Privacy Policy
Effective date: 2026-08-05. Last updated: 2026-11-12.
Published and in effect. Any amendment version-bumps this page.
nommi works, Inc. ("Nommi", "we") respects your privacy. This policy explains what we collect, why, who we share it with, and your rights. It is written in plain English. Sections 4, 9 and 10 add what EU/UK GDPR, California law and Turkish KVKK require.
01 · Who this policy covers
- Visitors to nommi.ai (the marketing site, resources, and tool landing pages)
- Account holders using the product (signed-in users running tools)
- Recipients of our product or transactional emails
- Investors, partners and firms whose public data we may hold (covered separately in §11)
02 · What we collect from you
2.1 At signup
- Email address (required for magic-link auth)
- Google profile (name, email, profile image) if you sign in with Google. We keep your first name on your account so we know who you are when you write to us; the app does not address you by it, and on request we correct or delete it
- Context you choose to share about what you are building (your first input, your stage, your project descriptions), used to make tool runs relevant to you
- Country code (read from your IP when you sign up, used for tax calculation and, if you allow analytics, in product analytics; write to us and we correct it)
2.2 When you use the product
- Tool inputs you submit (pitch deck content, idea descriptions, customer interview transcripts, URLs, files)
- Files you upload to a tool. We read each file once, keep the text and a short summary we draw from it with your project, and delete the file itself once it is read.
- Tool outputs we generate (verdicts, rewrites, scripts, checklists)
- The email addresses you name when you share a tool result by link. We use them only to check who may open it, show them only to you, and never write to them.
- Vault items you save
- Chat messages and attachments
- Workspace usage metadata (session timestamps, tool runs, durations, errors)
- Questions you type into the ask box, whether or not you have signed up. We send the question through OpenRouter to a language model to suggest the tools that fit it, and use it to answer in your language. It never goes into our logs, analytics record only a category label, and a redacted copy may be kept up to 30 days to check the suggestions, then deleted.
2.3 Automatic collection
- Standard request data (IP address, user agent, referrer, timestamp)
- Cookies and similar (see our Cookie Policy at nommi.ai/cookies)
- Analytics events (see §5 for who processes them)
- Session recordings, only with your analytics consent (see §2.5)
2.4 Payment data
We do not store your credit card. Stripe stores it and gives us a token + last-4 digits + brand for display. See Stripe's privacy policy at https://stripe.com/privacy.
2.5 Session recordings
What it is. With your analytics consent, we record how you move through the product: the pages you open, where you click and scroll, and browser errors. It plays back like a screen recording of your session. We use it to find where the product confuses people, and for nothing else.
What is never recorded. Everything you type and everything a tool writes back to you is masked before the recording leaves your browser. That covers what you paste into a tool, your vault contents, your project notes and every tool result. We never see those words in a recording, and masking happens on your device, so they are never transmitted.
Consent. Session recording sits in the analytics category of our Cookie Policy. In the EU and EEA, the UK, Switzerland, Turkey and California, analytics and recording stay off until you accept them. Everywhere else they are on by default until you decline them, and a Global Privacy Control or Do Not Track signal from your browser counts as declining. You can withdraw consent at any time and recording stops immediately.
Retention. Recordings are deleted after 30 days. They are deleted sooner if you ask us to, and account deletion removes them along with everything else.
Who can see them. Only the nommi team, through our analytics provider. Recordings are never shared, sold, or used for advertising.
2.6 What nommi keeps to answer you
What it is. Once you sign up, nommi keeps what it needs to work: your sign-in session and the cookies that carry it, the facts you give it or confirm about you and your company (your vault), your projects, the inputs you give a tool and the results it writes back, and your billing records.
Why no banner asks. The service you signed up for cannot run without these, so we process them to perform our contract with you (see §4). No consent banner asks for them and no cookie choice turns them off. Nothing on this list is used to measure you, to advertise to you, or to train a model (see §3).
How it ends. You can take a fact out of your vault or a file out of a project at any time, and deleting your account (see §8) deletes all of it, within the windows in §7.
What is different. Analytics and session recording (§2.5) and marketing cookies need your consent. You can refuse them, or take a yes back, at any time in the cookie preferences, which open from the "cookie settings" link in the site footer, from Cookie settings in your account settings, or at nommi.ai/?consent=manage. Refusing changes nothing about the service.
03 · What we do with it
We use your data to:
- Run the tools you ask us to run.
- Deliver magic-link sign-in.
- Process payments and add usage to your account.
- Send transactional emails (receipts, billing alerts, password-free login links).
- Send a few product reminders tied to what happened on your account: for example when you signed up and nothing has run yet, when one tool finished and you did not come back, when your usage ran out, or when your free usage came back. At most one every three days. Each carries a one-click unsubscribe that stops all of them within two days.
- Send you nommi news (a changed tool, a new radar, an announcement) if you ticked the box at sign-up that says nommi may send you reminders and news. At most one a day and two a week. Each carries the same one-click unsubscribe, and one click stops news and reminders together.
- Improve the service (aggregate, anonymized usage analysis).
