Privacy Policy

Noliser provides booking software for boat charter businesses. It is operated by Inumbra Labs (Brahim Ouasti EI), an individual entrepreneur (entrepreneur individuel) registered in France under SIREN 538 543 034 ("Noliser", "we", "us"). For anything about privacy, email hello@noliser.com.

2.1 We are the controller of personal data about: people who use Noliser to run a business (owners, managers, crew and other team members); visitors to noliser.com; people who contact us; and contacts at charter businesses we may offer Noliser to.

2.2 For people who book with a charter business through Noliser ("Customers"), the charter business is the controller, and we process their data on its behalf under our Data Processing Terms. The business's own privacy notice applies. If you booked a charter, contact the business first; we will help it respond.

2.3 We are also a controller of a limited set of data about Customers that we use for our own purposes: keeping Noliser secure, preventing fraud and abuse, and meeting our legal obligations.

We do not make decisions with legal or similarly significant effects based solely on automated processing. Our bot checks and rate limits are automated security measures; if one blocks you by mistake, contact us.

• Service providers listed in section 6, under contracts that limit them to processing on our instructions.
• Stripe, which processes payments for charter businesses, collects our fee on them and issues our invoices. For identity checks, fraud prevention and its own legal obligations, Stripe acts as an independent controller under its privacy policy.
• Google, if you choose Sign in with Google. Google acts as an independent controller under its privacy policy.
• The charter business you book with, if you are a Customer, and a business's team members, within the permissions the business sets.
• Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
• Authorities, courts and others where the law requires it, or where needed to protect rights, property or safety.
• A buyer or successor, if all or part of our business is sold, merged or reorganised, subject to this policy.

We do not sell personal data, and we do not share it for advertising.

We update this list, and tell account owners at least 7 days in advance, before a new provider starts processing Customer data, except for urgent changes needed to keep Noliser running or secure.

We are established in France. Some of our providers process personal data outside the European Economic Area (EEA). Where the country has no adequacy decision, we use the European Commission's standard contractual clauses or rely on the provider's certification under the EU–US Data Privacy Framework. Our staff may also access personal data remotely from outside the EEA, under this policy. You can ask us for a copy of the relevant safeguards.

Who this section is for. People who apply to Noliser's referral partner program, approved partners, and people whose business a partner invites to Noliser.

What we collect.

• Applicants: name, company, country, city, email, phone, profile or website, partner type, how many operators they know and how, the earnings estimates they entered, and the date they accepted this policy.
• Partners: the above, plus the result of the identity check (full name, date of birth, document type, issuing country and expiry; the ID images and the face comparison stay with our provider Didit, which deletes them after 30 days and also uses pseudonymised verification data for its own security and fraud prevention, as its Verification Privacy Notice explains), legal name and form, address, registration number, VAT status and number, and for individuals their date and place of birth; tax residence certificates and, for partners in France, URSSAF attestations; bank details, which are stored encrypted; the records of their signature of the partner agreement (typed name, drawn signature, email code check, time stamp, IP address and device); their referral links, invitations, statements and dashboard activity.
• Invited businesses: the business name, contact name, email, country and website the partner gives us, and the information we import from that website.

Why, and on what legal basis.

• To review applications, at the applicant's request before a contract (Article 6(1)(b) GDPR).
• To run the partner agreement, attribute operators, calculate commissions, issue statements and pay partners (Article 6(1)(b)).
• To meet our legal obligations: invoicing, tax declarations and withholding, and checks on French contractors (Article 6(1)(c)).
• To send an invitation a partner asked us to send, and to prepare the invited business's start on Noliser (our legitimate interest in responding to that introduction, Article 6(1)(f)); the partner confirms the business agreed to be invited.
• To verify a partner's identity before they sign: the ID document check is part of the partner agreement (Article 6(1)(b)); the comparison of a live photo with the document photo uses biometric data, which we process only with the partner's explicit consent, asked before the check (Article 9(2)(a)). Without this consent, the identity check can't be completed, so the application can't go further.
• To keep the program secure and prevent fraud (Article 6(1)(f)).

Who receives it. Our hosting, database, email and bot-protection providers, our identity-verification provider Didit, acting on our instructions (except for the pseudonymised data Didit uses for its own security and fraud prevention, described above); the time-stamping authority, which receives only a fingerprint of the signed agreement, never its content; our bank, for payments; the tax authorities, where the law requires it. Referred operators see the partner's name; partners see the information about referred operators described in our Terms.

How long we keep it.

• Applications that are not approved: 12 months after the decision.
• Invitations not accepted: deleted, with any imported information, 7 days after they were sent.
• Statements, signature records, and the tax and bank details used for payments: 10 years from the end of the year they relate to, as French accounting law requires.
• Other partner data: until the end of the partner agreement, then 5 years.

Your rights, and how to exercise them, are described in the rest of this policy.

10.1 Depending on where you live, you can ask to access, correct, delete, restrict or receive a copy of your personal data, object to how we use it, and withdraw consent at any time without affecting earlier processing. You can always object to direct marketing. You can also give instructions on what happens to your personal data after your death.

10.2 Email hello@noliser.com. We respond within one month, extended where the law allows, and may need to verify your identity.

10.3 If you are a Customer of a charter business, send requests to that business. If you contact us, we will pass your request to it.

10.4 You can complain to a data protection authority. Ours is the French CNIL (cnil.fr); you can also contact the authority where you live or work, or in the UK the Information Commissioner's Office.

10.5 If you live in California or another US state with a privacy law, you can exercise the rights above. We do not sell or share personal information for cross-context behavioural advertising, do not use sensitive personal information to infer characteristics about you, and will not treat you differently for exercising your rights.

Every table in our database has row-level security, so each business can read only its own data. Data is encrypted in transit and at rest. Staff access to Customer data is masked by default, limited to need and logged. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires. Our Security page has more detail.

Noliser accounts are for adults acting for a business. Customers' bookings may include children as guests; their details are provided by the person booking or by the charter business and handled under the business's privacy notice. We do not knowingly collect personal data directly from children.

When this policy changes, we update the date at the top. We email account owners about material changes before they take effect.

Inumbra Labs (Brahim Ouasti EI), trading as Noliser, France. SIREN 538 543 034. Email: hello@noliser.com.