Privacy Policy

1. Who we are, and our role

Nobex Technologies Inc is a Delaware corporation in the United States. You can reach us about privacy at support@nobexinc.com.

• We are the controller of personal data about our customers (broadcasters and their team members), visitors to our website, people who contact us, and applicants to our affiliate programme.
• We are a processor (service provider) for the data we handle on behalf of broadcasters about their audiences and contributors: listener analytics, recordings and podcast episodes (including the voices of presenters, guests and callers), and the station’s relationship with its supporters. The broadcaster is the controller of that data and decides what happens to it; our Data Processing Addendum governs how we process it. If you are a listener or took part in a show, please contact the station first; if you cannot reach them, write to us and we will pass your request on.

2. What we collect

• Account data — name, email address, password (stored only as a salted bcrypt hash), country, the timezone your browser reports (used for your station’s schedule and email timing), and any notification contacts you add (such as an alert email, phone number or webhook). For team members, the invitations and roles you set.
• Station data — station name, description, genre, logo, owner photo, website and social links, schedules, playlists, the music and audio files you upload, stream settings and metadata (now playing), and the licence and rights confirmations you give us.
• Billing data — plan, subscription status, invoices, billing country and address, and payment references. Card and bank details are collected and held by our payment processors (Stripe, PayPal, and for older subscriptions Recurly); we never see or store full card numbers. For broadcasters who receive listener payments, Stripe or PayPal also collect the identity and payout details they are required to verify.
• Usage data — the features you use and actions you take in the dashboard and app (for example creating a station, uploading tracks, going live), and the emails we send you and whether they are delivered.
• Technical data — IP address, browser and device details, and log data when you sign in or use the Service; the network details of sign-ins (for account security); and cookies and similar technologies (see section 5).
• Listener data (processed for broadcasters) — when someone listens to a station, we record a listening session with an irreversible keyed hash of the IP address and user agent (not the IP address itself), approximate location (city, region, country) derived from the IP address by a database on our own servers, browser, operating system, player or app, and listening times. Our streaming edge servers keep ordinary access logs, including IP addresses, for a short time (see section 9). Listeners who tip, join a membership or buy access provide an email address and optionally a name, display name and message.
• Recordings and live audio — the audio a broadcaster streams, records or publishes, which may include voices of presenters, guests and callers. Live audio from the mobile app or browser studio is captured only while you are broadcasting.
• Support conversations — messages you send us by email or through the in-product support assistant, and, if you are signed in, a short account snapshot (your stations, plan and on-air status) that lets the assistant answer accurately.
• AI feature inputs — when you use AI Promo Studio, AI ad copy or voiceover, the station details, text, logos and photos you submit to those features, and what they produce.
• Directory and form submissions — details you give when you add or claim a station in the directory, apply to be an affiliate, or contact us, including the IP address the submission came from.

We do not ask for, and ask you not to upload, special-category data (such as health or religious beliefs) other than what naturally occurs in a broadcast you choose to make.

3. Where it comes from

Mostly from you, when you sign up, set up a station or contact us; automatically from your device when you use the Service; from listeners’ players when they tune in; from our payment processors (payment status, not card numbers); and from advertising platforms when you arrive by clicking one of our ads (a click identifier).

4. Why we use it, and our legal bases

The GDPR and UK GDPR require a legal basis for each use. Ours are:

Where we rely on legitimate interests you may object (section 11). Where we rely on consent you may withdraw it at any time, without affecting what was done before. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Cookies, analytics and advertising

We group the cookies and similar technologies on our website into three categories:

• Necessary — keep you signed in, protect forms and checkout, remember your cookie choice (the nobex_consent cookie, 12 months) and remember a discount code or referral you arrived with. These are always on.
• Analytics — Google Analytics 4 and Microsoft Clarity. Clarity records how pages are used (clicks, scrolling, page interactions) so we can fix confusing screens. When you are signed in we tell these tools our internal account id, never your email or name.
• Advertising — the Meta Pixel and Google Ads tag measure whether our ads lead to sign-ups and purchases, and let those platforms show our ads to people likely to be interested.

Server-side events. So that key milestones (signing up, creating a station, subscribing) are counted even when a browser blocks the tags, our servers also report them directly to Meta (the Conversions API) — an advertising use — and to Google Analytics — an analytics use. Each follows the same choice as its category below. Anything sent to Meta that could identify you directly — email, name, country — is hashed before it leaves our systems, alongside your IP address and browser details; Google Analytics receives our internal account id, not your email. We never send payment card details, stream content or listener data to these partners.

Your choice. If you are in the EEA, the UK or Switzerland, nothing in analytics or advertising runs — in your browser or from our servers — until you accept it in our banner, and Google’s tags receive your choice through Google Consent Mode. Everywhere else these tools are on by default and you can turn them off at any time. Either way, you can change your mind whenever you like: open your privacy choices. The same link appears in the footer of every page. Turning a category off stops it for the future; we also clear the cookies those tools set on our domain.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of advertising (“sale” and “sharing”) and switch advertising off for that browser, including the events our servers would otherwise send.

Meta and Google also offer their own controls (Meta’s ad preferences, Google’s My Ad Center), and most browsers let you block third-party cookies. Embedded players on broadcasters’ own websites load no analytics or advertising tags.

