Last updated: April 2026

Privacy Policy

We respect your privacy. This policy explains what we collect, why we collect it, and your choices.

1. Overview

This Privacy Policy explains how NoHeck collects, uses, and shares information when you use noheck.com and app.noheck.com.

2. Information We Collect

• Account info: name, email, password hash, workspace info.
• Usage data: pages visited, feature usage, logs (may include IP, device).
• Customer Content: emails, messages, and board data you submit.
• Billing info: subscription plan, billing history, invoice records. Payment card data is handled by Paddle — we do not store card numbers.
• Support communications.

3. How We Use Information

• Provide and secure the Service.
• Authenticate users and enforce permissions.
• Improve performance and reliability.
• Provide support.
• Send service-related notices (billing, security, changes).

4. Sharing

We may share data with subprocessors (infrastructure, analytics) listed below. We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.

5. Data Retention

We retain your account information and Customer Content for as long as your account is active or as needed to provide the Service.

• Active accounts: Data is retained for the duration of your subscription.
• Account closure: Upon account deletion, we remove your Customer Content within 30 days. Some data may persist in encrypted backups for up to 90 days before being purged.
• Usage logs: Aggregated, non-identifying usage data may be retained for up to 12 months for service improvement.
• Legal obligations: We may retain certain data longer if required by law (e.g., billing records).

You can request data export or deletion at any time by contacting contact [at] noheck [dot] com.

6. Your Rights (GDPR and Similar Regulations)

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with applicable data protection laws, you have the following rights regarding your personal data:

1. Right of Access — Request a copy of the personal data we hold about you.
2. Right to Rectification — Request correction of inaccurate or incomplete data.
3. Right to Erasure — Request deletion of your personal data, subject to legal retention requirements.
4. Right to Data Portability — Request your data in a structured, machine-readable format.
5. Right to Restrict Processing — Request that we limit how we use your data in certain circumstances.
6. Right to Object — Object to processing of your data for specific purposes.
7. Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact contact [at] noheck [dot] com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

7. Cookie Policy

We use cookies and similar technologies to operate and improve the Service.

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled.
• Analytics cookies: We may use privacy-respecting analytics to understand how the Service is used. We do not use invasive third-party trackers.
• Preference cookies: Used to remember your settings and preferences (e.g., theme, language).

We do not use cookies for advertising or cross-site tracking. You can manage cookie preferences through your browser settings.

8. Third-Party Services and Subprocessors

We use a limited number of trusted third-party service providers to operate and deliver the Service. Each subprocessor is contractually bound to protect your data.

We evaluate subprocessors for their security practices before engaging them. This list is updated as our infrastructure evolves. Material changes will be communicated to affected customers.

Billing Data and PCI Compliance

When you subscribe to a paid plan, billing data is collected and processed by Paddle.com, our Merchant of Record. Paddle collects the information necessary to process payments and comply with tax regulations, including:

• Name and email address.
• Payment method details (card number, expiry, CVV).
• Billing address (used for tax determination).

NoHeck does not store card numbers or payment credentials. All payment card data is handled exclusively by Paddle, which is PCI DSS compliant. For more information, see Paddle's Privacy Policy.

Billing records (invoices, subscription history) may be retained for up to 7 years to comply with financial record-keeping obligations.

9. International Data Transfers

NoHeck processes data primarily in the United States, with some infrastructure in the European Union. If you access the Service from outside the US, your data may be transferred to and processed in the US or EU.

Where data is transferred outside your jurisdiction, we rely on appropriate safeguards, including standard contractual clauses approved by the European Commission, to ensure your data is protected.

10. Data Processing Agreement (DPA)

If your organization requires a Data Processing Agreement for GDPR compliance or other regulatory needs, we are happy to provide one. Contact contact [at] noheck [dot] com to request a DPA.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the updated policy on this page with a revised effective date.
• Notify workspace Owners via email or in-app notification for significant changes.
• Provide at least 30 days' notice before material changes take effect, where practicable.

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

Contact

Questions about this Privacy Policy? Contact us at contact [at] noheck [dot] com.