Beta - pending legal review. noori pro is currently a free, invite-only beta offered ahead of formal US incorporation, and this document has not yet been reviewed by a qualified attorney. Once Noori Pro is incorporated, this Service and these documents will transfer to that company, and registered Artists will be asked to accept updated Terms at that point rather than being carried over automatically. Bracketed placeholders mark details still to be finalised.
This Privacy Policy explains how [Noori Pro - US company registration pending incorporation] ("Noori Pro", "we", "us", "our") collects, uses, discloses, and protects personal data in connection with the noori pro booking and inquiry management platform (the "Service"), available at noori.pro. It is written with UK GDPR and the Data Protection Act 2018 in mind. Certain US state privacy laws may also give you additional rights depending on where you live and whether those laws apply to Noori Pro at your particular time of use - see Section 8 below.
The Service has two categories of people, and Noori Pro plays a different legal role depending on the specific activity:
That said, Noori Pro also carries out a smaller set of activities involving Client data for its own purposes, where we independently decide the purpose and means of processing - for example, platform security logging, fraud and abuse detection, our own support correspondence with a Client who contacts us directly, and legal/compliance record-keeping. For those specific activities, Noori Pro is an independent data controller, not a processor, and this Policy (not the artist's own privacy notice) governs them directly. Section 6 sets out the legal basis for each of these controller activities.
If you are a Client with a question about how a specific artist uses your booking-inquiry data for their own purposes (for example, their own record-keeping or client communications), that artist's own privacy practices govern - contact them directly.
We collect limited technical data - IP address, browser type, device type, referring/exit pages, and pages visited - via standard server logs, and via cookies as described in our Cookie Policy. As of this version of the Policy, we do not yet run third-party analytics or advertising trackers; when we add tools such as Google Analytics, this section and our Cookie Policy will be updated and the relevant cookies will require your consent before loading.
Certain information is required to use the Service - for example, an email and password to create an Artist account, or contact and event details to submit a Client inquiry. If you do not provide it, we, or the artist you are contacting, may be unable to provide that functionality.
We do not use your data for unsolicited marketing, and we do not sell personal data to third parties, in the ordinary meaning of "sell" or the definitions used in US state privacy laws.
When a client submits an inquiry, their name, contact details, and event details are shared with the artist they contacted - this is the core purpose of the Service. We also share data with the infrastructure providers who host and run the platform on our behalf, each bound by a data processing agreement or equivalent terms. The current list is maintained on our Subprocessors page. We do not permit any subprocessor to use personal data for its own purposes.
We may also disclose data where required by law, to protect the rights, property, or safety of Noori Pro, our users, or the public, or in connection with a merger, acquisition, or sale of assets (with notice to affected users where required).
See our Cookie Policy for the full list of cookies we use, their purpose, and how to manage your preferences - including a persistent "Cookie Settings" control in the site footer.
Where Noori Pro processes Client inquiry data solely as an artist's processor, the artist, as controller, determines the lawful basis for that processing under UK GDPR Article 6 - please refer to the relevant artist's own privacy notice, where they provide one. The table below covers the processing where Noori Pro is itself the controller.
| Purpose | Legal basis |
|---|---|
| Operating artist accounts and the booking platform (artist account data) | Performance of a contract with the artist |
| Platform security logging, fraud and abuse detection | Legitimate interests - our interest in securing the Service, preventing fraud, and protecting our users and systems from misuse |
| Our own support correspondence with a Client or Artist who contacts us | Legitimate interests - responding to enquiries directed to us |
| Billing and subscription management | Performance of a contract / legal obligation |
| Marketing emails (only if you opt in) | Consent - you may withdraw this at any time without affecting the lawfulness of processing carried out before withdrawal |
| Legal/compliance record-keeping (e.g. billing records) | Legal obligation |
Automated decision-making. We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on you. If we introduce a feature that does (for example, AI-assisted quote suggestions or lead prioritisation), we will update this Policy first and describe the logic involved, its significance, and your rights in relation to it.
Full retention periods and deletion process are set out in our Data Retention & Deletion Policy. In summary: by default, Client inquiry data is retained for up to 24 months from last activity as a default processing instruction under our DPA with each artist, unless the artist selects a different supported retention period or instructs earlier deletion, or the Client requests deletion sooner; artist account data is retained for as long as the account is active, plus a limited period afterward for legal, tax, and accounting purposes.
A growing number of US states have their own comprehensive privacy laws (for example, California's CCPA/CPRA). We do not represent that all such laws currently apply to Noori Pro - several set revenue or user-volume thresholds an early-stage service like ours may not meet - but we voluntarily extend the following rights to US users on request, regardless of whether a specific state law compels us to: the right to know what personal information we collect, use, and disclose about you; the right to request deletion of it; the right to correct inaccurate information; and the right to non-discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.
If you are a client and your request concerns an artist's use of your data as controller, we may need to direct your request to the relevant artist - we will tell you if that is the case. To exercise any right, contact us at hello@noori.pro. We will verify your identity and respond within 30 days (UK GDPR) or 45 days (where a US state law applies).
We use encrypted data storage, TLS/HTTPS in transit, hashed credentials, and role-based access controls (via Supabase Row Level Security) to protect personal data. See our Security & Breach Notification Policy for more detail. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
The Service is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, contact us and we will delete it promptly.
Our infrastructure providers may process data outside the UK or your home country, including in the United States. Where personal data originating in the UK is transferred internationally, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or another lawful UK transfer mechanism) with each relevant provider; where EEA data is involved, the underlying EU Standard Contractual Clauses apply. [The specific transfer mechanism in place with each current subprocessor - Supabase, Resend, Vercel, Cloudflare - should be verified against their actual data processing agreements rather than assumed.]
When an Artist chooses to draft a quote message using our "Draft with AI" feature, we send OpenAI a subset of the relevant inquiry data - the Client's name, event location, any message the Client left, the Artist's name and bio, and the pricing breakdown - to generate a suggested message text. This happens only when the Artist actively clicks to use the feature, and the Artist reviews and can edit the draft before it is sent. We process this Client data as the Artist's processor for this purpose, on the same basis as the rest of the booking workflow (see Section 1). Under OpenAI's API terms, data submitted through the API is not used to train OpenAI's models. [This should be confirmed against our actual OpenAI account configuration rather than assumed.] OpenAI is listed as a subprocessor on our Subprocessors page.
This feature drafts text for the Artist to review - it does not itself make any automated decision about a Client or Artist. We do not currently use AI for automated decision-making, lead scoring, or profiling that produces legal or similarly significant effects. If that changes, we will update this Policy first with the additional disclosures and rights that apply.
We may update this Privacy Policy from time to time. We will post the revised policy here with an updated date, and notify registered artists by email of material changes.
Questions, concerns, or rights requests: hello@noori.pro.
All Legal Documents
© 2026 noori pro - All Rights Reserved