Privacy Policy

1. Scope and roles

For account administration, billing, direct support, security, website operation, and SHRK's limited platform-level business metrics, SHRK generally determines the purposes and means of processing and acts as a business or controller. For Customer Content submitted to a workspace, including contacts, deal data, documents, messages, mandates, and submissions, SHRK generally acts as the customer's service provider or processor and follows the customer's instructions, subject to law and the Terms of Service.

If your information appears in a customer-controlled workspace and you wish to exercise a privacy right, contact that customer first when appropriate. We will assist customers with valid requests as required by contract and law.

2. Personal information we collect

A. Account and profile information

We collect information you provide to create and administer an account, such as name, business email, phone number, company, title, workspace affiliation, profile photo, login and authentication information, preferences, and communications settings. SHRK uses account contact information to operate accounts, provide support, and, when requested, assist with administrative work on behalf of users.

B. Customer Content hosted for users

The Service stores information users choose to enter, upload, import, or share. Depending on use, this may include contacts and professional profiles; deal, mandate, portfolio, buyer, seller, investor, issuer, lender, or target information; notes and relationship history; tasks; messages and comments; submission responses; documents, decks, financial information, and diligence materials; transaction status and economics; and sharing permissions.

SHRK hosts and processes Customer Content to provide the Service. SHRK does not claim ownership of it and does not use private Customer Content to market investments, sell contact databases, make investment decisions, or independently transact in deals.

C. Limited platform metrics

At present, SHRK tracks limited aggregate operating metrics: the gross volume or stated value of deals recorded through the platform, the number of users or accounts, and related high-level service-usage counts. These metrics are used to understand platform scale, capacity, and product operations. SHRK does not currently use deal-level Customer Content for advertising, data brokerage, or automated investment recommendations.

D. Payment and subscription information

If you purchase a paid plan, we collect transaction details such as plan, price, billing status, renewal date, invoices, and limited payment-method metadata. Stripe or another payment processor collects and processes complete card or bank details. SHRK generally receives a token, customer identifier, card brand, last four digits, expiration date, billing name or address, and payment status, not the complete card number.

E. Service, device, and security information

Like most online services, our systems and infrastructure providers may automatically generate limited technical records needed to deliver and secure the Service, such as IP address, device or browser type, operating system, timestamps, requested pages, referral URL, session and authentication events, error logs, audit logs, and security events. We use this information for functionality, troubleshooting, fraud prevention, security, and legal compliance, not to build advertising profiles.

F. Communications and support

We collect messages, support requests, meeting notes, feedback, and other information you provide when communicating with SHRK. If you ask SHRK to perform administrative work, authorized personnel may access the account information and Customer Content reasonably necessary to follow your instructions.

G. Information from other users and third parties

We may receive your business contact information when another user adds you as a contact, invites you to a workspace, sends a submission request, shares a deal page, or identifies you in Customer Content. We may also receive information from authentication providers, payment processors, integrations you enable, and public business sources when necessary to provide a feature you request.

3. How we use personal information

• Provide, host, operate, maintain, and improve the Service and requested features.
• Create and administer accounts, workspaces, permissions, invitations, submissions, shared pages, and support.
• Process subscriptions, invoices, renewals, cancellations, taxes, and payment status.
• Carry out customer instructions and requested administrative assistance.
• Authenticate users, maintain audit records, prevent fraud and abuse, troubleshoot errors, and protect security.
• Communicate about the Service, support requests, transactions, security, policy changes, and product updates.
• Measure aggregate platform scale, including user counts and gross deal volume recorded in the Service.
• Comply with law, legal process, sanctions, and enforceable governmental requests; protect rights and safety; and enforce agreements.
• Conduct internal accounting, corporate governance, audits, and business planning.
• Create aggregated or deidentified information that cannot reasonably identify an individual, which we may use for lawful business purposes and will not attempt to reidentify except to test deidentification.

SHRK does not sell personal information for money, does not share personal information for cross-context behavioral advertising, and does not use Customer Content to serve targeted advertisements. If those practices change, we will update this Policy and provide legally required choices before beginning the new practice.

