NomaNoma
Sign up

[ legal ]

Privacy Policy

How Noma collects, uses and protects personal data, who we share it with, and the rights you have over it.

Last updated

1. Who we are

Noma is provided by Nurdd Solutions Private Limited (“Nurdd”, “we”, “us”), a company incorporated in India with CIN U73100HR2026PTC143293 and its registered office at Unitech Cyber Park, Sector 39, Gurugram, Haryana, India.

This policy explains how we collect, use, share and protect personal data when you visit our website at nomahq.app or use the Noma application (together, the “Service”). For any privacy question or request, write to privacy@nurdd.club.

2. Who this policy covers, and our role

This policy covers personal data about:

  • visitors to our website;
  • people who create a Noma account, and the team members they invite;
  • people who request a free brand audit, book a call, or otherwise contact us.

For our website, your account and our own business records, we decide how and why personal data is used, so we are the controller (or “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). When a business customer puts data into Noma, such as server logs from its own website, that customer decides what the data is for and we process it on its behalf.

3. Information we collect

Information you give us

  • Account details: your name, work email and password. Passwords are handled by our sign-in provider and stored only as a hash. If you sign in with Google, we receive your Google account name, email and profile image. If a colleague invites you to their workspace, we receive your email address from them.
  • Workspace details: your company or brand name, website domain, industry and country, entered when you set up Noma.
  • Billing details: your plan, billing name, email and address, your GST or other tax number where you give one, and the invoices we issue to you. Card and bank details are collected by our payment processors; we do not store full card numbers.
  • Requests and messages: the email and website you give for a free brand audit, the details you give when you use one of our free tools (such as your name, email, company and role), the details you give when booking a call or making an enterprise enquiry, and anything you send to support or sales. A free brand audit is emailed to you and shared with our sales team, who may follow up about it.
  • Referral programme: if you share a referral link, we record which workspaces sign up through it and the commission they earn you. When someone clicks a referral link, we record the referral, the country and the referring page, not who the visitor is.

Information collected automatically

  • IP address, browser and device type, operating system, referring page, pages viewed, features used and timestamps. We use the IP address to estimate your country, for example to choose a currency, and to limit repeated requests to our free tools.
  • Session recordings and heatmaps of how pages are used. Recording tools mask sensitive fields such as passwords by default, and mask more of the page on billing and checkout screens.

How these tools are loaded is covered in Cookies and analytics.

Content you set up in Noma

  • The brands, domains, competitors, topics and prompts you choose to track.
  • What Noma retrieves for you from AI engines: their answers, the brands they mention, the sources they cite, positions and sentiment. Noma currently queries ChatGPT (GPT-4o mini and GPT-5), Claude, Gemini, Perplexity, Grok, DeepSeek, Qwen and Mistral through their APIs. AI answers sometimes name real people, such as a company’s founders or staff; Noma stores the answers as the engines return them.
  • Technical findings from crawling and speed-testing the pages you ask us to audit, including your competitors’ public pages.
  • Content drafts, images and chat conversations you create in Noma.
  • Google Search Console and Google Analytics data, if you connect them. We ask Google only for read-only access. For Search Console, we read search performance (queries, pages, clicks, impressions, positions) for properties you choose. For Google Analytics, we read the list of GA4 properties you can access and report data such as sessions, users, landing pages, traffic sources and conversions. We use this data only to show you reports inside Noma. We never change your Google data or settings.
  • Google Ads data, if you connect it. We read campaign performance (campaign names and status, cost, clicks, impressions and conversions for the last 30 days) for the Ads account you choose, to show paid results beside your organic search and AI visibility. Google Ads offers only one access scope, which also permits changes; Noma uses it only to read reports and never creates, edits or deletes campaigns, ads, budgets or settings.
  • Server log data you send us for Agent Analytics, described in the next section.

4. Server logs you send us (Agent Analytics)

Agent Analytics shows which AI crawlers read a customer’s website and which visitors arrive from AI assistants. It works from server logs the customer chooses to send us, by webhook, Vercel log drain or access-log upload. Those logs describe requests to the customer’s website, so they can contain personal data about that website’s visitors.

