Privacy Policy

Last updated: 30 October 2026

Nolt is provided by Nolt Software Inc., of 6D - 7398 Yonge St Unit # 320, Thornhill, Ontario L4J 8J2, Canada ("Nolt", "we", "us" or "our").

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information through our websites, hosted products, embedded features, integrations, support and related services (the "Services"). It explains the rights and choices available to individuals and the different roles of Nolt and its customers.

"Personal information" includes information that identifies, relates to or can reasonably be linked to an individual, as defined by applicable law.

For privacy enquiries, requests or complaints, contact hello@nolt.io. Our privacy officer and postal details appear in Section 16.

1. Scope and Our Role

This Policy covers visitors to Nolt's websites, customers, account holders, business contacts and people who interact with customer-facing features or whose information customers provide. You do not need a Nolt account for your personal information to be processed.

The Services include feedback boards, voting, comments, roadmaps, changelogs and related tools. Depending on the products and features offered and enabled, they may also include knowledge bases, AI question answering, email campaigns, surveys and Net Promoter Score tools, live chat, and inbox or mail functions. Describing a feature here explains its information practices when available; it does not mean every feature is currently offered or included in every plan.

1.1 Information We Control

We generally act as a controller, or the equivalent under applicable law, for personal information we use to manage our own websites, accounts, billing, business relationships, marketing, support, security and legal obligations. We determine the purposes and means of that processing, subject to applicable law. This includes the signup attribution described in Sections 2.5 and 7.2, including when an individual registers on a customer's feedback board.

1.2 Information We Process for Customers

"Customer Content" means information submitted, collected or made available through a customer's use of the Services, including contributions from people who do not have an account. We generally act as a processor or service provider for personal information in Customer Content processed on the customer's documented instructions. If the customer acts for another organisation, Nolt may act as a subprocessor.

The relevant customer determines why it collects and uses that information, the audiences for its content and the features it enables. Its privacy notices explain those activities. Our role depends on the particular processing, rather than simply whether information is stored in a customer account.

Our Data Processing Agreement ("DPA") governs personal information processed on a customer's behalf. The applicable EU and United Kingdom or USA and Canada version is identified in the customer's Order or acceptance documents and supplied or linked for review and retention before acceptance. It takes effect by signing or express incorporation into a binding customer agreement, including acceptance under our Terms of Service. Separately signed customised terms may replace or supplement it to the agreed extent. Contact hello@nolt.io for a copy. The regional form does not itself select a hosting environment. This Policy explains our practices; it does not replace the DPA or limit individuals' statutory rights.

2. Personal Information We Collect

The information involved depends on the features used, the information supplied and the permissions granted. We collect information directly from individuals, from customers and their authorised users, from connected services and authentication providers, and automatically through use of the Services.

2.1 Accounts Authentication and Billing

We process names, email addresses, profile images, organisation and account identifiers, roles, preferences and authentication records. Registration may use email-based passwordless authentication, social sign-in or customer-enabled single sign-on and user provisioning. These connections can supply profile details, email addresses, role information and other attributes within the permissions granted. Nolt does not store account passwords.

Where no profile image is available, we may send a hash derived from an email address to Gravatar to check for an associated image. A hashed identifier can still relate to an individual; it is not necessarily anonymous information.

For subscriptions and purchases, we process plan details, subscription status, transaction references and relevant billing, invoicing and usage records. Paddle acts as merchant of record and handles payment transactions. Full payment-card details are collected and handled by the payment provider, rather than stored on Nolt's servers. Billing administration may still involve personal information available through the purchase arrangements.

2.2 Feedback Knowledge Materials and User Attributes

Customer Content can include posts, votes, comments, attachments, roadmaps, changelogs, knowledge articles and related authorship, subscription and activity records. It may identify the contributor or another person mentioned in the content.

Customers may supply structured user attributes, such as company, region, customer tier or other information relevant to their relationship with a contributor. Attributes may be provided through permitted customer systems or entered by authorised administrators. An attribute's connection to a user's contributions can support customer-directed filtering and segmentation.

2.3 Campaigns Surveys and Conversations

Where the relevant features are used, we process recipient and contact details, distribution lists, message content, sender details, delivery records, subscription preferences, permissions and suppression information. Enabled measurement features may also process message-interaction information, such as opens or link clicks.

