative account/Workspace/Event milestones. Active time counts only while the tab is visible and interaction occurred within the preceding 60 seconds; a lightweight heartbeat runs approximately every 25 seconds. No Analytics-specific cookies or browser storage identifiers are used.
Retention: Identifiable raw Product Analytics sessions/events are deleted within a maximum of 12 months. Account deletion removes identifiable Product Analytics rows. Switching off immediately stops future collection; it does not itself erase earlier telemetry. Anonymized aggregate statistics may be retained longer.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Optional. Switching Product Analytics off does not affect authentication, product functionality, billing or marketing preferences. You can switch it on again later. See the rights section below for your right to object.

Consent-gated Attribution Lite

Purpose: Associate limited public acquisition context and allowlisted public interactions with signup and Workspace-creation milestones for aggregate campaign measurement.
Data categories: Canonical public landing-path category, referrer domain, sanitized UTM values, public tool identifier, allowlisted CTA identifier and timestamps. The state is stored in the browser and may be supplied as limited parameters only with accepted analytics consent.
Legal basis: Article 6(1)(a) GDPR and consent under section 25(1) TDDDG for optional terminal-device storage and access. Consent can be withdrawn through Cookie Settings.
Recipients / providers: Google Analytics only when GA4 is configured and the visitor has accepted the current analytics disclosure; otherwise the state remains in the browser.
Source: From the consenting visitor’s browser navigation and allowlisted public interactions.
Retention: At most 180 days from the first recorded touch. Stale state is discarded. Rejection or withdrawal clears the Attribution Lite browser state.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Optional. No Attribution Lite state is created or read for analytics unless the visitor has accepted analytics consent; rejection does not limit core services.

First-party Growth attribution

Purpose: Measure NOCTRA’s own consented acquisition funnel from public arrival through Reverse Onboarding, signup, account confirmation, Workspace creation and the first Event.
Data categories: Random cookie digest, bounded campaign labels, referrer hostname, canonical public landing category, stage and timestamp. No names, email addresses, IPs, device fingerprints, full URLs or form answers in events. A separately protected Auth ID binding verifies account milestones; aggregate reports contain no identity or resource IDs.
Legal basis: Article 6(1)(a) GDPR and consent under section 25(1) TDDDG for optional terminal-device storage and access. Consent can be withdrawn through Cookie Settings.
Recipients / providers: NOCTRA’s hosting, database and rate-limit infrastructure. Growth events are sent only to NOCTRA’s own endpoint, never to Google Analytics or advertising providers. Aggregate reporting is restricted to Platform Administrators.
Source: Consented first-party navigation and verified Auth, Workspace and Event outcomes.
Retention: Free-tool milestones contain only the tool identifier and start, completion, CTA click or subsequent /start arrival, never calculator values or checklist items. Cookie and journey expire after 180 days; expired server records are removed by daily cleanup. Withdrawal stops collection and requests deletion of the journey, milestones and Auth binding. A digest-only replay-prevention record remains for up to 180 days. No cross-device matching or backfill of unconsented visits.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Optional and gated by the current analytics consent policy. Rejecting or withdrawing has no effect on signup, support, recovery or other core functionality.

Accounts and authentication

Purpose: Create and secure accounts, authenticate users, maintain sessions, recover access and associate authorized users with Workspaces.
Data categories: Name, email, account and authentication identifiers, session and recovery state, membership, role, permission, invitation and access or revocation status.
Legal basis: Article 6(1)(b) GDPR where required to provide the requested account or contract to the data subject; Article 6(1)(f) for secure B2B administration of representatives and team members; Article 6(1)(c) for specific legal security duties.
Recipients / providers: Database, authentication, hosting and infrastructure providers used to deliver protected Platform access.
Source: Directly from the user, an inviting Workspace administrator and authentication systems.
Retention: For the account and Workspace relationship, then until deletion or restriction under applicable account, contract, security and legal-evidence requirements. Revoked access history may remain where needed for security evidence.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required for protected Workspace access; without it the user cannot use authenticated Platform functions.

