Privacy Policy

This policy covers the NOA Mandate marketing site and two NOA Mandate Enterprise surfaces: the enterprise console (the hosted admin product at /admin) and mobile app (the approver phone app that pairs with the console).

• Email address — used to sign you in and to send enterprise invitations. Console sign-in uses a password or your organization’s single sign-on (SSO), with a passkey optionally required to re-confirm sensitive actions; the NOA Mandate Enterprise mobile app signs in with a one-time magic link sent to your email. Your account email is stored in our database so we can operate your account; where a console password is used, it is stored only as a salted hash, never in plaintext. To deliver an email, the plaintext address is handed to our transactional-email provider at send time (see /subprocessors).
• Device public key — when an approver pairs the NOA Mandate Enterprise mobile app, only the device’s public signing/HPKE keys are registered with the console. The matching private keys are generated on the device, held in the phone’s OS-level secure keystore (iOS Keychain / Android Keystore), and are not transmitted — the console has no route that accepts a private key.
• Organization and audit data — for enterprise customers, the console records organization membership, member names, role assignments, and an append-only audit trail of admin actions (actor id, role, action, resource type/id, outcome, timestamp, and non-personal structured metadata) — scoped to that organization only.
• Receipts — where an integrating agent emits NOA receipts, the receipt records a hash of the action’s parameters, never the raw parameters, and identifies the approver by an opaque id, not by name or email. Low-entropy identifiers are replaced with tenant-scoped, HMAC-based opaque values, so receipts carry no raw personal data and are not directly correlatable across tenants.
• IP address — processed transiently to rate-limit requests and to enforce optional per-organization IP allowlists. Only hashed derivatives are persisted for abuse correlation; we do not keep a log of your raw IP address.
• Cookies — the console and admin area set only strictly-necessary cookies to keep you signed in: an admin session cookie (HttpOnly, SameSite=Lax, scoped to /admin) and a short-lived cookie during an enterprise SSO round trip. None are used for tracking or advertising. The public marketing pages (noamandate.com/*) set no cookies until you sign in, and this codebase contains no analytics or advertising tracker of any kind.

• Performance of a contract (GDPR Art. 6(1)(b)) — operating your account: sign-in email delivery, console and mobile sessions, enterprise invitations, organization membership, and routing approvals to paired devices.
• Legitimate interests (GDPR Art. 6(1)(f)) — keeping the service secure and accountable: rate limiting, optional per-organization IP allowlists, hashed-IP abuse correlation, security-event records, and the append-only audit trail. The interest is the security and verifiability the product exists to provide; the data used is listed above and minimized (hashes and opaque ids rather than raw values wherever the design allows).
• Consent — not currently relied on for anything: there is no marketing, no analytics, and no optional processing to consent to. If that ever changes, this policy changes first.

• Your signing key and display-decryption key are generated on your device and never leave it — not uploaded to any server, not visible to us. Unlocking the app (biometric/PIN) is a local gate on using the key; it is never itself transmitted as a credential.
• The human-readable approval display is stored as ciphertext inside the immutable hold-artifact record. The signed-in mobile app fetches that artifact directly from the console’s mobile approval API using its m1 mobile session; the retired private relay-message table is not the current handset transport. To route an approval and record its outcome, the console processes the request envelope — the tool name and target, with any parameters recorded as hashes — but it never holds your device’s private signing key and cannot sign on your behalf. Where the operator has enabled push notifications, delivery uses Google Firebase Cloud Messaging: we store the device’s FCM registration token to wake the app, and the notification itself carries no request content — a fixed title and body plus a one-word message kind, nothing about the action, amount, organization, or actor.
• An administrator can revoke a paired device from the console (logged, with a required reason), and you can sign out or unpair on the device itself to stop that device from receiving further requests.
• Uninstalling the NOA Mandate Enterprise mobile app removes the on-device signing key, which never leaves the device and cannot be exported or copied. To use a new device you pair it afresh — an administrator revokes the old device and the new one generates its own signing key; the old key is never transferred.

