Who We Are
Noctara builds security products for organisations using and testing modern software. We operate two products: Noctara ARS, a runtime security platform for AI agents, and Noctara Red, a penetration testing delivery platform. Both sit on a shared account and billing layer.
For the purposes of applicable data protection law, Noctara Security Ltd (trading as Noctara), a company registered in England and Wales under company number 17122134, with its registered office at 212 Noel Street, Nottingham, NG7 6AT, United Kingdom, is responsible for processing your personal information.
You can contact us at info@noctara.tech .
What This Policy Covers
This policy covers this website, Noctara ARS, Noctara Red, and the shared account, organisation and billing layer used by both products (together, the "Services").
When We Are a Controller and When We Are a Processor
This distinction matters, because it determines who you should contact about your information.
We act as a controller for information we decide the purpose of: your account details, organisation membership, billing records, support correspondence, marketing preferences, and information about how the Services are used.
We act as a processor for the content our customers put into the Services: agent and LLM traffic ingested by Noctara ARS, and engagement data, uploaded scan output, evidence and findings held in Noctara Red. We process that material on the customer organisation’s instructions, for the purpose of providing the Services to them.
If your personal information appears inside a customer’s data, for example because you work for an organisation whose systems were tested, that organisation is the controller. Please direct your request to them. We will assist them in responding.
What Data We Collect
Depending on how you use the Services, we may collect the following:
Account information: your name, email address, company name, login information, organisation membership and role, and other information required to create and manage your account.
Contact information: information you provide when contacting us or submitting a form, such as your name, email address, and company name.
Correspondence: messages, support requests, feedback, and other communications you send to us.
Usage data: information about how you interact with the Services, including pages visited, features used, session information, and similar technical activity.
Agent and runtime data (Noctara ARS): traffic and events ingested from agent tooling and software development kits, including tool calls, prompts and associated metadata where available, detections, verdicts, and the decision records produced from them.
Engagement data (Noctara Red): client records, engagement scope, rules of engagement, uploaded tool output and evidence files, findings, reports, review and sign-off records, and audit history. This may include personal information about individuals at the organisation being tested, where it appears in evidence or findings.
Report recipients (Noctara Red): the email address or domain a customer authorises to open a published report through a portal link, and a record of that access.
Billing information: subscription, plan, seat and consumption records. Card details are handled by our payment provider and are not stored by us.
Technical information: IP address, browser type, device information, operating system, and similar technical data used to operate and secure the Services.
Marketing preferences: whether you have chosen to receive product updates, news, or other communications from us.
How We Use Your Data
We may use your information to:
Provide, operate, and maintain the Services
Create and manage accounts, organisations, roles and product access
Monitor agent activity and provide detection, verdict and response features
Deliver and support penetration testing engagements, and produce the findings and reports arising from them
Control access to published reports and record who opened them
Process subscriptions, seats, metered usage and payments
Respond to enquiries, support requests, and other communications
Improve the performance, reliability, and functionality of the Services
Send product updates or marketing communications where you have opted in
Detect, investigate, and help prevent fraud, abuse, security incidents, and unauthorized activity
Comply with applicable legal and regulatory obligations
Legal Basis for Processing
Where applicable data protection law requires a legal basis for processing, we may rely on the following:
Contractual necessity: to provide the Services, manage your account, and perform our agreement with you.
Legitimate interests: to operate, secure, improve, and support the Services and maintain relationships with users.
Consent: where you have explicitly provided consent, including for certain marketing communications or optional cookies.
Legal obligation: where processing is required to comply with applicable law or a lawful request.
How Long We Keep Your Data
We retain personal information for as long as reasonably necessary to provide the Services, fulfil the purposes described in this policy, resolve disputes, maintain business records, and comply with applicable legal obligations.
Engagement records, findings, evidence and reports are retained for the customer organisation while its account remains active, under the retention and report delivery settings that organisation configures.
Where an organisation is deleted, access is withdrawn immediately and its data is permanently deleted after a short grace period, after which it cannot be recovered. A record that the deletion took place is retained separately.
Marketing information is retained until you unsubscribe or withdraw your consent, where applicable.
Sharing Your Data
We do not sell your personal information.
We may share information with trusted third-party service providers that help us operate the Services, such as hosting and cloud infrastructure providers, identity and authentication providers, payment processors, email delivery providers, analytics and monitoring services, and vulnerability data sources.
These providers may only process information as necessary to provide their services to us and are expected to apply appropriate safeguards.
Where a customer using Noctara Red issues a portal link, the report is disclosed to the recipient that customer authorises. That disclosure is directed by the customer, not by us.
We may also disclose information when required by law, to protect the rights and safety of Noctara, our users, or others, or in connection with a business transaction such as a merger, acquisition, financing, or sale of assets.
Security
We take reasonable measures designed to protect information processed through the Services against unauthorized access, loss, misuse, alteration, or disclosure. These include authentication controls, multi-factor authentication, access scoped to the organisation the data belongs to, and encryption in transit.
However, no internet-based service can guarantee absolute security. You are also responsible for maintaining appropriate security controls for your account, credentials, connected systems, and data, and for managing who in your organisation holds access to findings and reports.
Your Rights
Depending on your location and applicable law, you may have the right to:
Access the personal information we hold about you
Request correction of inaccurate or incomplete information
Request deletion of your personal information
Request restriction of certain processing
Object to certain processing
Withdraw consent where processing is based on consent
Request a copy of certain information in a portable format
Lodge a complaint with the appropriate data protection authority
To exercise applicable rights, please contact us at info@noctara.tech . Where we hold your information on behalf of a customer organisation, we will refer your request to that organisation and support them in responding.
In the United Kingdom, you may also complain to the Information Commissioner’s Office.
Cookies
We use cookies and similar technologies to operate the website, remember preferences, understand website usage, improve performance, and support optional analytics where permitted.
Where required by law, we will request consent before using non-essential cookies.
For more information, please see our Cookie Policy.
International Data Transfers
Depending on the services and infrastructure used, your information may be processed or stored in countries other than your own.
Where required by applicable law, appropriate safeguards will be used for international transfers of personal information.
Children’s Privacy
The Services are intended for business use and are not directed at children.
We do not knowingly collect personal information from children in violation of applicable law.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our services, legal requirements, or privacy practices.
Any updated version will be posted on this page with a revised effective date.
Contact
If you have questions about this Privacy Policy or how we handle personal information, please contact us at:
info@noctara.tech