Legal
Privacy notice
Last updated 12 October 2026
The short version
- We collect what each service needs to work, and nothing for advertising. We don't sell data or track you around the web.
- Our services run on Nossic's own servers in the UK. Our chat AI runs on those servers too: nothing you write is sent to an outside AI company.
- We use only the cookies needed to sign you in and keep you signed in. There are no analytics or advertising cookies, so you won't see a cookie banner.
- You can download your data and delete your account yourself in My Nossic account, or email privacy@nossic.uk.
Who we are
Nossic ("we", "us") makes the services at nossic.uk and its subdomains: the nossic.uk website, Nossic ID, Nossic DNS, Nossic Chat, Nossic eSign and Nossic Projects. We decide how and why personal data in these services is used, so we are the controller under the UK GDPR, the Data Protection Act 2018 and, for people in the European Union, the EU GDPR.
The one exception is the visitors who talk to our customers through Nossic Chat on our customers' own websites. For them, our customer is the controller and we process the data for them (see Nossic Chat visitors).
Contact us about privacy at privacy@nossic.uk.
What we collect
Everyone who uses our websites and apps
- Server logs: your IP address, browser (user agent), the address you asked for, the time and the result. Our servers record these to keep the services running and secure.
- Cookies and similar storage needed to sign you in. See our cookie policy.
We don't use analytics, advertising, social media plugins or tracking pixels, and our pages don't load anything from other companies.
Nossic ID (your account)
- Your name, email address, username and, if you add them, your phone number and profile photo.
- How you sign in: your password (stored only as a one-way hash), passkeys, authenticator apps and security keys.
- Sign-in sessions and security events, including the IP address and browser used to sign in, so we can protect your account and show you your active sessions.
- Emails we send you to verify your address or reset your password.
nossic.uk
If you sign in on nossic.uk, the website keeps your name and email in an encrypted cookie in your browser to show who's signed in. It doesn't store anything about you on our servers.
Nossic DNS
- Your Nossic ID, name and email, the domains you add and their DNS records. DNS records are public by nature: anyone on the internet can look them up.
- API keys you create (we keep only a one-way hash of each key, plus its name and when it was last used).
- A history of changes to each domain: what changed, when, and whether it was you in the app or one of your API keys.
Nossic Chat: team members
If you use Nossic Chat to talk to your own website's visitors, we keep your Nossic ID, name and email, your workspaces and team, your settings, chat flows, knowledge base, saved replies and the messages you write.
Nossic Chat: visitors to our customers' websites
When you chat with a business through the Nossic Chat bubble on its website, the business is the controller of that conversation and we process it for them under our data processing terms. The conversation can include your messages, any name, email or answers you give, the page you were on, your browser, and a random identifier kept in your browser so the chat can carry on where you left off. Ask the business about how it uses your data. We'll pass on any request you send us.
Nothing is stored until you open the chat or write. AI replies are made on our own servers, and are only used to answer you: we don't use conversations to train AI models.
Nossic eSign: people asked to sign
If someone at Nossic sends you a document to sign, we keep your name and email, the document, what you fill in, your signature and initials as you draw or adopt them, and an audit trail of what happened and when, with the IP address and browser used. The audit trail is part of the signed record and proves who signed what.
If you tick "Remember my style on this device" when signing, your signature style is saved in your own browser, not on our servers.
Nossic Projects
Nossic Projects is used by the Nossic team. It holds team members' names and emails and the projects, tasks and comments they write.
If you email us
We keep your email and our reply for as long as needed to deal with what you asked.
Why, and our legal reasons
| What we do | Legal reason (UK and EU GDPR Article 6) |
|---|---|
| Create and run your Nossic ID, and sign you in to our apps | Contract: you asked for an account |
| Host your domains and records in Nossic DNS; run your Nossic Chat workspace | Contract: providing the service you use |
| Send emails you need, such as address checks and password resets | Contract |
| Keep server logs and sign-in security events; stop abuse and attacks | Legitimate interests: keeping our services and your account secure |
| Keep eSign audit trails and signed documents | Legitimate interests: a reliable record of who agreed to what, and establishing or defending legal claims |
| Process chat conversations for our Nossic Chat customers | We act for the customer, who decides the legal reason |
| Keep records for tax and accounting, and answer lawful requests from authorities | Legal obligation |
We don't send marketing, and we don't make decisions about you by automated means that have legal or similarly significant effects. Nossic Chat's AI suggests replies and routes chats to the right place for our customers; a person can always take over.
