Nooks

Nooks uses call recordings and metadata for proprietary AI model training by default, but provides an opt-out mechanism. The Privacy Policy states users can opt out by emailing privacy@nooks.in, but warns that opting out may result in loss of certain functionality. This creates a moderate concern: while an opt-out exists, it is not the default, and the penalty for opting out (loss of functionality) may discourage users from exercising the right.

“[Privacy] 'If a User decides to record a third-party Customer Call, we may collect that call recording...If a call is recorded, we may use that data solely to provide or improve the functionality of our Services. Users are able to opt out of the use of their call recordings for model training by emailing privacy@nooks.in. By opting out, Users may lose access to certain functionality of our Services.'”

The ToS explicitly states that the customer retains sole and exclusive ownership of all Customer Data and outputs. Section 3.2 clearly states 'Company acknowledges and agrees that Customer retains sole and exclusive ownership of all right, title and interest to all Customer Data.' The license granted is limited strictly to providing the Services, with no sublicensing rights beyond essential service delivery.

“[ToS] 'Company acknowledges and agrees that Customer retains sole and exclusive ownership of all right, title and interest to all Customer Data and Customer's Proprietary Information. Company will not...disclose Customer Data to any third party, except to authorized subprocessors and service providers who are bound by obligations of confidentiality.'”

Nooks shares data with 'authorized subprocessors and service providers' under confidentiality obligations, but the Privacy Policy lists broad categories of third parties (analytics providers, AI platforms, sales/marketing tools) without publishing a specific sub-processor list. While DPAs are mentioned as binding third parties, the lack of a published sub-processor list and the breadth of 'AI Platforms' and 'Sales and Marketing Tools' creates moderate concern about visibility and control over data sharing.

“[ToS] 'disclose Customer Data to any third party, except to authorized subprocessors and service providers who are bound by obligations of confidentiality and data protection no less protective than those set forth in these Terms' and [Privacy] 'The categories of third parties we may share personal information with are as follows: ...AI Platforms...Sales and Marketing Tools...'”

The ToS requires deletion of Customer Data upon request within 30 days of account termination, but the Privacy Policy uses vague language: 'We will only keep your personal information for as long as it is necessary to provide our Services, unless a longer retention period is required or permitted by law.' The Privacy Policy also states data may be retained in 'backup archives' and isolated until deletion is possible, creating ambiguity about actual retention timelines and backup data handling.

“[ToS] 'Upon expiration or termination of this Agreement, Company will, upon Customer's written request made within thirty (30) days after the effective date of expiration or termination, make available to Customer an export of Customer Data' and [Privacy] 'To the extent that this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.'”

The ToS explicitly grants the customer ownership of all outputs and generated content. Section 3.2 states 'Customer shall own all right, title and interest in and to the Customer Data, as well as any data that is based on or derived from the Customer Data and provided to Customer as part of the Services.' Nooks retains rights only to Aggregated Data and the Services themselves, not to customer-generated outputs.

“[ToS] 'Customer shall own all right, title and interest in and to the Customer Data, as well as any data that is based on or derived from the Customer Data and provided to Customer as part of the Services. Company shall own and retain all right, title and interest in and to (a) the Services and Software...and (d) all intellectual property rights related to any of the foregoing.'”

Nooks claims compliance with EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF frameworks and states it has 'certified' adherence to these principles. However, no SOC 2 Type II, ISO 27001, or HIPAA certifications are mentioned. The Privacy Policy references 'appropriate and reasonable technical and organizational security measures' but provides no published security documentation, trust page, or third-party audit certifications beyond DPF self-certification.

“[Privacy] 'Nooks complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce. Nooks has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles' and 'We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process.'”