Your data. Your control.

1. Who we are

Noetis is a conversion-optimisation platform operated by FinalFrame B.V., a company registered in the Netherlands. FinalFrame acts as data controller for data processed through the Noetis dashboard and as a data processorfor visitor data collected on your customers' sites via our tracking script.

For all data-controller enquiries: chris@noetis.nl. For data-processor matters (DPA): chris@noetis.nl.

2. Data we collect from dashboard users

3. Data collected from visitors to Noetis-powered sites

When a visitor browses a website built with Noetis, our tracking script may collect the following data — only after the visitor grants explicit consentvia the site's cookie banner.

Noetis does not collect: full IP addresses, names, email addresses, biometric data, or any special category data under GDPR Art. 9.

4. Legal bases for processing

We process personal data only where we have a valid legal basis under GDPR Art. 6.

5. AI processing

To generate experiment hypotheses and optimisation recommendations, anonymised behavioural patterns — including element types, click-rate aggregates, scroll-depth percentages, and user-supplied page text — are sent to Anthropic's Claude AI model.

Safeguards

• No personal identifiers (session IDs, visitor IDs, email addresses) are included in AI prompts.
• Anthropic's zero data retention policy is enabled: prompt content and responses are not stored by Anthropic beyond the request.
• All user-supplied strings (page text, CMS content, form values) are sanitised before interpolation into prompts to prevent injection attacks.
• AI-generated content that is applied to your site is stored in adaptive_pages.graph_json and is subject to all standard retention and deletion rules.

6. Automated decision-making

Noetis uses automated processing to: (a) assign website visitors to experiment variant groups; (b) statistically evaluate which variant performs better; (c) automatically apply the winning variant to your page graph.

Visitor assignment is a randomised, pseudonymous process based solely on the visitor ID cookie. It has no legal or similarly significant effect on the visitor. No profiling of individual visitors for personalised advertising takes place.

Winner application is an automated action that updates the content of your site. This affects you (our customer), not your site visitors, and is the core service you have contracted for. You can roll back any AI-applied change at any time from the Revision History panel.

We do not make automated decisions with legal or similarly significant effects on any identifiable natural person within the meaning of GDPR Art. 22(1).

7. Data retention

8. Cookies and browser storage

All storage marked "Yes" above is created and cleared based on visitor consent. Revoking consent calls window.spRevokeConsent(), which immediately clears all Noetis storage from the browser. You can also delete your data server-side via DELETE /api/track/data?session_id=… or ?visitor_id=….

9. International data transfers

Noetis stores data primarily in the EU (Frankfurt, Germany). Some sub-processors are located in the United States. We ensure adequate safeguards for all transfers outside the EEA:

The Standard Contractual Clauses used are the European Commission's 2021 SCCs (Commission Implementing Decision (EU) 2021/914). For transfers where we act as processor, SCCs are incorporated into the relevant sub-processor DPA. A signed copy is available on request at chris@noetis.nl.

10. Security measures

We implement appropriate technical and organisational measures (TOMs) to protect personal data. A full description of our security controls is published on our Security & Trust page. Key measures include:

• Encryption in transit: TLS 1.2+ for all connections.
• Encryption at rest: AES-256 via Supabase on AWS infrastructure.
• Tenant isolation: Row-level security (RLS) enforced at the database layer. One tenant cannot access another's data.
• Access control: RBAC with five roles; 2FA enforced on all accounts.
• Audit logging: All write operations logged for 12 months.
• Breach notification: We will notify you and, where required, the competent supervisory authority within 72 hours of becoming aware of a personal data breach.
• Responsible disclosure: Security researchers may report vulnerabilities to chris@noetis.nl. We target a 24-hour acknowledgement and 72-hour remediation for critical issues.

11. Children's data

The Noetis platform and tracking script are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child under 16 has provided data to us, please contact chris@noetis.nl and we will delete it within 72 hours of verification.

Customers using Noetis on sites that are directed at children must ensure they have appropriate legal grounds to do so and must configure the service accordingly. Using the Noetis tracking script on a site targeted at children under 16 without a lawful basis constitutes a material breach of the Terms of Service.

12. Your rights under GDPR (EEA / UK)

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

We will respond to verifiable data subject requests within 30 days (extendable by 60 days for complex requests with notice). We will not charge a fee unless requests are manifestly unfounded or excessive.

13. California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights.

Categories of personal information collected

In the preceding 12 months, Noetis has collected: identifiers (email address, pseudonymous session/visitor IDs), internet or other network activity (page views, clicks, experiment variant assignments), and commercial information (billing records). We do not sell or share personal information for cross-context behavioural advertising.

Your California rights

• Right to know — you may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purposes, and any third parties we share it with.
• Right to delete — you may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct — you may request correction of inaccurate personal information.
• Right to opt out of sale / sharing — Noetis does not sell personal information. We do not share personal information for cross-context behavioural advertising.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA.
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights.

To submit a verifiable consumer request: email chris@noetis.nl with subject line CCPA Request. We will respond within 45 days. You may designate an authorised agent to submit a request on your behalf.

14. Sub-processors

Sub-processors are updated on the DPA page. Changes are notified to account owners at least 30 days in advance. You may object to a new sub-processor by contacting chris@noetis.nl.

15. Contact and policy updates

For privacy questions or to exercise your rights: chris@noetis.nl

For DPA / data-processor enquiries: chris@noetis.nl

For security-related matters: chris@noetis.nl

Policy updates

We will notify you of material changes to this policy by email at least 14 days before the new version takes effect. The current version is always available at noetis.nl/privacy. Continued use of the Service after the effective date constitutes acceptance of the updated policy.