Entity: Nobsy, LLC, a California Limited Liability Company (“Nobsy,” “we,” “us,” or “our”).
This Privacy Policy governs the data collection, processing, and protection practices for the Nobsy PDF Retrieval-Augmented Generation (RAG) application, accessible at nobsy.ai, and associated services (the “Service”). This document describes our data flows, your rights under applicable legal frameworks—primarily the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and Brazil’s Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018), and, to the extent it applies to you, the General Data Protection Regulation (GDPR/UK GDPR)—and the allocation of responsibility regarding uploaded content. As described in our Terms of Service, the Service is offered to users located in the United States, Canada, and Brazil.
1. Controller vs. Processor & Data Categories
To provide a secure and functional RAG pipeline while complying with applicable privacy frameworks, we separate the data we process into two operational categories:
Category A: Account, Billing & Analytics Data (Nobsy as Data Controller). Information required to maintain your account, provide support, process payments, and measure marketing performance. This includes your email address; an optional display name; marketing-attribution identifiers (such as campaign source and advertising click identifiers); a salted, cryptographically hashed representation of your IP address; and payment and transaction history processed through our payment provider. We do not store raw IP addresses on your user account, and we do not maintain dedicated job-title or employer fields; any company or role information is collected only if you voluntarily provide it (for example, in a support request).
1.1 Legal Bases for Category A Processing (GDPR/UK GDPR)
To the extent the GDPR or UK GDPR applies to our processing of your personal data, we process Category A data on the following legal bases, mapped by purpose:
Processing Purpose
Legal Basis
GDPR Article
Account provisioning & service delivery
Performance of a Contract
Art. 6(1)(b)
Billing & payment processing
Performance of a Contract
Art. 6(1)(b)
Fraud prevention & platform security
Legitimate Interest
Art. 6(1)(f)
Security logging & abuse prevention
Legitimate Interest
Art. 6(1)(f)
Essential service communications
Performance of a Contract
Art. 6(1)(b)
Optional marketing communications
Consent
Art. 6(1)(a)
Legal & regulatory compliance
Legal Obligation
Art. 6(1)(c)
Category B: AI Pipeline Data. The content you upload to our platform, including unstructured text extracted from your uploaded files (such as PDF, DOCX, and TXT documents), your chat queries, and the resulting session histories generated by the AI interface.
1.2 Role Allocation for Category B Data
For AI Pipeline Data processed solely to provide document retrieval, embedding generation, query handling, and response generation on behalf of an enterprise customer operating under an executed Data Processing Agreement (DPA) or Master Service Agreement (MSA), Nobsy acts as a processor/service provider and the customer acts as the controller/business.
For self-service individual accounts, and for processing necessary to secure, maintain, troubleshoot, prevent abuse of, and administer the Service, Nobsy acts as an independent controller with respect to such processing.
1.3 Anonymous Trial Data
If you use the Service without creating an account (for example, via a public trial or demo), we create a temporary anonymous session to deliver the trial, enforce usage limits, attribute conversions, and prevent abuse. This session may include an anonymous session identifier, a salted, cryptographically hashed representation of your IP address, a hashed browser-characteristics signal, a hashed user-agent value, the referring URL, usage counters, and an abuse-risk score, together with any files you upload during the trial and the AI Pipeline Data derived from them. Trial documents and anonymous sessions that are not converted to an account are removed by automated cleanup jobs; such unconverted sessions are retained for up to thirty (30) days for abuse prevention. If you later create an account and claim a trial session, the trial documents may be transferred to your account, and the session conversion record—including the hashed identifiers described above—is retained with your account for conversion attribution and abuse prevention until you delete your account.
2. User-Provided Content & Shared Responsibility
2.1 General Acknowledgment
By utilizing Nobsy PDF, you acknowledge that our system ingests unstructured text from the files you upload (such as PDF, DOCX, and TXT documents) for the sole purpose of enabling chat-to-document interactions.
2.2 Prohibited Content Categories
You are prohibited from uploading categories of regulated data as described in Section 4.1 of our Terms of Service, including but not limited to:
- Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA);
- Financial data subject to PCI-DSS or the Gramm-Leach-Bliley Act (GLBA);
- Highly sensitive PII (e.g., unredacted Social Security Numbers);
- Export-controlled data under ITAR or EAR;
- Third-party trade secrets or confidential information for which you lack authorization;
- Any data subject to sector-specific regulatory regimes that impose technical safeguard requirements beyond those described in Section 9 of this Policy.