6. Who we share it with

• Service providers that host, deliver, bill and support the Service on our behalf — for example Google Cloud, our streaming CDNs, Amazon SES for email, Stripe and PayPal for payments, and our support-chat and AI providers. The full list, with what each receives and where, is on our subprocessors page.
• Analytics and advertising partners (Google, Microsoft, Meta), as described in section 5 and only as your choices allow.
• The public and the broadcaster’s audience — whatever a broadcaster chooses to publish (station pages, directory listings, streams, podcast feeds) is public. A listener’s tip display name and message are shown to the station.
• Our affiliated company Nobex Partners, which runs the Nobex Radio directory and listener apps, for station listings you ask us to publish.
• Rights holders and authorities — when we receive a valid copyright notice we pass it to the affected customer and may share the counter-notice with the complaining party (see our Copyright & DMCA Policy); and where the law requires it, or to protect the rights, safety and property of our customers, the public or Nobex.
• A buyer or successor, if Nobex is involved in a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data for money. Under California and some other US state laws, letting Meta and Google use cookie identifiers and hashed contact details to measure and target our ads can count as “sharing” for cross-context behavioural advertising, or as a “sale”. You can opt out of that at any time through Your privacy choices or with GPC. We do not sell or share personal data of anyone we know to be under 16.

7. Information for California residents

In the past 12 months we have collected the categories of personal information below, for the purposes in section 4, from the sources in section 3. We disclose each category for business purposes to the service providers listed on our subprocessors page.

We use sensitive personal information only to provide the Service and keep accounts secure — purposes for which the law does not give a right to limit — and we do not use it to infer characteristics about you. Retention periods for each category are in section 9.

8. International transfers

Nobex is based in the United States, and the Service is hosted in the United States (Google Cloud, Iowa), with streams delivered through servers around the world. If you are outside the United States, your personal data will be transferred to and processed in the United States, which may not offer the same level of protection as your home country.

Where the GDPR, UK GDPR or Swiss law applies, we protect those transfers with the European Commission’s Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and the Swiss adaptations to them, both between you and us where needed and with our service providers, together with the technical measures described in section 10. You can ask us for a copy of the relevant safeguards at support@nobexinc.com.

9. How long we keep it

10. How we protect it

We use encryption in transit (TLS) for the dashboard, API and streams; encryption at rest for our databases and file storage; hashed passwords; keyed hashes instead of raw IP addresses in listener analytics; least-privilege access for staff, with sign-in required and administrative support access logged; and separate credentials for each station’s streams. No system is perfectly secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

11. Your rights

EEA, UK and Switzerland. You have the right to access your personal data, to have it corrected, to have it erased, to receive it in a portable format, to object to processing based on legitimate interests (including any direct marketing, which is absolute), to restrict processing, and to withdraw consent at any time. You also have the right to complain to a data protection supervisory authority — in the EU, the authority where you live or work; in the UK, the Information Commissioner’s Office; in Switzerland, the FDPIC — though we would appreciate the chance to help first.

California and other US states. You have the right to know what personal information we collect, use and disclose and to get a copy of it; to delete it; to correct it; to opt out of its “sale” or “sharing” (and of targeted advertising); to limit the use of sensitive personal information (which we already only use for permitted purposes); and not to be discriminated against for using any of these rights — using them never changes your price or service. We honour Global Privacy Control as a valid opt-out. If we decline a request, you can appeal by replying to our decision; we will answer within the time the law allows.

Authorised agents. You may use an authorised agent to make a request for you. We will ask for proof of the agent’s authority (for example a signed permission or power of attorney) and may ask you to confirm your identity with us directly.

Verification. To protect you, we verify requests before acting on them — normally by handling them from the signed-in account or by confirming control of the email address on the account. We do not ask for more information than we need, and use what you give us only to verify the request.

12. How to exercise them

• Yourself, instantly: in Account settings you can correct your details, download a copy of your data, and delete your account. You can also delete your account from the Nobex Broadcaster mobile app. Deleting your account deletes your stations, uploads, recordings and listener analytics promptly, except the records we must or may keep as described in section 9. If your account has an active paid subscription, a person on our team confirms the request with you first and completes it within 30 days; nothing changes until then.
• Cookies and advertising: Your privacy choices, available in the footer of every page.
• Marketing email: the unsubscribe link in any marketing email.
• Anything else, or if you cannot sign in: email support@nobexinc.com with the subject “Privacy request”. We respond within one month (GDPR / UK GDPR) or 45 days (California), and tell you if we need to extend that as the law allows.

If you are a listener, guest or caller asking about a station’s recordings or listener data, the station is responsible for your request; contact it directly. If you cannot reach it, write to us and we will forward your request and help the station respond.

13. Children

The Service is not directed to children. You must be at least 18 to create a broadcaster account, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

14. Nobex Broadcaster mobile app

• Microphone — used only while you are broadcasting (“Go Live”), to send your audio to your listeners in real time. It is never accessed at any other time and is not used for advertising or tracking. You can revoke access at any time in your device settings.
• Account — you sign in with your Nobex account; the app uses your email address to authenticate you. You can delete your account from within the app.
• Updates — the app checks for updates through Expo, which receives your device’s IP address and app version. The app contains no advertising or analytics SDKs.

15. Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant we will tell customers by email or in the dashboard before it takes effect.

16. Contact

Nobex Technologies Inc — support@nobexinc.com.