Privacy policy

1. Who we are

Noli is an invite-only community where designers show their work and their process, follow each other, talk, and find work.

Noli is operated by [Noli company legal name], a company registered in [free zone], United Arab Emirates, under licence number [licence number], with its registered office at [registered address] ("Noli", "we", "us").

For the personal data described in this policy, Noli is the controller: we decide why and how it is processed.

Contact for anything about your data: privacy@noli.design.
Data protection officer: [name, or "our data protection officer"], reachable at privacy@noli.design.
[Representatives, if required: EU representative [name and address]; UK representative [name and address].]

2. The short version

• We collect what you give us (your account, your profile, your posts, your messages, your job applications) and a small amount of technical data we need to keep accounts safe.
• We use it to run Noli. We do not sell personal data, we do not show third-party advertising, and we do not use advertising or analytics cookies.
• Your profile is public on the web. Your posts, projects and comments are visible to signed-in members. Your messages are private between you and the people you write to, unless one of them reports a message to us.
• Our data is stored by Supabase in India (Mumbai) and handled by a small number of service providers, several of them based in the United States. Section 9 explains how we protect it when it crosses borders.
• You can see, correct, download, and delete your data. Deleting your account removes your profile at once and the rest of your data within 30 days, except the few records the law or safety requires us to keep for longer (section 10).
• Noli is for people aged 18 and over.

3. What we collect

3.1 What you give us

Your account. Your email address, your username, your display name, and your password. Your password is held only by our authentication provider (Supabase) in a protected, one-way form; we never see or store it ourselves. If you join with an invite, we record which invite you used and who issued it.

You must give us an email address, a username, a display name, and a password to have an account. Without them we cannot create one.

Your profile. What you choose to add: a profile photo and a banner, a short bio, your discipline and other disciplines, your job title and company, your city and country, your website and portfolio, links to your social accounts, the languages you speak, your skills and tools, your years of experience, and whether you are available for work. Your city and country are asked for when you set up your profile. Everything else is optional.

What you post. Posts, projects, comments, the images you upload and their descriptions, the tags you use, and posts you schedule for later. When you upload an image, we remove its hidden metadata (for example the camera model and the GPS location) before we store it.

How you use Noli with other members. Who you follow, what you like, what you save and how you organise it into collections, who you block, and what you report.

Messages. The messages and images you send to other members, your reactions to messages, and when you last read a conversation.

Jobs. If you post a job: the job details, your company page, and the notes you keep on applicants. If you apply for a job: the note you write, the CV you upload, the work you attach, and how your application progresses.

Feedback. If you send us feedback: what you write, the kind of feedback, and any screenshot you attach. With it we record the page you were on (never the full address with its parameters), your browser and device type, the size of your window, and whether you use light or dark mode, so we can understand the problem.

Talking to us. What you write when you email us, for example at support@, privacy@ or appeals@noli.design.

3.2 What we collect automatically

Security and sign-in records. When you sign in we record the browser and operating system you used, a shortened form of your internet (IP) address, and the approximate city and country it suggests. You see this yourself under Settings, Security, as your list of signed-in devices and your recent security activity. We use a shortened IP address (the last part is removed) so it cannot point to a single device on its own.

An activity log. For security, abuse prevention, and to be able to show what happened if something goes wrong, we keep a record of important actions on your account and by our staff: for example signing in, changing your password or email, two-step sign-in changes, following, blocking, applying for a job, and any moderation action. Each entry records what was done, when, by which account, and a shortened IP address.

Rate limits. To stop abuse, we count how often an account or an internet connection performs certain actions (such as signing in or posting). For visitors who are not signed in we use a scrambled, one-way form of the IP address, never the address itself. These counts expire within an hour or a day.

Bot protection. Some forms (sign in, sign up, joining with an invite, resetting your password, deleting your account) use Cloudflare Turnstile to check that you are a person. Turnstile reads signals from your browser to do this. See Cloudflare's privacy policy for details.

Cookies and similar storage. See section 11. We use only the cookies Noli needs to work.

We do not use analytics tools, tracking pixels, or advertising cookies.