2.3 Responsibility for Enterprise Accounts
For enterprise and organizational accounts governed by a separately executed DPA or MSA, the allocation of data minimization, redaction, and compliance obligations shall be as set forth in that executed agreement. In the absence of such an agreement, the terms of this Section 2 apply.
2.4 Responsibility for Individual Accounts
For individual (non-enterprise) users, Nobsy implements the following safeguards:
Upload-Time Acknowledgment. By uploading a document, you represent and warrant that the content complies with our Acceptable Use Policy (Section 4.1 of our Terms of Service) and does not contain categories of data prohibited thereunder.
Content Responsibility. You are solely responsible for ensuring that content you upload complies with our Acceptable Use Policy. We do not guarantee detection of regulated or sensitive data within uploaded content.
2.5 Indemnification & Liability
Liability allocation and indemnification obligations arising from user-uploaded content are governed exclusively by the applicable Terms of Service agreement, not this Privacy Policy.
2.6 AI Outputs and User Review
The Service uses probabilistic AI systems. AI-generated summaries, answers, citations, and other outputs may be incomplete, inaccurate, misleading, or unsupported by the source document. You are responsible for reviewing your uploaded content and any AI outputs before relying on them. The Service does not provide legal, medical, financial, tax, or other professional advice. Additional disclaimers governing AI outputs are set out in Section 3 of our Terms of Service.
3. AI Sub-Processor Data Flow
When you upload a document to Nobsy PDF, the data follows this path:
Extraction & Embedding. Document text is extracted and converted into mathematical representations (embeddings) via embedding models.
Vector Storage. Embeddings are stored in a PostgreSQL database with pgvector extension, hosted on Amazon Web Services (AWS) infrastructure within the United States.
Inference Processing. When you query a document, relevant text chunks and your prompt are transmitted to our third-party AI providers’ standard commercial API endpoints for inference processing—currently OpenAI for embeddings, summaries, and answer generation, and Cohere for ranking the relevance of retrieved chunks.
Our core application infrastructure is hosted on Amazon Web Services (AWS) in the US-West-1 (N. California) region, with availability zone redundancy where supported by the deployment configuration. A complete list of infrastructure providers, their data processing locations, and applicable terms is maintained in our Sub-Processor Registry (Section 6).
4. No Model Training Commitment
Nobsy does not use customer Account Data or AI Pipeline Data—including uploaded PDFs, embeddings, and chat session histories—to train, fine-tune, or improve any general-purpose AI models.
To provide the Service, we transmit limited AI Pipeline Data to third-party AI API providers (currently OpenAI and Cohere) solely to perform the embedding, ranking, and inference functions you request. We rely on these providers’ standard commercial API terms regarding their use of submitted content. Based on those terms as published, we understand that they do not use content submitted through their APIs to train their foundation models, and that any retention is limited (for example, OpenAI’s API terms describe retention of API inputs for up to thirty (30) days for abuse and safety monitoring). We do not control these providers’ independent systems, and their retention, security, and deletion practices are governed by their own terms. We do not represent that any provider operates under a zero-retention or enterprise configuration unless we have a separate written agreement or configuration expressly confirming it.
Because third-party provider terms and technical controls may evolve, the providers we use and their roles are described in our Sub-Processor Registry (Section 6), which we update as our provider relationships change.
5. Cookies and Similar Technologies
Nobsy uses the following categories of cookies and similar tracking technologies on nobsy.ai and within the Service:
Essential Cookies. Required for core Service functionality, authentication, and security. These cannot be disabled.
Analytics Cookies. We use Google Analytics (GA4) and Microsoft Clarity to understand usage patterns and improve the Service. Google Analytics collects interaction data including page views, session duration, and device information. Microsoft Clarity collects heatmap and session recording data to analyze user experience. These may be disabled via your cookie preferences.
Advertising/Tracking Cookies. Our Google Analytics implementation is linked to Google Ads for cross-context behavioral advertising, including audience building and remarketing. Identifiers and internet activity information may be shared with Google for these purposes. You may opt out of this sharing as described in Section 10.2.
