Privacy Policy
Version v1 · Effective 26 October 2026 · Last updated 26 October 2026
This Privacy Policy explains how Nomisma LLC processes personal data in connection with Smartsteps (smartsteps.ai). It distinguishes the personal data Nomisma controls (about Users, billing, support and visits to our website) from the personal data contained in Customer Content, which Nomisma processes on behalf of its Customers. Capitalised terms not defined here have the meanings given in the Terms of Service.
Privacy at a glance. What we collect: your name, work email, password (stored only as a hash), company, country of establishment, billing records, support messages and security logs. Who we share it with: Amazon Web Services (hosting, email, and AI through Amazon Bedrock) and Stripe (payments), and Anthropic only if we use its API as a fallback; we do not sell personal data or use it for advertising. Why: to run your account and the Service, bill you, keep the Service secure and comply with sanctions law. Risks: your data is stored in the United States, where authorities may access it under US law, and no system is completely secure. The rest of this Policy gives the detail.
1. Who We Are and Scope
1.1 Smartsteps is a product of Nomisma LLC ("Nomisma", "we", "us"), a limited liability company formed under the laws of the State of Wyoming, United States, with its address at 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States (telephone +1 510-565-0510). For privacy questions and requests, contact info@nomisma.ai.
1.2 This Policy applies to personal data processed through the Smartsteps website at smartsteps.ai, the web application at smartsteps.ai/app (together, the "Service"), our transactional email, and our support channels.
1.3 Smartsteps is a business-to-business service. It is not directed at consumers or at anyone under 18 (see Section 13).
1.4 Read this Policy together with the Terms of Service, the Cookie Policy, the Sub-processors page and, where it applies, the Data Processing Addendum.
1.4 Where Smartsteps is offered. Smartsteps is currently offered only to businesses established outside the European Economic Area, the United Kingdom, Switzerland, Brazil and the Canadian province of Quebec (see the Terms of Service, Section 1.4). Visitors from anywhere may read our website. The sections below that describe rights under the GDPR and UK GDPR apply to any personal data of individuals in those places that we nevertheless process, for example of a visitor who contacts us.
2. Our Role: Controller and Processor
2.1 Nomisma as controller. Nomisma decides why and how the following personal data is processed, and is its controller (or "business" under the CCPA): account data, billing data, support data (for the purpose of running our support relationship with you), security and audit data, email delivery data, and data about visits to smartsteps.ai.
2.2 Nomisma as processor. Customer Content is submitted by, or collected for, our Customers. It includes the business profile, selected markets, website addresses, policy documents, crawl evidence and Reports. Where Customer Content contains personal data (for example, a name and address in a website imprint, contact details in a privacy policy, or personal data visible in a screenshot of a Customer Website), the Customer is the controller and Nomisma processes that data as its processor (or "service provider" under the CCPA), on the Customer's instructions and under the Data Processing Addendum.
2.3 If your personal data appears in a Customer's Customer Content, for example because you are named on a website that a Customer had us scan, please direct your request to that Customer first. If you contact us, we will refer your request to the Customer where we can identify it, and will assist the Customer in responding.
3. Personal Data We Collect
| Category | What it includes | Source |
|---|---|---|
| Account data | Name; email address; password, stored only as an Argon2id hash; email-verification status; single-use sign-in link tokens; session records; whether you chose "keep me signed in"; the Workspaces you belong to and your role in them | You; other Users of your Workspace |
| Billing data | Billing contact name and email; company name; Plan, subscription status, invoices and transaction records; identifiers that link your Workspace to Stripe. Full card numbers are collected by Stripe and never reach Nomisma | You; Stripe, Inc. |
| Support data | The content of support tickets and our replies, any attachments, and the Workspace context needed to resolve the ticket | You; other Users; other Nomisma websites that forward a support request to us through our own ticket intake (we do not use a third-party customer-support service) |
| Security and audit data | Records of sign-ins, failed sign-in attempts, account lockouts, account changes, billing actions and other security-relevant actions; records of Nomisma staff access to Workspaces; IP address and browser user agent associated with these events | Automatically, from your use of the Service |
| Email delivery data | The address a transactional email was sent to and its type, and information Amazon Simple Email Service may return about its delivery | Automatically; Amazon Simple Email Service |
| Website and technical data | Technical data that may be recorded in server and application logs when you visit smartsteps.ai or use the Service, such as IP address, browser user agent, requested address and time | Automatically, from your browser |
| Sanctions-compliance data | The country associated with a sign-up, used to block sign-up from sanctioned countries and regions | You; automatically |
| Correspondence | Emails and other messages you send us, for example to info@nomisma.ai | You |
We do not use analytics, advertising or third-party tracking technologies in the Service. See the Cookie Policy.
