Privacy Policy

Who we are

Noska is run by Reynald Arro (trading as 926 Systems), based in The Philippines. It is used by organisations (our clients) to share procedures and answers with their people. For the personal information of a client's people, that client is responsible and we handle it on their behalf. For our own client contacts and billing, we are responsible.

We follow the privacy laws that apply to us and our clients, including New Zealand's Privacy Act 2020 and the Philippines' Data Privacy Act of 2012.

What we collect

• Your name, work email address, role, and any profile picture you add.
• Your sign-in information: a one-way scrambled version of your password (never the password itself), and, if you use it, an encrypted two-step sign-in secret.
• What you write: articles, questions, answers, notes, quiz answers and confirmations of required reading.
• How the service is used, kept to what is needed to run and secure it: sign-ins and changes, articles viewed, searches made, and the IP address and browser for security events.
• If you book a meeting through a booking page: your name, email, and any phone number and notes you choose to add.

Why we use it

• To provide Noska: showing the right articles to the right people, required reading, training, reminders and notifications.
• To keep it secure: blocking repeated failed sign-ins, recording changes, and investigating misuse.
• To tell you about things you need to know, such as invitations, password resets, reminders and the weekly "What's changed" email (which you can turn off in your profile).
• To show your organisation's owners how Noska is used, for example who has confirmed required reading.

What we don't do

• We don't sell personal information or use it for advertising.
• We don't use your organisation's content to train AI models.
• We don't show one organisation's content or people to another.

Who we share it with

Only the service providers we need to run Noska, each bound to protect it:

• Vercel: hosts the website.
• Supabase: stores the database.
• Cloudflare (R2): stores screenshots and logos.
• Resend: sends emails.
• Microsoft: only if your organisation signs in with Microsoft accounts.
• We may also share information if the law requires it, or to protect people's safety.

Where it is kept

Your information is stored in Tokyo, Japan, and our providers may process it in other countries, including the United States. We use providers that protect personal information to a standard comparable to New Zealand and Philippine law, and we may access it from The Philippines to provide support.

How long we keep it

• Your account and what you write: while your organisation uses the service. When your organisation leaves, we delete its data within 30 days of the end of the export period.
• Deleted articles: kept in the recycle bin for 30 days so they can be restored, then deleted permanently.
• The security log of sign-ins and changes: 365 days.
• Bookings and usage figures: for as long as your organisation uses the service.
• Backups are kept for a short time by our database provider and then overwritten.

How we protect it

• Everything is sent over encrypted connections (HTTPS), and stored data is encrypted by our providers.
• Each organisation's space is separated, and access inside it follows the roles its owners set.
• Two-step sign-in is available and can be required for administrators and owners.
• Access by our team is limited to providing support, and is recorded.

Your rights

• You can ask to see the personal information held about you, and ask for it to be corrected.
• You can update your name, picture, password and email settings yourself in your profile.
• You can ask for your information to be deleted. If your organisation manages your account, we may pass your request to them.
• If you are not happy with how we handle a request, you can complain to the privacy regulator where you are, such as New Zealand's Office of the Privacy Commissioner or the Philippines' National Privacy Commission.

If something goes wrong

If a privacy breach is likely to cause serious harm, we will tell the affected organisations promptly, and the people affected and the regulator where the law requires it.

Contact

For privacy questions or requests, email privacy@noska.io.

We may update this policy. The date at the top shows the current version, and we will ask you to accept important changes.