Platform Contract and contracting-party evidence

Purpose: Identify the professional customer, verify technical acceptance authority, form and evidence the Workspace Contract and administer the selected Plan.
Data categories: Workspace, user and membership identifiers; role snapshot; contracting-party name, business type, address, country, billing email and optional registration or VAT information; B2B and authority attestations; Terms and DPA versions and hashes; Plan and commercial snapshot; timestamps and evidence hash.
Legal basis: Article 6(1)(b) GDPR where the data subject is the contracting professional; otherwise Article 6(1)(f) for B2B contract formation and administration through authorized representatives. Article 6(1)(c) and Article 6(1)(f) apply to mandatory records and establishment, exercise or defence of legal claims.
Recipients / providers: Database, authentication, hosting and infrastructure providers for protected contract processing; advisers, auditors or authorities where lawfully required.
Source: From the accepting user, Workspace authority records and the immutable legal and commercial release records.
Retention: Historical acceptance evidence is append-only and retained for applicable contract, tax, audit, limitation and dispute periods. It is not erased merely because the accepting user later leaves the Workspace.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required to conclude a Workspace Contract. Optional registration and VAT fields are required only where applicable or supplied.

Workspace administration and invitations

Purpose: Administer NOCTRA’s account relationship, invitation delivery, membership status and supportable authority boundaries independently of customer-controlled Event content.
Data categories: Business contact, invitation, role, membership, audit, activation and revocation data.
Legal basis: Article 6(1)(b) GDPR for the requested Platform relationship and Article 6(1)(f) for secure administration of business teams and authority.
Recipients / providers: Database, authentication, hosting and transactional-communication providers where an invitation or message is sent.
Source: From the invited user, the inviting Workspace and system-generated access records.
Retention: For the invitation and membership lifecycle, then as needed for account security, contract evidence and applicable limitation periods.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required for the requested invitation or membership; no invitation or protected access can be administered without the necessary contact and authority data.

Payments, ticketing and mixed roles

Purpose: Support SaaS subscription billing, hosted ticket checkout, Stripe Connect organizer payment accounts, payment and full-order refund handling, transaction security and NOCTRA’s own legal or commercial obligations. The organizer is generally the ticket seller and controller for the buyer relationship; NOCTRA processes customer-controlled buyer data under the DPA where applicable. Stripe may process data as processor, independent controller or in another role depending on the payment activity and its terms.
Data categories: Workspace subscription and billing references; organizer payment-account, seller, business and tax data; buyer name, email and billing data; reservation, order, ticket, pass, transfer, payment, full-order refund, chargeback, invoice and correction references, status and amounts. Card-entry data is handled on Stripe-hosted surfaces rather than stored directly by the NOCTRA application.
Legal basis: For NOCTRA-controlled portions: Article 6(1)(b) GDPR where necessary for the relevant contract, Article 6(1)(f) for secure B2B payment and transaction administration, and Article 6(1)(c) for mandatory financial or compliance records. Customer-controlled portions follow the organizer’s legal basis and instructions.
Recipients / providers: Stripe, the relevant organizer or ticket seller, and database, hosting and transactional-communication providers; authorities, banks or advisers where legally necessary.
Source: From the buyer, organizer, Workspace configuration, Stripe and system-generated transaction records.
Retention: Operational data for the subscription or transaction lifecycle; completed financial, refund and dispute evidence for applicable statutory, limitation and defence periods. Each category follows its purpose and applicable retention criterion rather than one universal period.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required for the selected paid ticket and payment flow. Without required buyer and payment data, a paid ticket purchase cannot be completed. Free tickets and Guestlist flows are distinct.

Financial, tax, contract and audit evidence

Purpose: Create and preserve legally required invoices, corrections, refunds, responsibility attestations, contract versions, audit trails and dispute evidence.
Data categories: Party and contact identity, transaction and tax context, invoice and correction data, acceptance and version records, timestamps, actor attribution, immutable hashes and dispute records.
Legal basis: Article 6(1)(c) GDPR for applicable accounting, tax and compliance duties; Article 6(1)(f) for reliable audit evidence and establishment, exercise or defence of legal claims.
Recipients / providers: Database and hosting providers; the relevant contracting party or ticket seller; tax, audit, legal and public authorities where lawfully required.
Source: From contracting parties, users, transaction providers and immutable application evidence paths.
Retention: For the applicable statutory retention and limitation periods. Retained evidence is segregated from ordinary active product use where the operational relationship has ended. No single period is asserted for all categories.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Some data is legally or contractually required. If required identity, tax or transaction evidence is not provided, NOCTRA may be unable to conclude or perform the relevant transaction or satisfy legal duties.

