Privacy Policy

1. Information We Collect

1.1 Licence Validation (All Products)

When you activate or validate your licence, the following is sent to our server (hosted on Cloudflare Workers):

• Your License Key, which we check against our own licence records
• A hashed device identifier (used for device binding and enforcement)

We receive from Stripe:

• The payment and order references, the product and the amount
• For the older monthly subscriptions, the subscription status, renewal dates and whether cancellation is pending
• Whether a payment is refunded, disputed or reported as fraudulent or unauthorised

In connection with your purchase we also hold: your purchase email address and a mapping between that address and your licence, held on our infrastructure (Cloudflare) and processed by our email provider for licence delivery and service notices.

We receive and store the email address you use at purchase. It is provided to us by Stripe from the details you enter at checkout, and is used to deliver your License Key, to send you service and licence notices (including any notice of changes to our terms or of discontinuation under our Terms of Service), and to help prevent fraud and abuse. We do not receive your full card number; all payment processing is handled solely by Stripe. For refunds, payment disputes and fraud prevention we may access, through Stripe, the name, email address and billing address you gave at purchase and the card brand, last four digits and country of issue of the card used.

1.2 Device Identification (NobleAIM and Noble Remote)

To enforce the one-device limit, the Software generates a hardware identifier (HWID) derived from your Machine GUID, computer name, and CPU brand. This identifier is hashed using SHA-256 before transmission and is non-reversible. It is sent to our server during licence validation for device binding. Noble Remote uses its own device identifier, a SHA-256 hash of your Machine GUID (or, if Windows does not provide one, your computer name), in the same way, and both apps’ identifiers are kept on the same list of devices for your licence.

1.3 Application Telemetry (NobleAIM)

During licence validation, the Software also sends:

• Application name and version
• Whether the check is made at start-up, periodically while the app runs, on activation or on a retry, and the time on your device
• Session duration (time since last validation)
• Whether your PC has a TPM 2.0 chip available

We use this to run and improve the Service, to see how often and for how long each licence is used (including as evidence if a payment is disputed, Section 3.1), and to detect misuse of licences (legitimate interests).

1.4 Integrity Events (NobleAIM and Noble Remote)

The Software includes a protection layer that detects tampering, debugging, reverse engineering, or unauthorised modification. As part of these checks, the Software may inspect the names and command-line parameters of other processes running on your device in order to detect debuggers, reverse-engineering tools, automated agents, and AI Tools as defined in the EULA (for example the Claude desktop application, Claude Code or OpenAI Codex).

The Software also checks whether it is running on a physical Windows PC or in a Virtualised Environment as defined in the EULA. To do this it reads a small number of characteristics of the machine itself: the system firmware manufacturer, product and version strings that your computer reports (the same values Windows shows in System Information), the processor’s hypervisor-presence flag and vendor identifier, and the model strings of enumerated disk devices. These describe the machine rather than you, but we treat them as personal data because they are linked to your licence, and no file, document or personal content is read in order to obtain them.

The Software also checks whether the Windows programming interfaces it is running on are provided by Windows itself or by a compatibility or translation layer such as Wine or Proton. To do this it reads whether the Windows system library exposes the compatibility layer’s version functions and, if so, the layer’s version and the host operating system name and version that they report, whether the compatibility layer’s registry keys and environment variables are present, and the address at which that system library is loaded. These describe the software environment rather than you, but we treat them as personal data because they are linked to your licence, and no file, document or personal content is read in order to obtain them.

Where a process has already been positively identified as one of these prohibited AI Tools, the Software additionally reads the values of a small, fixed, name-based allowlist of that process’s non-secret environment variables (a limited set of model and endpoint settings) so that we can recognise which AI model or service the tool has been configured to use. This additional read is performed only against a process already identified as a prohibited tool, never as a general or background scan of other processes, and it reads from the running process’s memory, not from any file. Environment variables whose names denote secrets, such as API keys, authentication tokens, or passwords, are not on the allowlist, and their values are never retained or transmitted. From an endpoint setting the Software derives and keeps only a short provider label (for example a Kimi, GLM, DeepSeek, Qwen, OpenAI, Anthropic, Gemini, local, or custom-host label); the scheme, the path, and any credentials contained in the value are stripped and discarded before anything is recorded. From a model setting the Software keeps only the sanitised model name.