The free practice check
The free practice check at smartsteps.ai/check can be used without an account. To answer it we process what you enter: your country, where your clients are, your sector, the tools and plans you name, the kinds of data you put into them, whether your clients were told, and an optional description of what you use the tools for. Before anything else happens we remove email addresses, phone numbers and web addresses from the description and cut it to 500 characters.
Fixed rules compare your answers with our library of vendor terms and our law database. The rule results, the vendor facts used and your cleaned description are then sent to Anthropic's Claude models (through Amazon Bedrock, or Anthropic's API as a fallback, see section 6) to word the explanation. The answer is returned to your browser and we do not store what you entered or the result: nothing you entered is saved to an account, our database or our application logs, and "Save a copy" builds the file in your browser.
We keep only: (a) your IP address with the time of each check, for one hour, to limit each connection to five checks an hour, after which it is deleted; (b) a record of the AI cost of the check (model and token counts, no content); and (c) a count record with your country, the names of the tools checked and the overall verdict, with no IP address and nothing you typed. Our legal basis is our legitimate interest in offering the check and protecting it from abuse.
4. Customer Content Processed for Customers
4.1 To provide the Service, we process Customer Content on the Customer's behalf, including:
- the business profile (for example what the Customer sells, revenue and headcount bands, visitor and user counts, categories of data collected, whether it serves minors, marketing channels, hosting regions, use of AI and subscriptions) and the markets selected;
- policy documents uploaded or linked (PDF, DOCX, HTML or text), including text extracted by optical character recognition;
- crawl evidence collected by our automated browser, SmartstepsBot, from Customer Websites: pages visited, cookies set, third-party requests, consent-banner behaviour, Global Privacy Control handling, form structure (field names and types only; the crawler never submits forms and does not record submitted values), legal links, imprint details, accessibility check results and screenshots; and
- Reports generated from the above.
4.2 Customer Content is mostly information about businesses and their websites. It may, however, include personal data that appears in a document or on a page of a Customer Website. Customers must only submit websites and documents they own or are authorised to have scanned (see the Acceptable Use Policy).
5. How We Use Personal Data and Our Legal Bases
Where the GDPR or UK GDPR applies to our processing as controller, we rely on the following legal bases:
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Creating and operating accounts, verifying email addresses, sending sign-in links, keeping you signed in | Account data | Performance of a contract (Art. 6(1)(b)) |
| Providing the Service, including crawling, analysis and Reports, and sending transactional email (verification, sign-in links, report ready, monthly standing, support replies) | Account data; email delivery data | Performance of a contract (Art. 6(1)(b)) |
| Taking payment, invoicing, and managing Plans and Credits | Billing data | Performance of a contract (Art. 6(1)(b)) |
| Keeping billing and tax records | Billing data | Legal obligation (Art. 6(1)(c)) |
| Responding to support tickets and enquiries | Support data; correspondence; account data | Performance of a contract (Art. 6(1)(b)); legitimate interests in answering enquiries (Art. 6(1)(f)) |
| Securing the Service, preventing fraud and abuse, enforcing our terms, investigating unauthorised crawling, and keeping audit logs | Security and audit data; website and technical data; account data | Legitimate interests in protecting the Service, our Customers and third parties (Art. 6(1)(f)) |
| Complying with sanctions and export-control law | Sanctions-compliance data; account and billing data | Legal obligation (Art. 6(1)(c)); legitimate interests in avoiding sanctions exposure (Art. 6(1)(f)) |
| Operating and maintaining the Service and fixing errors | Security and audit data; website and technical data | Legitimate interests in running a reliable service (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims, and responding to lawful requests | Any relevant data | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Marketing email, only if you have opted in | Name; email address | Consent (Art. 6(1)(a)), which you may withdraw at any time |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object at any time (see Section 10).