Consent Mode and Cookieless Measurement. If you decline analytics or advertising cookies, we do not set the corresponding cookies and Microsoft Clarity is not loaded. However, Google's measurement tags still operate in a restricted, cookieless state (Google "Consent Mode"): they send Google limited technical signals — such as the page visited, referring page, browser and device type, and approximate region derived from your IP address — without cookies or other persistent identifiers, and Google uses these signals only for aggregate, modeled measurement. In this state the signals are not used to build a profile of you or to personalize advertising. If your browser sends a Global Privacy Control (GPC) signal, we suppress Google's measurement tags entirely, including these cookieless signals.
You can manage cookie preferences through the cookie banner displayed on nobsy.ai or through your browser settings. We do not respond to legacy “Do Not Track” browser signals. However, we recognize and honor Global Privacy Control (GPC) signals as described in Section 10.2.
6. Third-Party Sub-Processors & Data Sharing
We do not sell your personal data for monetary consideration. We disclose personal data and AI Pipeline Data to the categories of service providers, sub-processors, and analytics and advertising partners described below, only as necessary to operate, secure, bill for, analyze, advertise, and improve the Service. As described in Section 10.2, we may "share" identifiers and internet activity information for cross-context behavioral advertising; you can opt out as described in that section.
Our current authorized sub-processors are:
Sub-Processor
Role
Data Location
Data Categories
Amazon Web Services (AWS)
Cloud hosting and application infrastructure, including S3 file storage, RDS PostgreSQL/pgvector database, Lambda compute, SQS job queueing, Cognito authentication, CloudWatch logging, Secrets Manager, and CloudFront content delivery
United States (primarily us-west-1)
Category A & B
OpenAI
Embeddings, summaries, and LLM inference (standard commercial API)
United States
Category B
Stripe
Payment processing
United States
Category A (billing)
Google (GA4 / Google Ads)
Analytics & advertising
United States
Category A (identifiers, network activity)
Microsoft (Clarity)
Analytics (heatmaps, session recordings)
United States
Category A (network activity)
Cohere
Search result reranking (inference processing)
United States
Category B
Amazon SES
Transactional email delivery
United States
Category A (email address)
Cloudflare (Turnstile)
Bot detection and abuse prevention
Global (Cloudflare edge network)
Category A (IP address, browser metadata)
A maintained version of this registry with links to each sub-processor’s Data Processing Agreement (DPA) is available at: https://pdf.nobsy.ai/sub-processors.html.
We will provide reasonable advance notice before authorizing a new sub-processor that will process Category B data. Customers may object on reasonable data protection grounds within a reasonable period following notification. If we cannot reasonably accommodate the objection, the customer may terminate the affected Service, without penalty, on written notice before the new sub-processor begins processing the relevant data.
7. Retention Timelines & Data Deletion
7.1 Retention by Data Category
We retain personal data only as long as necessary for the purposes described in this Policy or as required by applicable law:
Data Category
Retention Period
Basis
Account identifiers & profile
Until account deletion; residual copies in encrypted backups up to 90 days
Service delivery
Billing & transaction records
Until account deletion; residual copies in encrypted backups up to 90 days
Payment compliance
Support communications
Until account deletion; residual copies in encrypted backups up to 90 days
Service improvement / disputes
Analytics data (GA4, Clarity)
Per provider defaults (GA4: 14 months; Clarity: 13 months)
Analytics / product improvement
Uploaded documents & embeddings
Until user-initiated deletion or account termination
Service delivery
Chat session histories
Until user-initiated deletion or account termination
Service delivery
Anonymous trial session data & uploads
Unconverted sessions and trial uploads removed by automated cleanup (unconverted sessions retained up to 30 days); sessions converted to an account are retained with that account until account deletion
Abuse prevention / trial enforcement / conversion attribution
Encrypted backup residue
Overwritten per backup rotation (max 90 days)
Disaster recovery
7.2 Category B Data Deletion Protocol
When you initiate the deletion of a document or terminate your account, Nobsy uses commercially reasonable, automated processes to delete or render inaccessible the relevant data from active production systems, generally within ten (10) business days where the request is valid and technically processable:
Source File Deletion. We trigger deletion of the original uploaded file from our cloud object storage on a best-efforts basis. Because object-storage deletion can occasionally fail or be delayed due to transient provider, network, or permission errors, we log such failures and resolve them through routine operational cleanup; we therefore do not guarantee instantaneous erasure from every storage system.
Embedding Deletion. All associated mathematical embeddings are deleted from the PostgreSQL vector database.