To identify which tool is running and its recent sessions in the integrity report, and for our review of that report, the Software may also read limited metadata that the AI Tool records on your device in its own session-index or history files, namely the names, identifiers and working-directory paths of its recent sessions, and the number of any further sessions. It does not open or read your project files, your source code, or the contents of your conversations with the tool. Some AI tools name each session after what it is about, so a session name can show the subject of a conversation. Before a report is sent, your Windows username in any file path it contains is replaced with a placeholder (from NobleAIM 2.2.612 and Noble Remote 1.6.24; earlier versions send the path as it is).

For a process already identified as a prohibited AI Tool, the Software also reads where that tool’s program file is stored on your device and keeps only the type of installation this shows, such as a code-editor extension (for example in Visual Studio Code, Cursor, Visual Studio or a JetBrains editor), the Codex or Claude desktop application, a Microsoft Store app or a command-line installation (for example npm or Python), never the folder path itself. It also reads the names of up to three programs that started the tool (for example Code.exe, powershell.exe or explorer.exe) and their start times; the start times are used only to make sure the right program is named and are not sent.

Where such a tool is detected, the Software also reads the titles of that tool’s own windows and of the terminal and code-editor windows open on your device (for example Windows Terminal, PowerShell or Visual Studio Code), including the titles of their tabs. A title can include the name of a file, folder or session.

When such an event is detected, the Software sends an integrity report to our server containing:

• Your License Key, and the name and version of the app
• Your HWID (hashed)
• The type of integrity violation detected, and the name or identifier of the detected tool or process
• Where the detected tool is a prohibited AI Tool, the short provider label or sanitised model name derived from the environment settings described above
• Where the detected tool is a prohibited AI Tool, the names, identifiers and working-directory paths of its recent sessions read from that tool’s session metadata, and the number of any further sessions, as described above
• Where the detected tool is a prohibited AI Tool, the type of installation it runs from and the names of the programs that started it, as described above
• Where the detected tool is a prohibited AI Tool, the window and tab titles described above
• Where an environment check is performed, the firmware manufacturer, product and version strings, the hypervisor-presence flag and vendor identifier, the enumerated disk model strings, and the resulting environment classification
• Where a compatibility-layer check is performed, the name and version of the compatibility layer, the host operating system name and version that it reports, and which of the checks described above matched
• Your IP address
• A timestamp

We store each report with the email address and Discord account linked to your licence and the country associated with your IP address. Noble Remote runs checks of the same kinds and sends integrity reports of the same kinds, including, for a detected AI Tool, the session details, installation type, starting programs and window titles described above.

These checks inspect process names, command-line parameters, the limited environment-variable allowlist, the session metadata, program-file locations and starting programs described above, the window and tab titles, and the machine and software-environment characteristics described above; the environment data is read from a running process’s memory and not from any file, and these checks do not record, keep or send the contents of your personal files, your documents, your source code, or your conversations with the tool. Integrity events are processed on the basis of our legitimate interests in protecting the Software from unauthorised modification, preventing fraud, and enforcing our licensing terms.

When the Software checks in with our server, we also look at the network the connection comes from, to recognise when the Software is being run on a computer rented from a cloud computing or cloud gaming service, which the EULA treats as a Virtualised Environment. To do this we use the network operator to which your IP address belongs (its network number and name) and the approximate location associated with that address, both as reported by our hosting provider, Cloudflare, for that connection. Nothing additional is read from your device for this check. Where the network belongs to such a service, we keep a record of it against your licence: the network operator, the approximate location, the app and version, your IP address, your HWID and the time; otherwise this check keeps no separate record. This check is processed on the same legitimate-interests basis as the integrity events above.

1.5 Marketplace Data (Noble Trainer)

• Display name (derived from your username at activation)
• Models and content you upload to the Marketplace (files and metadata)
• Interaction data such as download counts and likes

1.6 Data Stored Locally on Your Device (All Products)

The following data is stored locally on your device. It is not sent to our servers, except as described at the end of this section and in Section 1.7:

• (a) License File: Stores your License Key locally.
• (b) Log Files: Diagnostic logs that may contain file paths, hardware information (GPU name, driver version), window titles, process names, and error messages. File paths may include your Windows username.
• (c) Crash Logs: Written locally if the software crashes.
• (d) Configuration Files: Your settings, profiles, and preferences.
• (e) Captured Frames (Noble Remote): Frames captured from gameplay windows are written to local shared memory only. They are not sent to any server.

