Nomity Privacy Policy

Effective date: 1 May 2026 Last updated: 04 October 2026

1. Who we are

This Privacy Policy explains how the Nomity group ("Nomity", "we", "us", "our") collects, uses, and protects personal information when you visit our website or use the Nomity platform as a customer or as a user within a customer's account.

The data controller depends on which entity you contract with:

International / EU / UK / US Controller: Nomity OÜ, registered in Estonia, registered address Hobujaama 4, Kesklinna linnaosa, Tallinn 10151, Estonia

South Africa Controller: Nomity (Pty) Ltd, registered address 1A Link Road, Howick 3290, South Africa

Our role: controller vs. processor

• Account & website data: information about you as our customer, prospect, or visitor. Nomity is the controller; this policy governs it.

• Customer end-user data: personal data that our customers collect from their own users and store on the platform. For that data the customer is the controller and Nomity is only the processor, acting on the customer's instructions under the processing terms in section 8 of our Terms of Use. This policy does not govern the purposes for which that data is used; if you are an end-user of one of our customers, consult that customer's privacy policy.

2. Scope

This policy applies to personal information we process as a controller. It does not apply to third-party sites we link to, or de-identified data.

Section 6 (Connected integrations) and section 7 (Automated processing and AI features) describe how the Nomity platform accesses, uses, stores and shares data through connected third-party accounts and messaging channels. Those two sections describe our technical data practices in both roles, so that a person connecting a third-party account can see what happens to their data without needing any other document. The purposes for which customer end-user data is used remain governed by the customer's own privacy policy and the processing terms in our Terms of Use.

3. Personal information we collect

• Account & identity: name, email address, login credentials, and your role within an account.

• Billing & payment: limited payment metadata required to process and reconcile payments (e.g. card type, last four digits, expiry, issuing country). We do not store full card numbers or security codes: full card data is handled by our payment processors.

• Communications: the content of messages you send us and our replies, including enquiry or contact-form submissions.

• Usage & analytics data: a session/visitor identifier, device and browser type, referrer, and campaign parameters. We respect your browser's "Do Not Track" signal.

• Technical data: IP address and request metadata, processed to route, secure, and deliver our services, and recorded with payment transactions for fraud prevention.

• Connected integration data: where a third-party account or messaging channel is connected, the data described in section 6.

We use strictly necessary and analytics cookies and similar technologies. We do not use third-party advertising or cross-site tracking cookies.

4. How we use your information, and our lawful bases

Each purpose below states our lawful basis under the GDPR and UK GDPR.

Create, operate, and secure your account Performance of a contract; legitimate interests (security).

Provide and maintain the platform and its features Performance of a contract.

Process payments and prevent fraud Performance of a contract; legitimate interests; legal obligation.

Respond to your communications Performance of a contract; legitimate interests.

Send service and transactional messages Performance of a contract.

Send marketing communications (where applicable) Consent (or soft opt-in where permitted).

Operate connected calendar integrations (§ 6.1) Performance of a contract; consent given at the point of connection.

Operate connected messaging channels (§ 6.2) Performance of a contract.

Understand and improve usage of our website and platform Legitimate interests; consent where required for analytics cookies.

Improve our documentation and support Legitimate interests. We use support enquiries and our replies to them to improve our documentation and to train and improve the models that answer support questions. This covers your support correspondence with us only, never the data you hold on the platform. You may object at any time by emailing privacy@nomity.com, and we will exclude your correspondence.

Maintain the email suppression list (§ 6.3) Legal obligation, in respect of addresses that have objected or unsubscribed; legitimate interests, in respect of addresses that permanently failed delivery.

Comply with legal, tax, and accounting obligations Legal obligation.

You may withdraw consent at any time where consent is the basis; this does not affect prior processing.

5. Automated processing and AI features

Certain platform features use AI models to assist users, for example drafting a suggested reply to an inbound message, summarising a conversation, extracting structured details from a message or an image, and screening inbound text for prompt-injection and abuse.

What is sent. Where a business has enabled AI assistance on a messaging channel, we send the model the text of the message, earlier messages from the same conversation for context, and the name of the business. Where the message contains an image, we send the image. We do not send the sender's phone number or WhatsApp profile name to any AI provider.

Which providers. All AI processing is routed through Cloudflare's AI Gateway. The providers we currently use are xAI, Google (through Google AI Studio and Google Cloud Platform), and Cloudflare's own AI service, which screens incoming messages for abuse.