We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals. Reports assess businesses, documents and websites, not individuals.
New purposes. We use personal data only for the purposes described in this Section. Before we use personal data for a purpose not described here, we will tell you and, where the law requires it (including under PIPEDA), ask for your consent first.
Basis for processing under Indian law. Where the Digital Personal Data Protection Act, 2023 applies, we process your personal data on the following grounds only: (a) because you voluntarily provided it for a specified purpose and have not told us you do not consent (section 7(a)): account data, billing data, support data and correspondence, to create and secure your account, provide the Service, take payment and answer your requests, including the security and audit logging needed to protect that account; (b) to meet our legal obligations (section 7): billing and tax records, sanctions screening, and responses to court orders and lawful requests; and (c) your consent (section 6), which we ask for separately when you create an account: marketing email, if you opt in, and any disclosure of your personal data to another business for its own purposes, other than our processors listed on the Sub-processors page and disclosures the law requires or permits without consent. We do not rely on legitimate interests for personal data governed by Indian law.
6. AI Processing
6.1 To evaluate legal obligations, run a second-opinion review, label clauses and write summaries, the Service sends policy text and crawl evidence to Anthropic's Claude models through Amazon Bedrock, a service of Amazon Web Services. Amazon Bedrock does not use customer inputs or outputs to train the underlying models.
6.2 Nomisma may alternatively use Anthropic's own API as a fallback provider. Where it does, Anthropic, PBC processes the same categories of data as a Sub-processor, as described on the Sub-processors page.
6.3 Nomisma does not use Customer Content or personal data to train, retrain or fine-tune any AI model. The data sent to the AI Features is Customer Content, so it may contain personal data only to the extent that a Customer's documents or Customer Websites contain it. Account data such as passwords is never sent to the AI Features.
6.4 More detail is in the AI Transparency statement.
7. Who We Share Personal Data With
7.1 Sub-processors and service providers. We use Amazon Web Services, Inc. for hosting, database, storage, email, optical character recognition and AI inference (through Amazon Bedrock), and Stripe, Inc. for payments. Anthropic, PBC is a conditional Sub-processor, used only when the Anthropic API serves as a fallback AI provider. The current list, with each provider's purpose, data and location, is on the Sub-processors page.
7.2 Stripe. When you pay, you are taken to pages hosted by Stripe. Stripe collects your card details directly and processes them under its own terms and privacy policy. Stripe acts as our service provider for payment processing and, for some purposes such as fraud prevention and meeting its own legal obligations, as an independent controller.
7.3 Our personnel. Our staff, which may include contractors bound by confidentiality obligations, may access personal data where needed for their role. Support staff may view the Workspace data needed to resolve a ticket. Staff access is role-based, protected by two-factor authentication and recorded in an audit log.
7.4 Within your Workspace. Other Users of your Workspace can see your name, email address and Workspace activity to the extent the Service displays them.
7.5 Legal and safety reasons. We may disclose personal data where required by law, legal process or a lawful request from a public authority; to enforce our terms; or to protect the rights, property or safety of Nomisma, our Customers or others.
7.6 Business transfers. If the Smartsteps business is involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy. Legal basis: our legitimate interests in carrying out and completing such a transaction; the recipient must protect the data as this Policy describes.
7.7 Professional advisers. We may share personal data with our lawyers, accountants and auditors under duties of confidentiality. Legal basis: our legitimate interests in obtaining professional advice and establishing, exercising or defending legal claims, and, for auditors, compliance with our legal obligations.
7.8 No sale and no sharing for advertising. We do not sell personal data and do not share it for cross-context behavioural advertising.
