This Privacy Policy explains what personal data Noms collects when you use the Noms API, websites, and related services (the "Service"), how we use and share it, and the rights you have over it. It applies to everyone who visits our sites or uses our API.
Who is responsible for your data
The data controller for the Service is Noms SpA, a sociedad por acciones organized under the laws of the Republic of Chile.
- Legal name: Noms SpA
- Tax ID (RUT): 78.450.967-2
- Registered address: Vitacura, Región Metropolitana, Chile
- Privacy contact: privacy@noms.sh
Scope
This Policy covers the personal data we process to run the Service — your account, your use of the API, and our websites. It does not cover the nutritional dataset the API returns, which is not personal data, nor the practices of third-party sites or services we link to.
Information we collect
We aim to collect only what we need to run the Service.
- Account information. When you sign up, we collect your email address and authentication details. Sign-in is handled by Google Firebase Authentication; if you sign in with a third-party provider (such as Google or GitHub), we receive basic profile information from that provider.
- Billing information. When you subscribe to a paid Plan, payment is processed by Lemon Squeezy as our Merchant of Record. We receive limited billing identifiers and subscription status from Lemon Squeezy (such as a customer ID, country, plan, and payment state). We do not receive or store your full payment-card number.
- API usage and metering. We record how you use the API — for example, request counts, endpoints called, timestamps, API-key identifiers, and IP addresses — to enforce rate limits and quotas, bill correctly, secure the Service, and improve it.
- Technical and diagnostic data. We collect logs and error reports (including via Sentry) that may contain IP addresses, device and browser information, and details of any errors, so we can keep the Service reliable and secure.
- Communications. When you email us (for example, at support@noms.sh) we keep your messages and contact details so we can respond and maintain a support record.
- Cookies and similar technologies. Our websites use a small number of cookies and similar technologies — see "Cookies" below.
How we use your information
We use personal data to: provide, operate, and secure the Service; authenticate you and manage your account and API keys; meter usage, enforce quotas, and bill paid Plans; respond to your support requests; detect, prevent, and investigate abuse, fraud, and security incidents; comply with our legal obligations; and understand and improve how the Service is used.
Legal bases for processing
Where the EU/UK General Data Protection Regulation (GDPR) or Chilean Law No. 21.719 applies, we rely on the following legal bases:
| What we process | Legal basis |
|---|---|
| Account and authentication | Performance of a contract |
| Billing identifiers (via Lemon Squeezy) | Contract; and legal obligation (tax/accounting) |
| API usage and metering | Performance of a contract |
| Security and abuse-prevention logs (incl. IP addresses) | Our legitimate interest in securing the Service |
| Error and diagnostic data (Sentry) | Our legitimate interest in a reliable Service |
| Support communications | Contract (customers); legitimate interest (others) |
| Optional marketing messages | Your consent |
Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out.
How we share your information
We do not sell your personal data. We share it only with service providers ("subprocessors") that help us run the Service, and only as needed:
| Provider | Purpose |
|---|---|
| Google Firebase | Account authentication |
| Lemon Squeezy | Payments and subscription billing (Merchant of Record) |
| Google Cloud Platform | Application hosting, database, and storage |
| Cloudflare | Content delivery, DNS, email routing, image hosting, and cookieless analytics |
| Sentry | Error and performance monitoring |
| Better Stack | Uptime monitoring and the public status page |
We may also disclose personal data when required by law, to enforce our agreements, or to protect the rights, safety, and property of Noms, our users, or the public. If the Service is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.
Payments and Merchant of Record
Payments are handled by Lemon Squeezy as our Merchant of Record and seller of record. For payment and cardholder data, Lemon Squeezy acts as an independent controller and stores that data in its own systems under its own privacy policy. Noms never receives or stores full card numbers; we receive only limited billing identifiers. Please review Lemon Squeezy's privacy policy for how it processes payment data.
