Privacy policy

Noonmark (noonmark.dev) is operated by a sole proprietorship established in the Netherlands. For anything in this policy, write to privacy@noonmark.dev.

Under the GDPR we act in two different capacities, and your rights differ between them.

• We are the controller for your account, your Workspace, its plan and our own analytics. We decide what is collected and why, and this policy governs it.
• We are a processor for Submissions — everything your Forms receive. You decide what your Form asks for and who sends it, so you are the controller of that data, and your own privacy policy governs it. We act on your instructions.

This is the same split the product is built on: the screen is yours, the URL is ours. We never decide what a Form collects.

• Your account. Your name, email address and sign-in identifiers, held through Clerk. We never see your password.
• Your Workspace. Its name, handle, any custom domain, its members, its plan, and the subscription record behind that plan.
• Your Forms. Their names, Fields, API keys, webhook destinations and webhook secrets.
• Administrative records. When we change a Workspace's plan, the change, the reason and who made it are written to an append-only audit record.
• Usage analytics. Page views and client-side errors in the Studio and on the public site, through PostHog on European infrastructure, served from our own domain. The legal basis is our legitimate interest in knowing whether the product works.
• Server logs. Requests to the service, including IP address, kept by our host for a short period for security and debugging.

When someone posts to one of your Forms, we store exactly what arrived and nothing we invented:

• the payload — the JSON object as sent, with nothing normalised and nothing discarded,
• the origin it was sent from, the user-agent that sent it, and the time it was received,
• when the Gate runs on a Form: the result, the reason and the summary it produced,
• when Auto classify runs: a category.

A payload can contain anything you ask for, which is why what is in it is your decision and your responsibility. If your Form collects health data, data about children, or anything else the law treats as special, you need a lawful basis for it before the first Submission arrives.

The Gate and Auto classify use an OpenAI API key that you supply on your Workspace. When one of them is on, the content of an arriving Submission is sent to OpenAI to be evaluated or categorised. Your key makes you OpenAI's customer; we call their API on your instruction.

With no key on the Workspace, no Submission content is sent to OpenAI. This is the only place where what your users write leaves our own stack, other than a webhook you configure yourself.

When you add a webhook, we deliver Submissions to the address you give us, signed so you can verify they came from us. Delivery is attempted three times. What your own service does with a delivery is outside our control and outside this policy.

Noonmark runs on United States infrastructure. The database that holds your Workspaces, Forms and Submissions is hosted in the United States, as are hosting, identity and email. PostHog, our analytics, is the one provider that stays in the European Union.

Transfers to these providers rely on the transfer mechanisms each of them offers — Standard Contractual Clauses, and certification under the EU–US Data Privacy Framework where the provider holds it. If you need the specifics for a provider, ask us at privacy@noonmark.dev and we will tell you what is in place.

• Submissions. Until your Workspace deletes them. A Form can be set to delete Submissions older than a number of days you choose; that happens in a sweep that runs once a day. You can also delete a single Submission, or a whole Form with everything it received, from the Studio at any time.
• Account and Workspace data. For as long as the account exists, and then for as long as we are required to keep records of it.
• Analytics and logs. Retained by PostHog and by our host under their own periods; we do not keep a separate copy.

Traffic runs over TLS. Webhook deliveries are signed with HMAC-SHA256 over the timestamp and the raw body, so a captured request cannot be replayed later. Signed-in surfaces are protected by Clerk, and the Backoffice runs as a separate application on its own subdomain with its own sign-in.

An OpenAI key you store on a Workspace is available to anyone who can reach that Workspace in the Studio. Use a key scoped to this purpose, not a shared production one.

Where we are the controller, you can ask for a copy of your data, ask us to correct or erase it, ask us to restrict or stop a particular use, and ask for it in a portable form. Write to privacy@noonmark.dev and we will answer within one month.

You can object to our analytics at any time by writing to privacy@noonmark.dev, and we will stop counting you.

You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

If you filled in a form built on Noonmark, we hold what you sent on behalf of the business that made it. They decide what happens to it, so ask them first — they are the controller, and we cannot act on their data without their instruction.

If you cannot reach them, write to privacy@noonmark.dev and we will help you identify who to ask. Businesses running Noonmark can take deletion requests through a Form of their own; the deletion-requests recipe sets one up.

We take no payments today and hold no card details. Plans are recorded by hand. When a payment provider is added it will be named here before it processes anything.

When this policy changes materially we will say so on the site and update the date at the top. This version is in effect from 21 September 2026.