For surveys and NPS tools, information can include questions, scores, responses, respondent details and associated technical or participation records. For live chat and any available inbox or mail features, it can include messages, attachments, participants, conversation history and connected-account information within the permissions granted.

2.4 Connected Information AI Inputs and Results

Customers may import information from authorised external systems or make relevant records available through integrations, APIs, webhooks and connected assistants. We process connection permissions, tokens and related records needed to operate those connections.

AI features may process questions, prompts, instructions, relevant knowledge passages, posts, conversations or other selected Customer Content. Related responses, summaries, moderation results and other generated information can contain personal information or inferences about people. The content sent depends on the feature, selected model and context needed for the request.

2.5 Technical and Usage Information

We process IP addresses, browser and device information, operating system information, referral URLs, timestamps, pages and features accessed, authentication events, actions within the Services and diagnostic or error records. Cookies, local storage, pixels and similar technologies can be involved, as explained in Section 7.

In connection with registrations for the Services, including end-user registrations on customer feedback boards, we collect signup attribution information. This may include referring sites, campaign tags and advertising click identifiers associated with the registering user's email address. We use it for Nolt's own marketing attribution, as explained in Sections 4 and 7.2.

Operational logs and service telemetry help us provide, secure and troubleshoot the Services. These activities are distinct from advertising and session replay on our own marketing pages.

2.6 Communications and Other Sources

We collect information in enquiries, support conversations, demonstrations, feedback, newsletter subscriptions and other communications with us. Authorised staff may access relevant account or content information to investigate a support request.

Information about someone can also come from another person, an organisation administering their account, a customer-designated source, an enabled integration or publicly available material used within an authorised feature. Where required, the responsible organisation must provide information about that indirect collection; we meet the notice duties applicable to our own role.

2.7 Sensitive Information

Free-text content, attachments and conversations may contain health, financial, private communications or other information treated as sensitive under applicable law. Customers should submit only what is necessary and satisfy any additional conditions for the processing they instruct. The Services are not an invitation to submit unnecessary sensitive information or credentials. Under Section 2.6 of the DPA, customers must obtain Nolt's prior written agreement before submitting special categories of personal data, personal data of children below the age at which consent is valid under applicable law, payment-card data subject to PCI-DSS, or protected health information subject to HIPAA. This contractual requirement applies in addition to the necessary legal grounds and protections.

3. Public Content Customer Settings and Notices

New feedback boards are public by default unless an available restriction is configured. Public posts, comments, displayed profile details and other published material can be viewed by people with access to the page and may be indexed, copied or redistributed. Customers can use available private-board and access settings to restrict audiences.

Authorised owners, administrators and moderators may access and manage information according to their roles, including information not displayed to ordinary visitors. Internal fields and user attributes are not necessarily visible to the person they concern. Plan changes do not themselves change privacy settings or necessarily erase attributes previously stored.

An anonymous display name, an accountless action or an anonymous survey setting does not necessarily mean that no personal information is processed. Technical records or customer-supplied information may still identify a person. The customer must describe anonymity and confidentiality accurately for the feature and configuration used.

Customers must provide appropriate notices and establish the permissions and legal grounds needed to collect, publish, send or otherwise process information through their deployment. Receiving a survey response or support message does not automatically authorise unrelated marketing. Accepting Nolt's Terms does not provide consent on behalf of another individual.

Changing access settings cannot recall information already copied by other recipients or guarantee immediate removal from external search engines and caches. These limitations do not remove Nolt's own privacy, confidentiality or security obligations. Contact the relevant customer or us through Section 16 if you believe information has been collected or disclosed improperly.

4. How we use Personal Information

We use personal information for the following purposes, subject to our role, customer instructions and applicable law.