International data transfers
We operate from Chile and use service providers that may process data in other countries, including the United States and the European Union. Where data is transferred across borders, we rely on appropriate safeguards as required by applicable law — including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum for EU/UK data, and the transfer mechanisms recognized under Chilean law, including the model clauses to be issued under Law No. 21.719. You can request information about these safeguards at privacy@noms.sh.
EU and UK representatives
Article 27 of the GDPR and its UK equivalent require controllers established outside the EU and UK that offer services to EU/UK residents to designate a local representative. We are in the process of appointing a representative within the European Union and a separate representative within the United Kingdom. Once appointed, their names and contact details will be published here. In the meantime, EU and UK residents may direct all privacy inquiries to privacy@noms.sh and we will respond within the timeframes required by applicable law.
Data retention
We keep each category of personal data for the following periods, after which we delete or anonymize it:
| Data category | Retention period | Basis |
|---|---|---|
| Account data (email address, credentials, profile information) | Duration of account, plus 6 years from account closure | Código Tributario Art. 200 — 6-year SII audit window |
| Billing records and billing-relevant usage metering | 6 years from the end of the tax year in which the transaction arose | Same |
| API usage counters (request counts per key and billing period) | Duration of the API key | Proportionate to our legitimate interest in billing verification and quota enforcement; counters are removed when the API key is deleted |
| Cloud Run request logs (endpoints called, timestamps, IP addresses) | 30 days | Cloud Logging default retention; proportionate to our legitimate interest in security monitoring |
| Error and diagnostic logs (Sentry) | Up to 90 days (subject to our error-monitoring provider's retention policy) | Proportionate to operational reliability; no legal obligation extends beyond this period |
Security
We use technical and organizational measures to protect personal data, including encryption in transit, access controls, IAM-based database authentication, and a private network for our database. No system is perfectly secure, but we work to protect your data and to respond promptly to security incidents.
Your rights
Depending on where you live, you have rights over your personal data. We honor these rights for all users to the extent the law allows.
- Chile. Under Law No. 19.628 on the Protection of Private Life — and Law No. 21.719, which strengthens these rights (in full force from 1 December 2026) and creates a Personal Data Protection Agency (Agencia de Protección de Datos Personales) — you may request access to, rectification of, deletion of, and blocking of your personal data, may object to certain processing, and may complain to the Agency.
- European Union / United Kingdom (GDPR). You may request access, rectification, erasure, restriction, and portability, and may object to processing; you may withdraw consent where we rely on it; and you may lodge a complaint with your local supervisory authority.
- California (CCPA/CPRA). You may request to know, delete, and correct the personal information we hold, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information, so we provide no "Do Not Sell or Share" mechanism.
How to exercise your rights
To exercise any of these rights, email privacy@noms.sh. We will verify your request against the email on your account and respond within the time required by applicable law. We are building a self-serve data-rights flow; until it is available, privacy@noms.sh is the way to make a request.
Cookies
Our websites use only cookies and similar technologies that are strictly necessary to operate the site — for example, to keep you signed in and to protect against abuse. For usage measurement we rely on privacy-friendly, cookieless analytics that do not set advertising or cross-site tracking cookies and do not build a profile of you. Because we do not use non-essential cookies, we do not show a cookie-consent banner. You can still control cookies through your browser settings. If we ever introduce non-essential cookies, we will ask for your consent first.
Children's privacy
The Service is intended for developers and is not directed to children. We do not knowingly collect personal data from children below the minimum age set by their local law — for example, 14 in Chile (Law No. 21.719), 13 in the United States, and 13 to 16 across the EU/UK. If you believe a child has provided us personal data, contact privacy@noms.sh and we will delete it.
Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you. Your continued use of the Service after a change takes effect means you accept the updated Policy.
Language
This Policy is published in English and in Spanish (a Spanish version is available). The English version is the working reference for our global developer audience; for a consumer in Chile the Spanish version governs, and in case of any discrepancy the Spanish text prevails for that consumer.
Contact
Questions or requests about your privacy can be sent to privacy@noms.sh.