  • Requests from AI crawlers: we store the request details, including the IP address, user agent, requested page, referrer, status code and time.
  • Visits referred by AI assistants: we do not store the raw IP address. We keep the country and device type derived from the request, and a session identifier made by hashing the IP address, user agent and date, which changes every day.

For this data the customer is the controller and we act on its instructions. Customers are responsible for having the right to share their logs with us and for telling their own visitors, for example in their own privacy notice. If you visited a website that uses Noma and have a question about your data, please contact that website first; we will help it respond.

Log data is kept for as long as the project it belongs to exists, and is deleted when the customer deletes that project or asks us to delete it.

5. Google user data

Noma’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models. People at Nurdd do not read it unless you ask us to for support, it is needed for security or the law requires it.

You can disconnect Google at any time from Noma’s settings or at myaccount.google.com/permissions, and we delete the stored Google data within 30 days.

6. How Noma uses AI models

Noma is built on AI models from third parties. We reach them through their APIs, by way of an AI model routing provider, not through the consumer apps. What each model receives depends on the feature:

  • Tracking: the prompts you track, sent to each AI engine Noma monitors, so that we can record how it answers.
  • Setting up and analysing your brand: your brand name, domain, industry and description, and text from your website’s public pages.
  • Content, chat and assistant features: the instructions, drafts and questions you write, with the project details needed to answer them.

We do not send your name or email address to AI models. The providers process what they receive under their own terms for API use, which you can read on their websites. We do not use your data to train AI models, and we do not sell it to anyone who does.

7. How we use information

  • To provide the Service: running your tracked prompts across AI engines, calculating visibility, position, sentiment and citation metrics, auditing sites, finding topics where competitors appear and you do not, generating content drafts, and reporting AI crawler and AI-referred traffic.
  • To run your account: signing you in, managing your subscription and payments, and sending service emails such as receipts, reports and password resets.
  • To support you: answering questions and requests.
  • To improve Noma: understanding how features are used, using aggregated or de-identified data where we can.
  • To tell you about Noma: sending product news where the law allows. You can unsubscribe at any time.
  • To keep the Service safe: preventing fraud and abuse, limiting repeated requests, and enforcing plan limits.
  • To meet legal obligations: keeping records the law requires and responding to lawful requests.

If you are in the European Economic Area or the United Kingdom, we rely on:

  • Contract: to provide the Service you signed up for.
  • Legitimate interests: to secure, improve and promote the Service, including product analytics inside the Noma application, weighed against your rights.
  • Consent: for analytics cookies on our website and for marketing where consent is required. You can withdraw consent at any time.
  • Legal obligation: where the law requires us to process or keep data.

9. Cookies and analytics

We use cookies that are strictly necessary to run the Service:

  • sign-in cookies that keep you signed in;
  • a referral cookie that remembers which referral link brought you, for 30 days;
  • a cookie that holds a team invitation while you sign up, for up to 7 days;
  • a cookie that signs you out after a period of inactivity.

On our website, analytics tools (Google Analytics, Microsoft Clarity, PostHog and Amplitude) load only after you allow analytics cookies in our cookie banner. You can change that choice through the banner, and you can also block or delete cookies in your browser settings.

Inside the Noma application, which only signed-in customers use, we run product analytics and session recording (PostHog and Amplitude) to see how features are used and to fix problems. These are linked to your account. To opt out, email privacy@nurdd.club.

10. Who we share information with

We do not sell personal data, and we do not use your data to train AI models.

We share personal data with service providers that help us run Noma, only as far as each one needs it, under terms that limit how they may use it. They provide:

  • hosting, database, sign-in and background processing;
  • email delivery;
  • payment processing;
  • AI models, reached through an AI model routing provider, for tracking AI engines and for content, chat and analysis features (see How Noma uses AI models);
  • crawling and speed-testing the websites you ask us to audit;
  • Google sign-in, and Google Search Console, Google Analytics or Google Ads if you connect them;
  • showing company logos, which uses company domain names only;
  • limiting repeated requests and caching results;
  • error monitoring, product analytics, session recording and website analytics;
  • booking demo and onboarding calls.