Security, fraud and abuse prevention

Purpose: Protect accounts, Workspaces, reservations, refunds, ticket access and infrastructure; investigate suspicious or failed operations and enforce security boundaries.
Data categories: Authentication and authorization events, access and revocation status, technical request data, scoped transaction references, rate-limit counters and pseudonymized HMAC-derived abuse signals.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in protecting users, customers, transactions and systems; Article 6(1)(c) where specific security or fraud-prevention duties apply.
Recipients / providers: Database, hosting, security and rate-limit providers, and Stripe where relevant to the affected payment flow; authorized personnel, advisers or authorities where necessary.
Source: Automatically from application, authentication, request and provider events; from reports submitted by users or customers.
Retention: For as long as needed to prevent, investigate and evidence the relevant security or abuse event and for applicable legal-defence periods; Vercel runtime logs are retained for 30 days; Upstash rate-limit keys expire according to their limiter windows, up to 48 hours plus one second. This does not specify retention of unrelated Redis records.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Generated as necessary for secure use. Refusing necessary security processing can make the affected function unavailable.

Privacy requests and legal defence

Purpose: Verify and answer rights requests, document compliance, communicate with authorities and establish, exercise or defend legal claims.
Data categories: Identity and contact data, request and verification details, affected records, correspondence, decision and fulfilment evidence, authority or legal correspondence.
Legal basis: Article 6(1)(c) GDPR for GDPR request and authority obligations; Article 6(1)(f) for proportionate identity verification, compliance evidence and legal claims.
Recipients / providers: NOCTRA personnel, the relevant Workspace controller where the request concerns customer-controlled data, service providers needed to retrieve records, advisers, courts and competent authorities.
Source: From the requesting person, the relevant organizer or Workspace, NOCTRA systems and competent authorities.
Retention: Personal-account request evidence is retained until the end of the third calendar year following completion, subject to a specifically documented legal hold. Unmatched declarations are reviewed after 90 days. Other requests follow their purpose and applicable legal duties.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Information necessary to identify the relevant records and verify identity may be required; excessive verification data is not requested as a default.

Processing controlled by a Workspace customer

A professional Workspace customer generally determines the purposes and means for its Event, Venue, Guestlist, Door, Campaign, ticket purchaser, attendee, reservation, ticket, refund and customer-report processing. For those instructed activities, NOCTRA generally acts as processor under the DPA rather than as independent controller.

People whose data relates to a customer-controlled Event or buyer relationship should normally contact the identified organizer or ticket seller. NOCTRA will route a request concerning customer-controlled data to the relevant controller and will assist that controller as required by the DPA. NOCTRA remains responsible for the separate controller activities identified in this Notice.

Customer-controlled processing can include organizer and seller records, public Event, Venue and Organizer pages and media, ticket purchasers and attendees, Guestlist, Door and access events, Offline Door data held locally on an enabled device, Campaign records, operational and commercial actuals, and generated Event or periodic reports. Transactional email providers may deliver customer-directed invitations, tickets and confirmations on NOCTRA’s behalf.

Cookies and browser storage

The current browser state supports public language and cookie preferences, authentication, recovery, secure callback binding, requested functional features and ticket-transfer replay protection. Optional analytics storage is separate and consent-gated.

Product Analytics uses the existing authenticated session for server-side grouping. It sets no Analytics-specific cookies or identifiers in localStorage or sessionStorage. The account preference is stored in your user profile on the server.

noctra_public_locale

Purpose: Remember an explicit English or German choice across public pages and buyer flows.
Technical necessity: Required for the stated core flow
Approximate lifetime: Up to approximately one year; replaced when another supported language is selected.
Relationship: First-party, HTTP-only NOCTRA cookie; it does not change an organizer account or Workspace locale.
Analytics or marketing: Not used for analytics or marketing

noctra_public_analytics_consent

Purpose: Remember whether a public visitor accepted or rejected optional analytics cookies and the disclosure-policy version for that choice. Rejected and undecided states do not load the Google tag.
Technical necessity: Used only to remember the visitor’s choice; if absent, optional analytics cookies remain undecided and disabled.
Approximate lifetime: Up to approximately six months; replaced when the visitor changes the choice.
Relationship: First-party NOCTRA preference cookie readable by public-site code; independent from public language and organizer or Workspace locale. Acceptance from an older disclosure version returns to undecided when a materially changed policy becomes active; rejection remains fail-closed.
Analytics or marketing: Stores only the Cookie Banner preference. It does not itself send an analytics request.

