Data Transfer Terms

Data Transfer Mechanisms

We may transfer your personal data internationally to provide our services. When doing so, we ensure appropriate safeguards are in place.

Standard Contractual Clauses (SCCs)

For transfers to the United States and other non-adequate jurisdictions, we rely on:

• Google OAuth: Data Processing Addendum with Standard Contractual Clauses
• Stripe: Data Processing Addendum with Standard Contractual Clauses
• Zoho Invoice: Data Processing Agreement with appropriate transfer mechanisms

These clauses are approved by the European Commission and provide legal safeguards for international data transfers.

Your Data Protection Rights

Right to Access

You have the right to request and receive a copy of your personal data that we or our service providers hold. This allows you to verify the accuracy of information and check how it's being used.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request correction or updating of your information.

Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances, such as:

• When your data is no longer necessary for the purpose we collected it
• When you withdraw consent (if that was our legal basis)
• When you object to processing and we have no legitimate reason to continue

Right to Data Portability

You can request your data in a structured, commonly-used, machine-readable format that can be transferred to another service provider of your choice.

Right to Restrict Processing

You can request that we limit how we use your data while a request (such as a correction request) is being processed.

Right to Object

You have the right to object to processing of your data in certain contexts, particularly for marketing purposes or profiling.

Security & Protection Measures

We implement comprehensive security measures to protect your data:

Technical Measures

• Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest
• Access Control: Limited access to data on a need-to-know basis
• Authentication: Secure password requirements and session management
• Regular Audits: Security assessments and penetration testing

Organizational Measures

• Staff training on data protection and privacy
• Vendor management and ongoing monitoring of service providers
• Incident response procedures for any data breaches
• Privacy by design principles applied to all features

Data Retention & Deletion

We retain your personal data only as long as necessary to provide our services:

• Active Accounts: Data retained while your account is active and in use
• After Deletion: We delete your data within 30 days of account termination (except where legally required to retain)
• Backups: Backup copies are deleted within reasonable timeframes
• Legal Hold: If required by law, data may be retained for legal or regulatory compliance

Breach Notification

In the unlikely event of a data breach:

• We will investigate the incident immediately
• We will notify affected users without undue delay
• We will cooperate with relevant supervisory authorities
• We will provide information about steps to mitigate harm

You can report suspected security issues to security@nomadti.me.

Jurisdiction & Governing Law

Our data transfer terms are governed by:

• General Data Protection Regulation (GDPR): If you're in the EU/EEA
• California Consumer Privacy Act (CCPA): If you're in California
• Other applicable privacy laws in your jurisdiction

Subprocessors & Third Parties

For a complete list of third-party service providers that process your data, please see our List of Subprocessors.

We notify you of material changes to our subprocessors and provide you the opportunity to object where applicable.

Exercising Your Rights

To exercise any of these rights, please contact us:

Please include sufficient information to identify you and your request. We may request additional information to verify your identity before processing your request.

Changes to These Terms

We may update these data transfer terms as our service and regulatory requirements evolve. We will notify you of material changes and obtain consent where required.

Last Updated: January 26, 2026
Effective Date: January 26, 2026