Your log files are uploaded to us only if you choose to send them. If we ask for your logs, the Software shows a request with Send logs and Not now, and you can also send them yourself from the app. When you send logs we asked for, the Software also tells us the name of your computer, which we keep with the request for 14 days. We use your logs to answer your support request (legitimate interests).

Noble Remote start-up report: each time Noble Remote starts, it sends us a short technical report with its device identifier, its version, the time, details of your Windows version, language and display settings, your graphics cards and security software, and whether Noble Remote is running as administrator, and a description of how its window was drawn on screen. We use it to find and fix display faults (legitimate interests).

If you contact us for support and share files yourself, they may contain the information described above.

1.7 Update Checks (All Products)

Products periodically check for updates by requesting a version file from our servers. These requests contain standard HTTP headers (User-Agent, IP address) but no personal data beyond what is inherent in any HTTP request.

If an update fails, the Software sends our server a report: your License Key, your HWID (hashed), the app version and the version it was updating to, the step that failed, the error, which updater was used and when the attempt started, and the last part of the update log, which can include file paths and so your Windows username. We add the email address and status of your licence, your IP address and the country Cloudflare associates with it. We use the report to find and fix update faults (legitimate interests).

1.8 Server Logs

Our servers keep a record of each request: its time, the address requested, the response, the IP address it came from and the approximate location Cloudflare associates with it, the details your app or browser sends with it, and the messages our software writes while handling it, which can include your email address, your HWID or a shortened form of your License Key. We do NOT log authorisation headers or full request bodies. Cloudflare also keeps its own logs. Section 6 says how long each is kept.

1.9 Third-Party Console Account Integrations (Noble Remote)

Noble Remote includes two optional capture modes that connect directly to a console platform. Neither mode is required to use Noble Remote, and neither sends any account material to Noble.

(a) Xbox Direct (Microsoft account)

If you select Xbox Direct, Noble Remote opens your default browser to Microsoft’s hosted login at login.live.com. You enter your Microsoft account credentials directly on Microsoft’s page; Noble never sees your username or password. Upon successful login, Microsoft returns OAuth material to a local-only listener within Noble Remote. From this, the Software retains:

• a long-lived refresh token, encrypted at rest using Windows DPAPI (per-user, per-machine, non-portable) in your profile under %APPDATA%\NobleRemote\;
• short-lived access tokens, XSTS user tokens, and an Xbox session token, held in process memory only and never written to disk;
• a locally generated device identifier (UUID) stored in your profile.

Streaming traffic and authentication flow directly between your PC and Microsoft’s public Xbox Live endpoints. Noble does not receive or proxy this traffic.

(b) PS5 Direct (PlayStation Remote Play)

PS5 Direct uses a two-step setup. You will be asked to sign in to your PlayStation Network account on Sony’s hosted login page at auth.api.sonyentertainmentnetwork.com. The page is rendered inside Microsoft Edge WebView2 (or your system browser as a fallback) and is sandboxed. Noble does not intercept, read, or have scripted access to the credentials you enter. Noble only observes the redirect URL Sony returns once authentication succeeds.

Following sign-in:

• The Software exchanges Sony’s redirect auth code for a short-lived OAuth access token using the public Remote Play client identifier (not a Noble secret). The token is used once to query Sony for your numeric account identifier and is then discarded; it is never written to disk.
• Only your numeric PSN account identifier (an 8-byte stable user ID) is retained, stored unencrypted in your profile INI under %APPDATA%\NobleRemote\.

Once your account identifier is known, you read an 8-digit pairing PIN off your console’s Settings screen and Noble Remote completes the LAN handshake with your PS5. The console returns per-device pairing keys (regist_key, morning_key) which are stored unencrypted in the same profile INI alongside the account identifier and console IP. These pairing materials function similarly to a Wi-Fi pre-shared key.

During streaming, communication is peer-to-peer between your PC and your PS5 over your local network using the public Remote Play protocol. The Software does not call any PlayStation Network cloud endpoints while a streaming session is active.

(c) No transmission to Noble

None of the credentials, tokens, account identifiers, or pairing material described above is transmitted to or stored on Noble servers.

(d) Removal

You can sign out of Xbox Direct or unpair from a PS5 at any time from within Noble Remote. Doing so deletes the corresponding stored material from your local profile.

