Effective Date: April 30, 2026 Last Updated: July 2026
1. Who We Are
This Privacy Policy describes how Data212 Inc. ("Data212," "we," "us," or "our"), a corporation incorporated in Canada, collects, uses, and shares information about you when you use Nota Mérican (the "Service"), including the website at nota.uno and our iOS/Android apps.
Contact for privacy matters: privacy@nota.uno Legal entity: Data212 Inc. Jurisdiction: Ontario, Canada
2. Information We Collect
2.1 Information You Provide
- Account information: email address, username, authentication credentials (via Sign in with Apple, Google, or email). Account creation is optional for playing and for App Store / Play purchases.
- Payment information:
- Web: processed by Stripe; we do not store full payment card details (we receive a Stripe customer ID and subscription status)
- iOS / Android apps: processed by Apple App Store / Google Play via RevenueCat; we receive subscription/entitlement status. You may purchase using your store account without creating a Nota login; if you later sign in, we may link that entitlement to your account.
- Game activity: quiz scores, XP, streak history, achievements
- Communications: any message you send to privacy@nota.uno or other support channels
2.2 Information Collected Automatically
- Usage data: pages visited, features used, game completion events, click events, session duration
- Device data: browser or app platform, operating system, screen resolution, language, approximate location derived from IP address
- Cookies and similar technologies (web): see our Cookie Policy for details
2.3 Information from Third Parties
- Sign in with Apple / Google: if you sign in with Apple or Google, we receive the identifiers and profile fields those providers share (for Apple, this may be a private relay email)
- Stripe (web): subscription and payment status
- RevenueCat + Apple/Google (apps): purchase and entitlement status for Pro
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service across web and native apps
- Process payments and manage subscriptions (Stripe on web; App Store / Play via RevenueCat in apps)
- Maintain your game progress, leaderboard placement, and achievements
- Send service-related communications (account confirmations, payment receipts, security notices)
- Personalize your experience
- Detect, prevent, and address fraud, abuse, security risks, and technical issues
- Comply with legal obligations
- With your consent, send marketing communications
4. Legal Bases for Processing (EEA/UK Users)
If you are in the EEA or UK, we rely on the following legal bases:
- Contract: to provide the Service you've signed up for
- Legitimate interests: to improve the Service, prevent fraud, secure our systems
- Consent: for non-essential cookies, marketing communications, and personalized advertising (web)
- Legal obligation: to comply with applicable law
5. Third-Party Services and Data Sharing
We share information with the following service providers, each of whom processes data on our behalf or as an independent controller for their own purposes:
Infrastructure and Hosting
- Vercel Inc. (USA) — frontend hosting and edge delivery
- Supabase Inc. (USA) — database, authentication, file storage
Payments
- Stripe, Inc. (USA) — payment processing for web subscriptions
- Apple Inc. / Google LLC — in-app purchases on iOS and Android
- RevenueCat, Inc. (USA) — subscription entitlement sync between the app stores and our backend
Analytics and Product Measurement
On the website, we may use:
- Google Analytics 4 / Google Tag Manager (Google LLC, USA)
- Microsoft Clarity (Microsoft Corporation, USA) — session recording and heatmaps (sensitive inputs masked)
In the native iOS/Android apps, we do not load Google Tag Manager or Microsoft Clarity. Limited product analytics may still be collected via our own event pipeline for gameplay and subscription status.
Advertising
We do not currently show third-party display ads in the Service.
Authentication
- Sign in with Apple (Apple Inc.)
- Google Identity Services (Google LLC, USA)
We do not sell your personal information for monetary consideration. However, certain analytics activities on the website may qualify as a "sale" or "sharing" under California law (CCPA/CPRA). See Section 8 for opt-out rights.
6. International Data Transfers
We operate globally. Your information is processed and stored on servers located in the United States, Canada, and potentially other jurisdictions where our service providers operate. By using the Service, you consent to the transfer of your information to these jurisdictions, which may have data protection laws different from those of your country.
For users in the EEA/UK, we rely on Standard Contractual Clauses or equivalent safeguards where required.
7. Data Retention
We retain personal information for as long as necessary to provide the Service and as required to comply with legal obligations:
- Account data: retained while your account is active. After you request deletion, we soft-delete immediately and permanently erase after a grace period of up to 30 days (unless law requires longer retention of payment records).
- Game activity: retained while your account is active.
- Payment records: retained for 7 years for Canadian tax compliance where applicable.
- Analytics data (web): retained per Google Analytics and Microsoft Clarity default retention (typically 14-26 months).
- Server logs: typically 30-90 days.
You can request deletion in Settings or by emailing privacy@nota.uno.
8. Your Rights
8.1 All Users
You have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated personal information
- Object to or restrict certain processing
- Withdraw consent (where processing is based on consent)
- Lodge a complaint with a data protection authority
To exercise these rights, email privacy@nota.uno. We will respond within 30 days (or as required by applicable law).
8.2 Canadian Users (PIPEDA + Quebec Law 25)
Canadian users have rights under PIPEDA, and Quebec residents have additional rights under Law 25, including rights regarding automated decision-making and complaints to the OPC or CAI.
8.3 California Users (CCPA/CPRA)
If you are a California resident, you have the right to know, delete, correct, opt out of sale/sharing, and non-discrimination. Use the footer opt-out link when shown, or email privacy@nota.uno. We honor Global Privacy Control (GPC) signals.
8.4 Other US States
Residents of states with comprehensive privacy laws have similar rights. Contact privacy@nota.uno.
9. Cookies and Tracking
On the website we use cookies and similar technologies as described in our Cookie Policy. Where required by law, we obtain consent before setting non-essential cookies.
10. Children's Privacy
The Service is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. Contact privacy@nota.uno if you believe we have collected information from a child.
11. Security
We implement reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest where supported by our providers, row-level security on database tables, and regular security review. No system is perfectly secure.
12. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated by email (where applicable) or via a notice on nota.uno. The "Last Updated" date reflects the most recent revision.
13. Contact
Email: privacy@nota.uno Mailing address: Data212 Inc., [INSERT REGISTERED ADDRESS], Ontario, Canada