8. Security
We protect personal data with technical and organisational measures that include: passwords hashed with Argon2id; account lockout after repeated failed sign-in attempts; uniform sign-in error messages; server-side sessions in httpOnly, Secure cookies; two-factor authentication and role-based access for Nomisma staff; audit logs; encryption in transit using TLS 1.2 or higher; encryption at rest of the database (using AWS Key Management Service) and of stored files; and least-privilege access between our cloud components. Nomisma personnel and contractors who can access personal data receive privacy and security training when they start and at least once a year. We apply security updates to our systems, containers and software dependencies promptly, prioritising critical vulnerabilities. We keep the logs and personal data needed to detect, investigate and remediate unauthorised access for at least one year. Our written contracts with each processor that handles personal data for which we are responsible, including Amazon Web Services and Stripe, require it to maintain security safeguards at least equivalent to those described in this section. More detail is in the Security Overview and Vulnerability Disclosure and Annex II of the Data Processing Addendum. No system is completely secure, and we cannot guarantee the security of information transmitted to or stored in the Service.
9. Retention
We keep personal data only for as long as we need it for the purposes in Section 5, and in particular:
| Data | Retention |
|---|---|
| Account data | While the account exists |
| Customer Content, including crawl evidence and Reports, in the live Service | While the Workspace exists; deleted with the Workspace |
| Crawl evidence history (screenshots and records from past analyses) | While the Workspace exists; deleted when the Workspace is deleted |
| Hosted policy documents and their versions | While the Workspace exists; deleted with the Workspace |
| Support tickets | Three years after the ticket is closed |
| Renewal-consent records (what you agreed to when subscribing) | Four years after the subscription ends, to evidence consent under automatic-renewal laws |
| Sign-up country and sanctions screening result | While the account exists, then with the audit logs |
| Sign-up consent records (terms acceptance; for India, the notice version and consent text) | While the account exists, then with the audit logs |
| Server and application logs (IP address, user agent, requested address) | One year, to detect, investigate and remediate unauthorised access |
| Email delivery data from Amazon SES | Ninety days |
| Free practice check: what you entered and the result | Not stored |
| Free practice check: IP address and time, for the hourly limit | One hour |
| Correspondence with us outside the Service | Three years |
| Audit logs | Two years |
| Billing and tax records | Seven years, to meet tax-law requirements |
| Database backups | Expire within seven days |
Deleting your account. You can delete your account yourself in Settings (Delete my account). When you do, your user account, and any Workspace in which you are the only member, are deleted immediately from the live database. If you are the only owner of a Workspace that other Users still use, you must first make another User an owner. Database backups expire within seven days. Crawl evidence for a deleted Workspace, including screenshots, is deleted at the same time, and any active subscription for that Workspace is cancelled first. Records we must keep by law (such as billing records) and audit logs are retained for the periods above. You can also ask us to delete your data by writing to info@nomisma.ai.
10. Your Rights
European Economic Area and United Kingdom
10.1 If the GDPR or UK GDPR applies, you have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict processing; receive your data in a portable format; object to processing based on legitimate interests; and withdraw consent at any time, without affecting processing that took place before withdrawal. 10.2 You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
California
10.3 If the CCPA applies, California residents have the right to: know what personal information we collect, use and disclose, and to access specific pieces of it; delete personal information; correct inaccurate personal information; and opt out of the sale or sharing of personal information. We do not sell or share personal information, and have not done so in the preceding twelve months. We use sensitive personal information (account log-in credentials) only to provide the Service and keep it secure, as the CCPA permits, and not to infer characteristics about you. We will not discriminate against you for exercising your rights.
10.4 In the preceding twelve months we have collected the categories of personal information described in Section 3: identifiers (such as name, email address and IP address); commercial information (Plan and transaction records); internet or other electronic network activity information (security, audit and server logs); professional or employment-related information (your company and role); and sensitive personal information (account log-in credentials). We collect them from the sources, for the business purposes, and for the retention periods described in Sections 3, 5 and 9, and disclose them for business purposes to the service providers described in Section 7.