5.1 Support enquiries

We use the support enquiries you send us, and our replies to them, to improve our documentation and to train and improve the models that answer support questions. This is limited to your correspondence with our support team. It does not extend to the data you hold on the platform, such as your contacts, listings, messages or campaign content, which is not used to train any model. To object, email privacy@nomity.com and we will exclude your correspondence.

Our commitments. We contract with AI providers on terms restricting further reuse of the data we send, and we do not use this content to train any model of our own. The single exception is support correspondence, described in section 4 and section 5.1, which we do use to improve our documentation and our support models. We never send calendar data to any AI provider or model (see § 6.1).

Messaging assistants are scoped, and a person is always reachable. The assistant that answers on a business's WhatsApp channel performs a defined set of tasks for that business and refuses anything outside them. It is not a general-purpose assistant, which the WhatsApp Business Platform does not permit, and every conversation it handles can be handed to a person at the business.

Human involvement. These features assist you and do not make decisions producing legal or similarly significant effects about you without human involvement.

6. Connected integrations

6.1 Google Calendar

Where a Google account is connected, Nomity uses the Google Calendar API to coordinate availability and, where that feature is enabled, to write booking entries to the connected calendar.

What we access

6.1.1 User info: email

The Google account identifier and email address, to link the connection to a Nomity user and show which account is connected.

6.1.2 Google Calendar: free / busy

Busy time intervals only, the start and end times during which the calendar is busy, and the identifier of the calendar they came from. We do not see event titles, descriptions, locations, attendees, organisers, attachments or conferencing links.

6.1.3 Google Calendar: events created by Nomity

Where calendar write-back is enabled, permission to create, update and delete only those events Nomity itself created. It gives no access to events created by you or anyone else.

We request nothing else. We have no access to your Gmail, your Drive, or the contents of your calendar beyond the above.

What we write to your calendar. Where write-back is enabled, Nomity creates booking events, marked private. Depending on your setting, an event shows either the type of booking only, or a title with the name of the person the booking is with and optionally a location. We never write a phone number or an email address into a calendar event.

What we store. Busy intervals, your Google account identifier and email address, and your integration settings. Where we have created events, a record of those events and their times. Your Google credentials are encrypted, using a key kept separately from every other key in our platform. Short-lived access credentials are never written to our database.

What we use it for. One purpose only: to show accurate availability and to create, update and remove booking entries. Both are features you can see and use directly in Nomity.

What we never do. We do not share information received from Google with anyone other than the infrastructure providers needed to run and secure the service (§ 7). We do not send it to any artificial intelligence service or model, and we do not use it to train or improve any model. We do not use it for advertising, credit or lending decisions, and we never sell it. Our staff access it only where necessary to investigate a security issue, to resolve a support request you have raised, or where the law requires it.

Limited Use. Nomity's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You may revoke Nomity's access at any time at myaccount.google.com/permissions, or by disconnecting the integration in Nomity. Booking events already on your calendar stay there, under your control, and you can delete them yourself.

6.2 WhatsApp Business

Where a business using Nomity connects a WhatsApp Business account, Nomity receives and processes messages exchanged between that business and the people who message it, via the WhatsApp Business Platform (Cloud API) operated by Meta. The business is the controller of that data; Nomity is the processor.

What we access

6.2.1 WhatsApp Business messaging

The messages exchanged between the business and the people who message it. The sender's phone number and WhatsApp profile name, the text of the message, any images, documents, audio or video attached to it, replies to buttons and menus, and delivery and read receipts.

6.2.2 WhatsApp Business management

The settings of the connected WhatsApp Business account (its phone number, display name, quality rating and messaging limit) so the business can manage its own channel from within Nomity.

6.2.3 Business information and public profile

The identity of the business account being connected, and the name of the person connecting it, so we can link the channel to the right Nomity account.

We request no Facebook Pages, advertising, or lead-retrieval permissions of any kind.

6.2.4 Staff WhatsApp numbers

Where a business lets its own staff work from WhatsApp, a staff member may link their personal WhatsApp number to their Nomity user account. We store that number, the date it was verified and whether the link is active, and we use it for one purpose: to recognise that person when they message the business's number, so that what they ask for happens under their own Nomity permissions and no one else's. A one-time code is sent over WhatsApp to verify the number. The staff member can remove the link at any time in their profile settings, and a message from an unrecognised number is ignored.

6.2.5 Consent, opt-out and template records

Where the business records that a person agreed to receive WhatsApp messages, or asked it to stop, we store that record against the contact so the business and its team can act on it. We also read from Meta the status, category and quality rating of the business's message templates and the messaging limit on its number, so the business can manage its own channel.

