Nook Privacy Policy Draft

Status and roles

This is an engineering data map, not an approved privacy notice. The contracting entity, contact point, legal bases, jurisdictions, transfer mechanisms, controller/processor allocations, and statutory retention duties require qualified review.

The Portal is expected to act as controller for customer-account, commercial, licensing, security, and support-contact records. Nook Cloud role allocation depends on the final service and DPA. A self-host customer controls content and local member data inside its own deployment.

Self-hosted boundary

• Messages, files, local member directories, local sessions, and local credentials do not flow to the Portal for licensing.
• The Portal stores account, organization, billing, agreement, entitlement, deployment-binding, download, support-consent, notification, and sanitized audit metadata needed for those purposes.
• Connected telemetry is not required for licensing. Any future telemetry must be opt-in, documented, data-minimized, and revocable.
• Air-gapped deployments require no outbound telemetry or online Portal connection at runtime.
• Support receives metadata only unless the customer creates an explicit scoped, expiring, revocable support grant; that grant does not create impersonation or local membership.

Rights and retention gate

Access, correction, deletion, portability, objection, restriction, complaint, and authorized-agent handling require a verified request workflow and jurisdiction-specific review. The engineering inventory identifies candidate records and actual technical TTLs; it does not promise deletion where no production erasure worker exists.

Security audit records currently carry a 90-day deletion timestamp. Short-lived sessions, challenges, enrollment capabilities, activation codes, and notification jobs have bounded expiries. Commercial records, agreements, entitlement history, and legal holds need an approved schedule before launch.