Other US states
10.5 Residents of other US states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others, may have similar rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and certain profiling, to the extent those laws apply to our processing. We do not sell personal data, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.
Canada
Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you may access your personal information, ask us to correct it, and withdraw consent to processing that relies on consent, subject to legal and contractual limits. We respond to written requests within thirty (30) days. Our Privacy Officer is accountable for our compliance (see Section 17). Your personal information is stored and processed in the United States by us and our Sub-processors and may be accessible to courts, law-enforcement and national-security authorities there under US law. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Withdrawing consent. You may withdraw your consent at any time on reasonable notice by writing to info@nomisma.ai, using Help in the Service, or deleting your account in Settings (Delete my account). If you withdraw consent to processing we need to provide the Service (your account, billing and security data), we will no longer be able to provide the Service to you and will close your account. Withdrawal does not affect processing that took place before it, and we will continue to keep the records we must keep by law, such as billing records and audit logs, for the periods in Section 9. If you withdraw consent to marketing email, you will still receive transactional email about your account.
Transfers for processing. We remain responsible for personal information we transfer to our service providers, including those in the United States. We use written contracts and other means to require each service provider to protect personal information to a level comparable to this Policy, to use it only to provide services to us, to keep it confidential and secure, and to return or delete it when the service ends. The service providers we use are listed on the Sub-processors page.
India
Under the Digital Personal Data Protection Act, 2023 and the Rules made under it, you may access a summary of your personal data and how it is processed, have it corrected, completed, updated or erased, nominate another person to exercise your rights if you die or become incapacitated, and have a grievance redressed. Our Grievance Officer (see Section 17) responds to grievances within ninety (90) days. If you are not satisfied, you may complain to the Data Protection Board of India.
When you create an account from India we show you a standalone Notice to users in India, separate from the Terms, listing the personal data we process, the purposes, the services this enables, and how to withdraw consent and complain. You consent to that processing by ticking a separate, unticked box; we record the time, the notice version and the exact text you agreed to.
Withdrawing consent. If you are in India, you may withdraw your consent at any time, as easily as you gave it: in Settings, choose Delete my account, or email info@nomisma.ai. When you withdraw, we stop processing your personal data within a reasonable time and cause our processors to stop, except where the law requires or permits us to keep it (for example, billing and tax records). Withdrawal does not affect processing carried out before it. Because we cannot provide the Service without your account data, withdrawing consent closes your account.
Information you must provide
To create an account you must give your name, email address, a password, your company name and the country (and, for Canada, the province) where your company is established. We need these to provide the Service, secure your account and comply with sanctions and availability rules; without them we cannot open an account. Everything else in the business profile is optional, and the Service tells you when an answer would make the analysis more precise.
11. How to Exercise Your Rights and Appeal
11.1 Making a request. Email info@nomisma.ai or use Help in the Service. You can delete your account yourself in Settings (Delete my account). We will verify your identity before acting on a request, normally by confirming control of the email address on your account, and may ask for further information where needed.
11.2 Authorised agents. Where permitted by law, you may use an authorised agent to make a request. We may require the agent to provide proof of authorisation and may ask you to verify your identity directly.
11.3 Timing. We respond within one month under the GDPR and UK GDPR (extendable by up to two further months for complex or numerous requests), and within 45 days under the CCPA and other US state laws (extendable as those laws allow). We will tell you if we need an extension.
11.4 Appeals. If we decline to act on your request, in whole or in part, you may appeal by emailing info@nomisma.ai with the subject line "Privacy appeal". We will respond within the period required by applicable law, explaining our decision. If your appeal is denied, you may contact the attorney general or privacy regulator of your state.
11.5 Customer Content. Requests concerning personal data in Customer Content should go to the Customer that controls it (see Section 2.3).
11.6 Complaints. If you have a concern or complaint about how we handle your personal information, write to our Privacy Officer at info@nomisma.ai (subject line "Privacy complaint") or at Nomisma LLC, 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States, or raise it through Help in the Service. We will acknowledge your complaint, investigate it, and give you our response, normally within thirty (30) days. If we find that your complaint is justified, we will take appropriate measures, including correcting our practices where necessary. If you are in Canada and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca); elsewhere, to the privacy regulator named for your country or state in Section 10.