3.3 What we receive from others

Google. If you choose "Continue with Google", Google tells us your name, your email address, your Google account identifier, and your profile picture. We use this only to sign you in to your existing Noli account.

Other members. Other members can mention you, message you, report you or your content, and invite you. A member who invites you gives us nothing about you except the invite link they send you themselves; we never receive your email address from them.

Companies you apply to. When you apply for a job, the company that posted it can record how your application progresses and keep notes about it.

3.4 Sensitive data

We do not ask for sensitive personal data, such as your religion, health, ethnicity, political views, sexual life, marital status, or criminal record, and we ask you not to share it on Noli.

This matters most for CVs. Please do not include your religion, marital status, health, date of birth, nationality, identity or passport numbers, or a photo in a CV you upload, unless you choose to share it with that employer. If a CV does contain sensitive data, it is shared only with the company you applied to (section 6).

4. How we use your data, and why we are allowed to

For each use below we name the reason the law allows it (our "legal basis"). The main ones are: to perform our contract with you (our Terms of service); to meet a legal obligation; your consent; and, where the law of your country recognises it, our legitimate interests in running a safe and useful service, which we always weigh against your rights.

Where we rely on your consent, you can withdraw it at any time, for example by changing the setting or by writing to us. Withdrawing consent does not affect what we did before. You can object to the optional emails, or turn them off, at any time.

We do not sell your personal data, we do not share it with advertisers, and we do not use it to build advertising profiles.

Our promise about your work. Your work is never used to train AI, never sold, and never handed to advertisers.

[Note for counsel: new paragraph, October 2026, added with "Download my data". Please confirm this promise can stand as a binding term, and its wording, which Noli also shows on the sign-in and join screens and in Settings.]

4.1 Automated decisions

Some things on Noli are decided by simple, automatic rules, not by a person:

• Jobs. A new job is checked against signs of a scam (for example asking candidates to pay a fee, or to move to a messaging app). A job that matches, and every first job a company posts, waits for a member of our staff to review it. A person always makes the final decision.
• Look-alike names. A display name that looks like a verified company's name is flagged for our staff to check. It is never blocked automatically.
• Limits. Sending too many requests in a short time pauses that action for a while.
• What you see. Lists such as Trending and Popular work are ordered by simple measures such as recent likes and saves. Suggestions such as Who to follow are based on the disciplines you share with other members and how recently they posted or joined. We do not use your data to profile you for advertising.

None of these produces a legal or similarly significant effect on you without a person reviewing it. If you disagree with something that happened to your account, write to appeals@noli.design and a person will look at it.

5. What others can see

Anyone on the web, even without an account, can open your profile page at noli.design/[your username]. It shows your name, photo, banner, bio, disciplines, job title and company, city and country, links, languages, skills and tools, availability, your projects and posts, and your follower counts. When someone shares a link to your profile, apps such as messengers may show a preview with your name, bio, location and an image.

Search engines. Under Settings, Profile, the "Search engines" setting lets Google and others list your profile. If you turn it off, we ask search engines not to list your profile, but your profile page stays visible to anyone who has the link. Search engines may take some time to remove a page they listed before.

The sign-in page. Each week one piece of work may be shown as the cover of Noli's public sign-in page, chosen by our staff or, when they choose none, from the most liked recent work. Only work that is already public on Noli is used, and the cover shows only your name, your photo and that work, with a link to your profile. To keep your work off it, turn off "Use my work as a cover" in Settings, Profile, Visibility (turning off "Search engines" does the same).

Signed-in members can see your posts, projects, comments, who you follow and who follows you, and your jobs. They see how many likes a post has, but not who liked it; only the author of a post is told who liked it.

Only you can see your saves and collections, your blocks, your drafts, your security records, and your settings.

Messages are visible only to the members in the conversation. Staff can read a message only if a member in that conversation reports it (section 6).

Your email address is never shown to other members.

Blocking stops a member from seeing your content and contacting you while they are signed in. Because your profile page is public on the web, a blocked member who signs out can still see that page.

Please think before you post. Anything you make public can be copied or kept by others, and we cannot control what they do with it.

