Privacy Policy

Last updated: May 25, 2026  •  Effective: May 25, 2026

1. Introduction

Welcome to Nosè ("we", "our", or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, process, and protect your information when you use the Nosè mobile application, services, and website (collectively, the "Services").

Because our core service relies on human verification of suspicious messages and potential scams, we have implemented rigorous, privacy-first technologies—such as automatic Personal Identifiable Information (PII) redaction—to ensure that your identity and sensitive details remain completely anonymous to our Trusted Node network.

2. Information We Collect

We only collect the data strictly necessary to provide our scam detection and verification services:

• Account Information: If you register for an account, we collect your name, email address, and encrypted password.
• Submitted Content for Verification: When you submit a screenshot, text message, or audio clip for scam verification, we process this content. Crucially, before this content is seen by any human (Trusted Node), our AI automatically redacts phone numbers, names, addresses, banking details, and other PII.
• Usage Data: We collect anonymized diagnostic data, device information (e.g., OS version, app version), and basic interaction logs to improve app performance and stability.

3. How We Process and Share Data

Human Verification via Trusted Nodes

When our AI fallback cannot confidently determine if a message is a scam, the content is routed to up to 3 randomly selected human experts (Trusted Nodes). To protect your privacy:

• All submissions are stripped of PII via automated on-device and server-side redaction before transmission.
• Trusted Nodes operate under strict Non-Disclosure Agreements (NDAs) and are cryptographically prevented from viewing the identity of the submitter.
• Trusted Nodes only receive the isolated, redacted context necessary to evaluate the scam pattern.

Third-Party Service Providers

We do not sell, rent, or trade your personal data to third parties. We only share minimal data with trusted cloud infrastructure providers (e.g., secure hosting) who are legally bound by stringent data processing agreements compliant with GDPR and UU PDP.

4. Data Retention

We practice data minimization:

• Verification Content: Screenshots and messages submitted for verification are permanently deleted from our active servers within 30 days after the verification is completed, unless retained in a fully anonymized format for training our AI threat models.
• Account Data: Retained as long as your account is active. If you delete your account, your personal data is erased within 14 days.

5. Your Privacy Rights

Under the GDPR, PDPA, and UU PDP, you hold the following rights regarding your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data directly through the Nosè app settings.
• Right to Restrict Processing: You can ask us to pause processing your data under certain conditions.
• Right to Data Portability: You can request to receive your data in a structured, commonly used format.

To exercise any of these rights, please contact our Data Protection Officer at nose.initiative@gmail.com.

6. Security Measures

We implement state-of-the-art technical and organizational security measures, including end-to-end encryption for data in transit, AES-256 encryption for data at rest, and zero-trust architecture principles to protect your information against unauthorized access, loss, or alteration.

7. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or our service features. We will notify you of any material changes via an in-app notification or email prior to the changes taking effect.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

• Email: nose.initiative@gmail.com
• Address: Nosè Initiative, Surabaya, East Java, Indonesia