Privacy policy.

Section 01

Applicability of this policy — controller and processor roles

BYGEN AI Kft. acts as controller of personal data — that is, we determine the purpose and means of processing — for:

• individuals who register for and use Nomis directly, on our Starter, Growth, or Scale plans;
• visitors to our website; and
• our own contract administration, invoicing, and statutory record-keeping.

Where an organization has entered into a separate agreement with us — including our standard Data Processing Addendum — to use Nomis with its own personnel or clients, that organization is the controller of the personal data its users submit through the Service, and we act as its processor, on its instructions. In that case, the organization's own privacy notice and its agreement with us — not this policy — governs how that data is used, and requests concerning that data should be directed to the organization. This policy does not limit or override the terms of any such agreement. If you are using Nomis as an employee or representative of an organization with such an agreement in place, please consult your organization for details of how your data is handled.

Where the distinction is not clear-cut, we describe throughout this policy which capacity we are acting in.

Section 02

Personal data we collect

2.1 Inferred user context

Nomis retains contextual information about you across conversations — such as your business type, tax status, industry, and jurisdiction — so that this context does not need to be restated in each new conversation. This information is generated by the system's language model based on prior conversations; it is not information you have entered directly, and its accuracy is not guaranteed. You may view and delete individual entries at any time in your account settings.

Section 03

How we use personal data

The majority of our processing is necessary to provide the Service you have contracted for (GDPR Article 6(1)(b)). Certain activities — including the use of inferred user context and internal quality review — are based on our legitimate interest in operating a reliable service (Article 6(1)(f)). Billing records are additionally retained to meet statutory accounting obligations (Article 6(1)(c)).

Section 04

Who we share personal data with

Providing a response involves more than one service provider. The complete and current list of recipients, the data each receives, and the applicable transfer safeguard is maintained in a single authoritative document: Sub-processors. In summary, we share data with:

• AI infrastructure providers, to generate answers and enable semantic search. Your query, the retrieved legal sources, and the generated answer are transmitted to our AI inference provider (AWS Bedrock); query and document text is transmitted to our embedding provider (Google).
• Our web search provider, when you enable web search — the search query is transmitted in full (via OpenRouter to Perplexity).
• Infrastructure and hosting providers (AWS), for database hosting, file storage, and application logging — distinct from AWS's role in AI inference above.
• Payment and communications providers (Stripe for billing, Resend for transactional email).
• Our issue-tracking system (GitHub), where you submit a bug report — the content you provide is posted as an issue in our repository.
• Our internal debugging and tracing tooling, which logs prompts and completions for quality and reliability monitoring.
• Legal and regulatory recipients, where necessary to comply with a legal obligation, court order, or valid request from a regulator or law enforcement authority, or to establish, exercise, or defend a legal claim.
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to the same protections described in this policy.

Section 05

Use of artificial intelligence

As this is core to how the Service works, we describe it here in addition to Section 3 above:

• Your query, the retrieved legal sources, and the generated answer are transmitted to our AI inference provider to produce a response.
• Content requiring semantic search is transmitted to a separate embedding provider.
• The system infers and retains contextual information about you across conversations, as described in Section 2.1; this information may be viewed and deleted by the user.
• No automated content-filtering or guardrail layer is currently applied to AI-generated output.
• We do not make legal or other significant decisions concerning users solely through automated processing; matters escalated for expert review are reviewed by a qualified professional.
• Whether content transmitted to our providers is used for model training purposes is governed by our contractual terms with each provider; confirmation of these terms is pending for certain providers.

Section 06

International data transfers

Nomis is built EU-first. The large majority of processing — including AI answer generation and all core infrastructure (database, file storage, hosting) — takes place within the EU, and we do not route this processing through providers outside the European Economic Area (“EEA”) by default.

A small number of ancillary services rely on providers that operate global infrastructure — this currently includes our embedding provider and our web search provider, and, further down the chain, sub-processors that some of our providers rely on for their own infrastructure or support functions. In every case, we require our providers to have a data processing agreement in place that includes an appropriate safeguard for any transfer outside the EEA — either an adequacy decision by the European Commission, or standard contractual clauses where no adequacy decision applies, consistent with Chapter V GDPR.

The specific safeguard confirmed for each recipient is listed in the Sub-processors document.

Section 07

Data retention and account deletion

We retain personal data for as long as necessary for the purposes described in this policy, including to meet legal, accounting, and dispute-resolution obligations. Defined retention periods do apply to certain technical logs: application logs are retained for 30 days, AI model-invocation logs (which may include prompt and embedding text) for 365 days, and infrastructure audit logs for 365–400 days.

Account deletion

When you close your account, we delete or anonymize the personal data associated with it, except where we are required or permitted to retain certain data — for example, for legal, accounting, security, or dispute-resolution purposes, or where data has already been aggregated or de-identified. Some data may take a limited period to be fully removed from backups, logs, and archives. You can delete certain content yourself at any time, without closing your account, from your account settings.

Section 08

Security

Detailed technical information is published in our Security and Trust Center documentation, which we recommend to any organization with specific security or compliance requirements. In summary:

• Data in transit between your browser and our servers is encrypted using TLS.
• Our database and file storage are encrypted at rest.
• Access requires an authenticated session; there is no public access to application data.

Section 09

Minors

The Service is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact us at privacy@asknomis.com and we will take steps to delete that information.

Section 10

Your data protection rights

Under the GDPR, you have the right to:

To exercise any of these rights, contact us at privacy@asknomis.com. We will respond within one month of receipt; this period may be extended by up to two further months where necessary, taking into account the complexity or number of requests, in which case we will inform you of the extension within the initial one-month period. We may ask you to verify your identity before fulfilling a request. Requests are currently reviewed and fulfilled manually rather than through an automated self-service system.

If you are using the Service under an organization's agreement with us, as described in Section 1, please direct your request to that organization in the first instance.

Section 11

Supervisory authority

Complaints regarding our processing of personal data may be lodged with:

You are also entitled to seek judicial remedy before the competent court in your place of residence.

Section 12

Updates to this policy

We may update this policy from time to time in response to changes in our practices, or for legal or regulatory reasons. We will notify registered users by email at least 15 days before any material change takes effect. Non-material changes, such as corrections and clarifications, take effect upon publication. The “Last updated” date at the top of this policy reflects the most recent revision.

Section 13

How to contact us

If you have questions or concerns about this policy or our handling of your personal data, email us at privacy@asknomis.com. Our full identity and registration details are set out at the top of this policy; Section 1 explains when we act as controller versus processor.