Privacy policy
Last updated: 13 October 2026.
1. Data controller
The controller of the personal data processed through this website is Nomad Room Sociedad Limitada, tax ID (NIF) ESB90220823, with registered office at Fernando IV, 22 Bajo, 41011 Sevilla, Sevilla, España. The trade name is Nömad.
Contact email for privacy matters and for exercising your rights: legal@nomad.ooo. No Data Protection Officer has been appointed at present, unless stated otherwise in a specific communication.
2. Who this policy applies to
This policy applies to people who visit the website, contact Nömad, request commercial information, subscribe to communications, interact with content, use forms, access the web application or have a professional or contractual relationship with Nömad.
3. Data we may process
Depending on the channel used, we may process identification and contact data such as first and last name, email, phone, company, job title, country, language, the message sent, commercial preferences, billing data if a service is contracted, information linked to a user account, brand and project data entered in the application, communications with Nömad (emails, WhatsApp messages, in-app conversations, support requests and notes of calls and meetings) and technical browsing metadata.
We may also process technical data such as IP address, online identifiers, device information, browser, operating system, pages visited, traffic source, interaction events and consent given or refused. If you accept analytics, we also record the website pages you visit with an identifier of Nömad's own, as explained in section 4.
4. Purposes and legal bases
We process personal data only when there is a legitimate purpose and a valid legal basis. By way of guidance, the main processing activities of this website and the application are:
Pre-contractual measures or legitimate interest in handling the request.
Performance of a contract, pre-contractual measures and legitimate business interest.
Performance of a contract, pre-contractual measures and legitimate interest in properly managing the relationship with clients and contacts.
Performance of a contract or the applicable terms of use.
Performance of a contract and legitimate interest in providing the service properly.
Consent, except for communications allowed by a prior contractual relationship under applicable law.
Consent when non-essential cookies or identifiers are used.
Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the cookie settings.
Consent.
Consent when non-essential cookies are involved; legitimate interest or the requested functionality when an enhanced privacy mode is used and the interaction is needed to show the content.
Legal obligation.
Legitimate interest and legal security obligations.
Nömad's own website visit measurement
If you accept analytics cookies, the website stores in your browser Nömad's own nomad_vid cookie, a random identifier that does not include your name or email, and Nömad records in its own systems the pages you visit: page path, title, referring page, campaign parameters (UTM) and date and time. We do not store your IP address or your browser's user agent. This data is not disclosed to third parties, except to the providers that host the platform on Nömad's behalf, and is not used for advertising.
As long as you do not submit a form or sign in to the application, those visits are not linked to an identified person. When you submit a website form or sign in to the application from the same browser, we link that identifier to your contact or client record in Nömad's CRM, so our team can see which pages you have viewed in order to understand what interests you and attend to you better.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time from the “Customize” link in the website footer: when you do, the nomad_vid cookie is deleted and we stop recording your visits. The cookie lasts 13 months from the first visit and is never extended, and recorded visits are kept for 13 months. More details in the Cookie policy.
Communications recorded in the CRM
To attend to clients and contacts with context and continuity, Nömad records in its CRM the communications you have with us: emails, WhatsApp messages, conversations within the application, support requests and the notes of calls and meetings logged by our team. We use them to reply to you, follow up on your requests and provide the contracted services, and we keep them for the periods described in section 7.
5. Tools and providers
To operate the website and the application we may use technology providers such as Supabase, Vercel, Google Analytics 4, Google Tag Manager, Google Ads, Google/YouTube, Meta Pixel, PostHog, Microsoft Clarity, Cloudflare Turnstile, MailerLite, MailerSend, Bird (WhatsApp messaging), Stripe or other payment providers, and AI providers when the user uses features that generate, analyse or transform content. Which ones are active depends on the features configured at any given time; the tools that use cookies and when they load are detailed in the Cookie policy.
Nömad seeks to use providers with contractual guarantees, security measures and data processing agreements where applicable.
6. International transfers
Some providers may process data outside the European Economic Area. When this happens, Nömad seeks appropriate safeguards such as adequacy decisions, standard contractual clauses, data processing agreements, supplementary measures or equivalent mechanisms provided for by applicable law.
7. Data retention
We keep data for as long as needed for the purpose for which it was collected and, afterwards, for the periods required by legal, tax, accounting or contractual obligations. Commercial requests are kept while the relationship is managed or there is a reasonable interest; accounts and application data while the account is active; billing data for the legal periods; commercial communications until you unsubscribe or withdraw consent; communications recorded in the CRM while the relationship lasts and, afterwards, for the applicable legal periods; visits recorded through the website's own visit measurement, 13 months; and technical or analytics data for the periods configured in each tool.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to legal@nomad.ooo. To protect your privacy, we may ask for additional information to verify your identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
9. Commercial communications
We only send commercial communications when there is a valid legal basis: consent, an express request, a prior relationship allowed by law or an applicable legitimate interest. Every commercial communication includes a simple way to unsubscribe.
