Privacy Policy

01Who the controller is

Noctly (noctly.video) is operated by Baite Tecnologia da Informação (L de Jesus Santos Brito Tecnologia da Informação Ltda.), registered under CNPJ No. 62.068.171/0001-00, with its registered office at Av. Tancredo Neves, 2539, Edifício CEO Salvador Shopping, Torre Londres, sala 2609, Caminho das Árvores, Salvador, Bahia, Brazil, 41820-021. Baite Tecnologia da Informação is the controller of the personal data processed in Noctly, meaning it decides how and why that data is used.

As a small-scale processing agent (a Brazilian micro-enterprise), Baite Tecnologia da Informação is exempt from appointing a data protection officer ("encarregado") under article 11 of ANPD Resolution CD/ANPD No. 2/2022, and keeps privacy@noctly.video as the channel for data subjects and the Brazilian Data Protection Authority. Use this channel for any question about this policy or to exercise your rights.

02Who this policy applies to

This policy applies to anyone who visits noctly.video, creates an account, subscribes to a plan or uses any Noctly feature, including connecting YouTube channels and Facebook and Instagram accounts. Please read it together with the Terms of Use.

03What data we collect

Account data

Email address, name and profile picture (when you sign in with Google), language preference and access records such as date, time and IP address.

Payment data

Payments are processed by Stripe. Your card details are entered directly in Stripe’s environment and never pass through Noctly’s servers nor are stored by us. We only receive what we need to manage your subscription: customer identifier, plan, amount, payment status, the card brand and last four digits and, where required for tax invoicing, billing details.

Content you create

Niches, topics, instructions, scripts, titles, descriptions, channel and series settings, as well as the videos, audio, images and captions generated for you. We also compute indicators about that content, such as the originality score and risk factors of the Viral Survival Kit.

Voice samples for cloning

If you use voice cloning, we collect a recording of your own voice and the voice model created from it. This data receives enhanced protection, described in the Voice data section.

Connected platform accounts

When you connect a YouTube channel or a Facebook Page and an Instagram account, we receive the access tokens you authorize and basic information about those accounts, such as identifier, name, username and the status of posts made through Noctly. Tokens are kept in our database with access restricted to the application server, and publishing tokens are stored encrypted in the secrets vault (Supabase Vault). An older copy of YouTube tokens is still kept in a table outside that vault and is being migrated to it.

Usage and telemetry data

Pages visited, clicks, product events (such as when a generation starts and finishes), device type, browser, operating system and approximate location inferred from your IP address. Technical error and performance logs are also collected to keep the service running.

Support

When you open a support ticket, we process the content of your message, any attachments you send and the conversation history.

04Cookies and similar technologies

Noctly stores, accesses and recognizes information on your device, including through cookies and browser local storage. We use three categories:

• Necessary — keep you signed in, protect forms against bots (Cloudflare Turnstile), and remember your language, theme and consent choices. The site does not work without them, so they do not depend on consent.
• Analytics — Google Analytics 4 and PostHog, used to understand how Noctly is used and to improve the product. Only enabled with your consent.
• Marketing — Meta and TikTok pixels, used to measure ad campaigns and build audiences. Only enabled with your consent.

You can accept, decline or change your choices at any time in the cookie preferences shown on the site. You can also block or delete cookies in your browser settings; in that case, parts of the site may stop working.

05Why we use data and on what legal basis

Each processing activity has a defined purpose and a legal basis under Article 7 of the LGPD (or Article 11 for sensitive data):