1.10 Support, Refund and Dispute Communications (All Products)

If you contact us for support, ask for a refund, or a payment dispute or chargeback is raised on your purchase, we process the information you or your payment provider give us for that purpose: your name and email address, your Discord username and the messages you send us, your License Key and order details, and any log files or screenshots you choose to share. We use this to respond to you, to investigate and answer the dispute, and to prevent fraud and abuse (contract performance and legitimate interests).

Messages posted in our Discord server may also be retained by us, separately from Discord’s own storage, for moderation and as evidence in disputes about purchases or account actions.

1.11 Referral Rewards (NobleAIM)

If you take part in our referral scheme as a Member or a Friend (Section 16 of the Terms of Service), we record who referred whom (both Discord accounts), the dates, the Friend’s qualifying purchase (including its email address and licence key), the device identifiers seen on both accounts while the referral is open, the outcome, and the Noble Credit each of you earns and spends. To check a referral is genuine, we compare the device identifiers and email addresses we hold for both accounts, check whether the Friend’s email address or card has paid us before, and check whether the card is one the Member has paid with. For the card checks, our payment processor, Stripe, gives us a code that identifies the card without revealing its number and finds the earlier payments made with it; we do not keep the code. We keep a record of the devices used by either person in a rewarded referral, so that none of them can be the Friend’s device in another referral. We do this to run the scheme (contract performance) and to prevent fraud (legitimate interests), and we keep these records while the scheme runs and, after it closes, until all Noble Credit from it has been used or has expired and any refund, dispute or fraud report on a qualifying payment has been dealt with.

Whether or not you take part, when you buy 30 days or more of NobleAIM we keep a note of that purchase (its date, type, amount, payment references, licence key and email address) for 120 days, so that a referral named afterwards can count it (legitimate interests). If such a payment is refunded, disputed or reported as fraud before a referral counts it, we keep a note of that for 400 days so that it cannot count later, and we keep a note of which referral a qualifying payment counted for, for 400 days, so that one payment counts only once.

1.12 Our Website (nobleaim.co.uk)

When you visit our website, your browser sends our website host, and the content delivery network it uses, the information that every web request carries, such as your IP address, your browser type and the page you asked for. Our host keeps this in its server logs to deliver the pages and keep the site secure (legitimate interests). Videos on the site are delivered from our own storage on Cloudflare (Section 3.2). Purchases take place on Stripe’s checkout pages, where Section 3.1 applies.

Our pages load their fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.

Our website does not use analytics or advertising cookies, and we do not use any tool that records or replays your visits.

1.13 Protected Models and Config Store Items (NobleAIM)

Downloading our protected models and loading Config Store items needs a PC with TPM 2.0, a security chip built into most modern PCs. The first time you use them on a PC, the Software creates a key inside that PC’s TPM and sends us its public part, with the TPM’s proof that it holds the key, so that we can lock protected content to that PC. We keep, against your account: that PC’s device identifier, a fingerprint (hash) of your License Key, the public key and its fingerprint, fingerprints of the TPM’s attestation key and of its proof, a fingerprint of the TPM’s endorsement key (which identifies the TPM chip itself), the TPM’s manufacturer, version, firmware version and platform type, and the dates. Each time you download a protected model we record the model, the PC, your account, a fingerprint of your License Key, your IP address and the status of your licence. For the Config Store we keep what you buy or claim (the item, the time, the payment references and amount, and any free pass), the PC each item is locked to and which items you have loaded. When the Software validates your licence it also tells us whether your PC has a TPM available, which we keep against that PC with the country of the connection. We use this to deliver what you are entitled to only on your own PC and to prevent sharing and fraud (contract performance and legitimate interests).

1.14 Profile Exports (NobleAIM)

When you export a profile to a file, the Software first asks our server for a signed tag, which it writes into the file. We keep a record of each export: your License Key, your HWID (hashed), the name you gave the profile, a fingerprint (hash) of its contents (not the contents), the time, the app version, and your IP address and country. The tag lets the Software check that a shared profile has not been changed, and lets us tell which licence exported it if a profile is passed on or misused (legitimate interests).