• Providing the Services: Operating accounts and customer-facing tools; organising feedback and knowledge materials; administering votes, surveys and conversations; and delivering enabled messages and requested AI functionality.
• Customer-directed organisation: Maintaining the content, history, user attributes and relevant context needed for the features the customer uses, including its permitted filtering, segmentation, search and moderation activities.
• Connections and publication: Exchanging information with authorised integrations and audiences within the permissions and instructions given.
• Support and administration: Responding to enquiries, configuring accounts, troubleshooting problems, managing subscriptions, processing transactions and maintaining appropriate business records.
• Security and reliability: Authenticating access, diagnosing failures, investigating abuse and protecting individuals, information and the Services against fraud, spam and other misuse.
• Website improvement and marketing: Understanding the use and performance of our own websites, diagnosing visitor difficulties, measuring advertising effectiveness and signup attribution, including attribution associated with end-user registrations on customer feedback boards, and sending opt-in marketing communications, subject to applicable choices and legal requirements.
• Legal purposes: Meeting binding legal obligations, responding to valid requests, resolving disputes and establishing, exercising or defending legal claims.

We do not use Customer Content for unrelated commercial exploitation, sell it or provide one customer's private content as context for another customer. Our use of account and technical information for service administration is distinct from processing private content under a customer's instructions. Where appropriate, we may use aggregated information that does not identify individuals; removing a name or hashing an identifier alone does not make information anonymous.

If information is necessary for a requested service, withholding it may prevent that service from operating. A new incompatible purpose requires the notice, consent or other lawful steps applicable to that processing.

5. AI Processing and Automated Features

Nolt uses external AI providers for features such as moderation, changelog generation or summarisation and, where available, knowledge-base question answering and other requested assistance. Providers and models depend on the feature and options enabled. The regional provider registers linked in Section 6 identify relevant Nolt-appointed services.

Processing can involve the inputs and context described in Section 2.4, generated results and related request information. Moderation may automatically flag, hold or reject a submission under the relevant configuration. Question-answering features may deliver responses without a person reviewing each answer beforehand.

We do not use Customer Content to train or fine-tune Nolt's own AI models. For AI processing we engage, we use commercial API arrangements and endpoints or settings under which provider training on Customer Content is disabled. We do not authorise those providers to train or fine-tune their models on it. Choosing a model within Nolt does not waive these commitments.

This restriction does not promise zero provider retention or exclude limited security and abuse review. Nolt-appointed AI API requests use EU endpoints for EU Nolt and US endpoints for Global Nolt. Endpoint selection does not determine every provider's storage, retention, onward-processing or remote-access location. Provider handling, retention and international processing remain subject to the applicable arrangements, safeguards and DPA.

AI results may be inaccurate or create mistaken inferences about an individual. Customers should maintain appropriate oversight and routes to correction. Individuals may raise concerns or exercise applicable rights, including rights concerning qualifying automated decisions, through Section 12. The features are intended for content management and assistance, rather than as the sole basis for decisions requiring legally mandated human involvement.

When you independently authorise an external AI assistant or another connected service to access Nolt, it can receive information and perform actions within the permissions granted. Its own use of information is governed by its privacy notice and the arrangements made by the person or organisation authorising it; the no-training commitments for providers Nolt appoints do not describe an independently selected service's practices.

6. How we Disclose Personal Information

We disclose personal information for the purposes described in this Policy, subject to legal and contractual restrictions and the permissions involved.

6.1 Service Providers

We engage providers for hosting, storage, content delivery, security, authentication support, transactional email, AI processing, monitoring, support, business communications, website analytics, advertising measurement and session replay. They receive information relevant to their functions. Our Global Nolt provider register is at https://nolt.io/help/data-subprocessors and our EU Nolt register is at https://eu.nolt.io/help/data-subprocessors. The applicable processing providers depend on the selected service environment and functions, rather than solely on an individual's address or the regional label of a DPA.

Where providers process information on our behalf, we require appropriate contractual restrictions, confidentiality obligations and security safeguards. Where Nolt is a processor, the DPA also governs the appointment of subprocessors and applicable customer authorisation and notification procedures. A provider's separate privacy notice does not displace Nolt's duties for processing we appoint it to perform.

6.2 Customers Authorised Users and Public Audiences

Customers and their authorised users receive information within the relevant roles and permissions. Customers may access contributions, survey responses, conversation history, supplied user attributes and related records needed for their enabled features. Public recipients receive information published to them as described in Section 3.

6.3 Connected Services and Customer Instructions

When a customer or authorized user enables a connection, exports information or directs a disclosure, we exchange relevant content and identifiers with the designated recipient. Integration permissions can allow information to be read, created or changed. An external service's privacy notice and its agreement with the person or organisation authorising it govern its independent handling of the information.