• Providing the service — creating and maintaining your account, generating scripts, narrations, images and videos, publishing or scheduling posts on the platforms you connect, managing credits and sending transactional emails (such as sign-in links and video-ready notices). Legal basis: performance of a contract (Art. 7, V).
• Billing and subscription management — processing payments, renewals and refunds, and issuing tax documents. Legal bases: performance of a contract (Art. 7, V) and compliance with legal or regulatory obligations (Art. 7, II).
• Security and fraud prevention — blocking automated sign-ups and disposable email addresses, detecting abuse, protecting accounts and keeping access logs. Legal bases: legitimate interest (Art. 7, IX) and compliance with legal obligations, such as the access-log retention required by the Brazilian Internet Civil Framework (Art. 7, II).
• Improving the product — measuring usage, costs and generation failures to fix problems and evolve features. Legal bases: legitimate interest (Art. 7, IX) for the service’s essential telemetry and consent (Art. 7, I) for analytics cookies.
• Marketing — measuring campaigns and sending communications about Noctly. Legal bases: consent (Art. 7, I) for marketing pixels and legitimate interest (Art. 7, IX) for communications to customers, always with an unsubscribe option.
• Support — answering tickets and requests. Legal bases: performance of a contract (Art. 7, V) and legitimate interest (Art. 7, IX).
• Defending rights — keeping information needed in judicial, administrative or arbitration proceedings. Legal basis: regular exercise of rights (Art. 7, VI).
• Voice cloning — generating narrations with your own voice. Legal basis: specific and highlighted consent (Art. 11, I).

When the legal basis is legitimate interest, we assess whether the processing is necessary and respects your expectations and rights. You can object to it through the DPO channel.

06Voice data

Voice cloning is not available yet. When it is released, the rules below will apply. A recording of your voice and the model created from it can reproduce unique characteristics of your speech. Noctly therefore treats this material as sensitive personal data, with the following safeguards:

• Cloning only starts after your specific and highlighted consent, given in the cloning flow itself, separately from accepting these documents.
• You may only clone your own voice. Uploading another person’s voice is prohibited by the Terms of Use.
• The sample and the model are used exclusively to generate the narrations you request in your account. We do not use them for any other purpose or make them available to other users.
• Processing is carried out by ElevenLabs, acting as a processor on our behalf.
• You can withdraw your consent at any time by deleting the cloned voice in the dashboard or by requesting deletion through the DPO channel. When you delete it, we erase the sample and the model from our systems and request removal from the provider. Videos already generated with that voice remain in your account until you delete them or the retention period ends.

07Who we share data with

Noctly does not sell personal data. We only share data with service providers acting as processors, each limited to what its role requires:

• Infrastructure — Supabase (database and authentication), Railway (application and video-processing servers), Vercel (website hosting), Cloudflare (video storage on R2 and Turnstile bot protection), Inngest (orchestration of generation steps), a Redis cache service and Sentry (technical error reporting, with no cookies and no form contents).
• AI and media — Anthropic (Claude, scripts and metadata), OpenAI (text-to-speech narration and narration-language checks), ElevenLabs (narration and voice cloning), Fal.ai (images with Flux), Replicate (videos with Seedance), Google (videos and images with Veo and Gemini) and Pexels (stock video search). These providers receive the content needed for each step, such as topics, scripts and narration text.
• Payments — Stripe.
• Communication and support — Resend (email delivery) and Zoho Desk (support tickets).
• Analytics and marketing (only with consent) — PostHog, Google Analytics 4, Meta and TikTok.
• Publishing platforms — YouTube (Google) and Facebook and Instagram (Meta) receive the videos, titles, descriptions and other metadata you choose to publish. Once published, the content is governed by each platform’s policies.

We may also share data when required by law, by court order or by a competent authority, or to protect the rights of Noctly, its users or third parties. In the event of a corporate reorganization, data may be transferred to the successor, which will remain bound by this policy.

08International transfers

Several of the processors listed above store or process data outside Brazil, mainly in the United States, including our primary database. These transfers are made to perform our contract with you and follow the mechanisms of Article 33 of the LGPD, such as contractual clauses with providers that commit to maintaining protection and security levels compatible with Brazilian law.

09Google and YouTube

When you connect a channel, Noctly uses the YouTube API Services with two access scopes:

• youtube.upload — upload to your channel the videos you choose to publish or schedule, with title, description, tags, privacy setting and synthetic-content disclosure.
• youtube.readonly — identify the connected channel and read channel and video information (such as name, identifier and post status) to confirm the connection and show progress in the dashboard.

