Privacy Policy

This Privacy Policy is issued by HamptonTCI Limited, a company incorporated in Hong Kong (registered address: Mezzanine Floor, Sun House, 90 Connaught Road Central, Sheung Wan, Hong Kong), trading as Nocrai. Nocrai Studio is a product line of Nocrai. References to “we”, “us”, and “our” in this policy mean HamptonTCI Limited.

Nocrai Studio sells one-time-purchase digital tools for small businesses at studio.nocrai.com. You design your files in the browser and, after purchase, download them. You own the files; we run no ongoing service for you and hold no account for you.

This policy covers studio.nocrai.com and the Nocrai Studio products only. The Nocrai platform at nocrai.com has its own privacy policy.

The content you enter to build your product — your name, business name, phone number, email address, website, social links, and any other card details — is handled like this:

• While you design — everything you type stays in your browser. The live preview is generated on your device. Nothing you enter is sent to us at this stage.
• When you buy and generate your files — your card content is sent once, over an encrypted connection (HTTPS), to our generation server. The server verifies your licence, builds your files in memory, and returns them to your browser as a download.
• After your files are generated — your card content is not saved. We operate no database of card content, no copies of generated files, and no record of what your card says. If you need your files again, you regenerate them with your licence key; we could not send you a copy because we do not have one.

This is not just a policy choice — it is how the system is built. There is nowhere in the Nocrai Studio infrastructure where card content is written to storage.

• We do not require or offer user accounts — there is nothing to sign up for
• We do not store your card content or your generated files
• We do not use analytics, advertising, or tracking cookies
• We do not build marketing lists or send marketing email
• We do not sell, rent, or trade personal information — to anyone, ever

Cloudflare may set strictly necessary functional cookies to deliver the website correctly and securely. These do not collect personal information for marketing or tracking and do not require consent.

After you unlock a product, your browser’s local storage remembers that unlock so you are not asked to re-enter your licence key on every visit. This is a convenience only — it stays on your device, is re-verified with Lemon Squeezy whenever files are generated, and you can clear it at any time by clearing your browser’s site data.

When you proceed to checkout, Lemon Squeezy may set its own cookies on their payment pages in accordance with their privacy policy. That happens on Lemon Squeezy’s platform, not on studio.nocrai.com.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies on studio.nocrai.com.

We share personal data only as strictly necessary:

• Lemon Squeezy — payment processing and licence management. Lemon Squeezy is US-based and acts as Merchant of Record and independent data controller for payment data.
• Cloudflare — website hosting, file generation, and support email routing. Cloudflare is US-based.
• Legal compliance — where required by law, court order, or regulatory authority.
• Business transfers — in the event of a merger, acquisition, or transfer of our business.

That is the complete list. We do not sell, rent, or trade your personal information.

Lemon Squeezy and Cloudflare are US-based. When data is transferred from regions with strict data protection laws (including the EEA, UK, Hong Kong, Australia, and Canada) to the US, appropriate safeguards apply, including Standard Contractual Clauses.

By using studio.nocrai.com or purchasing our products, you acknowledge that your data may be transferred to and processed in the United States.

• Card content and generated files — not retained at all. Processed transiently during generation and never stored.
• Purchase records — retained for 7 years from the date of transaction in accordance with Hong Kong accounting and tax requirements. Held within Lemon Squeezy’s systems.
• Support email — retained for up to 12 months after last contact.

Regardless of your location, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request deletion of your data, subject to legal exceptions (including our obligation to retain purchase records under applicable law).
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format (where applicable).
• Object — object to processing based on legitimate interests.

In practice, the only personal data we hold about most buyers is the purchase record described in section 3A and any support emails you have sent us. To exercise any right, contact support@nocrai.com. We will respond within 30 days.

All connections to studio.nocrai.com and to our generation server are encrypted (HTTPS). Licence verification is performed server-side against Lemon Squeezy on every file generation, and our systems are built to hold as little data as possible — the most effective protection for your card content is that it is never stored in the first place.

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and notify affected individuals without undue delay where the breach is likely to result in a high risk.

We may update this policy periodically. The effective date at the top indicates when changes were made. Because we hold no account for you, material changes will be announced by a notice on studio.nocrai.com.