1.15 Remote Setup Sessions (NobleAIM)

We set up NobleAIM in a remote session for Remote App Setup (Section 2.16A of the Terms of Service) and as part of Premium Support, and our setup and configuration specialist (Section 3.9) sometimes does the same for the Setup Service (Section 2.16). For a session, you install RustDesk, a remote-desktop app, and give the connection details it shows to the person running your session, so that they can connect. While connected, they see your screen and control your PC to install and set up NobleAIM, so they can see anything open on your screen, your PC’s hardware and settings, and your License Key if it is entered during the session. Please close anything you do not want them to see before the session starts. Sessions are not recorded. For Remote App Setup, we record on your order when your session finished, as proof that we provided the service. We use this information to provide the service you bought and to answer any refund request or payment dispute about it (contract performance and legitimate interests). RustDesk connects the two PCs under its own privacy policy (Section 3.10).

2. How We Use Your Information

We use the information collected to:

• Validate your licence and enforce licensing terms (contract performance);
• Enforce device limits (contract performance);
• Detect tampering, debugging, or unauthorised modification of the Software (legitimate interest);
• Operate the Marketplace and provide the Service (contract performance);
• Provide update notifications (legitimate interest);
• Analyse application usage, version distribution, and session data to improve the Service (legitimate interest);
• Deliver your License Key and send service and licence notices to your purchase email address (contract performance, and our legitimate interest in communicating about the Service);
• Respond to support requests and handle refunds, payment disputes and chargebacks (contract performance, and our legitimate interest in resolving disputes);
• Prevent fraud, abuse, and unauthorised access (legitimate interest);
• Comply with legal obligations (legal obligation).

2.1 Legal Basis for Processing (UK GDPR)

• Contract Performance (Article 6(1)(b)): Processing necessary to provide the Service, including licence validation, session management, device activation, Marketplace operation, and update delivery.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for fraud prevention, abuse detection, service improvement, and security, and sending service and licence notices, including notices of changes or discontinuation, and using the purchase email address to help prevent fraud and abuse. We have assessed that these interests do not override your fundamental rights. You have the right to object to processing based on legitimate interests (see Section 7).
• Legal Obligation (Article 6(1)(c)): Processing necessary to comply with applicable laws and regulations.

2.2 Automated Decisions

Some decisions about your access are made automatically by our licence systems, without a person being involved at the time: (a) suspending access after an automated check under Section 4.5 of the EULA; (b) suspending or ending access, and refusing further purchases, when a payment made through your account is charged back, reversed, reported as fraudulent or unauthorised, or queried with your payment provider (Section 3.6 of the Terms of Service); and (c) refusing a purchase or activation linked to an account, payment details, device or Discord identity whose access has been ended. These decisions use your licence, device, payment and Discord records, and they can stop the Software from running and end licences you have paid for. We tell you by email when one of them is made. You can ask for a person at Noble to review it, give us your view and contest it by emailing support@nobleaim.co.uk; Section 4.5 of the EULA and Section 3.6 of the Terms of Service describe the review.

3. Third-Party Services

The Service relies on the following third-party providers:

3.1 Stripe (stripe.com)

• Purpose: payment processing, refunds, payment disputes and fraud prevention, and the older monthly subscriptions
• Data shared: the details of your order, including your Discord user ID where you buy through our Discord community or the app, your PC’s device identifier when you buy a Config Store item, the Discord username you type when you buy Remote App Setup or Premium Support without a linked Discord account, for example from a link we send you, your License Key on the older monthly subscriptions, and, if a payment is disputed, the purchase, delivery, activation, device, IP-address and usage records and the messages relevant to the dispute, which Stripe passes to the card issuer or payment provider deciding it
• Data received: payment, order and subscription details, whether a payment is refunded, disputed or reported as fraudulent, and, for refunds, payment disputes and fraud prevention, the name, email address and billing address you gave at purchase and the card brand, last four digits and country of issue of the card used
• Privacy policy: https://www.stripe.com/privacy

3.2 Cloudflare (cloudflare.com)

• Purpose: Hosts our APIs (Workers), databases (D1, KV), and file storage (R2)
• Data processed: the information described in Section 1 that is sent to or kept on our servers, including your License Key, purchase email address, Discord user ID, HWID (hashed), TPM key records, integrity events, application data, referral and Noble Credit records, and standard HTTP metadata
• Privacy policy: https://www.cloudflare.com/privacypolicy/

3.3 Microsoft (microsoft.com), applies if you use Xbox Direct

• Purpose: Microsoft account authentication and Xbox Cloud Gaming streaming
• Data flow: credentials are entered directly on Microsoft’s hosted login pages and are never seen by Noble. OAuth tokens issued by Microsoft are stored locally on your device only (see Section 1.9). Streaming traffic flows directly between Microsoft’s edge servers and your PC.
• Microsoft privacy statement: https://privacy.microsoft.com/privacystatement

