Privacy Policy

This Privacy Policy is issued by HamptonTCI Limited, a company incorporated in Hong Kong (registered address: Mezzanine Floor, Sun House, 90 Connaught Road Central, Sheung Wan, Hong Kong), trading as Nocrai.

Nocrai provides digital financial diagnostic tools for business owners. References to “we”, “us”, and “our” in this policy mean HamptonTCI Limited.

This policy explains how we collect, use, and protect personal data in connection with the Nocrai website (nocrai.com), our digital products, and our affiliate programme.

We share your personal data only as strictly necessary:

• Resend — transactional email delivery for one-time verification codes. Resend receives your email address solely for the purpose of dispatching your verification code. Resend acts as a data processor under a Data Processing Agreement. Resend is US-based.
• Lemon Squeezy — payment processing and licence management for digital product purchases. Lemon Squeezy is US-based and acts as Merchant of Record and independent data controller for payment data.
• HubSpot — CRM for affiliate and partner application records, onboarding, and relationship management. HubSpot acts as a data processor under a Data Processing Agreement including EU Standard Contractual Clauses. HubSpot is US-based.
• DocuSign — electronic agreement execution for affiliate and partner agreements. DocuSign is US-based.
• Cloudflare — website hosting, content delivery, and authenticated user data storage (Cloudflare Workers KV). Business profile data and diagnostic outputs for authenticated users are stored in Cloudflare KV infrastructure. Cloudflare is US-based.
• Service providers — other trusted third parties (such as email delivery and IT support) who are contractually bound to protect your data.
• Legal compliance — where required by law, court order, or regulatory authority.
• Business transfers — in the event of a merger, acquisition, or transfer of our business.

We do not sell, rent, or trade your personal information.

HubSpot, Lemon Squeezy, DocuSign, Cloudflare, and Resend are all US-based. When we transfer data from regions with strict data protection laws (including the EEA, UK, Hong Kong, Australia, and Canada) to the US, we rely on appropriate safeguards including Standard Contractual Clauses.

By using our website, purchasing our products, or participating in our affiliate programme, you acknowledge that your data may be transferred to and processed in the United States.

• Authenticated user data (business profile, diagnostic outputs, session tokens) — retained for as long as your account is active. If your account shows no activity for 24 consecutive months, we will send a warning email to your registered address and delete all associated data 30 days after that warning unless you log in during that period. You may delete your account and all associated data at any time via the platform settings.
• Hashed email address — deleted at the same time as your account data. The hash is non-reversible and cannot be used to identify you independently of your account record.
• Product purchase records — retained for 7 years from the date of transaction in accordance with Hong Kong accounting and tax requirements.
• Affiliate and partner records — retained for the duration of the agreement and for 7 years following termination, in accordance with contractual limitation periods.
• Agreement execution records (DocuSign) — retained for 7 years following execution.
• Sanctions and PEP screening records — retained for as long as required by applicable anti-money laundering regulations.
• Email enquiries — retained for up to 12 months after last contact.

Regardless of your location, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request deletion of your data, subject to legal exceptions (including our obligation to retain records under applicable law).
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format (where applicable).
• Object — object to processing based on legitimate interests.

Self-serve rights for authenticated platform users: If you hold a Nocrai account, you can exercise your right of access and right to erasure directly within the platform without contacting us:

• Export your data — download a complete JSON export of your business profile and diagnostic outputs at any time from your account settings.
• Delete your account — permanently delete your account and all associated data (profile, outputs, session token, and email hash) at any time from your account settings. Deletion is immediate and irreversible.

To exercise any other rights, or if you do not hold a platform account, contact us at privacy@hamptontci.com. We will respond within 30 days.

Cloudflare may set strictly necessary functional cookies to ensure the website delivers correctly and securely. These cookies do not collect personal information for marketing or tracking purposes and do not require consent.

When you proceed to purchase a Nocrai product via Lemon Squeezy, Lemon Squeezy may set its own cookies on their payment interface in accordance with their privacy policy. This occurs on Lemon Squeezy’s platform, not on nocrai.com.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies on nocrai.com.

Local storage (authenticated users): If you create a Nocrai account, your session token and business profile data are stored in your browser’s local storage (not cookies). This data remains on your device and is used to maintain your session and pre-populate diagnostic inputs. You can clear this data at any time by clearing your browser’s local storage or by deleting your account via platform settings.

We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, alteration, or loss.

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and notify affected individuals without undue delay where the breach is likely to result in a high risk.

We may update this policy periodically. The “Last Updated” date at the top indicates when changes were made. If we make material changes, we will notify affected individuals by email where we hold your email address, or by a notice on our website.