Context and Session Clearing. All temporary context windows and associated chat logs tied to that document are cleared from our active databases.
Retained Audit Records. We retain certain records in anonymized form—for example, consent logs with account and IP identifiers removed—as part of our legal-compliance and security audit trail.
Account deletion also attempts to cancel and delete associated payment-provider (Stripe) customer records and the associated authentication (AWS Cognito) identity, on a best-efforts basis and subject to legal, tax, fraud-prevention, and chargeback retention requirements. Limited residual copies may remain temporarily in encrypted backups, logs, or disaster-recovery systems and will be deleted or overwritten in the ordinary course pursuant to our backup retention schedule (maximum 90 days). Additionally, our AI inference provider (OpenAI) may retain API inputs for up to 30 days solely for abuse and safety monitoring, in accordance with its applicable API terms. Upon request, we will confirm via email that deletion from production systems has been initiated.
8. Cross-Border Data Transfers
Nobsy’s core infrastructure is hosted in the United States on Amazon Web Services (AWS). Your Account Data and AI Pipeline Data will be transferred to, processed, and stored on servers located in the United States.
For users accessing the Service from Canada, the transfer of personal information to the United States is necessary to perform the Service under our agreement with you and is conducted in accordance with PIPEDA. By using the Service, you consent to this transfer.
For users accessing the Service from Brazil, your personal data is transferred to, processed, and stored in the United States. We carry out this international transfer in accordance with Chapter V of the LGPD, relying on the necessity of the transfer for the performance of the contract between you and Nobsy (our Terms of Service) and, where required for a specific processing activity, on your specific and highlighted consent. Transferred data remains protected by the technical and organizational safeguards described in Section 9. Details of your rights as a data subject in Brazil are set out in Section 12.3.
The Service is not offered to individuals located in the European Economic Area (EEA), the United Kingdom, or Switzerland, as stated in our Terms of Service. To the extent we nonetheless process personal data subject to the GDPR, UK GDPR, or Swiss FADP, we rely, where applicable, on Standard Contractual Clauses (SCCs) incorporated into our sub-processors’ data processing terms and on the supplementary safeguards described below.
Where required, we also assess the legal and practical risks of relevant transfers and implement supplementary contractual, technical, and organizational safeguards appropriate to the nature of the transferred data, including encryption in transit and at rest, access controls, and data minimization. Further details may be provided in applicable customer agreements.
9. Security Measures
We implement commercially reasonable technical and organizational measures designed to protect your data, including:
- TLS 1.2/1.3 encryption for data in transit;
- AES-256 encryption for data at rest;
- Access to production environments gated in accordance with the principle of least privilege (PoLP).
No internet-based service can guarantee absolute security. We do not warrant the absolute security of any information transmitted to or stored by the Service.
In the event of a security incident affecting personal data, Nobsy will notify affected users and applicable regulatory authorities in accordance with the timelines required by applicable law. For enterprise customers, incident notification timelines, content, and cooperation obligations may be specified in the applicable customer agreement or data processing addendum. Where no such agreement applies, we will provide notice without undue delay after confirming a security incident affecting personal data.
10. CCPA/CPRA Disclosures (California Residents)
Nobsy provides CCPA/CPRA-compliant rights to all California residents, including requests for access, deletion, and correction of personal information.
10.1 Categories of Personal Information Collected
In the preceding twelve (12) months, we may have collected the following categories of personal information as defined by Cal. Civ. Code §1798.140(v), depending on how you use the Service:
- Identifiers (such as email address, account identifiers, and IP address, which we store in hashed form);
- Personal information described in Cal. Civ. Code §1798.80(e) (such as billing address and payment-related records, to the extent collected through Stripe);
- Commercial information (such as records of subscriptions, purchases, and transaction history);
- Internet or other electronic network activity information (such as log data, device/browser data, interactions with nobsy.ai, heatmap and session recording data collected via Microsoft Clarity);
- Professional or employment-related information (such as company name, job title, or business contact details), only if you voluntarily provide it (for example, in a support message); we do not maintain dedicated profile fields for this information;
- Inferences drawn from personal information (limited to service-related inferences generated to operate, secure, or improve the Service where permitted by law; not used for profiling or advertising);
- Sensitive personal information, only where voluntarily provided by you, incidentally included in uploaded content, or otherwise processed as necessary to provide the Service and not for inferring characteristics about you.
