Privacy Notice

Last updated: 2026-10-27 Version: 1.4

This Privacy Notice explains how Numinor Systems Limited handles personal information across numinor.io, Matrix, data services, accounts, billing and support. Rights to retain licensed datasets are governed separately by your data agreement.

1 Who is responsible

Numinor Systems Limited is responsible for the personal information we collect and use to operate these services. Our office and correspondence address is Unit 606, 6th Floor, Alliance Building, 133 Connaught Road Central, Hong Kong SAR. Our privacy contact is Tom Liu at tyl@numinor.io. Customer support is available at support@numinor.io.

2 Information we collect

Account and contact information includes your name, email address, authentication identifiers, preferences, and information you provide in support or privacy requests. For an entity purchase, we also record the licensed company's name and the purchaser's authority confirmation.

Order and billing records include selected products and fields, the relevant data Vendor, delivery method, plan, billing and tax details, prices, payment references and status, refunds, service dates and cancellation. We keep the accepted documents, versions, acceptance wording, account identifier and timestamps. Notice records include their content, intended recipient, account publication, email delivery status and read status.

Service information includes requests, searches, queries, downloads, API and delivery activity, usage counters, session events, errors, and security logs. Depending on the feature, these records may include IP addresses, browser or device information, timestamps, prompts, code, outputs and other content you submit or save.

We receive account information from our authentication provider and any identity provider you choose for sign-in, and transaction information from our payment processor. Payment card details are entered with the payment processor; we do not receive full card numbers through the standard checkout.

When you follow a campaign-tagged link, we may record a random browser identifier, the campaign parameters, landing path and referring host. If you later sign up, we may link that campaign information to your account to understand which campaigns lead to registrations. This is separate from aggregate website analytics.

3 How we use information

We use information to authenticate accounts, supply the features and Data requested, manage permissions, record agreements, process payments and refunds, administer trials and subscriptions, and provide support. We use notices and delivery records to communicate service events and retain evidence of what was provided and accepted.

We use operational information to meter services, investigate errors, prevent abuse, protect accounts and infrastructure, and improve the service. We analyze usage and campaign outcomes internally. We also retain or disclose information where required by law and use necessary records to handle disputes and enforce agreements.

Product or marketing communications are separate from necessary account and contractual notices. You can use the unsubscribe or preference controls provided for optional communications, or contact us. We obtain consent where applicable law requires it. Accepting a data Order does not itself opt you into optional marketing or authorize new uses of your personal information.

4 Data Vendors

When you activate a covered self-service trial in Matrix or real-time SmarTag, we share your name, email address and licensed company name, where applicable, with the relevant data Vendor. On a purchase through Matrix or API streaming, we share that identity information and identify the products or fields purchased from that Vendor. We identify the relevant Vendor before activation or purchase. Each Vendor receives only information relating to its own offering.

We do not share your searches, queries, downloads, API requests, usage patterns or research activity with data Vendors. This restriction continues after the trial or subscription ends. The exception is disclosure required by law or a binding legal order, subject to the notice and protection provisions of your agreement. Identifying purchased content is not reporting how you use it.

These disclosures administer the Vendor's licensed offering. They do not authorize public identification of your relationship with Numinor or independent marketing use. We do not sell, rent or trade personal information for third parties' independent marketing.

5 Service providers and other recipients

We use service providers to operate the platform. They are distinct from data Vendors. Their access depends on the function they perform: Clerk handles account authentication; Stripe handles payment and billing; Resend delivers email; Vercel hosts the website and supplies website analytics; Amazon Web Services hosts database, storage and service infrastructure; and Cloudflare provides network and traffic-protection services.

When you use AI and research features, Anthropic may receive prompts, conversation context and relevant retrieved content to generate responses. OpenAI may receive questions or other text to generate embeddings for retrieval. The information sent depends on the feature you request and can contain personal information you include. E2B processes code, inputs and outputs when you use its sandbox execution features. Do not submit unnecessary personal information or credentials in prompts or code.

