1. Who we are
2. Our role
Noima is a platform that businesses (our customers) use to organise company knowledge, work with AI agents and connect the systems they already use. Each customer's space in Noima is called a workspace.
- Workspace content (everything a customer or its users put into a workspace or sync into it from connected systems): the customer is the controller and we process it only on the customer's instructions, as its processor, to provide the service.
- Account, billing, security and website data: we are the controller.
3. What we collect
- Account data: your email address, name if you provide it, sign-in and multi-factor authentication settings, and which workspaces you belong to and in which role.
- Workspace content: objectives, notes, hypotheses, decisions, experiments, reports, uploaded files, agent instructions and results, approvals and comments.
- Data from connected systems: when a workspace connects a system such as HubSpot, Google Analytics or Slack, we read the data that system allows under the permissions the workspace granted (for example campaigns and closed deals, daily sessions and key events per campaign, or messages from chosen channels).
- Billing data: plan, invoices and payment status. Card details are entered with and held by our payment processor; we never see or store full card numbers.
- Usage and security records: an audit trail of actions in each workspace, AI usage for billing, and technical logs (including IP addresses and browser information) used to keep the service secure, prevent abuse and apply rate limits.
- Communications: messages you send us and emails we send you (invitations, notifications, security and service messages).
4. How we use it and why
- To provide the service you or your organisation signed up for: accounts, workspaces, search, agents, integrations, notifications and exports (performance of a contract).
- To bill for paid plans and meet accounting and tax obligations (contract and legal obligation).
- To secure the service, investigate misuse and keep an audit trail customers can rely on (legitimate interests and, where required, legal obligation).
- To send service and security messages; you can choose which notifications you receive by email in your inbox settings (contract and legitimate interests).
- To answer requests and support you (contract and legitimate interests).
We do not sell personal data, we do not use it for advertising, and we do not use workspace content or data from connected systems to train AI models.
5. AI processing
When a workspace uses AI agents, the relevant workspace content is sent to our AI model provider to produce the requested result. The provider processes it on our behalf under terms that do not allow it to train its models on that content. Agents act only within the permissions and approval rules the workspace sets, and their proposals and actions are recorded in the workspace's audit trail.
6. Data from Google APIs
analytics.readonly) to read reports for the property the workspace chooses. Noima's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.- We use Google Analytics data only to show and analyse it inside the workspace that connected it.
- We do not transfer it to others except as needed to provide that feature, to comply with law, or as part of a merger or acquisition with notice.
- We do not use it for advertising, we do not sell it, and we do not use it to train AI models.
- People at Noima do not read it unless the workspace asks us to for support, it is needed for security or to comply with law, or it has been aggregated and anonymised for internal operations.
- A workspace can disconnect Google Analytics at any time; we then delete the stored access tokens and ask Google to revoke the grant. You can also remove Noima's access in your Google Account settings.
7. Connected systems
Integrations are read-only: Noima does not change anything in HubSpot, Google Analytics or Slack. Access tokens are encrypted before they are stored and are deleted when the workspace disconnects the system. Records already synced stay in the workspace as evidence until the workspace deletes them or is deleted.
8. Service providers
We use a small number of providers to run Noima. Each processes data only on our instructions under a data processing agreement.
- Hetzner Online GmbH (Germany): hosting of the servers, databases and file storage that hold all platform data.
- Stripe (Ireland and United States): payment processing and invoicing for paid plans.
- Anthropic (United States): AI model processing when workspaces use AI agents.
- Zoho Corporation (United States): delivery of transactional email such as invitations, notifications and sign-in messages.
Sign-in and identity management run on our own infrastructure. We will update this list before adding a provider that processes customer personal data.
9. Where data is stored and international transfers
Platform data is stored on servers in Germany. Some providers listed above process data in the United States; those transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses with additional safeguards.
10. How long we keep data
- Workspace content: for as long as the workspace exists. When an owner deletes a workspace it closes immediately and its content is permanently deleted after a 7-day period in which the deletion can be cancelled.
- Workspace exports: available to download for 7 days.
- Connected-system access tokens: deleted as soon as the system is disconnected.
- Audit trail and usage records: kept after a workspace is deleted for as long as needed for security, billing and legal obligations.
- Billing records: as long as Romanian accounting and tax law requires.
- Encrypted backups: kept for up to 30 days, after which deleted data is gone from backups too.
11. Security
13. Your rights
Under the General Data Protection Regulation you can ask for access to your personal data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. Where processing relies on consent you can withdraw it at any time.
14. Children
Noima is a service for businesses and is not intended for anyone under 16. We do not knowingly collect their data.
15. Changes
We will post changes on this page and update the date above. If a change materially affects how we handle personal data, we will tell workspace owners by email before it takes effect.