Privacy Policy
Nomos ("Nomos," "we," "us," or "our") provides an AI-powered legal research, document review, and drafting platform. This Privacy Policy explains what information we collect, why we collect it, and how we handle it.
This policy applies to nomoslegalai.co.za, our desktop application, our Word add-in, and any other product we refer to as "Nomos" or "the Service."
1. Who this policy covers
If you are located in South Africa, our processing of your personal information is governed by the Protection of Personal Information Act 4 of 2013 (POPIA). If you are located in the European Union or United Kingdom, it is additionally governed by the General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR. We describe your rights under each regime in Section 7.
2. Information we collect
Account information
When you create an account, we collect your email address and, if you sign up with a password, a securely hashed version of it. We do not store your password in plain text. If you sign in with Google, we receive your name, email, and profile identifier from Google's sign-in service.
Access and invitation status
Because Nomos currently operates on an invite and waitlist basis, we keep a record of your invitation, access, or waitlist status.
Session data
When you log in, we issue a signed session cookie that keeps you logged in for a limited period. This cookie identifies your session, not your identity directly.
Query content
The text, documents, and questions you submit to Ask, Review, or Draft are processed in order to generate a response. This may include the content of legal questions, uploaded documents, and drafted material.
If you are a legal professional. If you input a client's information, facts, or documents into Nomos, you are responsible for ensuring you have the necessary authorization to do so under your professional obligations. Nomos processes this content to provide the Service. See Section 4 for how long we retain it and Section 5 for who else may process it.
Usage and technical information
We collect information about how you use the Service (pages visited, features used, and similar activity) to maintain and improve the product. We may also collect standard technical information such as browser type, device type, and IP address for security and diagnostic purposes.
Payment information
If you are on a paid plan, payment is handled by Stripe. We do not store your full card number. Stripe processes payment details in accordance with its own terms and security standards.
3. How we use your information
We use the information described above to:
- Provide, operate, and maintain the Service
- Authenticate you and keep your account secure
- Generate responses to your Ask, Review, and Draft requests
- Communicate with you about your account or the Service
- Improve and troubleshoot the Service
- Comply with legal obligations
We do not sell your personal information to third parties.
4. How long we keep your information
We retain account information for as long as your account is active. We retain query content as needed to provide the Service and for diagnostic purposes, unless a longer period is required by law. We do not currently publish a fixed deletion schedule.
To request deletion of your account or query content, use the Contact page. Account deletion is handled by us. There is not yet a self-service deletion setting in the product.
5. Who we share information with
We may share information with:
- Service providers who help us operate Nomos: for example, our cloud infrastructure provider (Google Cloud) and, for South African legislative content, our licensed data provider (Laws.Africa). These providers only process information as needed to provide their service to us.
- AI model providers used to generate responses within the Service.
- Payment processors, where you are on a paid plan, as described in Section 2.
- Legal or regulatory authorities, where required by law.
We do not share your query content with other users of the Service.
6. Security
We take reasonable technical and organizational measures to protect your information, including encrypted password storage and signed session authentication. Nomos has not yet obtained SOC 2 or ISO 27001 certification. That work is in progress. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Your rights
If you are in South Africa (POPIA): you have the right to request access to, correction of, or deletion of your personal information, and to object to certain processing, subject to the requirements of POPIA. You may lodge a complaint with the Information Regulator of South Africa.
If you are in the EU or UK (GDPR): you have the right to access, rectify, erase, restrict, or port your personal information, and to object to certain processing, subject to the requirements of the GDPR. You may lodge a complaint with your local data protection authority.
To exercise any of these rights, use the Contact page.
8. Children
Nomos is not directed at, and should not be used by, anyone under the age of 18. We do not knowingly collect information from children.
9. International transfers
Because Nomos operates on Google Cloud infrastructure and serves users in multiple countries, your information may be processed outside of your home country. Where required, we rely on appropriate legal safeguards for such transfers.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will indicate the date of the most recent update at the top of this page.
11. Contact us
If you have questions about this Privacy Policy, use the Contact page.