Privacy Policy
Effective 11 November 2026 · See also our Terms of Service
This policy explains what personal data nozam collects, why, who it's shared with, and your rights. nozam is the AI listing studio at app.nozam.io and the website at www.nozam.io.
1. Who we are
nozam is operated by Nozam Inc. ("nozam", "we", "us"). We are the data controller for the personal data described here.
Contact for privacy questions: [email protected]
2. What we collect
Account data. Your email address and name. If you sign up with email, your password is handled by Google Firebase Authentication and we never see it. If you sign in with Google, we receive your name, email address and profile photo from Google.
Content you upload. Product photos, logos, style references, product details, ASINs, brand information and any text you enter.
Content we generate for you. Listing images, listing copy, strategy, A+ content, ad and social creatives, video scripts, compliance results and handoff PDFs. These are stored in your workspaces.
Purchase and credit records. Which credit pack you bought, the amount, the date, and a history of credits added, spent and returned. Card details are entered on Stripe's checkout page and go straight to Stripe. We never receive or store your full card number.
Usage and device data. If you accept analytics cookies, Google Analytics for Firebase collects pages viewed, features used, device and browser type, approximate location (from your IP address) and similar data. Our servers also keep short-term technical logs (time of request, function used, errors) for security and troubleshooting.
Security signals. To stop bots and abuse, the app uses Google reCAPTCHA v3 through Firebase App Check. It reads device and browser signals to tell people from bots.
Data stored on your device. The app keeps your settings and some workspace state in your browser's local storage so it loads faster. Firebase also stores your sign-in session in your browser.
We don't knowingly collect sensitive data (such as health data). Please don't upload images of people unless you have their permission.
3. Why we use it, and the legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, store your workspaces, generate content you request | Performance of our contract with you |
| Process payments, keep credit records, issue receipts | Contract; and legal obligation for tax and accounting records |
| Return credits automatically when a generation fails | Contract |
| Prevent fraud, abuse and bots; keep the service secure; limit free-trial misuse | Our legitimate interest in a secure service |
| Fix bugs and improve the service using technical logs | Legitimate interest |
| Analytics cookies | Your consent, which you can withdraw at any time |
| Reply to support emails | Contract or legitimate interest |
| Product news by email (only if you opt in) | Consent |
We don't sell your personal data, and we don't use it for targeted advertising.
4. AI processing
When you generate content, your uploaded images and text are sent to our AI provider to produce the result. The provider processes them only to return the result to us, under a contract that protects the data.
We don't use your uploads or generated content to train any AI model of our own.
5. Who we share data with
We share data only with service providers that help us run nozam, and only what each one needs:
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| Google Cloud / Firebase | Sign-in, database, file storage, server functions, app hosting | All account data and content | United States |
| AI provider | Generates images and text | Uploaded images, product details, prompts | United States |
| Stripe | Payments and receipts | Email, purchase details, card data (entered directly with Stripe) | United States and EU |
| Rainforest API | Looks up public Amazon product and keyword data | ASINs, keywords, marketplace (no personal data) | United States |
| Amazon data provider via RapidAPI | Looks up public Amazon reviews | ASINs, marketplace (no personal data) | United States |
| Google Analytics for Firebase | Usage analytics, only with your consent | Usage and device data | United States |
| Google reCAPTCHA (Firebase App Check) | Bot and abuse protection | Device and browser signals | United States |
| Cloudflare | Hosts and delivers the website | IP address, browser type | Global network |
| Public image proxies (wsrv.nl, corsproxy.io, allorigins) | Load public Amazon product images when you import an ASIN | Public image web addresses only | Various |
We may also disclose data if the law requires it, to protect our rights or users' safety, or to a buyer if the business is sold (you'd be told first).
6. International transfers
Several providers are in the United States. Where data leaves the EU, EEA or UK, we rely on the EU-U.S. Data Privacy Framework (and its UK extension) for providers certified under it, including Google and Stripe, and on the European Commission's Standard Contractual Clauses for the rest.
7. How long we keep data
| Data | How long |
|---|---|
| Account, workspaces, uploads and generated content | Until you delete them or delete your account |
| Credit history in the app | Until you delete your account |
| Payment records held by Stripe and our accounting records | As long as tax and accounting law requires |
| Server logs | About 30 days |
| Analytics data | Up to 14 months |
Deleting your account: go to Settings in the app and choose Delete account. This permanently deletes your profile, workspaces, uploaded and generated files, credit history and sign-in account. Unused credits are lost. It can't be undone.
8. Your rights
Depending on where you live (including the EU, EEA, UK and some US states), you can:
- see the personal data we hold about you and get a copy;
- correct it;
- delete it;
- restrict or object to how we use it;
- get it in a portable format;
- withdraw consent at any time (this doesn't affect anything done before);
- complain to the data protection authority in the country where you live or work.
Email [email protected] to use any of these rights. We answer within one month. We may need to confirm your identity first.
9. Cookies and similar technology
Website (www.nozam.io): no analytics or advertising cookies. Fonts are served from our own site.
App (app.nozam.io):
| Type | Purpose | Needs consent? |
|---|---|---|
| Sign-in session (Firebase) | Keeps you signed in | No, strictly necessary |
| Local storage for settings and workspace state | Remembers your settings, loads faster | No, strictly necessary |
| reCAPTCHA (App Check) | Blocks bots and abuse | No, needed for security |
| Google Analytics for Firebase | Understands which features are used | Yes, only after you accept |
You can change your analytics choice at any time in the app under Settings > Preferences > Privacy, or clear cookies in your browser.
10. Security
Data is encrypted in transit (HTTPS) and at rest on Google Cloud. Access to your workspaces is limited to your account by database security rules. Credit balances can only be changed by our servers. No system is perfectly secure. If a breach affects your data, we'll notify you and the regulator as the law requires.
11. Children
nozam is a tool for businesses and is not meant for anyone under 18. We don't knowingly collect data from children. If you think a child has given us data, email us and we'll delete it.
12. Changes
If we change this policy, we'll update the date at the top. For important changes, we'll tell you by email or in the app before they take effect.
13. Contact
Nozam Inc. Email: [email protected]