Businesses store their operating record with us. Some of it concerns their customers, who never chose us and may not know we exist. We treat a request for that data seriously, and we do not treat compliance as automatic.
1. We require valid legal process. A letter, an email, or a telephone call from an officer is not sufficient.
2. We assess every request. We check jurisdiction, scope, service and whether the process type matches the data sought.
3. We disclose the minimum. If process compels three fields, we produce three fields, not an account export.
4. We challenge overbroad requests. Including by narrowing scope before production and by moving to quash where appropriate.
5. We notify the affected customer, unless we are legally prohibited from doing so.
6. We do not provide direct or bulk access. No standing portal, no API, no automated feed.
| Read this before sending a request |
|---|
| For most data about an individual consumer — a salon client, a patient, a shop customer — we are the processor, not the controller. The business that uses Noxtill decides what is recorded and controls it. In most cases the correct recipient of your request is that business, not us, and they can produce the data more quickly and more completely than we can. |
| Data | Typically available |
|---|---|
| Subscriber information for a Noxtill account | Business name, registered email, account creation date, plan, billing contact. |
| Access logs | IP addresses and timestamps of sign-in events, retained 12 months. |
| Business records stored by a customer | Held on behalf of that customer. See the box above. |
| Message content | Where retained by the customer under their own retention setting. Transmission is carried by third-party providers who hold their own records. |
| Call recordings and transcripts | Only where the customer enabled recording and the retention period has not expired. |
| Payment information | We do not hold full card numbers. Payment records are held by Stripe, which is the merchant of record. |
| Data sought | Process required (United States) |
|---|---|
| Basic subscriber information | A valid subpoena. |
| Non-content records, including access logs | A court order under 18 U.S.C. § 2703(d), or a subpoena where the statute permits. |
| Content — messages, documents, recordings | A search warrant issued on probable cause by a court of competent jurisdiction. |
| Preservation request | A written preservation request under 18 U.S.C. § 2703(f). We will preserve for 90 days, extendable once on renewal. |
| Real-time interception | A wiretap order. We have no capability to intercept third-party carrier traffic. |
We are a United States company. A foreign authority seeking data should ordinarily proceed through a Mutual Legal Assistance Treaty, letters rogatory, or another recognised channel, or obtain an order from a United States court.
We will consider a direct request from a foreign authority on its merits where the law permits us to respond, but we are not able to comply with process that would put us in breach of United States law, and we will say so.
A request that seeks personal data of individuals in the United Kingdom raises additional issues under Article 48 of the UK GDPR, which we will consider before responding.
Where there is an imminent risk of death or serious physical injury, mark your email to legal@noxtill.com with the subject "EMERGENCY DISCLOSURE REQUEST" and include the nature of the emergency, the specific data needed and why it will help, the identity and agency of the requesting officer, and a callback number we can verify.
We will act as quickly as we can, and we will disclose only what is necessary to address the emergency. We may ask follow-up questions; that is verification, not obstruction.
Our policy is to notify the affected customer before producing data, so that they have the opportunity to object or to seek protective relief.
We will not notify where we are prohibited by law or court order, or where we have a good-faith belief that notice would create a risk of death, serious physical injury, destruction of evidence, or harm to a child. Where a non-disclosure order expires, we will notify the customer then.
We do not agree to indefinite non-disclosure as a matter of course, and we will ask a court to time-limit an order that has no end date.
We may seek reimbursement of reasonable costs of production where the law permits, particularly for requests requiring substantial engineering work.
- Provide direct, bulk or standing access to our systems.
- Build a capability to intercept or decrypt that does not already exist.
- Produce data without valid legal process, outside a genuine emergency.
- Produce data belonging to a customer in another jurisdiction solely because a request was convenient to send to us.
- Confirm or deny the existence of an account to a requester without valid process.
We intend to publish a periodic transparency report stating the number of requests received, the categories of process, the number of accounts affected, and the number where we produced data in whole, in part, or not at all. Where a legal restriction prevents us from reporting a category precisely, we will report it in the narrowest band the law permits.
| Method | Detail |
|---|---|
| legal@noxtill.com — accepted for preservation requests and for initial contact | |
| Postal | Noxtill LLC, Legal Department, 4539 N 22nd St Ste R, Phoenix, AZ 85016, United States |
| Registered agent | As recorded with the Arizona Corporation Commission |
Sending a request by email does not waive any requirement for formal service.