NinthMoon is committed to processing personal data lawfully, fairly, and transparently in line with the EU General Data Protection Regulation (2016/679) and the UK GDPR.

1. Our Role

For individuals who use our consumer Services, NinthMoon is the data controller. Where we process personal data on behalf of a business or partner organization, we act as a processor under a separate Data Processing Addendum.

2. Data We Process

Identification and contact data (name, email); optional date of birth, photo, and location; health and reproductive data (special category data under Article 9), provided voluntarily with your explicit consent; technical/usage data; and content you submit to the Services.

3. Legal Bases

Consent (Article 6(1)(a)) and explicit consent (Article 9(2)(a)) for health/reproductive data and for AI processing.
Contract (Article 6(1)(b)) to deliver the Services you request.
Legitimate interests (Article 6(1)(f)) for security, prevention of abuse, and improving the Services, balanced against your rights.
Vital interests (Articles 6(1)(d) / 9(2)(c)) where necessary to protect someone’s life in a crisis.
Legal obligation (Article 6(1)(c)) where applicable.

4. AI Processing and Sub-processors

Nimo is powered by the OpenAI API. To generate responses, your messages and relevant context are transmitted to OpenAI, which acts as a sub-processor under its API business terms. OpenAI does not use this content to train its models. We engage other sub-processors (e.g., cloud hosting on Google Cloud / Firebase) under data processing agreements. See our Sub-processor List. Where we use data to improve our own Services, we use aggregated or de-identified data where feasible, and rely on the legal bases above.

5. International Transfers

Personal data may be processed in the United States and other jurisdictions. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum), and conduct transfer assessments.

6. Your Rights

You have the rights to access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your supervisory authority. Automated decisions with legal or similarly significant effects are not made without an applicable safeguard; you may request human intervention.

In compliance with Article 7(3) of the GDPR, we ensure that withdrawing your consent is as simple and frictionless as granting it. You may revoke your consent for AI processing at any time by toggling off the "Nimo/AI Consent" feature within your app Account Settings.

7. Retention and Security

We retain personal data for the life of the account (there is no automatic inactivity-based deletion) and then delete it. We provide a self-service data export (Article 20 portability — a readable JSON copy, with chat content decrypted) and self-service erasure via a 14-day account-deletion process that comprehensively removes data across authentication, database, and file storage. Chat content is encrypted at rest with a dedicated application key. We apply encryption in transit and at rest, access controls, and regular testing. We will notify the relevant supervisory authority of a qualifying personal data breach within 72 hours, and affected individuals where required.

8. Data Protection Officer

NinthMoon has designated a Data Protection Officer (DPO) to oversee our global privacy compliance infrastructure. You may contact our DPO regarding any questions or concerns at dpo@ninthmoon.ai or via our primary legal intake at legal@ninthmoon.ai. NinthMoon AI LLC, 8 The Green, Ste A, Dover, DE 19901.

NinthMoon has dedicated Data Protection Officers (DPOs) for the EU and UK regions. You can reach them directly at:

European Union: privacy.eu@ninthmoon.ai
United Kingdom: privacy.uk@ninthmoon.ai

9. Updates

We may update this Statement; the effective date will reflect changes.

GDPR Compliance