Payment and sign-in providers may process information for their own purposes under their notices, as well as supplying information needed for the requested transaction or authentication. We do not obtain unrestricted access to an external account simply because it is connected.

6.4 Personnel and Professional Advisers

Authorised personnel may access information where necessary to operate, secure, maintain or support the Services. Access is limited according to responsibilities. We may disclose necessary information to legal, accounting and other professional advisers subject to appropriate confidentiality obligations.

6.5 Legal Security and Safety Purposes

We may disclose information where required by law or valid legal process, or where lawfully necessary to address fraud, security incidents, unlawful activity, serious safety concerns or legal claims. Where lawful and appropriate, we notify the affected customer or individual of a legally compelled disclosure and consider available protective steps.

6.6 Business Transactions

Information may be disclosed in connection with a proposed or completed acquisition, merger, reorganisation, financing or transfer of business assets. We apply appropriate confidentiality safeguards and applicable legal restrictions and notice requirements.

6.7 Other Authorised Disclosures

We may disclose information for another specified purpose with valid consent or other lawful authority. We do not sell Customer Content or sell personal information for money. Our own marketing, advertising measurement and signup attribution are explained in Section 7; some privacy laws define sales, sharing or targeted advertising more broadly than monetary sales.

7. Cookies Analytics and Communications Choices

7.1 Necessary Service Technologies

We use cookies, local storage and similar technologies where needed to authenticate users, maintain sessions, remember settings, secure access and provide requested functions. Disabling these technologies can affect the relevant functionality.

7.2 Our Marketing Websites and Signup Attribution

On Nolt's own website and landing pages, we use Google Tag Manager, Google Analytics and Google Ads tracking to analyse traffic and measure advertising and marketing effectiveness. We also use PostHog and FullStory session replay to understand navigation and interactions, diagnose problems and identify frustration signals.

These tools may process online identifiers, device and browser information, referral and campaign details, page content and interactions such as clicks, scrolling and navigation. Replay reconstructs activity on the relevant pages. Information disclosed to advertising providers may be used under the applicable service configuration and privacy choices for advertising measurement or related advertising purposes.

We do not place these marketing analytics, advertising pixels or session-replay tools on customer boards or their embeds for Nolt's own marketing. Operational security, diagnostic and service telemetry can still be processed for those Services. Customers may separately enable their own analytics integrations or other tracking, for which their notices and choices apply.

We also use the signup attribution information described in Section 2.5, including information associated with end-user registrations on customer feedback boards, to measure the effectiveness of Nolt's own marketing. For that activity, Nolt acts as an independent controller and applies the legal grounds and privacy choices described in Sections 7.3 and 10. A customer's acceptance of a DPA or our Terms does not provide consent on an individual's behalf.

7.3 Consent and Other Tracking Choices

Where required by applicable law, we obtain consent before activating nonessential analytics, advertising or replay technologies and provide the required ways to refuse or withdraw that consent. Where a lawful exception applies, we meet its conditions, including applicable objection rights. Visiting a page or accepting our Terms does not itself provide consent where a separate valid choice is required.

Use any privacy or cookie choices presented on the relevant page and the settings available in your browser. You may also contact us through Section 16 about your choices. Browser blocking and deletion can limit some technologies but may not prevent every server-side disclosure; clearing storage can remove previously saved preferences.

Where applicable law requires it, we honour recognised opt-out preference signals, including Global Privacy Control, for the processing those signals cover. A generic Do Not Track setting may operate differently.

If applicable law classifies a disclosure to an advertising provider as a sale, advertising-related sharing or targeted advertising, the corresponding opt-out and notice requirements apply. We provide the legally required choices for that processing. These requirements apply to the own-marketing and attribution activities described in this Section to the extent covered by the relevant law. They do not authorise the sale or unrelated use of Customer Content.

7.4 Emails and Customer Communications

Nolt's own marketing emails are opt-in. You may unsubscribe using the instructions in the message or contact us. Necessary account, billing, security and service notices may still be sent. Optional activity notifications can be managed through the available settings or unsubscribe options.

Messages, surveys and campaigns sent for a customer are directed by that customer. Use the sender's unsubscribe or contact method for its communications; contact us if you need help identifying the responsible customer or believe Nolt's infrastructure is being misused. We meet our own legal duties and assist customers with applicable suppression and privacy instructions.

