Privacy Policy
Last updated: 12 October 2026 · Controller: Dedieu Conseil · Contact: theo.dedieu@dedieu-conseil.fr
Nomad is a mobile relationship CRM. This policy describes how we collect, use, store, and delete personal data, including data obtained from Google APIs.
1. Data we process
- Account: email, name, authentication identifiers (AWS Cognito).
- Contacts: names, emails, phones, notes, tasks, documents, and interaction history you add or import.
- Recordings & transcripts: audio you record in the app and text extracted from it.
- Device contacts: if you grant iOS/Android Contacts permission, we sync contacts you choose to manage in Nomad.
- Google account data — only after you sign in with Google and grant the listed scopes (see §2).
- Diagnostics: crash and performance events (Sentry). We identify you by a non-email user id.
2. Google user data (OAuth scopes)
Nomad’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We request these scopes. We do not request Gmail read, Gmail metadata, or Gmail modify.
Calendar — calendar.readonly
After you tap Connect calendar in Settings (this is separate from Google Sign-In), we read your upcoming and recent Google Calendar events to show the next 7 days, to generate a pre-meeting briefing for contacts who appear as attendees, to auto-log past meetings as interactions, and to suggest new contacts from attendee emails that are not yet in Nomad. We store event id, title, time, and attendee emails on your account.
Calendar — calendar.events
When you ask Nomad to create or update a meeting, and you confirm the draft in the app, we write that event to your Google Calendar. We never create events without that confirmation.
People — contacts.readonly and contacts.other.readonly
During onboarding (and later import), we read your Google Contacts and Google “Other contacts” (people you have emailed) so you can pick who to follow in Nomad. We store only the contacts you select. This is separate from iOS/Android device contacts permission.
Drive — drive.file
When you tap “Add a Google Doc” on a contact, you pick specific files. We download those files, extract text, and attach them to that contact. Nomad cannot list or read Drive files you have not selected. We do not use the Restricted drive.readonly scope.
Gmail — gmail.send
After you connect Gmail in Settings, Nomad can send an email from your address, and only an email you wrote or approved in the app and chose to send. We do not read, list, or search your mailbox.
Limited Use
- Google user data is used only to provide and improve the user-facing features above.
- We do not use Google user data to serve ads or to train generalized AI/ML models.
- We do not transfer Google user data to third parties except as needed to provide those features (see §4) or for security / legal compliance, and not for any other purpose.
- Human access to Google user data is limited to security, legal, and support cases you initiate, or where required by law.
3. Where data is stored
Application data is stored in AWS eu-west-3 (Paris): DynamoDB, S3, and Cognito. Audio and documents live in our S3 buckets. Tokens on device use the iOS Keychain / Android Keystore (Expo SecureStore).
4. Processors
- Amazon Web Services (EU) — hosting and authentication.
- Google — Sign-In, Calendar, People, Drive, and (separately) Gmail send if you connect Gmail.
- OpenAI (United States) — generates briefings, task extraction, and drafts from content you create or import (recordings, notes, selected documents, and calendar event metadata when a briefing is produced). This is a transfer outside the EEA; we rely on OpenAI’s data processing terms / SCCs.
- Sentry — error monitoring.
- Stripe — payment and invoicing of the Pro subscription on the web (Stripe Checkout and billing portal). We send Stripe your account id and email; you enter your payment details directly with Stripe. We never see or store your card data.
5. Legal bases (GDPR)
Contract (providing the CRM you signed up for), consent (Google OAuth scopes, device permissions, optional AI processing of connected Google data), and legitimate interests (security, fraud prevention, product diagnostics). You can revoke Google access at any time in your Google Account permissions and by signing out or deleting your Nomad account.
6. Retention and deletion
We keep your data while your account is active. Deleting your account in Settings → Privacy cascades to contacts, documents, recordings, and the Cognito user. Google access tokens are dropped; revoke leftover grants in your Google Account if needed.
7. Your rights
You may access, rectify, erase, restrict, or export your data, and object to processing, by emailing theo.dedieu@dedieu-conseil.fr. You may lodge a complaint with the CNIL (France) or your local supervisory authority.
8. Children
Nomad is for professionals aged 18+. We do not knowingly collect data from children.
9. Changes
Material changes will be dated at the top of this page. Continued use after an update constitutes acceptance of the revised policy.