What we collect, why we collect it, and what we will never do with it. Written to be read, not to be survived.
Noetix is a company brain for AI agents: it keeps what a company knows and how it works, and makes that available to the AI agents the company uses. This policy covers www.noetix.dev, the early access list, the contact form, and the Noetix product — the web app, the API, and the MCP server agents connect to.
For the purposes of the UK and EU General Data Protection Regulation, the data controller is Ahmed Tarek, trading as Noetix, reachable at founder@noetix.dev. Noetix is an early-stage product and is not yet incorporated as a company; when that changes, this section and the contracting party in our Terms of Use will be updated and the change noted below.
For anything in this policy, including any request about your own data, write to founder@noetix.dev. A real person reads that inbox.
We collect as little as we can get away with, and we'd rather ask you for something later than hoard it now. Here is the complete list as of the date at the top of this page.
| What | Where it comes from | Why we have it | Legal basis (GDPR) |
|---|---|---|---|
| Your email address | The early access form | To tell you when we can let you in, send your invitation, and reply to you personally | Consent — you gave us the address for exactly this |
| Your company domain | Derived from your email address, not asked for separately | To understand what kind of teams are signing up and in what order to onboard them | Legitimate interests — understanding demand for a product we are building |
| Your name and message | The contact form | To answer the question you asked | Legitimate interests — responding to someone who contacted us |
| Account details: email, and an authentication identifier | Signing up and signing in | To create your account, keep you signed in, and keep your workspace separate from everyone else's | Contract — we cannot provide the service without them |
| Workspace membership: who is in your workspace, their role, and invite links | You and your colleagues, when you invite people or join through a link | So everyone in a company shares one brain, with the right permissions | Contract |
| Your knowledge: pages you write, files you upload, text you paste, skills, and content from sources you connect — with each page's version history | You, your colleagues, your agents, and the tools you choose to connect, via their official APIs, with your permission | To build the brain that is the entire product, and to answer your and your agents' questions from it | Contract — this is the service you asked us to perform |
| Conversations with the assistant, and files attached to them | The chat in the app | To show you your past conversations and let the assistant read what you attached. Attached files expire after 30 days unless you add them to your brain | Contract |
| Credentials: API keys we issue you, and an AI provider key you choose to add | Settings › API Keys and Settings › AI provider | So your code can call the API, and so your AI usage can run on your own provider account. API keys are stored hashed; your provider key is encrypted and never shown back | Contract |
| Usage records: how many items, pages and skills you have, API and MCP calls per day, AI usage (tokens and cost, including how much of an early access AI allowance has been used), and the web searches and page reads the assistant makes | Measured by the service as you use it | To apply your plan's limits, show you your usage, and protect the service from abuse | Contract, and legitimate interests — keeping usage within what a plan includes |
| Feedback: a rating on an answer, the reason you pick, and a problem report with the page address, browser and app version it was sent from | The rating buttons under an answer, and Report a problem in the account menu | To find wrong answers and broken things, and fix them | Legitimate interests — improving the service you use |
| Technical logs: IP address, browser and device type, pages requested, timestamps, error traces | Automatically, by our hosting providers, when you use the site or the app | Security, abuse prevention, and finding out why something broke | Legitimate interests — keeping the service running and secure |
| Visit counts: the page visited, the page that linked to it, and the country, device and browser type | Vercel Web Analytics, on this website and the app. It sets no cookies and keeps no profile of you: a visitor is counted with a value derived from the request that changes every day | To see which pages people read and what brought them here, so we know what is useful | Legitimate interests — understanding how the site is used |
| Your theme preference (light or dark) | Stored in your own browser, never sent to us | So the site looks the way you left it | Not personal data — it never leaves your device |
We do not ask for, and have no use for, special category data: health, race, religion, political opinions, biometrics, sexual orientation. If content you connect happens to contain such data, we process it only as part of your knowledge graph and never analyse it in its own right.
Worth stating plainly, because these are the assumptions people reasonably bring to a form that asks for an email:
This is the part that matters most, so it gets its own section rather than a line in a table.
When you connect a source — Slack, Google Drive, Notion, or anything else we support — you authorise us through that provider's own OAuth flow. We receive an access token scoped to the permissions you granted, and we ask for the narrowest scopes that let the feature work. We never see or store your password for those services.
When web search is switched on, the assistant can look things up on the public web. A search sends the query the assistant writes to our search provider (see section 6); that query can contain words from your question, but never your brain's content as such. To read a web page, our servers fetch it directly, and only fall back to the search provider when a page cannot be read that way, in which case the provider receives the page's address. What the assistant finds on the web is used to answer you; it is not saved to your brain unless someone saves it.
If your workspace adds the Noetix bot to Slack, the bot reads the email address on the Slack profile of whoever mentions it, to find their Noetix account in your workspace. It answers only as that person, from what they could see in Noetix, and if there is no matching account it says so and answers nothing.
If you connect a workspace containing other people's personal data, which is the normal case for a shared Slack or Drive, you are the controller of that data and we are your processor. You are responsible for having a lawful basis to connect it and for telling the people concerned. We will sign a data processing agreement — ask, and we'll send one.
Our providers are largely United States-based, so if you are in the UK, the EEA, or Switzerland, your data will be transferred outside your country. Where that happens we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or on an adequacy decision where one covers the provider. You can ask us for a copy of the safeguards in place for any specific transfer.
Backups lag deletion slightly by design. Anything deleted from the live system falls out of encrypted backups within a further 30 days and is never restored into service.
Data is encrypted in transit with TLS and at rest by our infrastructure providers. Each workspace's knowledge graph and search index live in their own databases, separate from every other customer's, and every request is checked against the workspace's permissions. API keys are stored only as hashes, and AI provider keys you give us are encrypted and never shown back to anyone. Access to production systems is limited to people who need it and protected by multi-factor authentication.
Noetix is an early-stage product built by a very small team. We have taken security seriously from the first commit, but we are not going to claim certifications we do not hold. If you find a vulnerability, email founder@noetix.dev and we will work with you; we will never pursue anyone for a good-faith report. If a breach affects your personal data, we will notify the relevant supervisory authority within 72 hours where required, and tell you directly without undue delay where the risk to you is high.
Depending on where you live, you have some or all of the following rights. We extend them to everyone who asks, regardless of where they live, because operating two standards is more work than operating the higher one.
To exercise any of these, email founder@noetix.dev from the address you signed up with. We will respond within 30 days, free of charge, and we will not make the service worse for you because you asked.
If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, and we have not in the preceding twelve months, so there is nothing to opt out of. You also have the right not to be discriminated against for exercising these rights, which we honour. The categories we collect and our purposes for collecting them are the table in section 2.
Noetix is a product for companies and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.
The product is going to change quickly, and this policy will change with it. When it does, we update the date at the top of the page. For any change that materially affects how we handle data you have already given us — a new purpose, a new category of sharing — we will email everyone on the early access list and every account holder before it takes effect, not after.
Questions, requests, complaints, or a correction to something above: founder@noetix.dev.
Something here unclear, or something we got wrong? Write to founder@noetix.dev and we'll fix it.