What we store. Message text and attachments, the sender's phone number and profile name, and the conversation history, so the business can see and continue its conversations. Attachments are stored privately and can only be opened by someone signed in to that business's Nomity account. They are never placed on a public web address. For security we also keep a short-lived copy of each message as it was delivered to us, which is deleted automatically. We check every incoming message against Meta's signature before processing it.

What we use it for. To deliver messages between the business and the person messaging it; to keep conversation history in the business's inbox; to route conversations to the right person; to suggest or send AI-assisted replies where the business has enabled that (§ 5); to detect abuse; and to reconcile message costs.

Retention and deletion. Conversation data belongs to the business, which determines how long it is kept. The business can delete conversations at any time, and we delete data on the business's instruction and on termination of their contract in accordance with our Data Processing Agreement with them. To request deletion, see § 11.

What Meta receives. Message delivery necessarily passes through Meta's WhatsApp Business Platform. Meta's own handling of that data is governed by the WhatsApp Business Privacy Policy and is outside Nomity's control.

6.3 Email marketing

Where a business using Nomity sends marketing email to its own contacts, that business is the controller of its recipient list and Nomity is the processor. Obtaining and holding valid consent for every recipient is the business's obligation under our Anti-Spam Policy and Terms of Use, not ours.

What we do on the sending business's behalf. We send the messages, record delivery, opens, clicks, bounces and complaints, operate the unsubscribe link and preference centre, and enforce the consent and suppression rules described below. Every marketing message carries one-click unsubscribe, and an opt-out is honoured immediately.

Marketing sending is opt-in only by default. A contact with no positive consent record is not mailable. The check runs before every send and, if it cannot be completed, nothing is sent at all.

One exception applies at onboarding. A business moving to Nomity from another platform may import its existing subscriber list once, and we treat those contacts as opted in on that business's written attestation that every address was collected with consent. The business carries that responsibility, and a first send that produces excessive bounces or complaints results in immediate and permanent termination of its account.

The suppression list. Nomity maintains a single suppression list across the whole platform. Where an email address permanently fails delivery, or a recipient reports a message as spam, that address is blocked for every business using Nomity, permanently, not only for the one that sent the message. The list holds the address, the reason and the date, and nothing else. It is used only to block sending. It is never used to market to anyone, never shared with our customers as a list, and never enriched or sold.

We do not delete a suppression record on request, because deleting it is what would cause the harm. Removing the record would not restore anyone's privacy. It would remove the only thing preventing that address being contacted again, by us or by any other business on the platform. Where someone has told us to stop, that record is how we keep the promise, and erasing it would put us in breach of the request it exists to honour. For the same reason the list is retained after a customer's account is closed.

If you received a marketing message from a business using Nomity, you can unsubscribe using the link in the message, which takes effect immediately and independently of that business. You may also exercise your rights against the business itself, which is the controller. If you cannot reach them, or would prefer we act, email privacy@nomity.com citing the address concerned and we will identify the sending business and forward your request. To report a message as abusive, use the same address.

7. Who we share information with

We do not sell your personal information. We share it only with categories of service providers that process it on our behalf, under contract and on our instructions:

• infrastructure, hosting, and storage providers;

• authentication and identity providers;

• payment processors;

• communication and messaging providers, including the WhatsApp Business Platform;

• analytics providers;

• AI service providers (named in § 5).

Our current named sub-processors are:

We give customers 30 days' notice before adding or replacing a sub-processor, as set out in section 8 of the Terms of Use.

We may also disclose personal data where required by law, to enforce our agreements, or in connection with a corporate transaction.

8. International data transfers

We operate from Estonia (EU) and South Africa, and some of our service providers are located outside the EEA, UK, or South Africa. Where we transfer personal data internationally, we rely on appropriate safeguards, including Standard Contractual Clauses (with the UK Addendum where relevant) and adequacy decisions where available.

Email sending is one of these transfers. Postmark processes message content and recipient addresses in the United States, under the Standard Contractual Clauses incorporated into its terms (Postmark EU Data Protection). AI processing described in § 5 and infrastructure processing may occur outside your country of residence. You may request a copy of the relevant safeguards using the contact details in § 12.

9. Data retention

We keep personal information only as long as necessary for the purposes above:

• Account data: for the life of your account and a reasonable period afterward.

• Billing & transaction records: a minimum of 10 years, and thereafter at our discretion.

