Privacy Policy
Last updated: October 14, 2026
1. Who we are
NoxWhale Systems (“NoxWhale”, “we”) builds deal workflow systems for investment firms. We are based in India.
This policy explains what personal data we collect about you through this website and in the course of providing services, and how we handle it. For the personal data described here, we are the controller. Contact for any privacy question or request: noxwhaleautomation@gmail.com.
We keep it deliberately simple: we collect little, and we sell nothing.
2. What we collect
- Contact details — name, email, firm, and anything you include when you book an audit or email us.
- Scheduling data — handled by our booking provider (Cal.com) when you book a call.
- Basic technical data — our hosting provider may log IP addresses and request data for security and performance. We do not run advertising trackers.
We do not deliberately collect special categories of personal data, and ask that you do not send them to us.
3. Why we process it, and on what basis
For anyone in the United Kingdom or Europe, UK GDPR and EU GDPR require us to state a lawful basis for each purpose:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and running scheduled calls | Legitimate interests, or steps before entering a contract |
| Scoping, delivering and supporting engagements | Performance of a contract |
| Keeping records for accounting and tax | Legal obligation |
| Security and reliability of the website | Legitimate interests |
| Occasional emails you asked for | Consent, withdrawable at any time |
Where we rely on legitimate interests, that interest is operating and improving a small professional services business, balanced against your rights. You can object at any time.
4. Deal data and your own systems
This policy covers the personal data we hold about you. It does not cover the data inside the systems we build, which is handled under your engagement contract, our non-disclosure agreement and, where personal data is involved, a data processing agreement in which you are the controller and we act as a processor.
Builds run in your own accounts and the tools you already use, so deal data, documents and firm records stay where they already live rather than moving into systems of ours. We take only the access a build requires, and that access ends when the engagement does. Where a build uses an AI tool to read documents or data, we agree which tools, and on what terms, before they process anything confidential.
5. Cookies
This website sets no cookies of its own and runs no advertising or analytics trackers. Your browser requests font files from Google Fonts, which means Google receives your IP address as part of that request.
6. Who else sees it
We rely on a small set of providers to operate: website hosting, Cal.com for scheduling, our email provider, and Google Fonts for typefaces. Each processes data under its own terms. We do not sell or rent personal data, and we do not use your data to train AI models.
We may disclose personal data where the law requires it, or to establish or defend a legal claim.
7. International transfers
We are based in India. If you are in the United Kingdom or Europe, your personal data is transferred outside that region when you deal with us, and some of our providers are based elsewhere again.
India is not currently the subject of a UK or EU adequacy decision, so for such transfers we rely on appropriate safeguards, including standard contractual clauses where they apply. You can ask us for details of the safeguards used.
8. How long we keep it
- Enquiries that do not become engagements — up to 24 months, then deleted.
- Client records — for the engagement and afterwards for as long as accounting, tax and limitation periods require.
- Email marketing contacts — until you unsubscribe.
- Access to your systems — removed when the engagement ends.
9. Your rights
Depending on where you live, including under UK and EU GDPR, India’s Digital Personal Data Protection Act 2023, and laws such as the CCPA in California, you may have rights to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent.
Email noxwhaleautomation@gmail.com and we will respond within one month. There is no charge, and we will not treat you differently for asking.
If you are unhappy with how we have handled a request, you may complain to your data protection authority — the Information Commissioner’s Office in the UK, your national supervisory authority in the EU, or the Data Protection Board of India.
10. Security
We follow least-privilege access practices, use reputable providers, keep access to client systems limited to what a build requires, and remove it when the engagement ends. No method of transmission or storage is completely secure, but we treat your data the way we would want ours treated.
11. Changes and contact
If this policy changes, we will update the date above. Questions or requests: noxwhaleautomation@gmail.com.