Privacy notice

Who we are

CorpusKit Cloud is run by Noice Pty Ltd (ABN 91 634 536 360), Melbourne. This notice covers corpuskit.cloud, where you ask for a trial, sign in and manage your account, and the portals Noice hosts on CorpusKit Cloud, at yourname.corpuskit.cloud and at customers' own web addresses.

Documents an organisation loads into its portal are handled on that organisation's behalf, under its agreement with Noice.

What we collect

• When you ask for a trial: your name, work email address and organisation name, the portal address you choose, and that you agreed to us storing these details.
• If you answer "How did you hear about CorpusKit?" on the trial form: the answer you choose from its list, such as a LinkedIn ad or a colleague. The question is optional. We keep the answer with your request's attribution records, for at most 90 days, and count answers in totals to see which channels bring trials. Because you give it on the form, we keep it whichever country you are in and whether or not your browser sends Global Privacy Control or Do Not Track.
• While trials are by invitation: if you ask without an invitation, your email address and organisation name, on a waitlist.
• When you sign in: your email address, when a sign-in link was requested and used, and when you last signed in.
• If your organisation uses single sign-on: your organisation's identity provider tells us your name and email address when you sign in.
• When an owner invites a colleague: the colleague's email address, their name if given, and their role in the portal.
• When you ask a question: the question, the passages found for it and the answer, kept as an answer record for 90 days by default (a portal can set 1 to 365 days) so the portal team can check how answers were produced.
• When you use a portal: your email address and portal role, your sign-in sessions, what you save there, such as investigations and saved sessions, and the portal's audit log of activity.
• If a portal has a feedback button and you use it: your message, what you said it is about, the address of the page you sent it from without anything after it, and your email address if you give one. We keep them with that portal, where its curators and administrators can read them, so that team can reply. Managed portals do not send an operator email copy by default. Your network address is used only to limit how many messages can be sent, and is not kept with them. Please do not include sensitive personal information.
• About your organisation's trial: a record of its steps, such as when it was created, set up, extended or ended, and usage counts (documents, storage, questions a day and members) to apply the trial's limits.
• If you choose a paid plan: your Stripe customer and subscription identifiers, selected plan and payment status. Stripe collects billing details and card information on its own payment pages; CorpusKit does not receive or store card numbers.
• To stop abuse: counts of requests from each email address and network. We store these counts under one-way hashes, not as addresses.
• When you visit a public page of corpuskit.cloud: a count of the visit, with the page, the site you came from, and your browser, device type and country, through Cloudflare Web Analytics. It uses no cookies. LinkedIn also receives details of the visit through its Insight Tag, which uses cookies, to measure our advertising, but not for visitors in the EU, the EEA, the UK or Switzerland.
• When you arrive at a public page from another site or a campaign: the landing page, referring site's host, campaign and ad identifiers, and whether its trial or demo link was followed. If you request a trial, we can connect that visit to the accepted request, verified trial, completed setup and paid subscription. We do not store your full referring URL, its path or query, LinkedIn click identifier, questions or document content in these records. This attribution is disabled in the countries listed above, when the country is unknown, and when your browser sends Global Privacy Control or Do Not Track.

Why we use it

• To create and run your trial, your account and your organisation's portal, and to send you sign-in links.
• To email you about your trial: when your portal is ready, reminders before the trial ends, and when it becomes read-only and when it is deleted.
• To contact you about your trial, as you agreed when you asked for one.
• To read and reply to feedback you send from a portal.
• To protect the service from abuse.
• To see how the public pages are used, in totals.
• To measure our advertising on LinkedIn, except for visitors in the EU, the EEA, the UK or Switzerland.

Noice staff who run the service can see account and trial details, to support you and run the service.

Cookies

corpuskit.cloud uses a sign-in cookie that lasts 7 days and is only sent to corpuskit.cloud itself. Each portal sets its own sign-in cookie. The portals use no analytics or advertising cookies.

Campaign attribution uses a signed reference carried in our trial links and form, valid for 7 days, without a persistent tracking cookie. After email verification creates a new trial, a separate secure, HTTP-only receipt cookie lasts at most 5 minutes and is consumed once on the generic confirmation page. It contains no name or email and prevents repeat visits from being reported as new trial signups.