• Transaction IP addresses: a minimum of 90 days for unknown traffic, and thereafter at our discretion.

• Communications: no fixed retention period; retained at our discretion for as long as necessary for the purposes in this policy.

• Analytics data: no fixed retention period; retained at our discretion for as long as necessary for the purposes in this policy.

• Customer end-user data, including messaging channel data: retained on the customer's instructions and deleted or returned in accordance with the processing terms in our Terms of Use. On termination a customer has 30 days to export, and we delete within 90 days.

• Email suppression records: retained indefinitely, including after the sending customer's account is closed, for the reasons given in section 6.3.

• Support correspondence: retained for as long as necessary to support you and to improve our documentation and support models (section 5.1).

When data is deleted it is removed from production systems and from backups on the next rotation cycle.

10. Your rights

EU / UK (GDPR & UK GDPR): access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and not to be subject to solely automated decisions with legal/significant effect. You may complain to a supervisory authority, in Estonia the Andmekaitse Inspektsioon, in the UK the Information Commissioner's Office, or your local EU authority.

South Africa (POPIA): to be notified of collection, to access, correct, or delete your information, to object to processing, and to complain to the Information Regulator (South Africa). Our Information Officer is Matt Hallowes (privacy@nomity.com), registered with the Information Regulator under reference 2026-030288.

California (CCPA/CPRA): to know the categories and specific pieces of personal information collected, used, and disclosed; to delete; to correct; and to opt out of "sale" or "sharing." We do not sell or share personal information as defined under the CPRA. We will not discriminate against you for exercising any right. Categories collected in the past 12 months: identifiers, commercial information, internet/network activity, and limited financial information (payment metadata).

Exercising your rights: contact us (§ 12). We verify identity and respond within the timeframe required by the applicable law (generally one month under GDPR/UK GDPR; 45 days under CCPA; a reasonable time under POPIA). Authorised agents may act on your behalf with proof of authorisation.

11. Deleting your data

Connected Google account. Revoke Nomity's access at myaccount.google.com/permissions or disconnect the integration in the Nomity dashboard. On revocation the stored connection record and encrypted refresh token are deleted.

WhatsApp and messaging data. If you messaged a business that uses Nomity, that business controls your conversation data, contact them to have it deleted. If you cannot reach them, or would prefer we act, email privacy@nomity.com citing the phone number concerned. We will identify the controlling business and forward your request. To stop receiving messages from that business, block or report it inside WhatsApp, which takes effect immediately and which we cannot override, or ask the business to stop, which it must honour under our WhatsApp Messaging Requirements.

Staff WhatsApp link. If you linked your own WhatsApp number to your Nomity user account, remove it in your profile settings, which deletes the stored number and the verification record. You may also email privacy@nomity.com and we will remove it for you.

Your Nomity account. Email privacy@nomity.com from your registered address. We delete your account data and connected-integration data, except records we are required to keep for tax, accounting or legal purposes (§ 9).

Email suppression records. These are not deleted on request, for the reasons given in section 6.3. If you believe an address was suppressed in error, email privacy@nomity.com with the address and we will investigate.

Where Meta notifies us of a user data deletion request, we process it under this section.

12. Security and contact

We protect personal information using encryption in transit, encryption of sensitive fields at rest, a separate encryption key for credentials to connected accounts, access controls and role-based permissions, verification of incoming messages against the sending platform's signature, private rather than publicly reachable storage of attachments, and processes to detect, investigate, and notify breaches as required by law. No system is perfectly secure.

For privacy questions or to exercise your rights:

• Contact: nomity.com/contact

• Support: support@nomity.com

• Privacy, data rights and abuse reports: privacy@nomity.com

• EU controller: Nomity OÜ, Hobujaama 4, Kesklinna linnaosa, Tallinn 10151, Estonia

• SA controller: Nomity (Pty) Ltd, 1A Link Road, Howick 3290, South Africa

• Information Officer (POPIA): Matt Hallowes (privacy@nomity.com) (Information Regulator ref. 2026-030288)

• UK representative (UK GDPR Art. 27): Matt Hallowes (privacy@nomity.com)

13. Children

The platform is a business tool, not directed at children. We do not knowingly collect personal information from anyone under 18, and we do not collect dates of birth, ages, or other age-identifying data. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or an in-product notice. Where a change materially affects how we use data obtained from a connected third-party account, we will notify you and, where required, obtain consent before the new use begins. The "Last updated" date reflects the latest version.