10.2 “Sale” and “Sharing” of Personal Information
We do not sell your personal data for monetary consideration as defined by CCPA §1798.140(ad).
We “share” (as defined by CPRA §1798.140(ah)) identifiers and internet activity information with Google through the linkage of Google Analytics (GA4) and Google Ads for cross-context behavioral advertising, including audience building and remarketing. California residents may opt out of this sharing by:
- Clicking the “Do Not Sell or Share My Personal Information” link in the nobsy.ai website footer; or
- Transmitting a Global Privacy Control (GPC) signal via their browser or device. We treat a browser- or device-based GPC signal as a valid request to opt out of the sale and sharing of personal information for that browser or device and, for authenticated users where legally required, the associated consumer profile, in compliance with CPRA regulations (§7025). Our implementation is browser- and device-based; if you use multiple browsers or devices, you may need to set GPC or your cookie preferences on each.
10.3 Sensitive Personal Information
We do not request or intentionally seek to collect sensitive personal information for purposes of inferring characteristics about consumers. However, because users may upload unstructured documents, uploaded content may contain sensitive personal information. Where such information is included in customer-provided content, we process it solely to provide the requested Service, to maintain security, and as otherwise permitted by applicable law, and not for profiling or cross-context behavioral advertising.
10.4 Your Rights Under CCPA/CPRA
- Right to Know/Access: Request disclosure of the specific pieces and categories of personal information we have collected about you.
- Right to Delete: Request the deletion of your personal information, subject to applicable legal exceptions.
- Right to Correct: Request the correction of inaccurate personal data we maintain about you.
- Right to Limit Use and Disclosure of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes that would require us to offer a separate “Limit the Use of My Sensitive Personal Information” choice, except as otherwise permitted by applicable law. If you believe this has changed in your case, you may contact us using the details in Section 15.
We will not discriminate against you for exercising any of these rights. We verify consumer requests by matching the request to the email address associated with your account and requesting confirmation from that email. Authorized agents may submit requests on your behalf with verifiable written authorization. We will respond to verifiable consumer requests within forty-five (45) days, with the option to extend by an additional forty-five (45) days if reasonably necessary.
10.5 California “Shine the Light” Disclosure
California residents may request information regarding whether we have disclosed certain personal information to third parties for their direct marketing purposes during the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes.
11. Rights for Individuals in the EEA, UK, and Switzerland
The Service is intended only for users located in the United States, Canada, and Brazil, and we do not offer, market, or intentionally make the Service available to individuals located in the European Economic Area, the United Kingdom, or Switzerland (see our Terms of Service). The rights and transfer mechanisms described in this Section and in Section 8 are provided on a precautionary basis and apply only to the limited extent required by applicable law in the event of inadvertent, legacy, or otherwise legally unavoidable processing; their inclusion does not constitute an offer to provide, or marketing of, the Service in those territories.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you may have the following rights under applicable data protection law:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of your personal data, subject to legal exceptions.
- Restriction: Request that we restrict certain processing of your personal data.
- Portability: Request a copy of certain personal data you provided to us in a structured, commonly used, and machine-readable format, and request that we transmit it to another controller, subject to applicable legal exceptions.
- Objection: Object to certain processing of your personal data, including processing based on legitimate interests.
- Withdraw Consent: Where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact our Privacy Officer using the details in Section 15. We will respond to data subject access requests within one (1) month, extendable by up to two (2) additional months where necessary due to complexity or volume. Data portability requests will be provided in a structured, commonly used, machine-readable format (e.g., JSON or CSV).
You also have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members\_en.
11.1 Automated Decision-Making
We do not engage in solely automated decision-making that produces legal effects or similarly significant effects on individuals within the meaning of GDPR Article 22. Our AI features assist users in retrieving and interacting with their own uploaded content and do not make autonomous decisions about individuals.
12. International User Rights, PIPEDA & LGPD Compliance
12.1 Global Data Rights
Regardless of your jurisdiction, you maintain the right to access, correct, or delete your personal data, and to withdraw consent for marketing communications. To exercise these rights, contact our Privacy Officer using the details in Section 15.
12.2 PIPEDA Accountability (Canadian Users)
In accordance with Canada’s PIPEDA and the Fair Information Principles, Nobsy designates the Privacy Officer identified in Section 15 as the individual accountable for our compliance.