6. Who we share your data with

Other members, as described in section 5, and as you choose to share.

Companies you apply to. When you apply for a job, the company that posted it receives your application: your profile, your note, your CV, and the work you attach. They become responsible for how they use it. Please read their own privacy notice.

Our staff. A small number of Noli staff can access personal data, only as their role needs, and every staff action that changes something is recorded with a reason:

• Moderators see the content that has been reported to them.
• Administrators can also see a member's email address and account history, the activity log, who invited whom, and feedback with its screenshots.
• Staff can read a private message only after a member in that conversation has reported it, and only that conversation's reported content.
• Staff cannot open CVs.

All staff must use two-step sign-in.

Our service providers, who handle data for us under contract, only on our instructions, and with security measures in place:

We review this list when we add or change a provider, and we update this policy.

Authorities. We disclose personal data when we are legally required to, for example in response to a valid order from a court, the public prosecution, the police, or a regulator in a country whose law applies to us. We check that each request is lawful and limit what we disclose to what it requires. Where the law allows, we tell the member concerned. We may also preserve data when lawfully asked to, while a request is processed. We may also share data on our own initiative where it is necessary to protect someone from serious harm, for example a threat to life, or the sexual exploitation of a child, which we report to the authorities.

If Noli changes hands. If Noli is reorganised, merged, or sold, your data may pass to the new owner, who will be bound by this policy or must tell you of any change and your choices first.

Advisers. Our lawyers, accountants and auditors, under a duty of confidentiality, when they need it to advise us.

7. How we protect your data

We use measures suited to the risk, including:

• encryption of data in transit (HTTPS everywhere) and at rest by our providers;
• private storage for messages' images, CVs and feedback screenshots, opened only through short-lived, signed links (from one to five minutes);
• passwords held only in one-way form by our sign-in provider;
• two-step sign-in available to every member, and required for all staff;
• recovery codes and invite tokens stored only in scrambled, one-way form;
• limits on how often actions can be repeated, and bot protection on sensitive forms;
• access for staff only where their role needs it, with every change they make recorded;
• removal of hidden metadata (including location) from images you upload.

No system is perfectly secure. If a breach of your personal data is likely to put your rights at risk, we will tell the relevant authorities and you, within the time the law requires (for example within 72 hours where that applies), and explain what happened and what we are doing about it.

8. Where your data is stored

Our main database is stored by Supabase in India (Mumbai). Images, CVs and attachments are stored by Cloudflare, and our website runs on Vercel's and Cloudflare's global networks, so your data may be processed in other countries where they operate, including the United States and the European Union.

9. International transfers

Because our providers are outside your country, using Noli involves transferring your personal data abroad. We protect it when we do:

• we choose providers with strong security, and bind them by contract to protect your data, use it only for us, and help us respect your rights;
• where available, we rely on recognised safeguards, such as standard contractual clauses or a provider's certification under the EU-U.S. Data Privacy Framework;
• we assess the risks of each transfer and record that assessment where the law requires it;
• where the law of your country requires your consent for a transfer, we ask for it, and we tell you what it means first.

If you are in Saudi Arabia, Oman, Qatar, Bahrain, Kuwait, or the UAE, your country's data protection law applies to how we transfer your data, and section 13 explains your rights. You can ask us for more detail about the safeguards for any transfer by writing to privacy@noli.design.

10. How long we keep your data

We keep personal data only as long as we need it for the reason we collected it, or as long as the law requires.

When you delete your account, under Settings, Account:

• at once: your profile is removed, your username is released, you are signed out everywhere, and your posts, projects and comments disappear from Noli;
• within 30 days: we erase your account details, profile, posts, projects, comments, images, likes, saves, collections, follows, CVs and applications, feedback, scheduled posts, and devices. If something you posted is part of a report that is still open, we keep it until the report is decided, and at most 12 months, so our staff can judge it fairly;
• messages you sent stay in the other member's conversation, shown as from a "Deleted member", because they are part of that member's own record; images you sent in messages are erased within 30 days;
• we keep, for the periods in the table above, the security records, activity log, reports and moderation decisions, because we need them to keep Noli safe and to answer legal claims or lawful requests;
• we also ask our image network to remove its cached copies of your public images; copies kept by other apps, or by people who saved them, are outside our control;
• copies may remain in backups until they rotate out;
• we keep only a minimal record that the account existed (an internal identifier, the dates it was created and deleted, and its role), so that the records we must keep still make sense.