Noctly’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means data obtained from Google is used only to provide and improve the user-facing publishing features; it is not sold, not used for advertising, not used to train generalized artificial intelligence models, and not read by humans except with your permission, for security reasons or when required by law.

By connecting a channel, you agree to be bound by the YouTube Terms of Service. Google’s processing of data is governed by the Google Privacy Policy.

You can disconnect the channel in the Noctly dashboard or revoke access at any time on your Google Account permissions page. After revocation, Noctly stops accessing the channel and deletes the tokens; other data obtained through the API is deleted or refreshed in accordance with the YouTube API Services developer policies.

10Facebook and Instagram

The Facebook and Instagram connection uses Facebook Login for Business. With your authorization, we receive the identifiers and names of the Pages and Instagram professional accounts you select and the access tokens needed to publish. This data is used only to publish the videos you choose and to show the status of those posts. Tokens are stored encrypted in Supabase Vault.

You can remove Noctly at any time in Facebook’s Business Integrations settings. When you do, Meta notifies us and we deactivate the corresponding connections.

If you request deletion of your data through Facebook, Noctly deletes the Page and Instagram connections and the stored access credentials, and cancels pending posts to those accounts. The request generates a confirmation code, and its progress can be checked on the data deletion status page.

11How long we keep data

We keep data only for as long as needed for the purposes in this policy or for the period required by law:

• Account data and content — while your account is active. After a deletion request, data is erased or anonymized, except what we must keep to comply with legal obligations or to exercise rights.
• Final video files — available for download for 3 days on the free tier, 7 days on Creator, 15 days on Studio and 30 days on Scale. After that period, the file is removed from storage.
• Voice samples and models — until you delete the cloned voice or your account.
• Connected platform tokens — until you disconnect the account, revoke access on the platform or delete your Noctly account.
• Access logs — at least six months, as required by the Brazilian Internet Civil Framework.
• Payment and tax data — for the period required by tax and accounting laws.
• Analytics data — for the periods configured in each tool, limited to what the purpose requires.
• Support tickets — for as long as needed to resolve the request and for the applicable legal periods.

12Your rights

Under Article 18 of the LGPD, you may at any time:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• request portability of your data to another provider;
• request deletion of data processed based on your consent;
• know which public and private entities we share your data with;
• be informed about the possibility of not giving consent and the consequences of refusing;
• withdraw your consent;
• object to processing based on another legal basis, in case of non-compliance with the law;
• request review of decisions made solely on the basis of automated processing (Art. 20).

To exercise any of these rights, including deleting your account, write to privacy@noctly.video from your registered email address. We may ask for additional information to confirm your identity before fulfilling the request. We respond within the deadlines set by the LGPD.

If you believe your request was not addressed, you may also file a complaint with Brazil’s National Data Protection Authority (ANPD).

13Security

We adopt technical and administrative measures to protect data against unauthorized access, loss or alteration, including: encryption in transit (HTTPS/TLS), access tokens stored with server-only access and, for publishing tokens, encrypted in a vault, per-account access control with isolation between users, internal access restricted to the minimum necessary, and failure monitoring.

No system is completely immune to incidents. If a security incident occurs that may create a relevant risk or harm to you, we will notify you and the ANPD as required by law.

14Children and teenagers

Noctly is not directed at people under 18, and account creation is restricted to adults aged 18 or over. We do not knowingly collect data from children or teenagers. If we identify an account belonging to a minor, it will be closed and its data deleted. If you become aware of such a case, let us know through the DPO channel.

15Changes to this policy

We may update this policy to reflect changes to Noctly or to the law. The date at the top shows the version in force. When a change is material, we will notify you by email or through a notice in the dashboard before it takes effect and, where the law requires, ask for new consent.

16Contact

Privacy questions, requests and complaints: privacy@noctly.video. Baite Tecnologia da Informação (L de Jesus Santos Brito Tecnologia da Informação Ltda.), CNPJ 62.068.171/0001-00, Av. Tancredo Neves, 2539, suite 2609, Salvador, Bahia, Brazil, 41820-021.