10. Minors, security and changes
The website and Nömad's services are not directed at children under 14. Nömad applies reasonable technical and organisational measures to protect personal data, although no internet-connected system can guarantee absolute security. We may update this policy to reflect legal, technical or service changes.
11. Google user data
Specific update: 2 August 2026. This section explains how Nömad accesses, uses, stores, shares, protects, and deletes data obtained through Google APIs.
Access and requested data
Nömad accesses Google data only after an authorized brand owner or administrator starts OAuth and expressly grants permission. We use incremental authorization and request only the scopes needed to read selected Google Analytics 4 metrics, read Google Tag Manager inventory, manage selected Google Business Profile listings, read YouTube channels and video metadata, and upload videos to YouTube. The authorized person selects the property, container, listing, or channel connected to the brand.
Use
We use this data only to display the selected accounts and resources in Nömad, provide requested metrics and inventories, maintain the connection, and publish to YouTube only user-created videos explicitly approved and scheduled for the chosen channel. Nömad does not sell Google user data, use it for personalized advertising, or use it to train general-purpose artificial intelligence models.
Storage, retention, and protection
OAuth tokens are encrypted at application level and are accessible only to authorized server services. We use HTTPS, brand role-based access, strict tenant isolation, and row-level security. Normalized metrics are retained for no more than 25 months and operational delivery detail for 180 days, unless a shorter period, a user deletion request, or a legal obligation applies.
Sharing
We do not share Google user data except with service providers acting on Nömad's behalf that are required to host, secure, and operate the platform, or where required by law. Those providers may not use the data for their own purposes.
Disconnecting, revocation, and deletion
A brand owner or administrator can disconnect each integration from Nömad's Connections section. When the last connection under an authorization is removed, we attempt remote revocation and delete stored tokens. When YouTube authorization is revoked, expires, or is disconnected, we immediately delete or anonymize authorized YouTube API data, including remote identifiers, metrics, and provider responses. You may also revoke Nömad from your Google Account permissions or request access or deletion by emailing legal@nomad.ooo.
Nömad's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
12. Data from Meta platforms (Facebook, Instagram, Threads and Meta Ads)
Specific update: 7 October 2026. This section explains how Nömad accesses, uses, stores, shares, protects, and deletes data it receives from Meta platforms.
Access
Nömad accesses Meta data only after an authorized brand owner or administrator expressly connects their accounts through Facebook Login for Business, Instagram Login or Threads authorization, and selects the Facebook Pages, Instagram professional accounts, Threads profiles or ad accounts that belong to that brand. We request only the permissions needed for the features the brand uses.
Data we process
The ID, name, username and profile picture of each connected account; the posts the brand creates and publishes from Nömad, with their IDs and links; the account's recent posts, to show its history and calendar; account and post metrics (reach, views, interactions, comment counts and followers); and, for Meta Ads, the impressions, clicks, reach and amount spent of the ad account. We do not read the text of comments or private messages.
Use
We use this data only to show the connected accounts and their results within the brand; to publish to the chosen account the content that a person of the brand creates and approves, including an optional first comment; and to delete a post from the network when that person asks for it. Nödo, Nömad's AI assistant, may use this data only within the same brand to help its users. Nömad does not sell Meta data and does not use it for advertising or to train general-purpose artificial intelligence models.
Storage, retention, and protection
Access tokens are encrypted at application level and are accessible only to authorized server services. We use HTTPS, brand role-based access, strict tenant isolation, and row-level security. We keep this data while the connection is active and, afterwards, for the periods described in section 7, unless deletion is requested earlier.
Sharing
We do not share Meta data except with service providers acting on Nömad's behalf that are required to host, run, and secure the platform (hosting, database, background jobs and AI providers), or where required by law. Those providers may not use the data for their own purposes.
Disconnecting, revocation, and deletion
A brand owner or administrator can disconnect each account from Nömad's Connections section. When the last connection under an authorization is removed, we attempt remote revocation and delete stored tokens. If you remove Nömad's access from your Facebook, Instagram or Threads settings, Meta notifies us and we stop using that authorization. If you also request deletion of your data through Meta, we delete or anonymize that account's data and give you a confirmation code. You may also request access or deletion by emailing legal@nomad.ooo.
Our processing of this data complies with the Meta Platform Terms and the Developer Policies.
This is a translation; in case of discrepancy the Spanish version prevails.