1. Scope and responsibility

[Legal entity name], located at [registered address], is responsible for the personal data it handles as a controller when operating its website, managing accounts, and communicating with customers. Contact [privacy email] with privacy questions. Our data protection officer or representative, where applicable, can be reached at [contact details or not applicable].

When a customer connects workplace content to Noema, that customer generally determines why and how the content is processed, and Noema acts as its processor under a Data Processing Agreement. For requests about employer-managed workspace content, contact your workspace administrator first. We assist the customer as required by our agreement and applicable law.

2. Personal data we collect

Depending on your use of the service, we may receive account and contact details; organization and subscription information; billing records; support messages; device, browser, IP address, and service-usage data; and content, queries, metadata, and permissions from sources you or your organization connect. Payment providers handle [payment details collected by provider]; Noema receives [billing information actually received].

We obtain this information from you, your organization, connected services you authorize, and [other actual sources, or none]. The cookies and similar technologies used on our website are described in Cookie Settings. Do not submit sensitive personal data unless your agreement expressly supports that use.

3. Purposes and legal bases

We use personal data to operate accounts, provide requested features, process payments, respond to support requests, protect the service, meet legal obligations, and send communications you request or are otherwise lawfully entitled to receive.

Where a legal basis is required, our controller activities rely on contract performance, applicable legal obligations, consent, or legitimate interests such as service security and business administration, subject to your rights. [Insert the verified purpose-to-data-to-legal-basis mapping, including the specific legitimate interests and any marketing or analytics use.] Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

4. AI processing and connected content

Connected content and queries are processed to provide the features your organization enables. [Identify model providers, data sent to each, processing locations, provider retention, and whether any content is used for model training, including the applicable controls and contractual restrictions.] Your organization's permissions and configuration determine the intended scope of access. Do not assume that a citation guarantees an answer's accuracy.

5. Sharing personal data

We disclose personal data only where necessary for the purposes described here, including to contracted providers supporting [actual hosting, AI inference, payments, support, and other provider categories]. Workspace administrators and authorized members may access information according to their roles and your organization's settings.

We may also disclose information when required by law, to protect legal rights, or as part of a business transaction subject to appropriate safeguards. [State the verified position on selling personal data, sharing for cross-context advertising, targeted advertising, and any related opt-out rights.] A current list of providers processing customer data is available at [subprocessor list URL].

6. International transfers

Personal data is processed in [actual countries or regions]. Where data is transferred to a country requiring additional safeguards, we use [applicable adequacy decisions, contractual safeguards, or other lawful mechanisms]. Contact [privacy email] for information about the safeguards and how to obtain a copy, subject to lawful redactions.

7. Retention and security

We retain personal data only for the purposes described here, including legal, accounting, and security requirements. [Insert actual retention periods or determining criteria for accounts, billing records, support records, logs, connected content, model-provider records, and backups.] Customer-content deletion follows the applicable agreement and documented backup schedule.

We use [verified technical and organizational measures] appropriate to the risks of processing. No service can guarantee absolute security.

8. Your choices and rights

Depending on where you live and the processing involved, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal data; object to processing; withdraw consent; and appeal a rights-request decision. You may also complain to your local data protection authority, including [relevant authority and contact].

Send requests to [privacy email]. We may need proportionate information to verify your identity and will respond within applicable legal deadlines. Authorized-agent requests and appeals can be submitted through [applicable process]. You can unsubscribe from marketing using the link in a message and manage optional cookies through Cookie Settings. Essential account and service notices may still be sent.

9. Children and automated decisions

Noema is intended for business use and is not directed to children under [applicable minimum age]. Contact us if you believe a child has provided personal data inappropriately. [State whether any solely automated decisions with legal or similarly significant effects occur; if so, describe their logic, significance, consequences, and available safeguards.]

10. Changes and contact

We update this policy as our practices or legal requirements change. The date above identifies the latest revision; material changes will be communicated through [notification method]. For questions or requests, contact [privacy email] or [registered address].