This page exists so that nobody has to guess which document answers their question. Find your situation in the table and go straight there.
| If you want to know | Read |
|---|---|
| What I am agreeing to by using Noxtill | Terms of Service |
| What you do with my information | Privacy Policy |
| What control I have over my information | Your Privacy Choices |
| Whether you sell my data | Do Not Sell or Share — the answer is no |
| How you keep it safe | Security |
| Who else touches it | Sub-processors |
| How long you keep it | Data Retention & Deletion Schedule |
| What I can and cannot do with the Service | Acceptable Use Policy |
| Whether I can send this campaign | Messaging & Communications Compliance Policy |
| What your AI does and does not do | AI Transparency Policy |
| Whether I get my money back | Refund Policy |
| What uptime you promise | Service Level Agreement |
| How fast you answer | Support Policy |
| Whether the Service works with a screen reader | Accessibility Statement |
| I am a healthcare provider | HIPAA Business Associate Agreement |
| I am a data protection officer | Data Processing Agreement |
| I found a security bug | Vulnerability Disclosure Policy |
| I am a law enforcement officer | Law Enforcement Request Guidelines |
| Someone is infringing my copyright | Copyright & DMCA Policy |
| I am building on your API | API & Developer Terms |
These create binding obligations between you and us.
| Document | What it does | Who it binds |
|---|---|---|
| Terms of Service | The master agreement. Licence, fees, renewal, data ownership, your responsibilities, liability, termination, governing law and arbitration. Contains the Module Terms and the Regional Terms. | Every customer |
| Data Processing Agreement | Processor terms under the UK GDPR and service-provider terms under United States state law. Carries the UK International Data Transfer Addendum. | Every customer, automatically |
| HIPAA Business Associate Agreement | Required before protected health information may be entered into the Service. | Covered entities — only on signature |
| API & Developer Terms | Credentials, rate limits, webhooks, versioning and deprecation. | Anyone using the API |
| Service Level Agreement | The 99.9% uptime commitment, how it is measured, and the credit schedule. | Every paying customer |
These describe what we do and what we require.
| Document | What it covers |
|---|---|
| Privacy Policy | What we collect, why, who we share it with, where it goes, how long we keep it, and your rights. Includes the CCPA category table and a jurisdiction annex covering every major region. |
| Cookie Policy | What we store on your device. We use no advertising or cross-site tracking cookies. |
| Your Privacy Choices | Every control you have, how to use each one, and how long we take. |
| Do Not Sell or Share My Personal Information | The statutory opt-out page. We do neither, and this says so in the statutory terms. |
| Data Retention & Deletion Schedule | How long each category is kept, and precisely what happens when something is deleted. |
| Acceptable Use Policy | What the Service may not be used for, and how we enforce it. |
| Messaging & Communications Compliance Policy | TCPA, CAN-SPAM, state law, CASL, PECR, platform rules and A2P registration. The single most important document for anyone running campaigns. |
| AI Transparency Policy | Where AI is used, the three things it may never do, disclosure, and our position on model training. |
| Security | Infrastructure, tenant isolation, access control, incident response, and an honest statement of where we stand on certifications. |
| Accessibility Statement | WCAG 2.2 AA as the target, what is in place, and a published list of known limitations. |
| Refund Policy | The 30-day guarantee, when we refund beyond it, and when we do not. |
| Support Policy | Channels, hours, severity levels and response targets. |
| Vulnerability Disclosure Policy | What researchers may test, and our safe-harbour commitment. |
| Law Enforcement Request Guidelines | What process we require, what we hold, and when we notify customers. |
| Copyright & DMCA Policy | Notice, counter-notice and repeat-infringer process. |
| Sub-processors | Every company that touches your data, what each does, and where. |
| Commitment | Where it is binding |
|---|---|
| We never sell your data or your customers' data | Terms 6.2 · Privacy Policy 1 · Do Not Sell |
| We never market to your customers | Terms 6.2 · Privacy Policy 1 |
| We never train public AI models on your data | Terms 10.5 · AI Transparency Policy 4 |
| AI never moves money without a human confirming | Terms 10.2 · AI Transparency 1 |
| AI never decides about a person | Terms 10.2 · AI Transparency 1 |
| AI never states a figure it has not retrieved | Terms 10.2 · AI Transparency 1 |
| We notify you of a breach within 72 hours | Terms 16 · DPA 8 · Security 8 |
| You can export your data at any time, free | Terms 6.4 |
| We give 30 days' notice before a new sub-processor | DPA 5.2 |
| Cancellation is online, in as few steps as signing up | Terms 5.3 · Terms 20.1 |
| The Service is available worldwide except where sanctions prohibit it | Terms 3.3 · Terms 3.4 |
| Required AI disclosures cannot be switched off | Terms 10.3 · AI Transparency 3 |
| There is no "send anyway" button on a blocked message | Messaging Compliance 6 |
| Fact | Detail |
|---|---|
| Company | Noxtill LLC, an Arizona limited liability company |
| File number | 25117457 |
| Registered address | 4539 N 22nd St Ste R, Phoenix, AZ 85016, United States |
| Infrastructure | United States |
| Data residency elsewhere | Not currently offered |
| Merchant of record | Stripe — see Terms 5.6 |
| Voice and SMS | Twilio |
| WhatsApp, Instagram, Messenger | Meta Platforms |
| Governing law | Arizona, United States |
| Dispute forum | AAA arbitration seated in Maricopa County, Arizona |
| Stated plainly, because a trust page that only lists strengths is not a trust page |
|---|
| We do not hold SOC 2 Type II, ISO 27001 or any equivalent third-party attestation. We have not commissioned an independent accessibility audit and do not publish a VPAT. We do not offer data residency outside the United States. We are not certified as a medical device or an electronic health record. Our uptime history is short. If any of these matters to your procurement, it is better that you learn it here than three weeks into a review. |
| Subject | Contact |
|---|---|
| General | contact@noxtill.com |
| Support | support@noxtill.com |
| Privacy, data rights, and DPA requests | privacy@noxtill.com |
| Security reports and vulnerability disclosure | security@noxtill.com |
| Legal notices, DMCA, law enforcement, complaints | legal@noxtill.com |
| Telephone | +1 808 998 5302 |
| Postal | Noxtill LLC, 4539 N 22nd St Ste R, Phoenix, AZ 85016, United States |
Material changes to any document on this page are announced by email and in the Service at least 30 days before they take effect, and apply from your next renewal. Minor corrections are made with notice in the Service.
We keep previous versions of every document, with the date each took effect, and will provide any earlier version on request at legal@noxtill.com.
| Version | Date | Change |
|---|---|---|
| 2.0 | September 4, 2026 | Full pack rewritten for Noxtill LLC (Arizona). Superseded the United Kingdom entity pack. |
| 1.0 | Withdrawn | United Kingdom entity. No longer in force. |
Questions about this document: support@noxtill.com · Privacy: privacy@noxtill.com · Noxtill LLC, 4539 N 22nd St, Ste R, Phoenix, AZ 85016, United States.