3.4 Sony Interactive Entertainment (playstation.com), applies if you use PS5 Direct

• Purpose: one-time PlayStation Network account authentication (to retrieve your numeric account identifier) and PS5 Remote Play console pairing
• Data flow: credentials are entered directly on Sony’s hosted login page and are never seen by Noble. A short-lived OAuth access token issued by Sony is used once and immediately discarded, never written to disk. Only the resulting numeric account identifier and per-device pairing keys are stored locally on your device (see Section 1.9). Pairing and streaming occur directly between Noble Remote and your PS5 over your local network.
• Sony privacy policy: https://www.playstation.com/legal/privacy-policy/

3.5 Resend (resend.com)

• Purpose: delivery of transactional email, including your License Key and service or licence notices
• Data shared: your purchase email address and the content of the message (for example your License Key or a notice)
• Privacy policy: https://resend.com/legal/privacy-policy

3.6 AI-Assisted Tools: Anthropic (anthropic.com) and OpenAI (openai.com)

• Purpose: AI-assisted tools (Claude and Codex) that help us operate the Service, for example drafting replies to support requests, reviewing purchase, licence and dispute records, and investigating suspected fraud or abuse
• Data shared: information described in Sections 1.1, 1.4 and 1.10 that is relevant to the task, which may include your name, email address, Discord username, License Key, order details, and the content of messages and files you send us
• Training and retention: we have opted out of model training with both providers, so the information is not used to train their models, except content that a provider’s systems flag for safety review under its terms. Each provider retains the information for the period stated in its terms
• Decisions: AI tools do not make decisions about you. A person at Noble decides refunds and any review under Section 4.5 of the EULA or Section 3.6 of the Terms of Service. Some decisions about your access are made automatically by our licence systems, as described in Section 2.2
• Tools on our own equipment: we may also use AI tools that run entirely on our own computers; these do not share your data with anyone
• Privacy policies: https://www.anthropic.com/legal/privacy and https://openai.com/policies/privacy-policy

3.7 Discord (discord.com)

• Purpose: our community, support tickets, linking your licence to your Discord account, and private channels in our Discord server where our systems post notices for our own use
• Data shared: your Discord user ID and the roles, membership status and moderation actions, including bans and their reasons, that apply to your account. If your access is ended, we give your Discord account a role in our community that marks it as banned, which other members can see. A suspension does not get this role, and we take the role off if your access is restored. Our private channels also receive notices about activations, purchases (including orders paid with Noble Credit), finished Remote App Setup sessions, free passes, referrals, payment problems, licence checks and integrity events, and our monthly payment records. Depending on the notice, these can include your Discord names, the name and email address you gave at checkout, your License Key, the product and price, your country, the IP address used, your device identifier, the details of an integrity report (Section 1.4) and how long your licence’s app has run each week. Discord stores these messages until we delete them (Section 6).
• Who can see the private channels: only us, except that our community moderators can see notices of Remote App Setup and Premium Support purchases (your Discord account and the amount, and your name, email address and keys), notices of finished Remote App Setup sessions and the private tickets for both, and our setup and configuration specialist can see the notices described in Section 3.9
• Privacy policy: https://discord.com/privacy

3.8 Email: 20i (20i.com) and Microsoft (outlook.com)

• Purpose: receiving and answering the emails you send to support@nobleaim.co.uk, including replies to emails we send you. 20i hosts the email for our nobleaim.co.uk domain and forwards each of these emails to our Microsoft Outlook.com mailbox, where we read them and reply to you
• Data processed: your email address and your name as they appear in your email, the content of your email and any attachments, and the technical details that every email carries (its headers)
• Privacy policies: https://www.20i.com/legal/20i-ltd-privacy-policy and https://privacy.microsoft.com/privacystatement

