Privacy Policy

Version of 5 November 2026

In brief

  • Your webcam images never leave your computer. Nobamouse processes them locally; we do not receive them.
  • We process what is needed for your account, subscription, payment, invoicing and support, nothing more.
  • Detailed usage analytics are off by default; you switch them on if you wish and can withdraw your consent at any time.
  • No advertising, no selling of data, no tracking cookies.
  • Your data is hosted in the European Union (OVH, France); payments go through Mollie B.V..
  • You can access, correct, delete or object to the processing of your data: privacy@nobatech.eu. You can also complain to the CNIL.
  • If you use Nobamouse through your employer or institution, they are responsible for your account data; we act on their behalf.

The controller is NOBATECH SAS (“NOBATECH”, “we”), 95 rue des Joncs, 57455 Seingbouse, France. We have not appointed a data protection officer (the criteria of Article 37 GDPR are not met). For any question or request about your data: privacy@nobatech.eu.

This Policy covers the website nobamouse.eu (and nobatech.eu), the Nobamouse account and subscription, the desktop application for Windows and macOS, support, our communications and our relationships with business customers and partners. Short notices at the point of collection are in the Privacy Notices the contract is described in the Terms of Sale and Use.

If your Seat is assigned to you by your employer, institution or school, that organisation is the controller of your account, Seat, licence, device and support ticket data; we process it on its behalf under the Data Processing Agreement (Article 28 GDPR). Address your requests to the organisation first; we forward those we receive. We remain the controller for the other processing described here (relationship with the customer organisation, invoicing, security of our services).

The table below summarises each use: the data concerned, the legal reason and the retention period. At the end of the stated period, the data is deleted or anonymised.

Why Which data Legal basis How long
Account and subscription: create your account, manage the subscription, devices, withdrawal, cancellation and refund, send you contractual confirmations and notifications Name, e-mail, country of residence, password (hashed), security settings, subscription status and history, activated devices, withdrawal and cancellation history Contract (Art. 6(1)(b) GDPR) Term of the contract, then up to 5 years as evidence (limitation period)
Payment: collect instalments via Mollie B.V. Mollie B.V. customer, mandate and transaction identifiers, payment method type and masked data returned by Mollie B.V., billing address. We never receive your full card number. Contract As above; transaction identifiers: 10 years (accounting)
Invoicing, accounting and VAT: issue your invoices, keep our accounts, declare VAT under the One-Stop-Shop (OSS) Invoice data (name, address, country, amounts, VAT, number and date), payment references, VAT location evidence (billing country, IP address country, payment method country) Legal obligation (Art. 6(1)(c) GDPR; Art. L123-22 French Commercial Code; Art. 63c Implementing Regulation (EU) No 282/2011) 10 years
The desktop application: activate and check your licence, keep the application stable Webcam images: processed on your device only, never transmitted. Transmitted: account and licence data for activation, technical diagnostics (crash reports, technical events). Detailed usage analytics (navigation, features used) only if you switch them on Contract (activation, diagnostics); consent for detailed analytics (Art. 6(1)(a) GDPR; Art. 82 French Data Protection Act) Diagnostics and telemetry: about 2 months, then anonymisation
Security and abuse prevention: protect our services, your accounts and our infrastructure, detect fraud Login logs (IP address, browser), security and administrator audit logs, approximate location (city) derived from the IP Legitimate interest: security of our services Login logs: 1 month; approximate location: 3 years; audit logs: 2 years; then anonymisation
Support: answer your requests and fix problems Account data, ticket content, language, history of exchanges, diagnostics you attach Contract Until account closure; timestamps: 3 years; diagnostics: about 2 months
Public reports and community features (where they exist): collect and discuss feedback Pseudonym, avatar, reports, comments, votes. Sensitive information you choose to post is visible to other users; avoid it Contract; for sensitive data you make public: Art. 9(2)(e) GDPR Comments: de-identified at account closure, anonymised after 1 year; votes and logs: 90 days
Website and contact form: run the site, answer your messages Form data (name, e-mail, phone, message); strictly necessary cookies and local storage (details in the Website Terms of Use) Legitimate interest: answering your request; strictly necessary cookies: no consent needed (Art. 82 French Data Protection Act) Contact e-mails: 6 months; cookies: session; local storage: until cleared
Audience measurement on the website: understand how the site is used and whether it leads to sign-ups Page viewed, referrer, approximate country, browser and device type, custom events (e.g. sign-up, checkout). No cookie, no cross-site tracking, no individual profile; IP address is not stored. Self-hosted tool on our own infrastructure (OVH, France) Legitimate interest (Art. 6(1)(f) GDPR); exempt from consent under the CNIL audience-measurement exemption (Art. 82 French Data Protection Act) Aggregated statistics: 25 months; raw events: 90 days
Free-trial check: make sure the free trial is used only once per person An encrypted, non-reversible identifier (keyed hash) derived from the card fingerprint or PayPal payer ID provided by Mollie B.V., and from your e-mail address. No card number, no readable e-mail. Used only to compare with future subscriptions Legitimate interest (Art. 6(1)(f) GDPR): preventing abuse of the free trial. You may object; we may keep the identifier where this interest prevails 3 years from creation, including after deletion of your account; then deleted automatically
Newsletter and waiting list: keep you informed of news E-mail, first name, last name Consent (Art. 6(1)(a) GDPR) Until you unsubscribe
Business customers, prospects, partners and suppliers: manage contracts, quotes, orders and relationships Name, role, business contact details, SIRET / VAT number, purchase order number, Chorus Pro service code, correspondence Contract (customers); legitimate interest: developing and managing our business relationships End of the relationship + 2 years
Social media: communicate about Nobamouse and engage with the community Public interactions, messages, images or videos (with your agreement if you are identifiable) Legitimate interest: communication; consent for identifiable images Media content: up to 10 years (image rights); interactions: per platform