First-party Growth cookie (noctra_growth_v1)

Purpose: An opaque random cookie links consented acquisition touches and funnel milestones on NOCTRA’s own site. Events contain no names, email, IP, device signals, questionnaire answers or resource IDs. A separate restricted Auth binding verifies signup and subsequent milestones; it is not exposed in reports or sent to GA4.
Technical necessity: Optional; used only after acceptance under the current GA4 disclosure version and valid production configuration.
Approximate lifetime: The cookie expires 180 days after journey creation. Server data expires at the same time and is removed by daily cleanup. Withdrawal stops collection and requests deletion; a cookie digest without attribution or identity is retained up to 180 days to prevent replay.
Relationship: Optional analytics consent. No cross-device matching; only Platform Admin can read aggregate reports. Blocking storage or withdrawing consent does not limit core services.
Analytics or marketing: Consent-gated public analytics only; not advertising or marketing profiling.

Google Analytics cookies (_ga and _ga_<container-id>)

Purpose: Distinguish browsers and preserve session state for the limited public-surface measurement described above after valid consent.
Technical necessity: Optional; used only after acceptance under the current GA4 disclosure version and valid production configuration.
Approximate lifetime: Controlled by the configured Analytics property, Google and the browser. NOCTRA attempts to expire matching cookies when analytics is rejected or withdrawn.
Relationship: First-party Google Analytics cookies, separate from the NOCTRA language and consent-preference cookies. They are created only after the production and consent gates pass.
Analytics or marketing: Consent-gated public analytics only; not advertising or marketing profiling.

Supabase Auth and PKCE cookies

Purpose: Maintain authentication sessions and complete PKCE sign-in or recovery exchanges.
Technical necessity: Required for the stated core flow
Approximate lifetime: Session and provider configuration dependent; no single lifetime is fixed in application code.
Relationship: First-party cookies managed through the Supabase authentication SDK.
Analytics or marketing: Not used for analytics or marketing

noctra-password-recovery

Purpose: Bind a password-recovery callback to the protected reset-password flow.
Technical necessity: Required for the stated core flow
Approximate lifetime: Up to approximately 10 minutes; cleared after completion or expiry.
Relationship: First-party, HTTP-only NOCTRA cookie.
Analytics or marketing: Not used for analytics or marketing

noctra_stripe_onboarding_workspace

Purpose: Bind a Stripe Connect onboarding callback to the Workspace that started it.
Technical necessity: Required for the stated core flow
Approximate lifetime: Up to approximately 30 minutes; expired by the return flow.
Relationship: First-party, HTTP-only NOCTRA cookie used around Stripe Connect.
Analytics or marketing: Not used for analytics or marketing

Ticket-transfer sessionStorage

Purpose: Hold a per-tab random nonce for transfer creation or recovery replay protection.
Technical necessity: Required for the stated core flow
Approximate lifetime: Current browser-tab session; the nonce can rotate during the flow.
Relationship: First-party browser session storage; no third-party script receives it.
Analytics or marketing: Not used for analytics or marketing

Functional local and session preferences

Purpose: Remember desktop-sidebar state, local Event Planning Checklist progress, temporary post-event state and organizer-interface dismissals or preferences requested by the user.
Technical necessity: Functional storage used only when the visitor or authorized user requests the corresponding feature
Approximate lifetime: Checklist and sidebar preferences remain until changed or browser storage is cleared; temporary operational state lasts for the relevant tab or browser session.
Relationship: First-party localStorage or sessionStorage. These values support the requested interface or tool and are not conditional on analytics consent.
Analytics or marketing: Not used for analytics or marketing