3.9 Our Setup and Configuration Specialist

• Who: a specialist who works with us, but is not our employee, provides the Setup Service (Section 2.16 of the Terms of Service) and helps members with Config Store items
• Data shared: when you buy the Setup Service or a Config Store item, our sales notice, which the specialist can see, shows your Discord account (username, display name and user ID), the item and amount, the name and email address you gave at checkout and your earlier Config Store purchases (the items, prices, dates and any refunds). When you claim a free pass from the Config Store, the notice shows your Discord account, the name the app shows for you, the item and the start of your PC’s device identifier. If you buy the Setup Service, the specialist can also see your private setup ticket and, if they set up NobleAIM for you in a remote session, what Section 1.15 describes. To help members with configs, the specialist can look up the Config Store items any member holds and has bought, with dates, prices and refunds
• Purpose: providing the Setup Service and Config Store support for us. The specialist uses this information only for that purpose and on our instructions, under a written agreement with us

3.10 RustDesk (rustdesk.com), applies if you have a remote setup session

• Purpose: the remote-desktop app you install so that we, or our setup and configuration specialist, can connect to your PC for a remote setup session (Section 1.15)
• Data flow: RustDesk’s servers put your PC in touch with the PC of the person running your session and, when a direct connection is not possible, relay the session between them. RustDesk says sessions are encrypted end to end, including when they are relayed. Under its own privacy policy, RustDesk (Purslane Tech Pte. Ltd., Singapore) collects the IP address and basic details (such as the processor and screen resolution) of each computer, the RustDesk IDs, and the time and length of each session
• Privacy policy: https://rustdesk.com/privacy

Where a provider listed above processes personal data for us, we remain responsible for that processing as UK data protection law requires. Where a provider uses personal data for its own purposes (for example Stripe for payments, or Microsoft or Sony for your console account), its own privacy policy applies to that use.

4. International Data Transfers

The Service is hosted on Cloudflare’s global infrastructure. Your data may be processed and stored in any country where Cloudflare operates, which may include countries outside the United Kingdom or European Economic Area. Cloudflare maintains appropriate safeguards for international transfers as described in their privacy policy.

Some of the other providers listed in Section 3 are based in, or process data in, the United States, including Stripe, Resend, Discord, Microsoft, Anthropic and OpenAI. Where data leaves the United Kingdom we rely, for each provider, on UK adequacy regulations (for the European Economic Area, and for US companies certified under the UK Extension to the EU-US Data Privacy Framework) or, where neither applies, on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in that provider’s terms. You can ask us which of these applies to a provider, and for a copy of it, by emailing support@nobleaim.co.uk.

5. Data Security

We implement commercially reasonable technical and organisational measures to protect your information, including:

• License Keys are transmitted over HTTPS (TLS encryption in transit)
• The device identifiers described in Section 1.2 are SHA-256 hashed before transmission (non-reversible)
• Sensitive credentials stored locally (such as the Xbox Direct OAuth refresh token in Noble Remote) are encrypted at rest using platform mechanisms such as Windows DPAPI. Other configuration data, profiles, and the PS5 pairing keys are stored in plaintext on your machine. These are device-pairing secrets equivalent to a Wi-Fi PSK, not user credentials.
• The Software uses certificate pinning to prevent man-in-the-middle attacks
• Session data expires automatically

However, no method of electronic storage or transmission is completely secure. We do not warrant or guarantee the absolute security of your data. You are solely responsible for maintaining the confidentiality of your License Key.

6. Data Retention

Server-Side:

