Privacy Policy

1. Introduction & Overview

NoctisID ("we", "us", or "our") operates a centralized Identity-as-a-Service (IDaaS) and OAuth 2.0 / OpenID Connect Broker platform running on secure, high-availability distributed cloud infrastructure. This Privacy Policy describes how we collect, store, proxy, and protect user personal data when users authenticate on connected downstream client websites ("Spoke Sites") using social identity providers (such as Google, Apple, Meta, Microsoft, and GitHub).

2. Role as Identity Broker

NoctisID acts as an authorized authentication proxy between upstream identity providers and authorized downstream websites. When you choose to authenticate via a third-party social provider:

• We receive your verified email address, unique vendor subject identifier (UID), full name, and avatar URL from the chosen social platform.
• We store a secure, encrypted copy of your authentication record in our encrypted multi-region database cluster to enable single-sign-on (SSO) and account recovery across connected sites.
• We issue a short-lived (60-second), single-use cryptographic authorization ticket back to the specific Spoke Site from which you initiated the login request.

3. Data Retention & OAuth Profiles

To maintain security audits and facilitate downstream synchronization, we retain:

• Identity Records: Social provider names, permanent provider UIDs, verified email addresses, profile display names, and profile photo links.
• Security & Audit Telemetry: IP address, Request Trace ID, country of origin, and user-agent strings for fraud prevention, rate-limiting, and brute-force mitigation.

4. Data Sharing & Webhook Relays

We do not sell, rent, or monetize your personal data. Personal data is transmitted exclusively to the authorized Spoke Site where you initiated the login session, via encrypted back-channel TLS REST calls and HMAC-SHA256 signed webhook events.

5. GDPR, UK Data Protection & CCPA Rights

Users in the European Economic Area (EEA), United Kingdom, and California enjoy rights including access, rectification, portability, and deletion of their identity profiles. To request permanent deletion of your social identity from our central registry, email privacy@noctisid.com.