Business customers can ask privacy@nurdd.club for the current list of these providers by name, with where each one processes data. Customers who sign our data processing agreement are told before we add a provider that processes their personal data.

Inside a workspace, the people you invite can see the workspace’s data according to the role you give them. If you are an agency using Noma for clients, you are responsible for having your clients’ permission to put their data into Noma.

We may also disclose personal data:

  • when the law, a court or a government authority requires it;
  • to protect the rights, property or safety of Nurdd, our users or the public;
  • to a buyer or successor if Nurdd is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

11. International transfers

We are based in India, and our service providers may process personal data in India, the United States, the European Union and other countries, including the countries where the AI model providers Noma uses operate. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

12. How long we keep information

We keep account data and the content in your workspace for as long as your account is active. When your account is deleted, or when you ask us to delete your data, we delete it or de-identify it, except for records we must keep for legal, tax, accounting or fraud-prevention reasons, which we keep only for as long as those reasons require.

  • Projects: deleting a project deletes its prompts, AI answers, audits and server log data.
  • Google data: disconnecting Google revokes our access at Google and deletes the stored connection straight away; any Google data we hold is deleted within 30 days.
  • Team invitations: an unused invitation expires after 7 days.
  • Invoices and payment records: kept for as long as Indian company and tax law requires, currently up to 8 years.
  • Audit requests, enquiries and call bookings: kept while we may still help you with them; ask us at any time and we will delete them.

Deleted data can remain in backups for a short time until those backups are replaced. We may keep aggregated or de-identified data that no longer identifies anyone.

13. Security

We protect personal data with technical and organisational measures, including:

  • encryption of data in transit, and encryption at rest by our database provider;
  • passwords stored only as hashes, and API keys stored only as hashes;
  • database access rules that keep each organisation’s data separate from every other’s;
  • limiting access to personal data to the people and systems that need it.

We do not currently hold a SOC 2 report. No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how we use it, and to withdraw consent. To use any of these rights, including to close your account and delete its data, email privacy@nurdd.club. We may need to confirm your identity, and we will respond within the time the law allows, and in any case within 30 days.

If you are a team member in a customer’s workspace, the customer controls that workspace’s data, and we may pass your request to them.

  • India (DPDP Act, 2023): you can access and correct your data, have it erased, seek redressal of grievances through our Grievance Officer, and nominate someone to exercise your rights if you die or become unable to.
  • EEA and UK (GDPR): you have the rights above and can complain to your local data protection authority.
  • California (CCPA, as amended by the CPRA): you can ask to know, delete and correct the personal information we hold, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, and we will not treat you differently for using your rights.

15. Automated decisions

Noma uses AI to analyse brands and websites and to suggest actions, but it does not make decisions about individuals that have legal or similarly significant effects on them.

16. Children

Noma is a business tool for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact privacy@nurdd.club and we will delete it.

The Service links to websites and platforms we do not control, including the sources AI engines cite. Their privacy practices are their own, so please read their policies.

18. Grievance Officer

In line with India’s Digital Personal Data Protection Act, 2023, you can raise any concern about how we handle your personal data with our Grievance Officer:

Abhijeet Singh Kaushal
Email: privacy@nurdd.club
Phone: +91 87955 10876
Nurdd Solutions Private Limited, Unitech Cyber Park, Sector 39, Gurugram, Haryana, India

We will respond to grievances within the period the law requires.

19. Changes to this policy

We may update this policy. We will post the new version here with a new “Last updated” date, and if a change is significant we will also tell you by email or in the application before it takes effect.

20. Contact us

Privacy questions and requests: privacy@nurdd.club. Help with your account: support@nurdd.club. Post: Nurdd Solutions Private Limited, Unitech Cyber Park, Sector 39, Gurugram, Haryana, India. Our Terms of Service explain the rules for using Noma.