Consent. By creating an account and using the Service, you provide meaningful consent to the collection, use, and disclosure of personal information reasonably necessary to provide the Service. We will seek additional consent where required for non-essential processing that is not reasonably necessary to provide the Service. You may withdraw consent for non-essential processing at any time by contacting our Privacy Officer or by using the account management tools within the Service.
Breach Notification. In the event of a breach of security safeguards involving personal information under our control that poses a real risk of significant harm, we will provide any required notifications to affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible after we determine that the breach has occurred, as required by PIPEDA §10.1.
12.3 LGPD Disclosures (Users in Brazil)
If you are located in Brazil, we process your personal data in accordance with the Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018). For the processing described in this Policy, Nobsy, LLC acts as the controller (controladora) of your personal data, except where Section 1.2 allocates a processor (operadora) role under an executed DPA or MSA.
Legal Bases (LGPD Art. 7). We process personal data under the following legal bases: performance of a contract to which you are a party, or preliminary procedures related to such contract (account provisioning, service delivery, billing); compliance with legal or regulatory obligations; the legitimate interests of the controller (fraud prevention, platform security, abuse prevention, and service analytics, in each case balanced against your fundamental rights and freedoms); and your consent (optional marketing communications and non-essential cookies), which you may revoke at any time.
Your Rights (LGPD Art. 18). You may request from us, at any time: (i) confirmation of the existence of processing; (ii) access to your personal data; (iii) correction of incomplete, inaccurate, or outdated data; (iv) anonymization, blocking, or deletion of unnecessary or excessive data or data processed in noncompliance with the LGPD; (v) portability of your data to another service or product provider, subject to applicable regulations; (vi) deletion of personal data processed on the basis of your consent, subject to the legal retention exceptions in LGPD Art. 16; (vii) information about the public and private entities with which we have shared your data; (viii) information about the possibility of not providing consent and the consequences of refusal; (ix) revocation of consent; and (x) opposition to processing carried out on a legal basis other than consent, where you believe the processing does not comply with the LGPD (LGPD Art. 18, § 2). Requests may be submitted through the contact details in Section 15. We will respond to requests within the timeframes established by the LGPD and applicable regulations of the ANPD.
Data Protection Officer (Encarregado). Our Privacy Officer, identified in Section 15, serves as our designated data protection officer (encarregado) under LGPD Art. 41 and is the point of contact for data subjects in Brazil and for the ANPD.
Supervisory Authority. You have the right to petition the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD) regarding the processing of your personal data.
International Transfers. Your personal data is processed in the United States as described in Section 8, in accordance with Chapter V of the LGPD.
Security Incidents. In the event of a security incident that may result in relevant risk or damage to data subjects in Brazil, we will notify the ANPD and affected data subjects in accordance with LGPD Art. 48 and applicable ANPD regulations.
Connection and Access Logs (Marco Civil da Internet). As an internet application provider serving users in Brazil, we retain application access records (including IP address and the date and time of access) in a secure environment for the period required by art. 15 of the Marco Civil da Internet (Law No. 12,965/2014), currently six (6) months, and disclose them only pursuant to a court order or as otherwise required by applicable law.
13. Children’s Privacy
The Service is not directed to children, and we do not knowingly collect personal information from children under the age of 13 (or such higher age as may be defined by applicable local law). We also require all users to be at least 18 years old under our Terms of Service. For users in Brazil, we do not knowingly process the personal data of anyone under the age of 18, consistent with our Terms of Service and LGPD Art. 14. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete such information promptly.
14. Policy Updates
We reserve the right to update this Privacy Policy to reflect changes in applicable regulatory frameworks, AI-specific legislation, or our system architecture. We will provide notice of material changes via email to the address associated with your account at least fourteen (14) days prior to the changes taking effect.
Where required by applicable law, we will obtain your consent to material changes before they take effect. Otherwise, your continued use of the Service after the effective date of the revised Privacy Policy will be subject to the updated terms.
15. Contact Information & Privacy Officer
If you have questions regarding this Privacy Policy, wish to exercise your data rights, or need to contact our designated Privacy Officer regarding accountability and compliance, please contact the Privacy Officer below, who also serves as our data protection officer (encarregado) for purposes of the LGPD:
Nobsy Privacy Officer
Email: privacy@nobsy.ai
Telephone: (650) 661-4298
Address: 2108 N ST STE N, Sacramento, CA 95816
Document version: 5.6 | Last revised: July 31, 2026