• No advertising identifiers, no ad networks, no cross-app or cross-website tracking.
• No location, contacts, photos, or microphone access.
• No third-party analytics or marketing SDKs are bundled in the marketing site, the console, or the mobile app.
• We do not sell or rent personal data, and we do not share it for advertising.

A summary of the infrastructure and service providers this codebase actually calls — confirmed against the code, not assumed — is published at /subprocessors.

The providers listed at /subprocessors are U.S.-headquartered companies, so personal data they handle for us may be processed outside the EU/EEA. Each of them publishes its own data-protection terms covering such transfers (data-processing addenda with Standard Contractual Clauses). We state plainly, here as on the sub-processors page, that we have not yet executed a reviewed Data Processing Agreement of our own with customers — if you need one before using the service, contact us first.

• Expired sign-in/authentication artifacts (login and WebAuthn challenges, mobile sessions, invitations) and aged security-event records are removed once expired/consumed and past the applicable retention window — your organization’s configured window (30–3650 days) for records tied to an organization, or a fixed 7-day floor for records not tied to one — via an explicit, operator-run cleanup job. One exception is fixed by design: expired mobile sign-in (magic-link) challenges are always removed on the 7-day floor, regardless of the organization-configured window.
• The audit trail is append-only by design and is not deleted by that cleanup job — it is kept for the life of the account, as the accountability record the security posture described at /security depends on.
• Encrypted hold-artifact records are immutable and are not currently removed by the cleanup job. We do not claim that an expired approval display is automatically purged from server storage; this is an explicit retention limitation, separate from preventing a revoked device from fetching new approvals.
• Historical rows in the retired private relay-message table may still retain ciphertext material (the encapsulated key, ciphertext, and authenticated-data value), routing identifiers (organization, device, and sender-agent ids), status, and expiry, delivery, and creation timestamps. The current cleanup job does not delete these historical rows automatically, and we do not claim a purge deadline for them.
• On-device data (signing key, session) is removed when you sign out, remove the paired device, or uninstall the mobile app.

• Unpair or sign out of the Noa Mandate mobile app at any time to stop receiving requests on that device.
• Access, export, or deletion requests — contact privacy@noamandate.com. We handle these requests manually — there is no self-service mechanism. One deliberate limit applies: tamper-evident audit and receipt records are append-only accountability evidence. The retention cleanup job never deletes them (it covers only expired sign-in artifacts and aged security-event records), and they are designed to reference people by opaque ids and parameter hashes rather than raw personal data. See “Your rights” below for what this means for erasure.
• Enterprise customers needing a Data Processing Agreement should contact privacy@noamandate.com.

Under the GDPR you can ask us for access to, rectification of, erasure of, restriction of, or a portable copy of your personal data, and you can object to processing based on legitimate interests — write to privacy@noamandate.com. Every request is reviewed and handled manually. What erasure can and cannot reach, stated plainly: account and profile data — such as your sign-in email, organization membership, and paired-device records — can be erased on request. Append-only audit events and signed receipts are retained as the tamper-evident accountability record described under “How long we keep it” and are not erased on request; they are designed to reference people by opaque ids and parameter hashes rather than raw personal data. You also have the right to complain to a supervisory authority; ours is the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk). We would prefer you write to us first so we can fix the problem, but that is your choice, not a condition.

NOA Mandate Enterprise — the console and the mobile app — is a workplace tool and is not directed to children under 13, or the equivalent minimum age in your country. We do not knowingly collect data from children.

Decisions are signed on-device and receipts are tamper-evident: a receipt changed after signing is detectable and reads as invalid, and the receipt chain is independently verifiable. A full public summary of the technical controls protecting this data — access control, tenant isolation, encryption, audit-trail integrity, and named gaps — is at /security. We deliberately do not claim any system is “tamper-proof”, “unhackable”, or “100% secure”. To report a vulnerability, see /.well-known/security.txt.

We may update this policy as the product changes. Material changes will be reflected on this page with a new “Last updated” date above. This policy is published in English only, and the English text is the version that governs — the product’s marketing pages exist in ten languages, its legal pages deliberately in one.

Questions about this policy, or a data-protection request: privacy@noamandate.com.