Privacy Policy

1. Who we are

Extreme Retail Ltd., company number 516289774, of 22 Brodetzky St., Tel Aviv, Israel (“Nostali”, “we”, “us” or “our”) operates the Nostali service. We are the controller of personal information described in this Policy unless we say otherwise.

Privacy questions and requests may be sent to [email protected]. Providing information is generally voluntary, but required information is necessary to create an account, process a purchase or provide the requested feature.

2. Information we collect

Depending on how you use Nostali, we may collect:

• Account and contact information: email address, authentication records, language, profile and preferences.
• Your content: photographs, album pages, extracted images, generated results, videos, captions, stories, dates, places, notes, people, family relationships, social-profile links, face bounding boxes and the people you manually associate with them. This may reveal sensitive facts about you or others.
• Guest workspace information: files and drafts used before registration. These remain in your browser until imported or removed; we do not receive them merely because you use the guest workspace.
• Processing information: selected service, settings, prompts, job state, provider/model identifiers, results, errors, cost and usage records.
• Purchases and rewards: packages, subscriptions, Moments ledger, coupons, referrals, orders, billing email, payment status, invoice identifiers, cancellations, refunds and provider references. Nostali does not intend to store full card numbers.
• Sharing and communications: share links, support requests, optional Telegram identifiers/messages and service emails.
• Technical and security information: IP address, device/browser data, timestamps, essential cookies, request/security logs, rate limits, audit and diagnostic records.

3. How we use information

We use information to provide and secure accounts; store and organize private libraries; detect and straighten photographs; generate requested restorations, edits, colorized images and videos; preserve originals and versions; manage people and relationships; enable controlled sharing; operate Moments, subscriptions, payments, rewards and orders; provide support and service messages; prevent abuse; investigate errors; enforce our Terms; comply with law; and improve reliability, safety and usability.

We do not use a generated result as a factual determination about a person or make decisions producing legal or similarly significant effects through automated processing. We may use aggregated or de-identified information for analytics and improvement where permitted.

4. Legal grounds

Where a legal basis is required, we process information to perform our contract, take steps at your request, comply with legal obligations, protect legitimate interests such as security and fraud prevention, and, where required, based on consent. You may withdraw consent for future processing without affecting prior lawful processing.

5. AI and face processing

When you request an AI feature, the selected image, instructions and limited job information may be sent to the applicable AI provider. Generated content can infer, alter or invent visual details and motion. It is not proof of identity, health, age, relationships or events.

For authenticated cloud uploads, Nostali may use Google Cloud Vision to propose rectangles around likely faces. Existing photos are sent only when you explicitly start detection or tagging. We send normalized pixels from the current primary still image (or a still-image fallback), without person names. The feature does not identify people, create face embeddings or automatically match faces. You decide whether to associate an existing or new person with a proposed box. The private coordinates and face crop remain tied to the source image until you change them.

Google states that content sent to online Vision operations is processed in memory rather than persisted to disk, is not used to train or improve Cloud Vision, and limited request metadata may be logged temporarily. You must have the right to upload and process content and information about other people, including any required consent or lawful basis. Avoid identification documents, medical records, intimate images, precise financial information or other unnecessary sensitive material.

6. When we share information

We may share information with the providers below; people you deliberately invite; professional advisers and corporate transaction participants under confidentiality; authorities or others when reasonably necessary to comply with law, protect rights and safety or respond to valid process; and a successor in a merger, financing, reorganization or sale.

We do not sell personal information. A share link exposes only selected content until expiry or revocation, but anyone receiving a live link may view or forward it.

7. Subprocessors and service providers

These providers may process information when the relevant feature is used. Their subprocessors may also process it under their terms and data-protection commitments.

We may add, replace or remove providers as Nostali evolves. We will update this Policy before a material new provider processes user content and provide additional notice or obtain consent where required.

8. International transfers

Nostali is operated from Israel, and providers may process information in Israel, the United States, Europe and other countries. Where required, we use adequacy decisions, contractual safeguards or another lawful mechanism. Israel is currently recognized by the European Commission as providing adequate protection for data transferred from the EEA.

9. Retention and deletion

We retain account content while the account is active and as reasonably needed to provide the service. You may permanently delete eligible photos or request account deletion. Active processing, unresolved payment matters, legal claims, security investigations, physical-order records and tax obligations may delay or limit deletion.

Billing, tax, fraud-prevention, audit and legal records may be retained as required or permitted. Backups and provider caches may clear on a delayed cycle. De-identified information may remain. Guest data stays on your device until cleared, imported or the browser profile is removed.

10. Security

We use safeguards designed for the service, including access controls, private storage, row-level authorization, short-lived access links and encryption in transit. No service can guarantee absolute security. Keep access emails and share links private and report suspected unauthorized access.

11. Your choices and rights

Account tools let you view, edit, download, export, share, revoke and delete certain information. You may email us to request access, correction, deletion, restriction, objection or portability where applicable, or withdraw consent. We may verify identity and retain information where law permits or requires.

Israeli law may provide rights to inspect personal information and request correction of information that is inaccurate, incomplete, unclear or outdated. EEA/UK and other residents may have additional rights and may complain to their local authority or the Israeli Privacy Protection Authority.

12. Cookies, communications and age

We use essential cookies and local storage for authentication, security, preferences and the guest workspace. If we add non-essential advertising or cross-site analytics, we will update this Policy and request consent where required. Service messages may be sent by email or connected Telegram. Essential account, billing, security and legal notices cannot always be opted out of.

Nostali is only for people aged 18 or older. Photographs may depict children, but an adult user must have the right to upload and process them.

13. Changes and contact

We may update this Policy as the service, vendors or law change. We will post a new effective date and give additional notice where required. Material changes apply prospectively unless law permits otherwise.

Extreme Retail Ltd., company number 516289774, 22 Brodetzky St., Tel Aviv, Israel. Email: [email protected].