Privacy Policy

The data controller is CogEx Ltd, a company incorporated in the United Kingdom, registered office at [TO COMPLETE — registered address], company number [TO COMPLETE].

Because the controller is established outside the EU, it has appointed a representative in the European Union under Art. 27 GDPR: [TO COMPLETE — name and contact of the EU representative].

For any request about your data, write to hello@noemie.ai.

Account data: your Telegram identifier, your email address, and the connection details of the services you authorize (provider, account email, connection status).

Conversations: the messages you exchange with Noemie and the notifications it sends you.

Tasks and reminders: tasks, scheduled missions, and appointments you ask Noemie to handle.

Documents: the documents you share and their content.

Personal memory: facts and entities Noemie remembers to assist you better over time.

Connected services: when you authorize it, Noemie accesses Gmail, Google Calendar, and Google Drive to perform the actions you request.

Waitlist: if you request an invite, we store your email address and a hashed (not readable) form of your IP address to prevent abuse.

Operational data: technical logs, usage statistics, and cost tracking.

Noemie does not ask for special categories of data (Art. 9 GDPR), such as health data. Free-text fields — conversations, documents, memory — may contain them if you choose to enter them: please share them only when strictly necessary.

Providing the assistant — conversations, tasks, documents, memory (Art. 6(1)(b) GDPR, performance of a contract).

Connecting your Google services and acting on them (Art. 6(1)(a) GDPR, consent given when you connect them).

Sending recaps and proactive notifications (Art. 6(1)(b) GDPR, performance of a contract).

Improving the quality of answers through personalized adaptations, security, operational logs, and abuse prevention (Art. 6(1)(f) GDPR, legitimate interest).

We do not use your data to train AI models — not ours, not third parties'. We do not sell your data or share it for marketing.

Using the service requires accepting this policy before any processing. The service is not intended for people under 18.

We rely on providers that process data on our behalf (processors under Art. 28 GDPR), bound by data processing agreements:

Supabase — database hosting — EU (Frankfurt).

Hetzner — application servers — EU (Falkenstein, Germany).

OpenRouter and the language-model providers it routes to — processing of prompts — USA. Requests are sent with zero data retention and data collection disabled.

OpenAI — embeddings for documents and memory, image analysis — USA.

Composio — connection to your Google services and custody of the access tokens — USA.

Telegram — messaging channel — [TO COMPLETE — location].

Langfuse — technical traces, self-hosted on our own servers — [TO COMPLETE — region].

Resend — transactional email — [TO COMPLETE — region].

Vercel — hosting of the website and dashboard — USA.

Exa — web search, when you ask Noemie to search the web — USA.

Firecrawl — reading a web page, when you ask Noemie to open one — USA.

Some providers are based in the United States. Those transfers rely on the Standard Contractual Clauses approved by the European Commission, with supplementary measures (encryption in transit, data minimization).

Transfers to the United Kingdom, where the controller is established, are covered by the EU–UK adequacy decision.

[TO COMPLETE — reference to the signed SCCs and DPAs of each provider.]

Technical and notification logs: 90 days.

Your conversations and content (tasks, documents, memory, contacts, preferences): for as long as your account is active, until you delete them or your account.

Sign-ups never completed (privacy policy not accepted): deleted after 24 hours.

Inactive accounts: [TO COMPLETE — inactivity policy].

When you request erasure, your data is removed from the live database; backup copies are overwritten within the backup retention window [TO COMPLETE — window].

Access and portability: you may download a copy of all your data in a machine-readable format (JSON) from your dashboard, or by sending /export-me to Noemie on Telegram.

Erasure: you may delete your account and all associated data from your dashboard, or by sending /delete-me to Noemie on Telegram. Both ask for confirmation; the operation is irreversible.

Rectification, restriction, and objection to processing based on legitimate interest.

Withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before.

For any other request, write to hello@noemie.ai. We answer within one month (Art. 12(3) GDPR).