Privacy Policy

Last Updated: September 2026

This Privacy Policy (the "Policy") describes how Niccolite ("Niccolite," "we," "us," or "our") collects, uses, discloses, retains, transfers, and protects personal information when you visit, access, or use the niccolite.net website located at niccolite.net, together with our software-as-a-service platform, applications, application programming interfaces, dashboards, and related features and functionality (collectively, the "Services"). This Policy applies to personal information we process as a "business" under the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.) ("CCPA") and as a "controller" or equivalent regulated entity under other applicable United States state privacy laws.

This Policy is incorporated by reference into, and is subject to, our Terms and Conditions available at site-terms.php, and should be read together with our Cookie Policy available at cookies_terms.php. By accessing or using the Services, submitting information to us, or otherwise engaging with the Services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described in this Policy, you must discontinue use of the Services. Your continued use of the Services after the "Last Updated" date constitutes acceptance of the then-current Policy to the fullest extent permitted by law.

Where Niccolite processes personal information on behalf of a business customer in connection with our provision of the Services, we act as a "service provider" or "processor," and that customer's own privacy notice governs the processing. In such circumstances, this Policy describes our general practices, and any data subject request relating to information processed on behalf of a customer should be directed to that customer in the first instance. We will reasonably assist our customers in fulfilling their legal obligations where required.

1. Information We Collect

We collect personal information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as that term is defined under applicable law. The categories of personal information we collect depend on how you interact with the Services and the nature of your relationship with us, and may include identifiers, commercial information, internet or other electronic network activity information, geolocation data (at the general or city level), professional or employment-related information, inferences drawn from the foregoing, and, where you voluntarily provide it, sensitive personal information.

Information you provide directly. We collect information you submit when you create an account, complete a registration or demo form, subscribe to a plan, configure your workspace, communicate with our support or sales teams, participate in surveys, respond to promotions, or otherwise interact with the Services. This may include your name, business name, email address, postal address, telephone number, job title, employer, billing and payment details, account credentials, support correspondence, and any other content you upload or transmit to the Services.

Information collected automatically. When you access the Services, we and our service providers automatically collect certain technical and usage information, including IP address, device and browser type, operating system, referring and exit pages, pages or screens viewed, features used, clickstream data, session timestamps and duration, approximate location derived from IP address, and unique identifiers such as cookie identifiers, mobile advertising identifiers, and account-level identifiers. We may use session-replay and similar diagnostic technologies in limited circumstances to detect errors, prevent fraud, and improve usability; where required, we provide notice and obtain consent before deploying such technologies.

Information from third parties and business customers. We may receive personal information from third-party sources, including identity and fraud-verification providers, payment processors, marketing and analytics partners, publicly available sources, and business partners. Where you access the Services through an enterprise account administered by your employer or another organization, that organization may provide us with your account details and administrative settings. We do not knowingly collect information from children under 13 except as permitted by the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506 (COPPA) and the COPPA Rule as amended effective June 2025 (16 C.F.R. Part 312, 2025 amendments). To the extent the Services are used in a healthcare, financial, or other regulated context, additional restrictions may apply under the Health Insurance Portability and Accountability Act (HIPAA) where applicable, or the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801-6809 (GLBA) for financial institutions, and applicable business associate or data processing agreements will control.

We do not use or disclose sensitive personal information for purposes of inferring characteristics about you, and we do not use sensitive personal information for any purpose other than those permitted under the CCPA and applicable state laws without providing you the required notice and an opportunity to limit such use where required.

2. How We Use Your Information

We use personal information to provide, operate, maintain, secure, and improve the Services; to create and administer accounts; to authenticate users and enforce access controls; to process payments and manage subscriptions; to deliver customer support; to communicate with you about service updates, security notices, and administrative matters; and to respond to your inquiries and requests. We also use personal information to develop new features, conduct internal research and analytics, measure the performance of the Services, and debug and repair errors.

