Last updated: September 30, 2026
This policy explains what personal information Night Raven Enterprises LLC (“we”, “us”), which runs the NoctisCorvus brand and this website, collects, why, how long we keep it, who processes it for us, and the rights you have. It applies to this website and to the NoctisCorvus blog emails.
Who is responsible
Night Raven Enterprises LLC, [to be completed]. Privacy contact (including for Quebec’s Law 25, the person in charge of the protection of personal information): [to be completed], [to be completed].
What we collect
- Blog subscription. Your email address, your preferred language, the page where you subscribed, the date and time you gave and confirmed consent, the version of the consent wording you saw, and a keyed one-way hash of your IP address (we never store the IP itself). We also keep delivery events for the emails we send you (delivered, bounced, marked as spam) so we can stop sending to addresses that don’t work.
- Browsing this site. We don’t use advertising or analytics cookies, and we don’t track you across sites. The only cookie we set is
NEXT_LOCALE, which remembers the language you chose with the language switcher; it is strictly necessary for that feature. Our hosting provider keeps short-lived technical logs (such as IP address and pages requested) for security and to keep the site running. - Bot protection. When you use the subscribe form, Cloudflare Turnstile checks that the request comes from a person. Cloudflare processes technical signals from your browser for that purpose only.
- Embedded videos. Product instruction videos are hosted by Vimeo. The player loads only when you press play; from then on Vimeo’s privacy policy applies.
- Amazon links. Product links take you to Amazon, which has its own privacy policy. As an Amazon Associate we may earn from qualifying purchases; we receive no personal information about you from Amazon.
Why we use it (legal bases)
- Sending the blog by email: your consent, given by entering your address and confirming it through the link we send (double opt-in). This is express consent under Canada’s CASL and Quebec’s Law 25, and consent under the GDPR (art. 6(1)(a)) and Dominican Republic Law 172-13.
- Security, fraud and abuse prevention, and keeping proof of your consent: our legitimate interest (GDPR art. 6(1)(f)) and our legal obligations.
We don’t sell or rent your personal information, we don’t use it for profiling or automated decisions, and we don’t use it to train AI models.
How long we keep it
- Unconfirmed sign-ups: deleted after 30 days.
- Active subscribers: while you are subscribed.
- After you unsubscribe: we keep your email address, the unsubscribe date and your consent record for up to 3 years, only to prove consent and to honour your choice; you can ask us to delete them sooner.
- Email delivery events: 13 months.
Who processes it for us
We use these service providers, each bound by a data processing agreement:
- Vercel Inc. (USA) — website hosting and delivery.
- Supabase Inc. (USA; database hosted in the AWS us-east-1 region) — the subscriber database.
- Resend (Plus Five Five, Inc., USA) — sending emails and reporting delivery.
- Cloudflare Inc. (USA and global network) — DNS, network protection, and Turnstile bot protection.
- Anthropic PBC (USA) — AI assistance used by our editors to draft and translate blog posts. No subscriber data is ever sent to it.
International transfers
Our providers are in the United States, so your information is processed there. For people in the European Economic Area, the UK and Switzerland, transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses. For people in Quebec, we assessed these transfers as required by Law 25 before making them.
Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your information, object to or restrict its use, and withdraw consent at any time (this doesn’t affect what we did before). Every email has a one-click unsubscribe link and a link to your email preferences, where you can change the language, download your data or delete it immediately. For anything else, write to [to be completed]; we answer within 30 days.
You can also complain to a data protection authority: in the EU, the authority in your country (in Spain, the AEPD; in France, the CNIL); in Quebec, the Commission d’accès à l’information; elsewhere in Canada, the Office of the Privacy Commissioner; in the Dominican Republic, you can exercise habeas data before the courts under Law 172-13.
Security
Data is encrypted in transit and at rest. Access to subscriber data is limited to our owner account, which requires a password and a second factor. IP addresses are stored only as keyed hashes. If a breach puts your information at risk, we will notify you and the authorities as the law requires.
Children
This site is not directed to children under 16, and we don’t knowingly collect their information.
Changes
If we change this policy, we will update the date above. If a change affects how we use your email address, we will tell subscribers by email before it takes effect.