- Detect abuse, fraud, and security incidents.
- Comply with legal obligations (tax reporting, lawful requests).
We do NOT:
- Sell your data to third parties.
- Use your tool inputs or outputs to train our own foundation models.
- Use any model provider that trains on your inputs or outputs (requests currently go through OpenRouter).
- Share workspace content with other users, unless you create a share link for a tool result. That link opens a frozen copy of the result, with only what you chose to include, and only for someone signed in to nommi with one of the email addresses you named when you created it.
04 · Lawful basis (GDPR and UK GDPR)
We process your data under:
- Contract: to provide the service you signed up for: your account (including the first name from your Google profile) and sign-in session, your vault and the facts nommi keeps to answer you, your projects, tool runs and results, and billing (see §2.6). No consent banner asks for these.
- Legitimate interest: to improve the service from server logs and aggregate counts that set no cookie, to open a tool result you shared only for the people whose email addresses you named, to detect abuse, to send service updates that materially affect you, and to send the product reminders in §3 to an account holder about the service she signed up for, each with a one-click unsubscribe. Where the law of your country asks for a prior yes to such a reminder, none is sent until you give it: the box at sign-up is that yes, and you can tick or untick it later in your account.
- Consent: for nommi news, through the box at sign-up; for the product reminders where your country asks a prior yes, through the same box; for analytics cookies and session recording, marketing cookies, and any use of your Google profile beyond your email and the first name kept on your account. Each can be refused, and a yes taken back, at any time, with no effect on the service.
- Legal obligation: for tax reporting, lawful access requests, and required record-keeping.
You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Cookie consent is withdrawn in the cookie preferences (see §2.6); any other consent by email to privacy@nommi.ai.
05 · Who we share with (data processors)
We use the following third-party processors. Each is contractually bound to GDPR-compliant terms.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Stripe | Payment processing | Email, payment data, billing address, transaction history | US (with EU subprocessors) |
| OpenRouter | LLM API gateway | Tool inputs + outputs, including the files you upload (in transit; not stored by OpenRouter beyond logs per their policy) | US |
| Exa | Web search, when a tool looks up who has already tried an idea like yours, and when the Idea Radar looks for public evidence for an idea it suggests to you (reached through OpenRouter) | For a tool: a short search category made from your idea, a few words, never your own sentence and never the name of a person, company or product. For the Idea Radar: a short search query about the idea it suggests, with links, email addresses and phone numbers removed | US |
| Cloudflare | DNS, content delivery, load balancing, and hosting of the web app | IP address and request metadata (the country read from your IP at sign-up is kept on your account, see §2.1) | Global edge network |
| Amazon Web Services | Cloud hosting | All data | EU (Frankfurt) |
| Resend | Transactional email and the product reminders in §3 | Email, name, language, delivery and bounce metadata. Reminders carry no open or click tracking | US |
| PostHog | Product analytics, session recording, and deciding when a product reminder in §3 is due | Your user ID, email, language, sign-in method, plan and, if you allow analytics, the country read at sign-up; event data; session recordings with all typed text and all tool output masked at source; which reminders were sent to you and whether you unsubscribed | US (EU instance available on request) |
| Google Analytics 4 | Marketing attribution (anonymized session-level only) | No per-user identifiers | US |
| Google Sign-In | OAuth (only if you sign in with Google) | Profile email, name | US |
OpenRouter forwards tool inputs to the model provider it routes each request to (for example Anthropic, OpenAI or Google), under the training setting in §3.
When a tool looks up who has already tried an idea like yours, it first turns your idea into a short search category of a few words, and only that category goes through OpenRouter to Exa, which searches the web and returns the pages it finds. Your own words, your name, your email and anything else about your account are not sent to Exa.
When the Idea Radar finds an idea for you, it writes a short search query about that idea to look for recent public evidence of demand or competition. Any link, email address or phone number is removed from the query, and only the query goes through OpenRouter to Exa. The idea is one nommi suggests, not your own words, and your name, your email and your account are not sent to Exa. The query can name existing companies or products in the idea's market.
We do NOT share your data with any other parties except as required by law or as you direct (for example, you create a share link for a tool result, which only the nommi accounts signed in with the email addresses you named can open).
Partner links. Some tool results end with links to products the result already picked, whose makers may pay us a commission when you sign up or buy through them (see the Terms of Service, §9). Partners are not processors, and we send them nothing about you: not your name, email or account, not anything you typed and not anything a tool wrote. Your browser does not tell the partner which nommi page you came from. Once you open a link, the partner's site sees your visit the way it sees any visitor, and may use its own cookies to credit the visit to nommi, under its own privacy policy. On our side, if you have allowed analytics, a click is recorded as one product event, like our other analytics events, with three facts about it: the tool, where in the result the link appeared (its position, not its words), and the partner. It is kept with those events (PostHog, above) for 12 months (§7).
06 · International transfers
Data is processed in the US and EU. For EU/UK personal data transferred to US processors, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO, plus supplementary measures (encryption in transit and at rest, processor SOC 2 attestations where available).
