Your private space.

Who is responsible

NOCT. is operated by Manaweave Ltd., the controller for the information used to operate this store. Company number: 17494739. Registered office and company details.

For privacy enquiries, email contact@noct.house.

Orders and enquiries

Checkout collects the information needed for payment and fulfilment, including contact and delivery details, quantity and transaction references. NOCT. keeps the records needed to manage orders, payments and fulfilment. Stripe processes payment details; NOCT. does not receive or store full card numbers.

Order processing uses information to enter into and perform a purchase contract. Applicable accounting and legal records are kept to meet legal obligations. Customer enquiries are used to respond to the request. Security and service operation require proportionate operational records. Retention information is described below.

Required checkout information is needed to process and deliver an order. Optional advertising consent is never required to buy.

For the first 1,000 customer replacement offer, we use your contact details and original order reference or payment confirmation to check eligibility and record your request and replacement dispatch. We use only the information needed to administer the offer. A photo or clip is optional, and you do not need to share the contents of your private pages.

Essential storage

The checkout-proof cookie and order-status storage below are used only for checkout through NOCT.’s own order flow. They are not used when you pay through a Stripe-hosted Payment Link.

noct_consent

A first-party cookie remembering your consent choice, policy version and time of choice for 180 days. It does not contain an advertising identifier.

noct_checkout_token

A secure, HTTP-only first-party checkout proof cookie used to protect the checkout and order flow. It expires after 24 hours.

noct_current_session_id

Session storage remembering the Stripe checkout session for the current browser tab, so that your order status can be retrieved after the private return parameter is removed from the URL. The session ID does not grant access on its own: a matching checkout proof cookie is also required. It lasts for the tab session and is not used for advertising.

Essential storage supports your requested service and privacy preferences. Rejecting advertising leaves these functions available.

Advertising — only with permission

When advertising consent is given and a TikTok Pixel ID is configured, we load TikTok’s Pixel. It measures product views and checkout initiation. Confirmed-purchase events apply only to payments confirmed through NOCT.’s own order flow; this integration does not send them for Stripe-hosted Payment Links. Events include the product identifier, quantity, currency, confirmed value where available and an opaque event identifier. We do not deliberately send your name, email, address or payment details to this integration.

TikTok’s script can receive browser and device information, the page URL, IP address and its own identifiers. Campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term and ttclid) are preserved in this tab’s session storage only after consent. Private checkout access parameters are removed before a purchase event can be sent.

This optional advertising processing uses consent. We do not load advertising scripts or preserve campaign identifiers before you accept. Declining has no effect on access or checkout. No optional first-party analytics SDK is installed.

Withdrawing consent stops future advertising events and clears our advertising session storage and accessible first-party TikTok identifiers. It does not undo data already shared with TikTok; cookies on TikTok’s own domains cannot be deleted by this site.

Providers and sharing

Stripe hosts checkout and processes payment, contact and delivery information. Railway hosts this website and processes technical information needed to deliver and secure it. Namecheap forwards messages sent to contact@noct.house to our customer-service inbox. Google’s Gmail receives and stores that correspondence and is used for replies. Postal and courier providers receive the details needed to deliver orders and replacement notepads. TikTok receives advertising events only when its Pixel is configured and you give advertising consent.

Personal data may be processed outside the UK. Railway’s primary processing operations take place in the United States. Namecheap’s privacy terms state that it processes data in the United States. Google uses servers worldwide for Gmail and its other services. Stripe transfers personal data to the United States and other countries where its affiliates and service providers operate. Railway’s data-processing terms incorporate standard contractual clauses with the UK Addendum for relevant restricted UK transfers. Stripe and Google describe the Data Privacy Framework, including its UK Extension, and standard contractual clauses in their transfer terms where applicable. Namecheap’s privacy terms also describe applicable standard contractual clauses. For details or copies of the applicable safeguards, email contact@noct.house.

For information about TikTok’s own processing, see its privacy policy. See Stripe’s privacy policy for payment processing.

Retention

Financial records required for company accounting are retained for at least six years after the end of the financial year they relate to, or longer where legally required. Other order and enquiry records are retained while needed for fulfilment, customer care or resolving claims. Minimal replacement-eligibility and claim records are retained while needed to honour outstanding replacement promises and prevent duplicate claims. Consent preferences last 180 days; campaign attribution and purchase-event deduplication last for the current browser-tab session.

Your information rights

Depending on the processing and legal basis, you may have rights to access, correct, erase or restrict your information, and to receive a portable copy. You can withdraw consent at any time through Cookie preferences.

You have the right to object to processing based on legitimate interests, including direct marketing. Contact us to exercise your rights or raise a concern. You can also complain to the Information Commissioner’s Office.

NOCT. does not make solely automated decisions with legal or similarly significant effects. Stripe and TikTok operate their own services under their respective notices.