What is mandatory. Account, payment and invoicing data are needed to conclude and perform the contract: without them we cannot provide Nobamouse. Everything else (detailed analytics, newsletter, feedback, community) is optional.

Legitimate interests. Where we rely on our legitimate interest, it is: the security of our services and abuse prevention; answering your requests; managing our business relationships; our public communication. You may object at any time on grounds relating to your situation (Section 7).

No automated decisions. We take no decision based solely on automated processing that produces legal or similarly significant effects on you, and we do no profiling.

Sensitive data. We do not collect it deliberately. If you mention some in a free-text field (ticket, feedback), it is processed with the rest of your request; avoid sharing it unless necessary.

This table reflects our record of processing activities (Article 30 GDPR).

We do not sell your data. Only the following have access, as needed:

  • our team, to operate and improve the services;
  • our processors, bound by contract: OVH SAS (2 rue Kellermann, 59100 Roubaix, France) for hosting in the European Union, under a data processing agreement; the transactional e-mail provider (NOBATECH SAS's own mail server, hosted on its own infrastructure at OVH (France); no external e-mail service provider); the support ticketing tool (NOBATECH SAS's own ticketing system, hosted on its own infrastructure at OVH (France));
  • Mollie B.V. (the Netherlands), our payment provider, which processes your payment data to execute payments and manage the recurring mandate; Mollie B.V. is not the seller. Under its terms it acts partly as an independent controller (regulatory obligations: fraud and money-laundering prevention) and partly on our behalf: mollie.com/privacy.
  • authorities and our advisers where the law requires it or to defend our rights (tax administration, accountant, lawyers, consumer mediator);
  • third-party platforms (social media) when you choose to interact with us there; they are then responsible for their own processing.

Transfers outside the European Union. Our services and main processors are in the EU. Only social media platforms (YouTube/Alphabet, Instagram/Meta, LinkedIn, Discord, Reddit) may process data in the United States; they rely on an adequacy decision (EU–US Data Privacy Framework for certified providers) or on standard contractual clauses. Any transfers made by Mollie B.V. are described in its privacy statement.

We protect your data with appropriate technical and organisational measures: encryption in transit (TLS) and at rest, role-based access control, strong authentication and logging of administrator access, backups, access limited to those who need it. In the event of a breach posing a risk to you, we inform you in accordance with Article 34 GDPR.

Only an adult may take out the subscription. A holder of parental authority may subscribe for a minor and allow them to use Nobamouse (Terms of Sale and Use). In that case the parent is the customer: account, payment and invoicing data are theirs; the minor’s application usage data (settings, calibration profiles, diagnostics) is processed within the same limits as for any user, and camera images stay local. Detailed analytics (opt-in) may be switched on for a minor under 15 only with the parent’s agreement (Article 45 of the French Data Protection Act; 16 for German residents, Article 8 GDPR). The minor may exercise their rights themselves, depending on their maturity, or through their parent. We do not knowingly collect minors’ data for other purposes and delete any received without authorisation.

You may at any time: access your data and obtain a copy; have it rectified; have it erased; restrict its processing; receive it in a portable format (portability); object to processing based on our legitimate interest; withdraw your consent (detailed analytics, newsletter) without affecting past processing; give instructions on what happens to your data after your death.

Write to privacy@nobatech.eu or to NOBATECH SAS, 95 rue des Joncs, 57455 Seingbouse, France. We reply within one month, extendable by two months for complex requests; we may ask you to prove your identity. Detailed analytics can also be switched off directly in the application Settings, the newsletter via the unsubscribe link.

You may lodge a complaint with the supervisory authority of your country of residence, place of work or place of the alleged infringement. In France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.

We may update this Policy for legal, technical or operational reasons; the current version is published on nobamouse.eu with its date, and we inform you of significant changes through the services.

Privacy: privacy@nobatech.eu
Support: support@nobamouse.eu
Billing: billing@nobamouse.eu
Security (vulnerabilities): security@nobatech.eu
nobamouse.eu/legal.

Take control

Download