07 · How long we keep it
| Data | Retention |
|---|---|
| Account email + profile | While account is active, then deleted within 30 days of a deletion request |
| Tool inputs you submitted | 12 months by default; you can request deletion sooner; vault items are retained while saved by you |
| Tool outputs | 12 months by default; same as inputs |
| A copy of a tool result you shared by link | Stops opening when the link runs out (7, 30 or 90 days, your choice) or when you stop it; otherwise kept as tool outputs are |
| The email addresses you named for a shared result | Deleted when you remove them or stop the link, and within 30 days after the link runs out |
| Which accounts opened a result shared with them | Kept with the shared copy; shown to the person who shared it only as a count, never as names |
| Files you upload to a tool | Deleted as soon as the tool has read them; a file that is never read is deleted 30 days after upload |
| The text and summary drawn from a file | Kept with your project, outside the 12-month default above, until you take the file out of the project's context or delete your account |
| Payment + billing records | 7 years (US tax law minimum) |
| Per-user PostHog events | 12 months |
| Session recordings | 30 days |
| Aggregated anonymized analytics | Indefinite |
| Magic-link tokens | 10 minutes to use, then deleted within the hour |
| The question you typed before signing in | Kept with your sign-in link so it is waiting for you wherever you open the link; removed when the link is used or expires, within 15 minutes |
| Server logs (request, error) | 30 days |
| Stripe data | Per Stripe's retention |
When you request account deletion (see §8), we delete the above within 30 days, except records we are legally required to keep (e.g., tax records). We notify you when deletion is complete.
08 · Your rights
You have the following rights over your personal data:
- Access: request a copy of the data we hold about you.
- Rectification: request correction of inaccurate data.
- Deletion (right to be forgotten): request deletion of your account and personal data.
- Portability: receive your data in a machine-readable format (JSON).
- Restriction: request that we limit processing while you contest accuracy.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: withdraw consent for analytics or marketing cookies in the cookie preferences at any time (see §2.6), and for other consent-based processing by email. Stop the product reminders with the one-click unsubscribe in any of them.
To exercise any right: email privacy@nommi.ai. We respond within 30 days (sometimes sooner; complex requests may take up to 90 days with notice).
You also have the right to lodge a complaint with a data protection authority in your country (in the UK, the ICO; in Turkey, the Personal Data Protection Authority (KVKK); in California, the AG; in the EU, your national DPA).
09 · California specific (CCPA + CPRA)
California residents have these additional rights:
- Right to know what personal information we collect, use, disclose, and sell (we do not sell).
- Right to delete (covered by §8).
- Right to correct.
- Right to opt out of sale or sharing. We do not sell your personal information. You can set your cookie choices at any time in the cookie preferences, which open from the "cookie settings" link in the site footer, from Cookie settings in your account settings, or at nommi.ai/?consent=manage, and a Global Privacy Control signal from your browser counts as opting out.
- Right to limit use of sensitive personal information (we do not knowingly collect sensitive PI).
- Right to non-discrimination for exercising any of the above.
"Sensitive personal information" categories per CPRA: we do not collect SSN, driver's license, financial account credentials, precise geolocation, race or ethnicity, religious beliefs, union membership, mail/email/text content, genetic data, biometric identifiers, health data, or sexual orientation. Email is collected but not classified as sensitive under CPRA.
10 · Turkey specific (KVKK)
Turkish data subjects have rights under the Turkish Personal Data Protection Law (KVKK) substantially equivalent to GDPR. Data controller: nommi works, Inc., contact privacy@nommi.ai.
11 · Curated reference data (investors and benchmarks)
We may keep reference data about investors and firms drawn from public and published sources: SEC filings, published benchmark reports, fund and partner public profiles, publicly announced funding rounds, and similar. Records carry their source and as-of date.
If you are an investor, partner, or firm representative and want your record corrected or removed, email privacy@nommi.ai. We respond within 30 days. We retain the right to keep records that are documented in public sources (e.g., publicly announced funding rounds) for our reference purposes, but we will remove personal contact information (email, phone, direct LinkedIn URL where not publicly listed) on request.
12 · Children
The service is not directed at children under 16. We do not knowingly collect data from children under 16. If we learn we have collected such data, we delete it promptly.
13 · Security
We use technical and organizational measures appropriate to the risk: encryption in transit and at rest, strict access control on production systems and credentials, least-privilege access for staff, passwordless sign-in, and regular security review.
For vulnerability reports: see https://nommi.ai/.well-known/security.txt or email security@nommi.ai.
14 · Changes to this policy
We may update this policy. Material changes will be announced via email to your account address. Continued use after the effective date constitutes acceptance.
15 · Contact
- General privacy questions: privacy@nommi.ai
- Data subject rights requests: privacy@nommi.ai (we respond within 30 days)
- Security: security@nommi.ai
- Legal notice: legal@nommi.ai
nommi works, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, US.
If you have questions or want to exercise a right, email privacy@nommi.ai. We aim to respond within 5 business days even for non-urgent requests.