• Device identifiers (HWID): Retained while you hold an active licence (a Subscription, a Fixed-Term Pass, or a Lifetime Licence) and for up to 12 months after your last successful licence validation, after which the identifier is deleted, EXCEPT that where an identifier is associated with a licence that has been revoked or ended, or a device that has been banned, for breach or under Section 3.6 of the Terms of Service (reversed or charged-back payments), we retain it (in a minimised, ban-enforcement form) for as long as necessary to keep that revocation or ban effective. Deactivating a device ends its session but keeps it on your licence’s device list, because a licence can be moved to at most two different devices before a device reset is needed (Section 3.3 of the Terms of Service); a device reset removes the devices from that list.
• IP addresses and countries on your licence record (the IP address of the first activation, the IP addresses of the last five check-ins with the device that made each, and the countries of up to ten recent check-ins): kept and deleted on the same terms as the device identifiers above
• Purchase email address, the name you gave at checkout, and the email-to-licence mapping: Retained while you hold any active licence and for 18 months after your last licence ends, to handle refunds, service notices and disputes, and, where an address is associated with fraud, abuse, a ban or a reversed or charged-back payment, for as long as necessary to prevent its recurrence or to keep a ban or a refusal of further purchases effective; otherwise deleted or anonymised on a verified erasure request (Section 7).
• Integrity events (including the cloud-service network records described in Section 1.4): Retained for up to 200 days, or longer where an event is relied on for a suspension, revocation, ban or dispute, for as long as needed to keep that action effective or to establish or defend a legal claim
• Update-failure reports (Section 1.7): 90 days. A copy without the update-log extract, with your License Key shortened, is kept in our request archive for up to 200 days
• Subscription details from Stripe (older monthly subscriptions): kept with your licence record and deleted with it
• Server logs: Cloudflare’s own logs are retained per Cloudflare’s defaults (up to 7 days for Workers logs, typically up to 30 days for other services). We also keep our own archive of requests made to our servers, including the IP address each request comes from and the approximate location Cloudflare associates with it, for up to 200 days, to investigate faults, misuse and payment disputes, or longer where a record is needed for a dispute, chargeback or legal claim
• Notices in our private Discord channels (Section 3.7): notices of activations, purchases, finished Remote App Setup sessions, free passes, referrals and weekly use, and other routine notices, are deleted after 2 years, and our monthly payment records after 6 years; notices of payment problems, licence checks and integrity events are kept for as long as they may be needed to keep a suspension, a ban or a refusal of further purchases effective, or to establish or defend a legal claim
• Marketplace data (Noble Trainer): Retained until you delete it or request deletion
• Support, refund and dispute communications (Section 1.10): Retained for as long as needed to resolve the matter and, where a payment dispute or chargeback is raised, for as long as necessary to establish or defend a legal claim
• Copies held by AI tool providers (Section 3.6): Retained by the provider for the period stated in its terms
• Purchase and dispute evidence (records of your purchases, the consent you gave at checkout, the delivery of your licence key or of a Remote App Setup session, activations and use, and any review of your account): kept while you hold a licence and for 18 months after your last payment or the end of your licence, whichever is later, so that we can answer payment disputes and legal claims
• Payment records we need for our accounts and tax returns: kept for six years from the end of the financial year they relate to, as the law requires (legal obligation)

Local (on your device):

• License file: Retained until you deactivate or delete it
• Log files: kept on your device until newer logs replace them
• Crash logs, configuration files: Retained until you delete them manually
• Xbox Direct refresh token (DPAPI-encrypted, Noble Remote): Retained until you sign out from Noble Remote or revoke access via Microsoft’s account dashboard
• PS5 Direct pairing keys (Noble Remote): Retained until you unpair the console from within Noble Remote

We may retain certain data for longer periods where required by law, to resolve disputes, or to enforce our agreements.

7. Your Rights and Choices

You may:

• (a) Deactivate your device using the option within the software.
• (b) Delete local data (license files, logs, configuration) at any time.
• (c) Delete Marketplace content (Noble Trainer) through the software.
• (d) Contact us to request details of any data we hold, or to request deletion. On a verified erasure request we will delete the data we hold about you, except where we still need it to enforce licences, prevent fraud, keep a ban or revocation effective, comply with a legal obligation, or establish or defend a legal claim; where an exception applies we will tell you and will delete the data once it no longer does.

Under UK data protection law you have the following rights, wherever you live:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests

To exercise these rights, contact us using the details in Section 10. We will respond within one month of receiving your request and anything we need to confirm your identity. If we need you to clarify your request, that time pauses until you reply. For complex or numerous requests we may extend it by up to two further months, and we will tell you why within the first month. We may verify your identity before processing any request. You can complain to us about how we use your personal data by emailing support@nobleaim.co.uk with “Data protection complaint” in the subject line. We will acknowledge your complaint within 30 days of receiving it, look into it, and tell you the outcome. You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commission (formerly the Information Commissioner’s Office, ICO): Website: https://ico.org.uk Telephone: 0303 123 1113

8. Children’s Data

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that a person under 18 has bought or used the Service, we may end their access. We keep the records we need for the purchase, any refund, chargeback or dispute, and any legal claim, and delete the rest when we no longer need it.

9. Changes to This Policy

We may update this Policy by publishing a revised version on our website or within the Service. Where a change means we will use your personal data for a new purpose, we will tell you before we start.

10. Contact

For privacy concerns or data requests, contact:

Noble Software Limited (registered in England and Wales, company number 17035870) Registered office: 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom Website: nobleaim.co.uk Email: support@nobleaim.co.uk