← Back to home

Privacy Policy

Last updated: March 6, 2026

1. Data Controller

The data controller for the hosted service at noctambule.pierregallet.com is:

Pierre Gallet
Email: [email protected]
Paris, France

Noctambule is an open-source, self-hosted platform for long-term AI agent memory. This Privacy Policy explains how we collect, use, and protect your information when you use our hosted service. If you self-host Noctambule, your data stays entirely on your own infrastructure and this policy does not apply.

2. Information We Collect

Account Information

When you create an account, we collect your email address and password (hashed, never stored in plaintext). You may optionally provide your first and last name.

Agent Data

We store the memories, conversations, and configuration data you create through your AI agents. This data is necessary to provide the service.

Integration Credentials

If you connect third-party services (GitHub, Slack, Notion, Gmail), we store the necessary API tokens and OAuth credentials, encrypted at rest, to maintain those integrations.

Usage Data

We collect basic server logs (IP addresses, request timestamps, user agents) for security and operational purposes. We do not use third-party analytics or tracking services.

3. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

  • Performance of a contract (Art. 6(1)(b)) — Account data, agent data, and credentials are processed to provide the Service you signed up for.
  • Consent (Art. 6(1)(a)) — Third-party integrations (GitHub, Slack, Gmail, Notion) are only activated when you explicitly connect them. You can withdraw consent at any time by disconnecting the integration in Settings.
  • Legitimate interest (Art. 6(1)(f)) — Server logs are processed for security monitoring, abuse prevention, and service reliability. Our legitimate interest does not override your rights given the limited nature of the data collected.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Data Storage and Security

Your data is stored on servers located in Europe. We use industry-standard security measures including:

  • Encrypted connections (HTTPS/TLS)
  • Hashed passwords (bcrypt)
  • Encrypted credential storage
  • Database access restricted to the application layer

5. Data Retention

  • Account data (email, name, password hash) — retained for the lifetime of your account.
  • Agent data (memories, conversations) — retained until you delete them or delete your account.
  • Integration credentials (API tokens, OAuth tokens) — retained until you disconnect the integration or delete your account.
  • Server logs (IP, timestamps, user agent) — retained for 90 days, then automatically purged.

Upon account deletion, all associated data is permanently removed within 30 days.

6. Your Rights (GDPR Art. 15-22)

Under the General Data Protection Regulation, you have the right to:

  • Access (Art. 15) — obtain a copy of your personal data
  • Rectification (Art. 16) — correct inaccurate personal data
  • Erasure (Art. 17) — request deletion of your data ("right to be forgotten")
  • Restriction (Art. 18) — restrict processing of your data
  • Portability (Art. 20) — export your data in a structured, machine-readable format (via the API)
  • Objection (Art. 21) — object to processing based on legitimate interest
  • Withdraw consent — for third-party integrations, at any time via Settings

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority:
CNIL (Commission Nationale de l'Informatique et des Libertes)
www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

7. Third-Party Services

When you connect integrations, data may be shared with:

  • GitHub (Microsoft, USA) — repository access, issues, pull requests
  • Slack (Salesforce, USA) — message sending and reading
  • Google/Gmail (Google LLC, USA) — email access via OAuth
  • Notion (Notion Labs, USA) — page and database access
  • OpenAI (OpenAI LLC, USA) — LLM API calls for agent responses
  • Anthropic (Anthropic PBC, USA) — LLM API calls for agent responses

Each integration only accesses the scopes you explicitly authorize. You can disconnect any integration at any time from Settings.

8. International Data Transfers

Your account data and agent data are stored on servers located in Europe (France).

However, when you use LLM features or connect third-party integrations, your data may be transferred to the United States. These transfers are necessary to provide the services you requested and are based on:

  • Your explicit consent when connecting an integration
  • Standard Contractual Clauses (SCCs) adopted by the European Commission, which the above providers adhere to in their data processing agreements
  • Necessity for contract performance (Art. 49(1)(b) GDPR) for LLM API calls required to operate your agent

You can avoid international transfers by self-hosting Noctambule and using a local LLM provider.

9. Cookies

We use a single session cookie for authentication. We do not use advertising, analytics, or tracking cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or an in-app notice.

11. Contact

For any questions about this Privacy Policy or to exercise your data protection rights, contact:
Pierre Gallet — [email protected]