If your account is suspended or under review, you can still ask us to delete your data, and we will do so once the review is complete, unless the law requires us to keep it.

If we are told to keep certain data because of a legal claim, an investigation, or a lawful order, we keep it until that is resolved.

11. Cookies and similar storage

We use only cookies and browser storage that Noli needs to work or that remember a choice you made. We do not use advertising or analytics cookies, so we do not ask you to accept them.

Cloudflare Turnstile may also set its own cookies on the forms it protects.

Your recent searches, your post draft, and your place on a page are cleared when you sign out or delete your account. Your light or dark mode, side menu, and time zone preferences stay until they expire, as shown above. You can also clear cookies in your browser at any time, but Noli will sign you out.

12. Children

Noli is only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. When you join, you confirm that you are 18 or over, and we may ask for further confirmation of your age.

If we learn that someone under 18 has an account, we will close it and erase their data. If you believe a child is using Noli, please tell us at privacy@noli.design.

13. Your rights

Depending on the law that applies to you, you have the right to:

• know what personal data we hold about you and how we use it;
• access it and receive a copy;
• take it with you in a common, machine-readable format (portability);
• correct it if it is wrong or incomplete;
• delete it, or have us stop using it, when there is no longer a reason to keep it;
• object to our use of it, including for any legitimate interest we rely on;
• restrict our use of it while a question about it is resolved;
• withdraw your consent at any time where we rely on it;
• not be subject to a decision based only on automated processing that significantly affects you, and to ask for a person to review it;
• complain to us, and to a data protection authority.

Many of these you can do yourself: edit your profile in Settings; delete posts and projects; turn emails off in Settings, Notifications, and search engine listing off; see your devices and security activity; and delete your account.

You can also download a copy of your data yourself, once a day, in Settings, Account, Your data, with "Download my data". It is a ZIP of JSON files, a common, machine-readable format, holding your account, profile and settings, your posts, projects and comments, your saves and collections, who you follow and who follows you, your conversations as you can see them in Messages, and your job applications.

[Note for counsel: new paragraph, October 2026. Please confirm what the download must include to meet the access and portability rights above.]

For anything else, write to privacy@noli.design from the email address on your account. We may need to confirm your identity before we act. We will answer within 30 days, and sooner where your country's law sets a shorter time. If a request is complex, we will tell you within that time if we need longer and why, where the law allows it. We do not charge for requests, unless they are clearly unfounded or excessive, as the law allows. We will never treat you less favourably for using your rights.

13.1 Complaints

Please tell us first, at privacy@noli.design, so we can put it right. We will acknowledge your complaint within 30 days.

You also have the right to complain to the data protection authority in your country, for example:

• United Arab Emirates: the [UAE AI and Data Authority (formerly the UAE Data Office)], [or the Commissioner of Data Protection of the DIFC, or the Office of Data Protection of ADGM, if Noli is registered there];
• Saudi Arabia: the Saudi Data and AI Authority (SDAIA);
• Qatar: the National Data Privacy Office of the National Cyber Security Agency;
• Bahrain: the Personal Data Protection Authority;
• Oman: the Ministry of Transport, Communications and Information Technology;
• Kuwait: the Communication and Information Technology Regulatory Authority (CITRA);
• European Union: the supervisory authority where you live;
• United Kingdom: the Information Commission.

14. Changes to this policy

We will update this policy when Noli or the law changes. When we make an important change, we will tell you in Noli or by email at least 30 days before it takes effect, unless the change is required sooner by law. Where the law requires your consent to a change, we will ask for it. Previous versions are available on request.

15. Language

This policy is written in English. [An Arabic version is available at noli.design/ar/privacy.] [If the two versions differ, (to be decided with counsel).]