4. Legal bases for processing

Where a law requires a legal basis, we process personal information as necessary to perform a contract or take steps requested before a contract; for our legitimate interests in providing, securing, supporting, and improving a business service; to comply with legal obligations; with consent where required; and to establish, exercise, or defend legal claims. Where we rely on legitimate interests, we consider the impact on individuals and do not rely on that basis when overridden by applicable rights.

5. How we disclose personal information

We may disclose personal information in the following circumstances:

• Workspace owners, administrators, and authorized users. Information in a workspace is available according to its permissions. Administrators may manage, export, retain, or delete workspace information.
• Recipients you or a customer select. Deal pages, invitations, submissions, messages, documents, and other materials are disclosed to recipients selected by the relevant user or workspace.
• Service providers and subprocessors. Vendors may provide cloud hosting, storage, authentication, email delivery, customer support, security, error monitoring, analytics limited to service operation, document processing, and other infrastructure. They may process information only to provide contracted services and under appropriate obligations.
• Payment processors. Stripe or another processor receives information needed to process payments, prevent fraud, manage subscriptions, and satisfy financial-compliance obligations.
• Professional advisers. Lawyers, accountants, auditors, insurers, and consultants may receive information subject to confidentiality duties.
• Legal and safety disclosures. We may disclose information if reasonably necessary to comply with law or valid process; enforce agreements; detect or prevent fraud, security incidents, or illegal activity; or protect users, SHRK, or others.
• Business transactions. Information may be disclosed in connection with financing, due diligence, merger, acquisition, reorganization, bankruptcy, or sale of some or all assets, subject to appropriate safeguards.
• With consent or direction. We disclose information when you or the relevant customer instructs or consents to the disclosure.

Current providers and safeguards

• Cloud hosting and storage. Microsoft Azure hosts SHRK's service infrastructure and may process information on SHRK's behalf.
• Payments. Stripe processes subscription payments and receives the billing information needed to complete transactions, prevent fraud, and manage payment status.
• Authentication. SHRK uses rotating authentication keys and access controls to reduce the risk of unauthorized access. No authentication or security system can be guaranteed invulnerable.
• Error detection and response. Users and the SHRK team may identify service errors. The SHRK team investigates reported or detected errors and corrects confirmed service issues within its reasonable control. Liability for errors is governed by the Terms of Service and applicable law.

6. Cookies and similar technologies

SHRK may use strictly necessary cookies and local storage for login, session continuity, security, preferences, and core functionality. We may use limited first-party or service analytics to understand reliability and aggregate usage. We do not currently use third-party advertising cookies or pixels for cross-site behavioral advertising.

Browser settings may block cookies, but blocking necessary technologies can prevent the Service from working. If SHRK later deploys nonessential cookies in a jurisdiction requiring consent, we will provide an appropriate consent mechanism and update this Policy. "Do Not Track" signals are not standardized; because we do not currently sell or share personal information for targeted advertising, there is no advertising opt-out triggered by those signals. We will honor legally required browser-based preference signals if and when applicable to our practices.

7. Data retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining account and transaction records, complying with legal and tax obligations, resolving disputes, enforcing agreements, preventing abuse, and maintaining security and backups.

Account and Customer Content retention generally follows the customer relationship and workspace instructions. After account closure or deletion, information may remain for a limited period in backups, logs, fraud-prevention systems, or records required by law. Payment and invoice records may be retained for legally required accounting and tax periods. Security logs are retained for a period appropriate to risk. We may retain aggregated or deidentified information that does not reasonably identify an individual.

After a user deletes an account, SHRK deletes the account data and active Customer Content within 60 days. Backup copies are also deleted or expire within 60 days. A user may ask us to complete an available administrative deletion sooner by emailing contact@noblenest.dev. After we verify the request, we will complete that administrative deletion within five business days. These periods remain subject to any longer retention required by law or reasonably necessary for security, fraud prevention, dispute resolution, or enforcement of agreements.

