Nemosine
Start writing

Legal

GDPR information

EEA, Norwegian, and UK privacy rights information for Nemosine users.

1. Controller and contact

For GDPR purposes, the controller is:

Nemosine AS
Org. no. 937 091 567
Vestre Furmyrveg 26, 6017 Aalesund, Norway
support@nemosine.app

Nemosine has not currently appointed a separate data protection officer. Privacy questions should be sent to the contact above.

2. What processing this page covers

This page summarises GDPR-relevant processing for Nemosine's currently live service, including:

  • account creation and authentication
  • optional encrypted cloud sync
  • subscriptions and billing status
  • support and website contact requests
  • operational metrics for reliability, capacity, storage, and bandwidth planning

The optional read-only Google Calendar integration and optional Cloud AI models on Nemosine Pro are part of the current processing scope. Cloud AI content processing is based on explicit, revocable consent. Luna (Cloud), the one cloud model, uses OpenAI; every request goes to OpenAI. See section 7a of the Privacy Policy and Cloud AI data processing.

3. Main categories of personal data

Nemosine may process:

  • identifiers such as email address and user ID
  • user-generated content you choose to store or sync
  • sync metadata such as timestamps, row IDs, versions, and randomly generated device IDs used by the sync algorithm
  • usage counters such as storage, ingress, egress, read/write requests, and session totals
  • technical error data from the local error log only if you choose to attach it to feedback you send, and automatic error reports only if you allow them, both without note contents or synced note bodies
  • subscription and transaction metadata
  • support and contact-form information
  • content you choose to include in a Cloud AI request, while it is being relayed and processed
  • Cloud AI usage records containing token counts, model, timing, status, and cost, without prompt or reply content
  • Luna's reasoning state, returned encrypted by OpenAI and stored on your device with the chat, which Nemosine cannot read

4. Lawful bases

For EEA, Norwegian, and UK users, Nemosine generally relies on:

  • Article 6(1)(b) contract for account creation, authentication, cloud sync, subscriptions, and support connected to the service
  • Article 6(1)(f) legitimate interests for service security, abuse prevention, troubleshooting, operational metrics, capacity planning, and internal aggregated KPI reporting
  • Article 6(1)(c) legal obligation where records must be retained under accounting, tax, consumer, or other applicable law
  • Article 6(1)(a) consent for content you choose to send to Cloud AI, and where consent is otherwise specifically required, such as any future optional non-essential cookies or comparable tracking

5. Encrypted sync and metadata

If you enable cloud sync, synced note content and synced media are encrypted on your device before upload.

However, not all metadata is encrypted end-to-end. To provide authentication and sync, Nemosine still processes technical metadata such as:

  • account identifiers
  • timestamps
  • sync row and table identifiers
  • row versions and deletion markers
  • randomly generated device identifiers used by the sync algorithm as anonymous technical metrics
  • usage and quota counters

Technical error data is only sent if you choose to submit an error report, and those reports do not include note contents or synced note bodies.

Nemosine therefore provides end-to-end encryption for synced content, but not for all sync metadata.

6. Recipients and international transfers

Nemosine uses service providers including Supabase, Vercel, Formspree, Stripe, Apple, and Google, depending on the feature you use. If you use Cloud AI, OpenAI Ireland Limited receives Luna requests. Nemosine does not put your account identifier, email address, or client IP address in a provider request. Free-form request content remains pseudonymous personal data where it can be linked to a person; it is not treated as anonymous data.

Where personal data is transferred outside the EEA or Norway, Nemosine relies on applicable legal transfer mechanisms such as adequacy decisions, Standard Contractual Clauses, and supplementary safeguards where appropriate. For Cloud AI, Nemosine's data processing agreement for Luna is with OpenAI Ireland Limited in Ireland; OpenAI carries any onward transfer outside the EEA — including to OpenAI OpCo, LLC in the United States — under its own agreements containing Standard Contractual Clauses or an adequacy decision.

7. Retention

In general:

  • account and cloud data are retained while the account remains active
  • cloud data may be deleted after 2 years of inactivity
  • paid accounts normally retain cloud data while the subscription or account remains active
  • local copies on your devices are not automatically deleted when cloud data is deleted
  • Nemosine does not retain or log Cloud AI prompt or reply content on its servers
  • OpenAI may retain Luna request and response content in abuse-monitoring logs for up to 30 days unless Nemosine's OpenAI organisation is separately approved and configured for Zero Data Retention; store: false prevents provider-hosted application-state storage but does not by itself remove that abuse-monitoring period
  • Cloud AI token-usage and billing records are retained for 24 months and are then aggregated into statistics that do not identify you
  • legal and accounting records may be retained longer where required
  • de-identified or aggregated statistics may be retained after account deletion

8. Your GDPR rights

Subject to GDPR and applicable exceptions, you may have the right to:

  • access
  • rectification
  • erasure
  • restriction
  • objection
  • portability
  • withdraw consent where processing is based on consent

You also have the right to complain to a supervisory authority. In Norway, that authority is Datatilsynet.

Requests may be sent to support@nemosine.app. We may request information needed to confirm your identity before acting on a request.