12. International Data Transfers
12.1 Nomisma is based in the United States, and the Service is hosted on Amazon Web Services in the us-east-1 region (Virginia, United States). Personal data from other countries, including the European Economic Area, the United Kingdom and Switzerland, is therefore transferred to and processed in the United States, which may not provide the same level of protection as your home country.
12.2 For transfers of personal data from the European Economic Area and the United Kingdom that require a transfer mechanism, Nomisma relies on the EU Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, together with the security measures described in Section 8.
12.3 Because Smartsteps is not currently offered to businesses in the European Economic Area, the United Kingdom or Switzerland (Section 1.4), Nomisma has not designated a representative under Article 27 of the GDPR or the UK GDPR. Nomisma will designate representatives before offering the Service in those places.
12.4 You may ask for a copy of the safeguards we rely on for international transfers (such as the Standard Contractual Clauses) by writing to info@nomisma.ai; commercially sensitive terms may be removed.
12.5 Transfers from India. Personal data of users in India is transferred to and processed in the United States. We monitor notifications made by the Government of India under section 16 of the Digital Personal Data Protection Act, 2023, will not transfer personal data to any country or territory that it restricts, and will comply with any requirement it sets on making personal data available to a foreign state or its entities.
13. Children
The Service is not directed at anyone under 18, and accounts are for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact info@nomisma.ai and we will delete it. A Customer's business profile may record whether the Customer's own business serves minors; that is information about the Customer's business, not about any child.
14. Personal Data Breaches
We maintain processes to detect and respond to security incidents. If a personal data breach affects personal data for which we are controller, we will notify the competent supervisory authority and affected individuals where and as required by applicable law, including, where the GDPR or UK GDPR applies, the supervisory authority within seventy-two (72) hours of becoming aware of the breach, and, where PIPEDA applies, the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible where the breach creates a real risk of significant harm. We keep a record of every personal data breach, including those that do not need to be notified, for at least twenty-four (24) months. Where the Digital Personal Data Protection Act, 2023 applies, on becoming aware of any personal data breach, whatever its likely risk, we will (a) inform each affected individual without delay, through their Smartsteps account and registered email address, in clear and plain language, of the nature, extent, timing and location of the breach, its likely consequences, the measures we have taken or are taking to reduce the risk, the steps they can take to protect themselves, and the contact details of our Privacy Officer, who will answer their questions; and (b) inform the Data Protection Board of India without delay and, within seventy-two (72) hours of becoming aware of the breach or any longer period the Board allows on our written request, give the Board updated and detailed information on the facts, circumstances and reasons for the breach, the measures taken to mitigate risk, any findings about the person who caused it, the remedial measures taken to prevent recurrence, and a report of the notices given to affected individuals. If a breach affects personal data in Customer Content, we will notify the affected Customer without undue delay and provide the information reasonably available to help it meet its own obligations, as set out in the Data Processing Addendum.
15. Marketing and Communications
The Service sends transactional email only, through Amazon Simple Email Service from updates@smartsteps.ai, for email verification, sign-in links, notice that a Report is ready, monthly standing updates and replies to support tickets. These messages are part of the Service. We do not send marketing email without your consent. If you consent, you may withdraw consent at any time using the link in the message or by writing to info@nomisma.ai.
16. Changes to This Policy
We may update this Policy from time to time. The version and dates at the top show when it last changed. For material changes, we will take reasonable steps to notify Users in advance, for example by email or by notice in the Service.
17. Contact
Privacy questions and requests: info@nomisma.ai, or Help in the Service (smartsteps.ai/app, then Help).
Post: Nomisma LLC, 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States. Telephone: +1 510-565-0510.
Nomisma has not appointed a data protection officer under the GDPR. Our Privacy Officer, who is accountable for our compliance with privacy law and also acts as our Grievance Officer for India, is the Managing Member of Nomisma LLC, reachable at info@nomisma.ai or at the postal address above.