Privacy & Cookie Notice

1. Controller

ElaronWorks sp. z o.o.
ul. Kalwaryjska 69/9, 30-504 Kraków, Poland
KRS 0001207366 · NIP 6793349283 · REGON 54333337900000

No Data Protection Officer has been appointed. For privacy inquiries contact privacy@nomiaweave.com.

2. Data We Process

• Account data: email address, display name.
• Profile data: country of residence, country of origin, join reason.
• Login metadata: authentication method, session tokens, IP addresses, timestamps.
• Application data: weave names, name options, ratings, preferences, collaborator emails.
• AI feature data: AI requests, bounded weave context, generated suggestions and insights, token usage, model/provider metadata, and moderation or failure metadata.
• Billing data: subscription plan, payment metadata (processed by Stripe; we do not store card numbers).

3. Purposes & Legal Bases (GDPR Art. 6)

• Service delivery — Art. 6(1)(b) performance of contract.
• Security & fraud prevention — Art. 6(1)(f) legitimate interests.
• Billing & tax compliance — Art. 6(1)(c) legal obligation.
• Product improvement — Art. 6(1)(f) legitimate interests. We may analyse aggregate, de-identified usage patterns.
• AI feature delivery — Art. 6(1)(b) performance of contract when you request AI draft suggestions or AI name insights.
• Advertising — Art. 6(1)(f) legitimate interests. Non-identifying data (general location, product category) may be used for ad targeting on free/lower tiers. You may opt out by upgrading to a tier that disables ads.
• Marketing communications — Art. 6(1)(a) consent. Promotional emails are sent only with your explicit opt-in and you may withdraw consent at any time.

4. Recipients & International Transfers

We may share data with the following categories of processors:

• Cloud infrastructure: Railway / AWS (USA).
• Payment processing: Stripe (USA).
• AI providers: OpenAI or another configured AI provider (USA or other jurisdictions listed by that provider) — only when you use AI features. We send bounded context required for the requested output and do not use your data to train AI models.
• Email delivery: Resend (USA).
• CDN & security: Cloudflare (USA).

Transfers to the USA rely on Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework where applicable.

5. Retention

• Account & application data: retained while your account is active; deleted within 90 days of account closure.
• Billing records: 5 years (Polish accounting law).
• AI outputs and usage records: retained while your account is active unless deleted earlier through the product, then deleted with account data according to the schedule above.
• Security logs: 12 months.

6. Your Rights

Under GDPR you may exercise the following rights by contacting us:

• Access your data.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict processing.
• Data portability.
• Object to processing based on legitimate interests.

You also have the right to lodge a complaint with a supervisory authority (in Poland: UODO — Urząd Ochrony Danych Osobowych).

7. Cookies & Local Storage

We use essential cookies and local storage only for authentication, session management, security, and core functionality (e.g. remembering your cookie notice acknowledgment).

We do not currently use analytics or advertising cookies. If this changes in the future we will update this notice and request your consent where required.

8. Contact

Privacy inquiries: privacy@nomiaweave.com
Legal inquiries: legal@nomiaweave.com