Offline Door IndexedDB and service-worker cache

Purpose: Hold an authorized Event access snapshot and the application resources needed for the explicitly enabled Offline Door workflow.
Technical necessity: Functional storage used only when the visitor or authorized user requests the corresponding feature
Approximate lifetime: For the enabled offline workflow until the local snapshot, site data or service-worker cache is replaced or cleared.
Relationship: First-party IndexedDB and service-worker/cache storage on the authorized Door device; independent from optional analytics consent.
Analytics or marketing: Not used for analytics or marketing

NOCTRA Attribution Lite localStorage

Purpose: Store limited public landing, referrer-domain, sanitized campaign and allowlisted interaction context for consented public acquisition measurement.
Technical necessity: Optional; used only after acceptance under the current GA4 disclosure version and valid production configuration.
Approximate lifetime: At most 180 days from the first recorded touch; stale state is discarded and rejection or withdrawal clears it.
Relationship: First-party localStorage. It is created and used only after current analytics consent and is cleared with analytics rejection or withdrawal.
Analytics or marketing: Consent-gated public analytics only; not advertising or marketing profiling.

NOCTRA signup attribution localStorage (noctra_signup_attribution_v1)

Purpose: Preserves the first consented landing category, referrer hostname and validated UTM labels through signup. A private record links the new account, initial Workspace and first Event. Only verified Platform Admins can read it. No data is sent to Meta or added to Auth metadata.
Technical necessity: Optional; used only after acceptance under the current GA4 disclosure version and valid production configuration.
Approximate lifetime: Browser and server data expire 180 days after capture. Daily cleanup removes expired server records. Withdrawal clears browser data and requests deletion of the signed-in account’s record; if signed out, deletion is retried after sign-in on this browser.
Relationship: First-party storage under the existing optional analytics consent. No new cookie. Signup works without consent or browser storage; Founder Outreach remains separate.
Analytics or marketing: Consent-gated public analytics only; not advertising or marketing profiling.

Necessary cookies support the stated core functions. The Cookie Banner stores a versioned accepted or rejected preference and sends no analytics request itself. Optional GA4 loads only when production configuration is valid and the current policy is accepted. Rejection stops future application events and triggers best-effort removal of the configured GA cookies. Public language remains independent.

General retention and termination boundary

Retention follows the purpose and legal basis stated for each activity. Customer-processor data is returned or deleted after the Platform Contract ends in accordance with documented DPA instructions and the technically available process, subject to statutory retention. This does not erase NOCTRA-controller evidence that must remain for applicable financial, tax, contract, audit, security, limitation or dispute purposes. Retained evidence is restricted from ordinary active product use. No universal backup or provider-deletion period is promised.

Your data-protection rights

Access to personal data and the information required by Article 15 GDPR.
Rectification of inaccurate data under Article 16 GDPR.
Erasure under Article 17 GDPR where its requirements are met.
Restriction of processing under Article 18 GDPR.
Data portability under Article 20 GDPR where applicable.
Objection under Article 21 GDPR to processing based on legitimate interests, on grounds relating to the person’s particular situation; direct-marketing objections apply without that additional requirement.
Withdrawal of consent at any time for the future, without affecting the lawfulness of processing before withdrawal.
Complaint to a competent data-protection supervisory authority under Article 77 GDPR.

Email the NOCTRA privacy contact: legal@noctraintelligence.com

Complaint to a supervisory authority

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-WestfalenPostfach 20 04 44, 40102 Düsseldorf, Germany+49 (0)211 / 38424 - 0https://www.ldi.nrw.de/kontakt

You may complain to this authority or another competent supervisory authority. The authority name and contact above were verified against its official contact page on 13 August 2026.

Automated decision-making

NOCTRA does not use the controller processing described in this Notice to make decisions based solely on automated processing that produce legal effects or similarly significantly affect a person within Article 22 GDPR. Operational calculations, fraud signals and access checks do not by themselves establish such a decision. If that product fact changes, this Notice must be updated before the change is used.

Providers and processing terms

View the DPA View provider disclosure

Security reports

Suspected security issues affecting the NOCTRA Platform can be reported to the published security contact. No response time or outcome is promised by this notice.

Email a security report: legal@noctraintelligence.com

Back to NOCTRA