Privacy Policy

This Privacy Policy is issued by HamptonTCI Limited, a company incorporated in Hong Kong (registered address: Mezzanine Floor, Sun House, 90 Connaught Road Central, Sheung Wan, Hong Kong), trading as Nocrai.

Nocrai provides digital financial diagnostic tools for business owners. References to “we”, “us”, and “our” in this policy mean HamptonTCI Limited.

This policy explains how we collect, use, and protect personal data in connection with the Nocrai website (nocrai.com), our digital products, and our affiliate programme.

We share your personal data only as strictly necessary:

• Lemon Squeezy — payment processing and licence management for digital product purchases. Lemon Squeezy is US-based and acts as Merchant of Record and independent data controller for payment data.
• HubSpot — CRM for affiliate and partner application records, onboarding, and relationship management. HubSpot acts as a data processor under a Data Processing Agreement including EU Standard Contractual Clauses. HubSpot is US-based.
• DocuSign — electronic agreement execution for affiliate and partner agreements. DocuSign is US-based.
• Cloudflare — website hosting and content delivery. Cloudflare is US-based.
• Service providers — other trusted third parties (such as email delivery and IT support) who are contractually bound to protect your data.
• Legal compliance — where required by law, court order, or regulatory authority.
• Business transfers — in the event of a merger, acquisition, or transfer of our business.

We do not sell, rent, or trade your personal information.

HubSpot, Lemon Squeezy, DocuSign, and Cloudflare are all US-based. When we transfer data from regions with strict data protection laws (including the EEA, UK, Hong Kong, Australia, and Canada) to the US, we rely on appropriate safeguards including Standard Contractual Clauses.

By using our website, purchasing our products, or participating in our affiliate programme, you acknowledge that your data may be transferred to and processed in the United States.

• Product purchase records — retained for 7 years from the date of transaction in accordance with Hong Kong accounting and tax requirements.
• Affiliate and partner records — retained for the duration of the agreement and for 7 years following termination, in accordance with contractual limitation periods.
• Agreement execution records (DocuSign) — retained for 7 years following execution.
• Sanctions and PEP screening records — retained for as long as required by applicable anti-money laundering regulations.
• Email enquiries — retained for up to 12 months after last contact.

Regardless of your location, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request deletion of your data, subject to legal exceptions (including our obligation to retain records under applicable law).
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format (where applicable).
• Object — object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@hamptontci.com. We will respond within 30 days.

Cloudflare may set strictly necessary functional cookies to ensure the website delivers correctly and securely. These cookies do not collect personal information for marketing or tracking purposes and do not require consent.

When you proceed to purchase a Nocrai product via Lemon Squeezy, Lemon Squeezy may set its own cookies on their payment interface in accordance with their privacy policy. This occurs on Lemon Squeezy’s platform, not on nocrai.com.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies on nocrai.com.

We implement industry-standard technical and organisational measures to protect your personal information against unauthorised access, alteration, or loss.

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and notify affected individuals without undue delay where the breach is likely to result in a high risk.

We may update this policy periodically. The “Last Updated” date at the top indicates when changes were made. If we make material changes, we will notify affected individuals by email where we hold your email address, or by a notice on our website.