8. Retention and Deletion

We keep personal information only while needed for identified purposes, lawful customer instructions or applicable legal requirements. Relevant factors include the nature and sensitivity of the information, the service relationship, deletion requests, security needs, legal obligations and any required retrieval period.

8.1 Active Customer Content

Board content ordinarily has no preset expiry while the subscription remains active. Customers determine what they retain, subject to applicable law and the DPA. Keeping an account active does not make unnecessary personal-information retention lawful.

8.2 Cancellation and Reactivation

Cancellation or expiry ordinarily makes the affected board and content inaccessible to customers and their end users immediately. It does not automatically erase the information. For personal information processed on a customer's behalf, the applicable DPA provides for return or secure deletion, at the customer's choice, within ninety (90) days after termination or expiry, except for backup or archival copies deleted in accordance with the ordinary backup-retention cycle. Shorter mandatory periods, legally required retention and applicable return, switching or retrieval arrangements remain effective. Any retention for possible reactivation is limited by those requirements and a lawful, identified purpose; permanent archiving or recoverability is not guaranteed.

Our Terms address exports, switching and retrieval, including applicable rights that take precedence over ordinary loss of access. We preserve information for a legally required or otherwise lawfully agreed retrieval period and delete it afterwards as required.

8.3 Requested Deletion

We give effect to valid deletion requests and lawful instructions in accordance with applicable data-protection law, the DPA and agreed processing instructions. The ninety (90) day ordinary end-of-contract period in Section 8.2 does not extend a shorter applicable legal deadline or delay deletion required by law. Lawful preservation to complete an applicable return, switch or retrieval remains subject to its permitted purpose and period. Where needed to give effect to deletion, we also remove the relevant personal information from linked or derived records we control.

Individuals' requests concern their own information and do not necessarily authorise deletion of an entire customer board. We handle requests according to our role, the relevant customer's lawful instructions and applicable rights. Restoring a backup must not undo an applicable deletion instruction.

Backup or archival copies awaiting their ordinary backup-retention cycle remain protected and unavailable for ordinary use, and may be used only as necessary for permitted recovery, security or lawful retention. Restoration must give effect to outstanding deletion instructions. Relevant backup-retention information is made available to customers for their compliance assessment under the DPA.

8.4 Connections and Other Copies

Disconnecting an integration stops further access through that connection but does not necessarily delete information already imported or transmitted. Separate deletion instructions may be needed. Public copies, customer exports and information independently held by customer-selected services are subject to those recipients' obligations.

We require Nolt-appointed processing providers to meet applicable return and deletion obligations under their agreements, the DPA and applicable law. Their actual retention arrangements depend on the processing and applicable requirements. We remain responsible for the provider obligations that apply to us.

8.5 Business Records and Exceptions

We may retain limited account, billing, transaction, support, signup-attribution, security and legal records while reasonably necessary for their stated purposes or required by law, including applicable accounting duties and legal claims. The period depends on the relevant purpose, the information needed for it, applicable choices and deletion rights, and legal retention requirements. Records retained under an exception remain protected and may be used only for the relevant purpose. We do not treat possible reactivation as permission to retain all personal information indefinitely.

9. Security

We maintain technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration and loss. Measures include encryption in transit and at rest, restricted administrative access and controls protecting our storage and infrastructure. Security responsibilities also include appropriate provider safeguards and access permissions.

No system or transmission method guarantees absolute security. Protect your sign-in methods, access links and connected-account credentials, and review the people and services authorised to access your account.

We notify affected customers without undue delay after becoming aware of a personal-data breach affecting information processed on their behalf and provide required information and assistance. We also provide notifications to individuals and regulators where applicable law requires. Any stricter binding obligation remains effective. Security reports may be sent to security@nolt.io.

10. Legal Grounds for Processing

Where applicable law requires a legal basis for processing we undertake as a controller, we rely on the basis appropriate to the activity, as described below. Legitimate interests are used only where available under the relevant law and after considering individuals' rights and reasonable expectations; they do not replace consent required for particular tracking or communications.

Where we rely on consent, you may withdraw it as explained in Section 12. Withdrawal does not affect the lawfulness of earlier processing. Sensitive information may require an additional legal condition. A contract with an organisation does not itself supply a contractual legal basis for all processing of its employees' or customers' information.

