Last updated · July 2026

    Privacy Policy

    Overview

    This policy explains what personal data Nomona processes, why, and what rights you have. It applies to buyers, audit firms, and anyone browsing nomona.io.

    Who operates Nomona

    Nomona is currently a pre-incorporation project. The operating entity's registered name and address will be added here once incorporation is complete. Until then, direct any privacy question or request to privacy@nomona.io and we will handle it directly.

    What we collect

    Account details such as name, work email, and company. Bid request details including company information, scope, budget, and timeline. Audit firm listing details including accreditation, services, and pricing. Reviews and quote requests. Messages exchanged through the platform. Basic technical data such as IP address and browser type, collected automatically when you use the site.

    Why we use it

    To operate the marketplace: create your account, match bid requests with firms, send notifications about opportunities or quotes, and display firm listings and reviews. This processing is necessary to provide the service you signed up for. Where we check accreditation details or investigate misuse, we do so based on our legitimate interest in keeping the directory accurate and trustworthy. All email we send is transactional, tied to your account or an action you took. We do not currently send marketing email, and would ask for your consent first if that changes.

    Automated matching

    We use basic rules and filters to route bid requests to relevant firms based on framework, region, and scope. This helps you find matches faster. It does not produce legal or similarly significant decisions about you without human involvement, and you can always browse the directory yourself instead of relying on matching.

    Who we share it with

    We use a small number of infrastructure providers to run the platform: Supabase for hosting, database, and authentication, Google for optional sign-in, and Resend for transactional email delivery. If you choose to pay for a plan, Stripe processes billing and we do not see or store your card details. Buyers and firms see the information about each other that is necessary to communicate, such as contact details shared after a bid is accepted or a quote request is sent.

    International transfers

    Some of our infrastructure providers may store or process data outside the European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the provider's equivalent certification.

    Cookies and local storage

    We use local storage to keep you signed in and a small cookie to remember interface preferences. We do not currently use advertising or third-party analytics cookies. See our Cookie Policy for details.

    AI agents and the Nomona API

    Nomona exposes parts of the directory and bid data through an API designed for AI agents to act on your behalf, using your own credentials. If you connect a third-party AI agent, that agent can access the same data you can. You are responsible for which agents you authorize and what you allow them to do.

    How long we keep it

    We keep account and bid request data for 12 months after account deletion or bid closure, to handle disputes or legal claims, and then delete or anonymize it. Public listing and review content is kept for as long as the related account or listing is active.

    Your rights

    You can request access to, correction of, or deletion of your personal data, object to or restrict certain processing, or ask for a copy of your data in a portable format. Contact privacy@nomona.io and we will respond within the timeframe required by law. You also have the right to lodge a complaint with your national data protection authority.

    Children

    Nomona is a business-to-business platform and is not directed at or intended for use by children.

    Security

    We restrict data access using row-level security at the database layer, so users and services can only reach the data their role permits. We use encrypted connections throughout the platform.

    Changes to this policy

    We may update this policy as the platform evolves. Material changes will be reflected in the date above.

    Contact

    Questions about this policy or your data can be sent to privacy@nomona.io.

    Questions? Email hello@nomona.io.