Skip to content

Privacy Notice

Version 2026-11-01

This is a translation. If the versions differ, the German version (Datenschutzerklärung) prevails.

This notice explains which data Noman processes, why, on which legal basis, who receives it and what your rights are.

1. Controller

The controller under the GDPR is Dominik Pfaffenbauer, Zeileisstraße 6, 4600 Wels, Österreich, a sole trader doing business as "Noman", VAT ID ATU68275948. For all data protection matters write to [email protected].

2. What we process and why

Website noman.works

When you visit the website, our hosting provider and we process technically necessary data (IP address, time, page, browser) in server logs to deliver the website securely — legitimate interest (Art. 6 (1) (f) GDPR). We set no tracking or advertising cookies. The website loads fonts from Google Fonts (Google Ireland Ltd.) and a styling script from cdn.tailwindcss.com; these providers receive your IP address.

Communication via WhatsApp and e-mail

When you write to us we process your phone number, profile name, messages and the pictures and files you send, to answer you and provide our services — contract and pre-contractual steps (Art. 6 (1) (b) GDPR).

Customer and contract data

Name, company, address, e-mail address, VAT ID, plans, credits, invoices and your projects with all drafts — for the contract (Art. 6 (1) (b) GDPR) and statutory retention duties (Art. 6 (1) (c) GDPR).

Payments

Payments are processed by Stripe. Stripe does not pass your card details to us; we only receive the payment status, amount, card brand and last four digits (Art. 6 (1) (b) GDPR).

Vault

If you entrust us with logins, payment cards or API keys so that we can book or order for you, we store them encrypted (Art. 6 (1) (b) GDPR). You enter them only through a secure one-time link, never in the chat. The AI only sees labels such as "Visa •••• 1111", never the values; these are decrypted only on our server and filled straight into the website you approved. We never keep a card's security code.

Bookings and orders for you

For a booking or order we give the merchant only the data it needs, and only after your approval (Art. 6 (1) (b) GDPR). The merchant then processes it under its own responsibility.

Accepting the terms and the AI notice

We record which version of our terms you accepted, when and how (with the id of the message or the payment), and when we told you that you are talking to an AI — legitimate interest in proving the contract and legal obligation (Art. 6 (1) (c) and (f) GDPR).

Operations and security

Logs, error reports and abuse prevention (e.g. message rate limits) — legitimate interest in a secure, working service (Art. 6 (1) (f) GDPR). Steps our browser carries out for you are recorded for troubleshooting; password and payment fields are masked.

3. Artificial intelligence

Noman is an AI. Your messages, files and projects are processed by AI models to answer you and create results. We use the models through business interfaces (APIs) whose providers, under their terms, do not use the inputs to train their models. We make no automated decisions with legal effect on you within the meaning of Art. 22 GDPR — everything binding is approved by you.

4. Recipients and processors

We use these service providers, with whom we have agreements under Art. 28 GDPR:

  • Anthropic, PBC (USA) — AI models (Claude) for conversations and drafts
  • OpenAI, L.L.C. (USA) — image generation
  • ElevenLabs Inc. (USA) — voice-overs and music, only if your project contains them
  • Cloudflare, Inc. (USA) — hosting of your websites (Cloudflare Pages), domain registration (Cloudflare Registrar), e-mail sending
  • Google Ireland Ltd. / Google LLC (Ireland, USA) — servers and file storage (Google Cloud)
  • Stripe Payments Europe, Ltd. (Ireland) with Stripe, Inc. (USA) — payments
  • WhatsApp Ireland Ltd. / Meta Platforms, Inc. (Ireland, USA) — WhatsApp Business
  • browserless — protected browser for websites that block our own, only when needed
  • Functional Software, Inc. (Sentry) (USA) — error reports

For a domain we pass your registrant data to the registry of the extension (e.g. nic.at for .at). Authorities receive data only where the law obliges us.

5. Transfers to third countries

Some recipients are in the USA or may access data from there. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

6. How long we keep data

  • Chats, projects and drafts: while your customer account exists; they are deleted with it.
  • WhatsApp contacts that do not become a customer account: after 14 days.
  • Invoices and accounting records: seven years (§ 132 BAO).
  • Proof of accepting the terms: for the duration of the business relationship.
  • Vault entries: until you delete them or your account is deleted. Card security codes: for the one payment only, 30 minutes at most.
  • Recordings of our browser: 14 days.
  • Server logs: usually 30 days at most.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (Art. 15–21 GDPR). Write to [email protected].

If you think we process your data unlawfully, you may complain to the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

8. Obligation to provide data

Without your phone number and messages we cannot communicate with you; without billing data we cannot provide paid services. Beyond that you are not obliged to give us any data.