Privacy Policy

1. Data Controller

The data controller for your personal data is:

• Trade name: DETERMOS, provider of the Nomos platform

Nomos is currently operated by an individual acting as a self-employed professional (autónomo) while a company is being incorporated; these identification details will be updated upon incorporation.

2. Data We Collect

• Account data: email address, username, password (encrypted by Firebase Auth).
• User-uploaded content: text, instructions, and documents provided for document generation.
• Images: image files uploaded for analysis and inclusion in documents.
• Audio: voice recordings for transcription. Audio files are not stored permanently; they are processed in memory and deleted after transcription.
• Generated documents: the text and information produced by the system from user instructions.
• Knowledge base: reference instructions and data that users configure per organization to guide document generation.
• Tender profile (Licitaciones): the business preferences you configure to find public tenders — a free-text description of your activity/specialties, CPV codes, and minimum/maximum contract amounts. The tenders detected for you are stored so you can review them.
• Workspace data: if you create or join a shared workspace, the name and email address of its members are stored to manage access to the shared content. Whoever invites another person is responsible for having their authorization.
• Referral data: if you sign up through an invitation link, we store the identifier of the user who invited you, in order to credit the referral bonus.
• Payment data: handled entirely by Stripe. Nomos does not store card details.
• Technical usage data: activity logs, session identifiers, operation metadata.

3. Purposes and Legal Basis

4. Third-Party Service Providers

Nomos uses the following external services acting as data processors or recipients:

5. International Data Transfers

AI providers (OpenAI and Anthropic) and Stripe are headquartered in the United States. Data transfers to these providers are made under the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision 2021/914), ensuring an equivalent level of protection to that required in the EU.

Content you enter on the platform (text, images, audio) may be processed on servers located in the United States when using document generation, image analysis, or audio transcription features, always under the safeguards described above.

Your stored content and settings — generated documents, knowledge base, tender profile, and application data (Firestore), the files you upload (Cloud Storage), and the service's application logs — are kept at rest in European Google Cloud data centers (regions eur3 and europe-west1). Two exceptions run on Google's global infrastructure and may involve the United States: account credentials managed by Firebase Authentication (email and password hash), and the administrative audit records Google Cloud keeps for the project, whose location Google does not allow to be changed. Both remain covered by the safeguards described above (EU-U.S. Data Privacy Framework and/or SCCs).

6. Data Retention

Your data will be retained while your account is active or as needed to provide the service. After account cancellation, data will be deleted or anonymized within a reasonable timeframe, unless there is a legal obligation to retain it longer (e.g., billing data for the period required by applicable tax law).

Audio files uploaded for transcription are processed and deleted immediately after the operation; only a partial transcription summary (maximum 1,000 characters) is retained for audit purposes.

7. Your Rights

Under the GDPR, you have the right to:

• Access: request confirmation and a copy of the data we process about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data when it is no longer necessary or you withdraw consent.
• Restriction of processing: request that we suspend processing under certain circumstances.
• Data portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

You can exercise your rights by writing to nomos.servicedesk@gmail.com stating the right you wish to exercise. If there are reasonable doubts about your identity, we may ask for additional information to verify it. We will respond within one month, extendable by two months in complex cases.

8. Complaint to a Supervisory Authority

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with your local supervisory authority. In the EU, you can find your authority at edpb.europa.eu. In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD): www.aepd.es

9. Cookies

Nomos uses strictly necessary technical cookies for authenticated session management (managed by Firebase Authentication). These are exempt from consent under Art. 22.2 LSSI.

Nomos also uses Google Analytics 4 (provided by Google, via the Firebase/GA4 measurement ID) to understand aggregated usage of the platform. Analytics cookies are only activated once you give your consent through the cookie banner: we implement Google Consent Mode v2, so no analytics or advertising identifier is stored until you accept. You can accept, reject, or change your choice at any time.

In addition, Nomos uses Vercel Analytics and Vercel Speed Insights to measure performance and traffic. Both are cookieless and only process aggregated, anonymized technical data.

For the full list of cookies, their purpose and duration, and how to manage them, see our Cookie Policy.

10. Special Categories of Data

Nomos is not designed or enabled to process special categories of data under Art. 9 GDPR (health data, ideology, religion, racial origin, sexual orientation, trade union membership, genetic or biometric data, criminal convictions). Users agree not to upload this type of data to the platform.

11. Changes to This Policy

Nomos may update this Privacy Policy at any time. Substantial changes will be communicated via a platform notice or email with reasonable advance notice. Continued use of the service after changes take effect constitutes acceptance.