Last updated: November 8, 2026
This policy explains what personal information Night Raven Enterprises LLC (“we”, “us”), which runs the NoctisCorvus brand and this website, collects, why, how long we keep it, who processes it for us, and the rights you have. It applies to this website, to the NoctisCorvus blog emails and to our emails with offers and discounts.
Who is responsible
Night Raven Enterprises LLC, 1704 LLANO ST, STE B #1303, Santa Fe, NM 87505, United States. Privacy contact (including for Quebec’s Law 25, the person in charge of the protection of personal information): FELIPE DE CASTRO, privacy@noctiscorvus.com.
What we collect
- Blog subscription. Your email address, your preferred language, the page where you subscribed, the date and time you gave and confirmed consent, the version of the consent wording you saw, and a keyed one-way hash of your IP address (we never store the IP itself). We also keep delivery events for the emails we send you (delivered, bounced, marked as spam) so we can stop sending to addresses that don’t work. If you subscribe from the pop-up on our product instruction pages, you also ask for occasional emails with offers and discounts on our products: we record that request, the wording you saw and, once you confirm, the date of that consent.
- Browsing this site. We don’t use advertising or analytics cookies, and we don’t track you across sites. The only cookie we set is
NEXT_LOCALE, which remembers the language you chose with the language switcher; it is strictly necessary for that feature. The optional subscribe pop-up on the instruction pages remembers in your browser’s local storage whether you closed it or subscribed (no identifier, never sent to us), so it doesn’t keep appearing. Our hosting provider keeps short-lived technical logs (such as IP address and pages requested) for security and to keep the site running. - Visit statistics. To know which pages are read and whether visitors get their language, we record each page view without cookies: the page, its language, the referring site (domain only), the country (and, for Canada, the province) derived from your IP address, and the device type (mobile, tablet or desktop). Your IP address is not stored. To count unique visitors per day we keep a one-way hash of your IP address and browser, salted with a random value that is deleted after two days, so visits can’t be linked across days or back to you. We don’t record visits when your browser sends Do Not Track or Global Privacy Control. Raw records are deleted after 90 days; only daily totals are kept. We also use Vercel Web Analytics and Speed Insights, which are cookieless and measure page loads and performance in aggregate. Legal basis: our legitimate interest in running and improving the site (GDPR art. 6(1)(f)).
- Bot protection. When you use the subscribe form, Cloudflare Turnstile checks that the request comes from a person. Cloudflare processes technical signals from your browser for that purpose only.
- Embedded videos. Product instruction videos are hosted by Vimeo. On the dream-catcher instructions page the player loads with the page, in Vimeo’s “do not track” mode, so the video starts immediately when you scan the QR code; Vimeo may set a strictly necessary security cookie (
__cf_bm, 30 minutes). Other embedded videos load only when you press play. Vimeo’s privacy policy applies to its player. - Amazon links. Product links take you to Amazon, which has its own privacy policy. As an Amazon Associate we may earn from qualifying purchases; we receive no personal information about you from Amazon.
Why we use it (legal bases)
- Sending the blog by email and, if you asked for them, offers and discounts: your consent, given by entering your address and confirming it through the link we send (double opt-in). This is express consent under Canada’s CASL and Quebec’s Law 25, and consent under the GDPR (art. 6(1)(a)) and Dominican Republic Law 172-13.
- Security, fraud and abuse prevention, and keeping proof of your consent: our legitimate interest (GDPR art. 6(1)(f)) and our legal obligations.
We don’t sell or rent your personal information, we don’t use it for profiling or automated decisions, and we don’t use it to train AI models.
How long we keep it
- Unconfirmed sign-ups: deleted after 30 days.
- Active subscribers: while you are subscribed.
- After you unsubscribe: we keep your email address, the unsubscribe date and your consent record for up to 3 years, only to prove consent and to honour your choice; you can ask us to delete them sooner.
- Email delivery events: 13 months.
Who processes it for us
We use these service providers, each bound by a data processing agreement:
- Vercel Inc. (USA) — website hosting and delivery.
- Supabase Inc. (USA; database hosted in the AWS us-east-1 region) — the subscriber database.
- Resend (Plus Five Five, Inc., USA) — sending emails and reporting delivery.
- Cloudflare Inc. (USA and global network) — DNS, network protection, and Turnstile bot protection.
- Anthropic PBC (USA) — AI assistance used by our editors to draft and translate blog posts. No subscriber data is ever sent to it.
International transfers
Our providers are in the United States, so your information is processed there. For people in the European Economic Area, the UK and Switzerland, transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses. For people in Quebec, we assessed these transfers as required by Law 25 before making them.
Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your information, object to or restrict its use, and withdraw consent at any time (this doesn’t affect what we did before). Every email has a one-click unsubscribe link and a link to your email preferences, where you can change the language, download your data or delete it immediately. For anything else, write to privacy@noctiscorvus.com; we answer within 30 days.
You can also complain to a data protection authority: in the EU, the authority in your country (in Spain, the AEPD; in France, the CNIL); in Quebec, the Commission d’accès à l’information; elsewhere in Canada, the Office of the Privacy Commissioner; in the Dominican Republic, you can exercise habeas data before the courts under Law 172-13.
Security
Data is encrypted in transit and at rest. Access to subscriber data is limited to our owner account, which requires a password and a second factor. IP addresses are stored only as keyed hashes. If a breach puts your information at risk, we will notify you and the authorities as the law requires.
Children
This site is not directed to children under 16, and we don’t knowingly collect their information.
Changes
If we change this policy, we will update the date above. If a change affects how we use your email address, we will tell subscribers by email before it takes effect.