The public pages of corpuskit.cloud, such as this notice, count visits with Cloudflare Web Analytics, a script from Cloudflare that sets no cookies and stores nothing in your browser. The trial form uses Cloudflare Turnstile to check for automated requests when it is configured. The sign-in and account pages load no scripts from anywhere else.

The public pages also use LinkedIn's Insight Tag, which sets LinkedIn advertising cookies to measure our ad campaigns. The generic confirmation page sends a trial-signup event only after email verification creates a new trial and its one-use receipt is checked. That page contains no name, email, document or payment data. LinkedIn tracking is disabled for visitors in the EU, the EEA, the UK or Switzerland, when the country is unknown, and when the browser signals Global Privacy Control or Do Not Track. The tag may set a cookie on corpuskit.cloud as well as LinkedIn's own. To opt out, change your LinkedIn ad settings, or block or clear cookies in your browser.

Where it is stored

• Account details, sign-in records and the waitlist are in a Cloudflare D1 database created with an Oceania location hint.
• Portal settings, sessions and investigations are held by Cloudflare, set to its Oceania region.
• Your organisation's documents are held in its Progress Agentic RAG knowledge box. Noice creates knowledge boxes in Progress's Australian region (AWS Sydney) by default, and in another region when an organisation asks. During a trial, that box is in Noice's Progress account.
• Email: we send email through Cloudflare, which processes messages to deliver them under its own privacy terms.

Outside Australia

Cloudflare treats the Oceania setting as a preference, so it may store or process account data outside Australia, including in the United States.

LinkedIn, which receives details of visits to the public pages to measure our advertising, is located in the United States and Ireland.

Knowledge boxes Noice creates stay in Progress's Australian region (AWS Sydney) unless an organisation asks for another region. Language models receive document text for summaries and labels, and each question with the passages found for it. Trial portals generate answers through OpenRouter and Together AI in the United States. Progress Agentic RAG may use Azure OpenAI or Google models for some steps unless a portal is set to guaranteed-residency models. Paid portals use the models shown on their Models and regions page. See Security.

Who we share it with

Cloudflare hosts this site, the portals and their data, sends our email, and counts visits to the public pages. Progress holds the documents organisations load. We do not sell your personal information.

Stripe processes paid subscriptions and optional setup payments. We send it the owner's email address, organisation name and an organisation reference. Stripe keeps billing and financial records under its privacy policy. We retain Stripe identifiers and subscription state with the organisation and processed event identifiers for at most 12 months; we do not keep raw payment webhook bodies.

LinkedIn receives details of visits to public pages and verified trial-signup events through its Insight Tag, within the location and browser-preference limits above. We do not send it names, email addresses, questions, documents or payment details through this integration. LinkedIn handles its data under its privacy policy.

We do not currently send your details to a customer relationship management system. If that changes, we will update this notice.

How long we keep it

• Sign-in links work once and expire after 20 minutes. We keep only a one-way hash of each link. A signed-in session on corpuskit.cloud lasts 7 days.
• A trial's documents and knowledge box are deleted about 30 days after the trial starts, or later if the trial is extended, unless the organisation goes ahead.
• Trial, account, sign-in and waitlist records, and the data in a trial portal, are kept while the account is active, and deleted within 12 months after a trial ends, an account closes or a waitlist request was last made, unless the law requires otherwise.
• To limit repeated trials, we keep a one-way, keyed count for an email domain for 365 days after a trial starts, even if its account is deleted sooner. It contains no email address, readable domain or account reference. A deleted counter may remain in database backups for another 30 days.
• Messages sent with a portal's feedback button are kept for up to 90 days, or until the portal is deleted if that is sooner.
• Campaign landing, link and request-attribution records, including any answer to how you heard about CorpusKit, are kept for at most 90 days. Confirmation receipts expire within 5 minutes and are removed after use or during scheduled cleanup. Account and person deletion requests also remove their related attribution records.

You can ask us to delete your details sooner, or to see or correct them, at hello@corpuskit.cloud.

Access, correction and complaints

You can ask for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing hello@corpuskit.cloud.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

For Noice's other services, see Noice's general privacy policy.

Contact

Noice Pty Ltd, ABN 91 634 536 360, Melbourne. hello@corpuskit.cloud