When you submit a report for publication, automated content review may send its title, narrative, chart labels and categorical axes, and table content to DeepSeek, with Anthropic or MiniMax as fallback reviewers. The review checks whether publication is permitted; not every reviewer receives every submission. Reports you choose to publish become accessible through their public links. External AI clients you connect receive the tool responses they request and handle that information under their own terms and privacy notices.

We limit access to information needed for the relevant task and use appropriate contractual and operational safeguards. Payment, identity or other providers may also process information for their own legal, security or service responsibilities under their notices. We may share necessary information with professional advisers or authorities for legal obligations and claims, and with parties to a corporate transaction subject to applicable confidentiality, notice and legal requirements. These arrangements do not override the data-Vendor activity restrictions above.

6 Cookies and international processing

Authentication and session cookies support sign-in and security. Preference storage remembers settings such as language and theme. Website analytics help measure aggregate use. Campaign-attribution cookies named nmr_aid and nmr_ft are set on campaign-tagged arrivals and have a configured lifetime of 180 days; the associated campaign record may be linked to a subsequent account registration.

You can control cookies through your browser, although blocking authentication cookies may prevent sign-in. Clearing browser cookies does not delete information already recorded in an account; contact us for an access, correction or deletion request. We provide any additional choices required by applicable law.

Numinor is based in Hong Kong. Primary database and storage infrastructure is in the AWS Asia Pacific Seoul region, and website functions also run in Tokyo. Service providers may process information in the United States or other countries. Protections may differ between jurisdictions. We apply safeguards appropriate to the transfer and any additional measures required by applicable law; this notice does not itself obtain consent where separate consent is required.

7 Retention and security

Our scheduled retention rules remove Matrix session activity older than 90 days and Matrix egress metering and abuse records older than 730 days. Saved work is separate from that activity feed. Account controls let you delete saved reports and configurations; associated operational records, result tables and backups may remain subject to their own retention requirements. None of these rules permits keeping Trial Data beyond its contractual deletion deadline.

Other records are retained according to their purpose, including active account administration, support, security, accounting and legal obligations. Order, acceptance and relevant notice records may remain after cancellation to establish continuing license rights and resolve claims. We review information and delete or anonymize it when no longer needed, subject to required retention and appropriate backup handling. A previously communicated shorter retention commitment continues for the information it covers unless retention is legally required.

To request deletion of your account and associated information, contact our privacy contact. Closing an account does not remove records we must retain or records needed to document continuing contractual rights. We explain applicable exceptions when responding. Deletion of personal account records is separate from your obligation to delete licensed Trial Data.

We use access controls, authentication, encryption where supported and operational security measures appropriate to the information and service. Access is limited to authorized people and providers for the purposes described here. No system eliminates every security risk. We respond to incidents and notify affected people or authorities where required by law.

8 Your rights and contact

You may request access to and correction of personal information we hold about you. Depending on applicable law, you may also request deletion, restriction or portability, object to particular processing, or withdraw consent. Withdrawal does not undo lawful processing already completed, and some information remains necessary to supply a requested service or meet legal duties.

Send requests to Tom Liu at tyl@numinor.io or our office address above. We may seek information necessary to verify your identity and clarify the request. We respond within applicable legal time limits and explain any restriction or permitted charge before it applies. You may also contact the Hong Kong Privacy Commissioner for Personal Data or another competent privacy authority.

The services are intended for adults. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

9 Changes and contract rights

We publish a dated, versioned notice when our handling changes and give additional notice or seek consent where required. For contractual notices on covered data Orders, we post in the account Notice Center and send email as the accepted Terms require. Reading this notice, signing in or continuing to use the site does not by itself consent to a new processing purpose or accept amended Data License Terms.

This notice does not expand contractual disclosure rights or replace a signed agreement. Changes to data Orders remain subject to their agreed notice and acceptance rules.