For information processed on a customer's instructions, the customer determines its legal grounds and any additional conditions. We comply with our independent duties; neither this policy nor the DPA supplies consent on another person's behalf.

11. International Processing and Transfers

Global Nolt uses core hosting in the United States. For the EU service, core storage, including databases, backups and logs, is maintained in the EU. Nolt-appointed AI API requests use EU endpoints for EU Nolt and US endpoints for Global Nolt. Endpoint selection does not determine every provider's storage, retention, onward-processing or remote-access location. Authorised staff may access information remotely from other countries, and customer-enabled external services and other processing outside core hosting can involve additional countries.

An EU hosting selection therefore does not mean that every processing activity is confined to the EU. Provider processing and remote access may constitute international transfers even when the underlying database remains in the selected region. Specific contractual residency commitments apply within their stated scope.

Information may be processed in Canada, the United States, the EU and other countries where the relevant authorised personnel or providers operate. Privacy laws can differ and local authorities may have lawful access powers.

Where a restricted international transfer occurs, we use the lawful mechanism and additional safeguards required for that transfer. Depending on the circumstances, these may include an applicable adequacy decision, approved contractual safeguards and any required transfer assessment or supplementary measures. For relevant EEA and UK transfers, contractual safeguards may include the European Commission's Standard Contractual Clauses and the applicable UK transfer instrument.

The DPA addresses relevant customer-directed transfers. Selecting a region or accepting the Terms does not replace required transfer safeguards. Contact us through Section 16 for information about applicable destinations and safeguards or a legally available copy, subject to necessary redactions that do not obscure the safeguards' substance.

12. Privacy Rights and Requests

Depending on your location, applicable law and our role, you may have rights to:

• Obtain access and information about processing, sources and disclosures.
• Correct inaccurate or incomplete personal information.
• Request deletion, anonymisation or restriction of processing.
• Receive a portable copy of information where applicable.
• Object to certain processing, including direct marketing.
• Withdraw consent where processing relies on consent.
• Exercise applicable opt-outs concerning sales, advertising-related sharing or targeted advertising.
• Obtain information, human review or other safeguards concerning qualifying automated decisions.
• Appeal a refusal where applicable and complain to a competent privacy regulator.

The conditions and exceptions depend on the relevant law.

12.1 Making a Request

Email hello@nolt.io, addressed to our privacy officer, or use an applicable account control. You do not need a Nolt account to make a request. Give enough information to identify the relevant interaction or customer without sending unnecessary sensitive material.

We request only the verification information reasonably necessary to establish identity or authority and locate the relevant records. Do not send a government-ID copy unless we specifically request it and explain why it is necessary. An authorised representative may act where permitted, subject to appropriate verification.

We respond within applicable statutory periods and explain any permitted extension, refusal or available appeal route. Where the GDPR applies, the ordinary response period is one month; permitted extensions require timely notice. Under applicable Canadian requirements, access requests ordinarily receive a response within 30 days, subject to lawful extensions. Section 8 explains the relevant deletion arrangements; its ordinary end-of-contract period does not extend these statutory request deadlines.

12.2 Information Controlled by a Customer

For information processed on a customer's behalf, you may contact that customer directly or contact us. We direct the request to, and assist, the relevant customer as required by law and the DPA. A contributor's inability to access a cancelled board does not remove their statutory privacy rights.

Where we control the relevant processing, we address the request ourselves. We do not require individuals to waive rights because their information appears in Customer Content. Withdrawal of consent may prevent a feature that depends on that information from continuing.

12.3 Complaints

Raise concerns through Section 16. We investigate and communicate our response as required by applicable law. You may also complain to your competent privacy regulator without losing other available remedies. Where a statutory internal complaint or appeal process applies, we follow its applicable acknowledgement, investigation and response requirements.

13. Additional Regional Disclosures

13.1 Canada

Where Canadian federal or provincial privacy law applies, individuals may request access, correction and information about the handling of their personal information and withdraw consent subject to applicable restrictions and reasonable notice. Contact Jason Kim through Section 16. You may complain to the Office of the Privacy Commissioner of Canada or the competent provincial regulator.

Where Quebec's private-sector privacy law applies, additional rights can include portability and information or choices concerning identification, location, profiling and exclusively automated decisions, according to their statutory conditions. Requests may be directed through Section 16.

