Data Processing Terms

1. What this document is

These Data Processing Terms explain how Nosmai, LLC ("Nosmai", "we", "us") handles personal data in connection with our SDKs, and set out the terms that apply where we process personal data on a customer's behalf.

They form part of our Terms and Conditions at https://nosmai.com/terms/ and should be read together with our Privacy Policy at https://nosmai.com/privacy/

If you need a signed copy for your records, write to [email protected].

2. Summary

Our SDKs run on the end user's device. We do not receive camera frames, images, video, audio, or any content your application processes. The only data that reaches us is what is needed to verify your licence and count usage for billing, and for that data we act as a controller in our own right rather than as your processor.

In most integrations this means there is no processing of your end users' personal data by Nosmai at all. The processor terms in section 6 are set out so that they apply automatically where that is not the case.

3. Our role

Licence verification and usage counting: Nosmai is an independent controller.

When your application activates one of our SDKs, it contacts us to verify the licence and count monthly active users. We determine the purposes of that processing ourselves, namely validating licences, enforcing plan limits, preventing licence abuse, and billing. Because those purposes are ours rather than yours, we are a controller for this data rather than your processor.

Your application: you are the controller.

You decide what your application does, what it collects, and why. You are the controller for your end users' personal data, and your own privacy notice governs it.

Processing on your behalf: Nosmai is your processor.

Where we do process personal data on your instructions, we act as your processor and section 6 applies. Today this is limited to information you send us through support channels. It will also cover the generative AI feature in Nosmai Try-On once that feature launches, which is the only feature in any of our SDKs that transmits end user images to us.

4. Data we receive

The device identifier is hashed before transmission. We do not receive the underlying identifier. It is used only to determine whether a device has already been counted within a billing period. It is not used for advertising, cross-application tracking, or profiling.

Because this data relates to your end users' devices, you should disclose it in your own privacy notice. Section 7 of our Privacy Policy describes it in full.

5. What never reaches us

• Camera frames, photographs, video and audio are processed entirely on the end user's device and are never uploaded to Nosmai.
• Facial landmark and face geometry data produced by face tracking is computed in memory for the frame being rendered and then discarded. It is never stored, never written to persistent storage, and never transmitted.
• Content classification performed by Nosmai Moderation happens on the device. Neither the content nor the result is sent to us.
• We do not embed any third party analytics, crash reporting or advertising SDK inside our SDKs.

The single exception is the generative AI feature in Nosmai Try-On, which is in beta and is enabled by you rather than by us. Where you enable it, section 7.3 of our Privacy Policy describes what happens to the images involved, and section 6 of this document applies to that processing.

6. Processor terms

This section applies where and to the extent that we process personal data on your behalf, as described in section 3. Where it applies, you are the controller and we are the processor, and the following terms form a data processing agreement between us for the purposes of Article 28 of the GDPR and the UK GDPR.

6.1 Instructions. We will process personal data only on your documented instructions, including as to international transfers, unless required otherwise by law. Your instructions are given through your use of the Services and through these terms. We will tell you if we believe an instruction breaches data protection law.

6.2 Subject matter and duration. The subject matter is the provision of the Services. Processing continues for as long as we provide the Services to you.

6.3 Nature and purpose. Providing, supporting and maintaining the Services, as described in our Terms and Conditions.

6.4 Categories of data subjects. Your end users and your personnel.

6.5 Types of personal data. As described in section 4 and, where you enable the generative AI feature in Nosmai Try-On, images submitted by your end users through that feature.

6.6 Confidentiality. We will ensure that personnel authorised to process personal data are bound by confidentiality obligations and are trained appropriately.

6.7 Security. We will implement appropriate technical and organisational measures, as described in section 9.

6.8 Sub-processors. You give general authorisation for us to engage the sub-processors listed in section 8. We will impose data protection obligations on them no less protective than those in this document, and we remain responsible for their performance. We will give you at least 30 days' notice before adding or replacing a sub-processor that processes personal data on your behalf. If you reasonably object on data protection grounds within that period, we will work with you in good faith to find a solution, and if none is available you may terminate the affected Services without penalty for the remainder of the term.

6.9 Assistance with data subject requests. Taking into account the nature of the processing, we will assist you with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. If we receive such a request directly, we will refer the individual to you and will not respond substantively ourselves unless you instruct us to.

6.10 Assistance with compliance. We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to us.

6.11 Personal data breach. We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data we process on your behalf. The notification will describe the nature of the breach, the likely consequences, the measures taken or proposed, and a contact point for further information, to the extent that information is available to us at the time.

6.12 Deletion or return. On termination of the Services, we will delete or return personal data processed on your behalf at your choice, unless we are required by law to retain it. In the absence of an instruction from you within 30 days of termination, we will delete it.

6.13 California. Where the California Consumer Privacy Act applies, we act as a service provider in respect of personal information processed on your behalf. We will not sell or share that information, retain, use or disclose it for any purpose other than performing the Services, or combine it with personal information received from another source, except as permitted by that Act.

6.14 Audit. We will make available the information reasonably necessary to demonstrate compliance with this section, and will respond to a written security questionnaire once per year. Where an audit is required by a supervisory authority or by applicable law, we will cooperate with it. On-site audits beyond this are by agreement and at your cost.

7. International transfers

Personal data may be stored and processed in more than one country rather than in a single data centre. The locations of our sub-processors are listed in section 8. Our personnel and authorised contractors located outside the European Economic Area may access customer account and support data in order to operate and support the Services.

Where we process personal data on your behalf and that processing involves a transfer out of the European Economic Area, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses apply, Module Two, controller to processor, together with the UK International Data Transfer Addendum where applicable. By agreeing to our Terms and Conditions you and Nosmai enter into those Clauses, with the information in sections 4 to 9 of this document completing their annexes. Where the Clauses require a competent supervisory authority to be identified, it is the authority of the EEA member state in which you are established or in which your EU representative is established. A countersigned copy is available on request from [email protected].

8. Sub-processors

Of the vendors below, only Cloudflare and Brevo are engaged in processing personal data on your behalf. The others support our own operations, where we act as a controller.

9. Security measures

We protect personal data using access controls, encryption in transit, restricted administrative access, and segregation of production systems. API keys are secret credentials, and you are responsible for keeping them secure and rotating them if exposed.

10. Your responsibilities

You are responsible for having a lawful basis for the personal data you process through your application, for publishing your own privacy notice, and for obtaining any consents required from your end users. This includes consent for camera access and face tracking where applicable law requires it, and, where you enable the generative AI feature in Nosmai Try-On, consent to the transmission of images to us and to our use of them to train and improve our models.

11. Precedence and liability

Where these terms conflict with our Terms and Conditions on a matter of data protection, these terms prevail. On every other matter the Terms and Conditions prevail.

Each party's liability under these terms is subject to the limitation of liability in our Terms and Conditions.

12. Changes

We may update these terms as our products and obligations change. We will change the date at the top of this page, and where a change materially affects processing carried out on your behalf, we will notify account holders by email or through the Console before it takes effect.

13. Contact

Nosmai, LLC Email: [email protected]