We may use personal information for marketing and commercial purposes, including sending promotional communications, newsletters, product announcements, and event invitations, and to personalize content and offers. Where required by law, we obtain your prior opt-in consent, or provide a clear and conspicuous opportunity to opt out, before sending marketing communications. You may opt out of marketing emails at any time using the unsubscribe mechanism included in each message; transactional, security, and legal notices may still be sent where necessary.

We use personal information to protect the safety, rights, and property of Niccolite, our users, and third parties; to detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms and Conditions; to verify identity and eligibility; and to comply with legal obligations and enforce our agreements. We also use information to establish, exercise, or defend legal claims and to respond to lawful requests from public authorities.

We may aggregate, de-identify, or anonymize personal information so that it can no longer reasonably be linked to an identifiable individual or household, and use and disclose such data for any lawful purpose, including analytics, benchmarking, product development, and reporting. We will not attempt to re-identify de-identified data except as permitted by law and consistent with our contractual commitments.

3. Information Sharing

We disclose personal information to third parties only as described in this Policy or as otherwise disclosed to you at the time of collection. We share personal information with service providers and contractors that perform functions on our behalf, including hosting and cloud infrastructure providers, payment processors, fraud-prevention and security vendors, analytics providers, customer-support platforms, email and communication providers, and professional advisors. These parties are contractually restricted from using personal information for any purpose other than performing services for us and are required to provide a level of privacy protection consistent with applicable law.

We may disclose personal information to our affiliates, subsidiaries, and joint venture partners for the purposes described in this Policy. We may also disclose personal information to business partners and third-party advertising networks where you have consented or where permitted by law, and such disclosures may constitute a "sale" or "sharing" (including for cross-context behavioral advertising) under the CCPA and analogous state laws. Where we engage in such activity, we provide the required notice and the ability to opt out as described in Section 5.

We may disclose personal information in connection with a corporate transaction or proceeding, such as a merger, acquisition, financing, reorganization, bankruptcy, dissolution, or sale of all or a portion of our assets, including during due diligence. In such circumstances, information may be transferred as a business asset, subject to the commitments in this Policy and applicable law.

We may disclose personal information where we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce our Terms and Conditions; to protect the safety, rights, or property of Niccolite, our users, or the public; to detect, prevent, or address fraud, security, or technical issues; or to respond to an emergency. We do not sell personal information of consumers we know to be under 16 years of age without affirmative authorization, as required by the CCPA, and we do not sell or share personal information in violation of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506 (COPPA).

4. Cookies and Tracking

We and our service providers use cookies, pixels, web beacons, software development kits, local storage, and similar tracking technologies to operate and improve the Services, remember your preferences, authenticate sessions, measure the effectiveness of our content and campaigns, and, where permitted, deliver interest-based advertising. The specific categories of cookies we use, their purposes, and their retention periods are described in our Cookie Policy at cookies_terms.php, which is incorporated into this Policy by reference.

Under the California Consumer Privacy Act as amended by the CPRA, certain uses of cookies and tracking technologies that disclose personal information to third parties for cross-context behavioral advertising may constitute a "sale" or "sharing." Accordingly, we honor the Global Privacy Control ("GPC") signal as a valid request to opt out of the sale and sharing of personal information for eligible browsers and devices, consistent with Cal. Civ. Code § 1798.120 and § 1798.135. Where required, we also provide a clear "Do Not Sell or Share My Personal Information" link on our website and within the Services.

We may use third-party advertising networks, analytics providers, and social media platforms that collect information across websites and applications over time. Where we participate in interest-based advertising programs, we comply with applicable self-regulatory frameworks, including the Digital Advertising Alliance ("DAA") principles and the DAA AdChoices program, and we honor opt-out preferences submitted through the DAA's industry opt-out tools where applicable. Certain state laws, including the California Invasion of Privacy Act (Cal. Penal Code § 631), and the Electronic Communications Privacy Act, 18 U.S.C. § 2511 (which has limited application to our activities), may also inform how we deploy interception- and recording-based technologies; we do not use such technologies to intercept the contents of communications without appropriate notice and consent.