8. Security

We use commercially reasonable administrative, technical, and organizational measures designed to protect personal information, which may include access controls, authentication, encryption in transit, vendor controls, logging, backups, and least-privilege practices as appropriate. No method of transmission, storage, or security is perfect, and we cannot guarantee absolute security.

Users are responsible for strong credentials, multifactor authentication when available, appropriate workspace permissions, device security, and careful sharing. Contact contact@noblenest.dev promptly if you believe an account or shared link has been compromised.

9. Your choices and privacy rights

Depending on your location and subject to exceptions, you may have rights to request access to or a copy of personal information; correction; deletion; restriction or objection; portability; withdrawal of consent; and information about collection, use, and disclosure. You may also have rights to opt out of sale, targeted advertising, or certain profiling and to appeal a denied request. SHRK does not currently sell personal information or use it for targeted advertising or legally significant automated profiling.

You may update certain account information through the Service. To submit a privacy request, email contact@noblenest.dev. Describe the request and the account, workspace, email address, or interaction involved. We may verify identity and authority before acting. Authorized agents must provide proof of authority, and we may verify the request directly with the individual. We will not discriminate against you for exercising a right.

If SHRK processes your information only for a customer-controlled workspace, we may direct the request to that customer or assist the customer in responding. We may deny or limit requests where permitted by law, including when we cannot verify identity, must retain information, or an exemption applies. If applicable law provides an appeal right, you may appeal by replying to our decision with "Privacy Appeal."

10. California privacy notice

This section supplements the Policy for California residents. Its application depends on whether SHRK meets statutory coverage thresholds and whether an exemption applies. In the preceding 12 months, SHRK may have collected the following categories of personal information: identifiers; customer-record information; commercial information related to subscriptions and user-entered deals; internet or electronic network activity; professional or employment-related information; approximate geolocation derived from IP address; and inferences limited to service preferences or account administration. Customer Content may contain additional categories chosen by customers.

Sources include you, your organization, other users, integrations you enable, service providers, payment processors, and limited public business sources. Business purposes are described in Section 3. Categories of recipients are described in Section 5. SHRK has not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months. SHRK has no actual knowledge that it sells or shares personal information of individuals under 16.

California residents may have rights to know, access, correct, delete, and obtain information about disclosure; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and to non-discrimination. SHRK does not use or disclose sensitive personal information for purposes that currently require a right to limit. Submit requests through contact@noblenest.dev.

11. Other U.S. state privacy rights

Residents of states with comprehensive privacy laws may have rights similar to those described above, subject to coverage thresholds, exemptions, and differences in law. These may include access, correction, deletion, portability, opt-out, and appeal rights. Submit a request to contact@noblenest.dev. We will apply the law that governs the request and may request information needed for verification.

12. International users and data transfers

SHRK is operated from the United States. If you access the Service from another country, personal information may be transferred to, stored in, and processed in the United States and other countries where SHRK or its service providers operate. Those countries may have different data-protection laws. Where required, we will use recognized transfer mechanisms and contractual safeguards.

SHRK does not currently market or formally offer the Service in the European Economic Area, United Kingdom, Switzerland, or Asia. A person in one of those regions may choose to access the Service where local law permits. That access does not represent a public launch or a statement that SHRK has localized the Service for that jurisdiction. Users are responsible for determining whether their access and use comply with local law. SHRK's liability remains subject to the Terms of Service and any rights or obligations that applicable law does not allow the parties to waive.

13. Children's privacy

The Service is intended only for adults and business professionals and is not directed to children under 13. We do not knowingly collect personal information online from children under 13. Users must be at least 18 to create an account. If you believe a child provided personal information, contact contact@noblenest.dev so we can investigate and take appropriate action.

14. Third-party services

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own notices, not this Policy. When you enable an integration or follow a third-party link, review that party's policies and permissions.

15. Changes to this Privacy Policy

We may update this Policy to reflect changes in the Service, data practices, vendors, or law. We will post the updated version and revise the effective date. If changes are material, we will provide additional notice when required. We will not materially expand use of previously collected personal information without providing any notice or choice required by law.

16. Contact us

If applicable, you may also contact your local data-protection authority.