Privacy Policy

1. Scope

This Privacy Policy applies to personal information we collect through:

• the Nomad web application and websites;
• the Nomad mobile applications;
• account registration, authentication, and workspace administration;
• customer support and service communications;
• billing and subscription workflows; and
• integrations and connected services you choose to enable.

This Privacy Policy does not apply to third-party services, websites, payment platforms, app stores, or integrations that have their own terms and privacy policies.

2. Who We Are

Nomad is operated by:

3. Information We Collect

We collect information you provide to us directly, information collected automatically when you use the Services, and information we receive from third parties or from other users acting on behalf of a workspace or organization.

A. Information You Provide Directly

Depending on how you use Nomad, we may collect:

• Account Information, such as your name, email address, password, company or workspace name, and profile details.
• Profile and Preference Information, such as language, currency preferences, theme settings, notification settings, and optional home address information.
• Expense and Finance Information, such as expense descriptions, amounts, currencies, merchants, dates, categories, tags, notes, reports, reimbursement details, recurring expenses, budgets, departments, cost centers, entities, and tax codes.
• Receipt and Document Information, such as receipt images, invoice files, attachments, uploaded documents, file metadata, OCR status, and extracted fields like merchant name, date, total amount, taxes, and line items.
• Workspace and Team Information, such as workspace memberships, roles, invited users, approval data, and administrative settings.
• Communications, such as messages you send to us, support requests, and feedback.
• Billing Information, such as billing contact details, billing address, invoice details, subscription status, payment status, transaction identifiers, and limited payment metadata.

B. Information We Collect Automatically

When you use the Services, we may automatically collect:

• Device and App Information, such as device type, operating system, app version, browser type, preferred language, and time zone.
• Usage Information, such as login events, session activity, request timestamps, export activity, OCR job status, and feature usage.
• Security and Log Information, such as IP address, authentication records, rate-limiting events, audit trails, and related security logs.
• Diagnostics and Performance Information, such as crash reports, exception traces, and troubleshooting data.
• Cookie and Storage Information, such as session cookies, refresh-token cookies, browser storage, mobile secure storage, IndexedDB, and local device databases.

C. Information From Third Parties

We may receive information from:

• workspace owners, administrators, managers, finance users, or teammates who invite or manage you in Nomad;
• payment and billing providers, such as Stripe;
• integration partners you choose to connect;
• service providers that help us operate the Services; and
• app-store providers if we later enable in-app subscriptions through those stores.

4. How We Use Information

We use personal information to:

• provide, operate, maintain, and improve Nomad;
• create and manage accounts, authenticate users, and maintain sessions;
• create, process, categorize, review, sync, export, and report on expenses, receipts, invoices, and related records;
• power OCR, receipt extraction, autofill, duplicate detection, and related automation features;
• administer workspaces, permissions, approvals, reimbursements, and reporting;
• process subscriptions, invoices, renewals, and billing administration;
• send transactional or service-related communications;
• monitor performance, troubleshoot issues, and improve reliability;
• protect the security and integrity of the Services and detect fraud, abuse, misuse, or unauthorized access;
• comply with legal, tax, accounting, and regulatory obligations; and
• enforce our Terms of Service and related policies.

We do not sell your personal information.

5. OCR, AI, and Document Processing

Nomad includes receipt and document processing features that may use on-device processing, cloud OCR, or AI-assisted extraction. When you use these features, we may process:

• receipt images;
• invoices and uploaded documents;
• extracted text;
• document metadata; and
• structured output generated from those files.

Depending on the feature, platform, configuration, and settings, this processing may occur on your device, in our cloud environment, and/or through specialized third-party processors that provide OCR, hosting, workflow, or AI capabilities on our behalf.

Nomad does not use your customer content to train Nomad-owned general-purpose models without your permission. Where we use commercial OCR or AI providers, they process content to provide the requested service subject to their applicable privacy commitments and our contractual arrangements with them.

6. Billing, Payments, and Subscriptions

If you purchase a subscription directly through Nomad, payment processing may be handled by Stripe. We do not store full payment card numbers.

When you subscribe, renew, cancel, or manage billing, we may receive limited billing and transaction information necessary to:

• activate and manage your subscription;
• issue invoices or receipts;
• reconcile payments;
• respond to billing questions;
• handle taxes, chargebacks, and refunds where applicable; and
• maintain required accounting and compliance records.

7. Cookies and Similar Technologies

We use cookies, secure browser storage, local databases, and similar technologies to:

• keep you signed in;
• remember settings and preferences;
• support local-only, offline, and synchronization features;
• secure accounts and sessions; and
• operate and improve the Services.

Some of these technologies are necessary for core functionality and security. If you disable them, parts of Nomad may not function properly.

8. How We Share Information

We may share personal information in the following circumstances:

A. Within Your Workspace or Organization

If you use Nomad through a shared workspace or company account, your information may be visible to authorized users within that workspace based on their role and permissions.

B. Service Providers

We may share information with vendors and service providers that help us operate Nomad, including providers of cloud hosting, databases, authentication, OCR and AI processing, email delivery, customer support, payment processing, and more.

C. At Your Direction

We may share information when you ask us to, such as when you connect an integration, export data, invite users, or share reports.

D. Legal and Safety Reasons

We may disclose information if we believe it is necessary to comply with applicable law, protect rights and safety, or detect and prevent fraud or abuse.

E. Business Transfers

We may disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction.

9. International Transfers

Nomad may store or process information in Canada, the United States, and other countries where we or our service providers operate. If your information is transferred across borders, we take reasonable steps to protect it in accordance with applicable law, including through contractual, organizational, or technical safeguards where required.

10. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy. Retention may vary by category:

• Account and Profile Information: generally while your account is active and for a reasonable period afterward.
• Expense, Workspace, and Operational Records: generally until deleted by you or your workspace.
• Receipt Images and Attachments: generally until deleted by you or your workspace.
• Billing, Tax, and Payment Records: retained for the period required by tax, accounting, contractual, and legal obligations.
• Security Logs and Audit Records: retained as needed for security and compliance.

We may also de-identify or aggregate information so that it no longer reasonably identifies you and use that information for lawful business purposes.

11. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These may include:

• encryption in transit;
• secure session and cookie handling;
• access controls;
• logging and monitoring;
• rate limiting and abuse protections;
• secure development and review practices; and
• deletion, retention, and backup controls.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your Rights and Choices

Depending on where you live, you may have rights to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete personal information, subject to legal exceptions;
• receive a portable copy of certain information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a privacy regulator or data protection authority.

To exercise privacy rights, contact us at privacy@nomad-finance.com. We may need to verify your identity before fulfilling a request.

13. Children's Privacy

Nomad is intended for business and adult users and is not directed to children. We do not knowingly collect personal information from children under 13, or under any higher age threshold required by local law. If you believe a child has provided personal information to us, contact us at privacy@nomad-finance.com and we will take appropriate steps.

14. Third-Party Services

Nomad may link to or integrate with third-party services. Those third parties have their own privacy practices and policies, and we are not responsible for them. Please review their privacy notices before providing information to them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Nomad, our practices, or applicable law. When we make material changes, we will take appropriate steps to notify you, such as by:

• posting the updated Privacy Policy in the app or on our website;
• updating the effective date above; or
• sending an email or in-product notice where appropriate.