Who else handles it
We don't sell personal data or share it with advertisers. A few companies help us run the services and handle data only on our instructions:
| Company | What they do | Where |
|---|---|---|
| DigitalOcean | Runs the gateway server that connects the internet to our servers. Traffic passes through it encrypted, and it can see IP addresses and which service you use. | London, UK (DigitalOcean is a US company) |
| Thundercloud | Hosts the mail server that sends our emails, such as Nossic ID address checks. | UK |
We may also share data when the law requires it, to protect people's safety or our rights, or as part of selling or reorganising the business (the new owner would have to respect this notice).
Where it's kept
Our services and their databases run on Nossic's own servers in the United Kingdom. Backups are encrypted and kept on our own equipment in the UK.
The UK and the EU each recognise the other's data protection as adequate, so data can flow between them. Where a company that helps us is based outside the UK, such as DigitalOcean in the United States, we rely on the safeguards the law requires, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in their data processing agreements.
How long we keep it
| Data | How long |
|---|---|
| Nossic ID account | Until you delete it. A record of past account events stays in Nossic ID's internal history, which can't be edited, and is only used to keep the system consistent and secure. |
| Sign-in sessions | 12 hours, or up to 30 days if you choose "Keep me signed in" |
| Nossic DNS domains, records and change history | Until you remove the domain or delete your account. A removed domain's name stays reserved for your account for 30 days, so nobody else can take it while it still points at our servers. |
| Nossic DNS API keys | Until you revoke them; details of revoked and expired keys are deleted after 90 days |
| Nossic Chat workspace and team data | Until the workspace is deleted, or you delete your account |
| Nossic Chat conversations with visitors | As our customer sets for their workspace: by default 12 months after the conversation's last message |
| Nossic eSign documents and audit trails | As long as needed as a record of the agreement: normally 6 years after signing, longer if the law or a dispute requires it |
| Server logs | Overwritten as new logs come in, normally within days and never more than 30 days |
| Backups | Up to 5 weeks, then overwritten |
Your rights
Under the UK GDPR and the EU GDPR you can ask us to:
- See the personal data we hold about you, and get a copy (access).
- Correct it if it's wrong (rectification).
- Delete it (erasure).
- Limit how we use it while a question is sorted out (restriction).
- Take it with you in a machine-readable form (portability).
- Object to things we do because of our legitimate interests.
The quickest way: in My Nossic account you can update your details, download your data (Nossic ID, Nossic DNS and Nossic Chat) and delete your account, which also deletes your data in those apps. For anything else, email privacy@nossic.uk. We'll reply within one month, and it's free.
Some data we must or may keep even if you ask us to delete it, such as signed eSign records needed as evidence of an agreement. We'll tell you if that applies.
Cookies
We use only cookies and browser storage that are strictly necessary to sign you in and keep the services working, so we don't ask for consent. Our cookie policy lists each one.
Children
Our services aren't meant for children under 16, and we don't knowingly create accounts for them. If you think a child has given us their data, email privacy@nossic.uk and we'll delete it.
Security
All connections are encrypted (HTTPS). Passwords are stored only as one-way hashes and API keys only as hashes. Our servers are in a private network that the internet reaches only through our gateway, staff access needs strong authentication, and backups are encrypted. If a breach puts your data at risk, we'll tell you and the regulator as the law requires.
Complaints
Please contact us first at privacy@nossic.uk and we'll try to put things right. You can also complain to a data protection regulator:
- In the UK: the Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint, 0303 123 1113.
- In the EU: the data protection authority where you live or work. The European Data Protection Board lists them at edpb.europa.eu.
Changes
We'll update this notice when our services or the law change, and change the date at the top. If a change matters to how we use your data, we'll tell account holders by email or in the apps before it takes effect.