Most browsers permit you to refuse or delete cookies through their settings. Blocking or deleting cookies may impair the functionality of the Services, and some features may not operate as intended. Where required by law, we obtain consent before setting non-essential cookies and provide you with a mechanism to withdraw consent or update your preferences at any time through our cookie preference center referenced in the Cookie Policy.

5. Your Rights and Choices

Depending on your state of residence, you may have certain rights regarding your personal information. Under the CCPA, California residents have the right to know the categories and specific pieces of personal information we have collected, the categories of sources, our business or commercial purposes for collecting, selling, or sharing, and the categories of third parties to whom we disclose personal information; the right to request deletion of personal information, subject to statutory exceptions; the right to request correction of inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right to be free from discrimination for exercising these rights. Similar rights are available to residents of Virginia under the Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.), Colorado under the Colorado Privacy Act (C.R.S. § 6-1-1300 et seq.), Connecticut under the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.), Utah under the Utah Consumer Privacy Act (Utah Code § 13-11-101 et seq.), and under other state comprehensive privacy laws, including those enacted in Texas, Oregon, Montana, Florida, Tennessee, and additional states as they become effective.

To exercise your rights, submit a request to [email protected] or by telephone at +17377050387. We will acknowledge receipt and verify your identity before processing your request, using information already in our possession or by requesting additional information necessary to confirm your identity. You may designate an authorized agent to submit a request on your behalf where permitted by law; we may require written permission and verification of your identity. Where you submit a request through an authorized agent, we may deny the request if the agent cannot provide proof of authorization.

We will respond to verifiable consumer requests within 45 days of receipt, and may extend this period by an additional 45 days where reasonably necessary, in which case we will notify you of the extension and the reason for it. There is no charge for processing a request unless it is excessive, repetitive, or manifestly unfounded, in which case we may charge a reasonable fee or decline to act, and we will explain our decision. If we deny a request, we will provide an explanation and instructions for how to appeal where an appeal right is provided by applicable law.

You may opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly. You may also disable certain tracking through your browser settings or your device's advertising identifier settings, and you may submit opt-out preference signals such as the GPC, which we will honor as described in Section 4. We do not offer financial incentives in exchange for personal information unless we provide a specific, legally compliant notice describing the material terms of the incentive, and we obtain your prior opt-in consent where required.

Where a request relates to personal information we process solely on behalf of a business customer as a service provider or processor, we will forward the request to the relevant customer and reasonably assist with fulfillment. We do not discriminate against you for exercising any right protected by applicable law, including by denying goods or services, charging different prices, or providing a different level or quality of goods or services, except as permitted by statute.

6. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, destruction, or loss. These safeguards include encryption in transit and at rest where appropriate, role-based access controls, authentication requirements, network and endpoint security monitoring, vendor due diligence, secure development practices, and incident response procedures. We review and update our safeguards periodically in light of evolving risks and industry practices.

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, to comply with our legal, tax, accounting, and reporting obligations, to resolve disputes, to enforce our agreements, and to protect our legitimate business interests. Retention periods vary based on the type of information, the nature of our relationship with you, and applicable legal requirements. When information is no longer necessary, we delete, de-identify, or aggregate it in accordance with our retention schedule and applicable law.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly of any suspected unauthorized access to your account. Where required by applicable law, we will notify affected individuals and relevant authorities of a security incident without unreasonable delay.

To the maximum extent permitted by applicable law, and except as expressly provided in our Terms and Conditions, the Services and our security measures are provided on an "as is" and "as available" basis without warranties of any kind, whether express, implied, or statutory. Nothing in this Policy limits any right or remedy that cannot lawfully be waived, including rights under applicable state data breach notification statutes.

7. International Data Transfers

Niccolite is based in the United States, and the Services are hosted on infrastructure located primarily in the United States. If you access the Services from outside the United States, you understand that your personal information will be transferred to, stored in, and processed in the United States and potentially in other jurisdictions where we or our service providers operate. The data protection laws in those jurisdictions may differ from, and may be less protective than, those in your country of residence.