13.2 EEA and United Kingdom

Where the GDPR or UK data-protection law applies, the rights in Section 12 apply according to the relevant basis and conditions. You may object to direct marketing at any time and withdraw consent where it is the basis for processing. Additional information about controller legal grounds and transfers appears in Sections 10 and 11.

You may complain to the supervisory authority competent for your circumstances, including an EEA authority where you live, work or consider an infringement occurred, or the UK Information Commissioner's Office. This Policy does not restrict those rights to Canada.

13.3 United States

Where an applicable state privacy law grants rights, residents may exercise access, correction, deletion, portability, advertising-related opt-outs, rights concerning sensitive information or qualifying automated decisions, and any statutory appeal right. We do not unlawfully discriminate for exercising these rights.

The categories in Section 2 include identifiers, account and commercial information, professional or customer attributes, internet activity, communications and other submitted content, inferences and potentially sensitive information. The sources, purposes, recipients and retention criteria are explained in Sections 2 and 4 through 8. The information actually involved depends on the features used and material supplied.

We do not sell personal information for money. Where applicable privacy law defines a sale, sharing or targeted advertising more broadly, Section 7 explains our own marketing and attribution activities and the applicable choices. Where a law requires limits on particular uses of sensitive information, we provide those rights. Customers' own campaigns and tracking remain subject to their separate notices and duties.

13.4 Australia and New Zealand

Where applicable law provides them, individuals may request access or correction and raise complaints through Section 16. Our collection sources and overseas handling are described above. Unresolved concerns may be raised with the Office of the Australian Information Commissioner or the New Zealand Office of the Privacy Commissioner, as appropriate.

13.5 Brazil

Where Brazil's LGPD applies, individuals may have rights to confirmation and access, correction, anonymisation, blocking or deletion of unnecessary or unlawful information, portability, information about disclosures, withdrawal of consent and applicable review of automated decisions. Contact us through Section 16 or raise a concern with the competent Brazilian data-protection authority, subject to applicable procedures. Restricted transfers require safeguards recognised by the applicable law.

13.6 Other Locations

Individuals in other locations may have additional rights under the law governing the particular processing. Contact us through Section 16; we assess requests under the law applicable to the information concerned.

14. Children and their Information

The Services are used mainly by businesses and are not directed to children under 13. Our Terms require people to be at least 13 to create an account or use interactive features, with legally appropriate adult or organisational authorisation where needed. The ability to open an account does not establish a child's legal capacity to consent to every use of information; local age and authorisation requirements can be higher.

Customers must not direct their deployment to children under 13 or knowingly permit them to submit personal information. Information about a child may nevertheless be supplied by another person or organisation. The relevant organisation must establish the lawful purpose, notices, consents and additional protections required for its processing. Processing personal information of a child below the age at which consent is valid under applicable law also requires Nolt's prior written agreement under Section 2.6 of the DPA, in addition to the applicable legal conditions. The account age threshold does not waive that requirement.

If we learn that personal information has been collected in breach of applicable child-protection requirements, we take appropriate action, which may include restricting access and deleting the information. Contact us if you believe a child's information has been processed improperly.

15. Changes to this Policy

We may update this Policy to reflect changes in the Services, our practices or applicable law. We identify the revision through the Last updated date and provide additional notice of material changes where required or appropriate.

Before undertaking new processing, we obtain any required consent or take the other lawful steps that apply. Continued use, a revised policy or acceptance of the Terms does not itself supply consent where a separate valid choice is required. Changes to a contractual DPA follow its amendment provisions.

16. Contact Us

For privacy enquiries, requests or complaints, contact our privacy officer:

Legal entity: Nolt Software Inc.

Address: 6D - 7398 Yonge St Unit # 320, Thornhill, Ontario L4J 8J2, Canada

Privacy officer: Jason Kim

Email and privacy requests: hello@nolt.io

Security reports: security@nolt.io

Data Processing Agreement: the applicable regional version supplied or linked in the customer's acceptance documents; request a copy at hello@nolt.io.

Provider registers: Global Nolt, https://nolt.io/help/data-subprocessors; EU Nolt, https://eu.nolt.io/help/data-subprocessors.

Terms of Service: https://nolt.io/help/terms