Last updated: March 24, 2026
This Privacy Policy describes how personal information is collected, used, and shared when you use the Nopi website at nopi.me (the "Site"), the Nopi Chrome extension (the "Extension"), the Nopi web dashboard at app.nopi.me (the "Dashboard"), and the review portal (collectively, the "Service").
When you register for an account we collect your email address and password. If you subscribe to a paid plan we also collect billing information through our payment processor, Stripe. We do not store your credit card details directly.
The Nopi Chrome extension collects the following data when you create a feedback pin:
The Extension stores your authentication session locally via chrome.storage.local so you stay signed in across browser restarts. It also stores your analytics consent preference and a "show/hide pins" toggle. If you consent to analytics, the extension records a single install event labeled as source: store. No data is collected when you are simply browsing — data is only captured when you actively create a pin.
Guests who receive a review link can leave feedback without creating an account. They may optionally provide a display name and email address. The same pin data listed above (URL, screenshot, position, viewport metadata, description) is collected when a guest creates a pin.
When you visit the Site, we automatically collect standard device information such as your browser type, IP address, and time zone. We use this for security (rate limiting) and to improve the Service.
Where required by applicable law, we process personal data under one or more of the following legal bases:
We do not sell or rent your personal data. We share data only with the following categories of service providers, solely to operate the Service:
We use cookies and similar technologies only where we have your consent or where strictly necessary for the Service to function.
Tools we use:
You can accept or reject optional cookies (analytics and marketing) when you first visit, or at any time via the Cookie preferences link in the footer or in the Extension/Dashboard settings. Withdrawal of consent will stop future optional tracking; existing browser cookies/storage may persist until deleted through your browser settings.
We do not use analytics or marketing tools to track you without your consent.
Our service providers may process data in countries other than your own. Where required, we apply appropriate safeguards for cross-border transfers, such as contractual protections (including standard contractual clauses where applicable), and we assess transfer risks on a service-by-service basis.
We retain personal data only for as long as needed for the purposes described in this policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.
If you delete your account, we will delete or de-identify your personal data within 30 days, except where retention is required by law or for legitimate security/compliance purposes.
Depending on your location, you may have the right to:
To exercise any of these rights, contact us at hello@nopi.me and include the request type, account email, and relevant scope details (workspace/project/time range where possible). We may request information needed to verify your identity and authority before fulfilling a request. We respond within the timelines required by applicable law, and where an extension is permitted we will notify you accordingly.
Where permitted by law, authorized agents may submit requests on your behalf, subject to proof of authorization and identity verification requirements.
Where local law provides additional rights (for example, specific rights for California residents or other regional laws), we will honor those rights as required.
EEA/UK: You may have rights including access, correction, erasure, portability, restriction, objection, and complaint to your local supervisory authority.
US state privacy laws: Depending on your state, you may have rights to know, access, delete, correct, opt out of certain processing, and appeal refusal decisions. Where required, we provide non-discriminatory treatment for exercising privacy rights.
Other jurisdictions: We will apply rights and disclosure obligations required by applicable local law based on your residency and context of processing.
The Service is intended for business and professional use and is not directed to children. We do not knowingly collect personal data from children where prohibited by law. If you believe a child has provided personal data to us, contact us and we will investigate and take appropriate action.
We implement industry-standard security measures including encrypted connections (HTTPS), hashed and salted passwords, HMAC-signed session tokens, and scoped API access. While no method of transmission over the internet is 100% secure, we take reasonable steps to protect your data.
If we confirm a personal-data incident affecting customer data, we will provide notifications without undue delay as required by applicable law and contractual obligations. Notifications will include, to the extent known at the time, incident scope, likely impact, mitigation actions taken, and recommended next steps where relevant.
We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify registered users of material changes by email or via the Dashboard.
For questions about this Privacy Policy, or to exercise your data rights, please contact us at hello@nopi.me.
Related legal documents: Terms of Service, Data Processing Addendum, Subprocessors, Cookie Notice, and Legal Center.