Where we transfer personal information from jurisdictions with transfer restrictions, we implement appropriate safeguards, which may include standard contractual clauses, data processing agreements, adequacy determinations, or other lawful transfer mechanisms recognized under applicable law. We conduct transfer impact assessments where required and implement supplementary technical and organizational measures as appropriate.

By using the Services and providing personal information to us, you consent to the transfer of your personal information to the United States and other jurisdictions as described in this Policy, to the extent such consent is a lawful basis for transfer. Where consent is not a valid transfer mechanism or is withdrawn, we will rely on other lawful transfer mechanisms.

We take reasonable steps to ensure that personal information transferred internationally remains protected in accordance with this Policy and applicable law, and we require our service providers to implement commensurate protections through contractual commitments.

8. Children's Privacy

The Services are not directed to children under the age of 13 (or such other minimum age as may apply in your jurisdiction), and we do not knowingly collect, use, or disclose personal information from children under 13 except as permitted by law. We comply with the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506 (COPPA) and the COPPA Rule as amended effective June 2025 (16 C.F.R. Part 312, 2025 amendments). We do not condition participation in any activity on the disclosure of more personal information than is reasonably necessary.

If we become aware that we have collected personal information from a child under 13 without verifiable parental consent as required by COPPA, we will take reasonable steps to delete that information promptly. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at [email protected] so that we can investigate and take appropriate action.

For users between the ages of 13 and 16, we do not sell or share personal information without affirmative authorization as required by the CCPA and applicable state laws. Where the Services are made available to educational institutions, we may process student information as a service provider or processor under an applicable agreement and consistent with COPPA and applicable state student privacy laws.

If you are under the age of majority in your jurisdiction, you should use the Services only with the involvement and consent of a parent or legal guardian.

9. Changes to Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where required by applicable law or where the changes are material, provide additional notice, such as by posting a prominent notice on the Services or sending an email to the address associated with your account.

Your continued use of the Services after the effective date of any revised Policy constitutes your acceptance of the revised Policy to the fullest extent permitted by law. If you do not agree to a revised Policy, you must stop using the Services and may request deletion of your account in accordance with Section 5.

Where a change involves a new use or disclosure of previously collected personal information that requires notice or consent under applicable law, we will provide such notice and, where required, obtain your prior consent before implementing the change. We will not materially reduce your rights under this Policy without providing you advance notice consistent with applicable law.

Limitation of liability. To the maximum extent permitted by applicable law, and without limiting any non-waivable statutory rights, our aggregate liability arising out of or relating to this Policy or our handling of personal information is limited in accordance with the limitations and exclusions set forth in our Terms and Conditions at site-terms.php. This Policy does not create any obligation beyond those imposed by applicable law or by our contractual commitments, and nothing herein constitutes a waiver of any defense available to Niccolite under the Federal Trade Commission Act § 5, 15 U.S.C. § 45 (FTC Act — unfair or deceptive practices), the Uniform Commercial Code (UCC) Article 2 as adopted by the states, the Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (ROSCA), or other applicable law.

10. Contact Information

If you have questions, concerns, or complaints about this Policy, or if you wish to exercise any of the rights described in Section 5, please contact us using the information below. We will review and respond to your inquiry in accordance with applicable law.

• Company: Niccolite
• Email: [email protected]
• Telephone: +17377050387
• Mailing Address: 1 Market Street, San Francisco, CA 94105, United States

Please include sufficient detail in your communication to allow us to understand and respond to your request, including your name, contact information, the nature of your request, and, where applicable, the state or jurisdiction in which you reside. We may need to verify your identity before processing a request, and we will use the information you provide solely for that purpose and to respond to your inquiry.

If you are a California resident and are not satisfied with our response, you may contact the California Privacy Protection Agency or the California Attorney General. Residents of other states may contact their state attorney general or the applicable supervisory authority in their jurisdiction. We encourage you to contact us first so that we can attempt to resolve your concern directly.

For information about our use of cookies and tracking technologies, please review our Cookie Policy at cookies_terms.php. For the terms governing your use of the Services, please review our Terms and Conditions at site-terms.php.