Smith Business Solutions SRL (“STOICA”, “we”, “us”), Trade Register No. J29/1411/2014, CIF RO33734100, sat Predesti, com. Tinosu, nr. 28, Prahova, Romania, 107612, operates the https://noombat.ai website and the noombat platform (together, the “Service”). Questions about this policy or our practices: hello@noombat.ai.
We play two distinct roles. For the public website, our own marketing and the accounts of people who sign in, we are the data controller and this policy applies in full. For the business data that client organizations bring into their platform workspaces, we are a data processor acting on the client's instructions under our Data Processing Addendum — the client organization is the controller of that data.
Information we collect
Information you provide. When you sign in with a work email address, request a demo, or contact us, we collect what you give us: name, work email address, company name and role. When you book a call with us, our booking provider passes us your name, work email address and the time of the meeting, and we keep a record of the booking in our own customer relationship system.
Log and device data. Collected automatically when you visit: IP address, browser and device characteristics, pages visited, and timestamps.
Website visitor identification. When you visit the public website, we may try to identify the company you are browsing from. We do this on our own servers: the IP address and browser identifier your visit leaves in our analytics are sent to a third-party business identification service, which returns the company and, where it holds them, the business contact details (name, role, work email) of a person associated with that connection. We process these as business-context data under our legitimate interest in reaching companies that show interest in noombat. This runs on the public website only, never inside client workspaces or on signed-in pages, and a visitor who also uses a client workspace is excluded. You can object at any time (see Your rights below).
Session recordings. On the public website we record how visitors move through the pages (scrolling, clicks, the pages opened) using our analytics provider's session replay. Text you type into form fields is masked and not recorded. We keep a copy of these recordings, matched where possible to the company identified above, so that we can understand how companies read the site before we speak to them. Recordings are made on the public website only, never inside client workspaces or on signed-in pages. You can object at any time (see Your rights below).
Client data in the platform. Client organizations connect business data — CRM records, business contact details, engagement and intent signals — and the platform additionally obtains related data from third-party enrichment and signal providers on the client's behalf. We process this data to provide the Service to that client, as its processor. If your data appears in a client's workspace, that client is the controller; see “Exercising your rights” below.
How we use information
As controller, we use personal information to:
- Provide, operate and secure the Service (legal basis: performance of a contract, legitimate interest)
- Sign you in and administer your organization's workspace (contract)
- Respond to requests and provide information or services you ask for (contract, consent)
- Follow up with companies that show interest in noombat, and send marketing you can opt out of at any time (legitimate interest, consent)
- Understand how the Service is used and improve it (legitimate interest)
- Comply with legal obligations (legal obligation)
People in prospect boards
Before a company becomes a client, we sometimes build it a prospect board: a list of the companies it sells to, the people who work there, the leaders of its competitors, and the dated public pages that suggest why now could be a good time to talk. A board is private to that company. Its own staff can sign in with their work email and see it, and so can ours. We are the controller of this data, and we process it under our legitimate interest in showing a company who it could sell to and what noombat can do. If you are named on a board, this section says what we read and how to have it removed.
What we read. Only public, professional information: your public LinkedIn profile and your public posts, comments and reactions there; your employer's website; conference, podcast, webinar and press pages that name you; code you publish in public; and company registers. From these we show your name, photo, role and company, the things you did in public with their dates (a talk, a post, a new role), and a link to each page.
How we describe people. For some people we add short notes on the topics they write about and on how they like to be approached, for example “leads with numbers”. A note may name an interest outside work, such as cycling or music, only when the person wrote about it on a professional page. Each note comes from a fixed list and links to the posts behind it. An AI model helps us match public posts to that list. We never label anyone as a type, and we never score anyone's character. A board orders people for its reader by their role, their company and their dated public activity, and that order decides nothing about you. We review each board 90 days after we read its pages, and a board never shows a note that is more than 180 days old.
What we leave out. We drop anything about health, religion or beliefs, politics, ethnicity, sex life or sexual orientation, union membership, genetics or biometrics, or criminal matters, even when it is public, and we never show or use it. We leave out private life, such as family, age, home address and money. We read nothing from private groups, closed communities or event guest lists, collect no email addresses or phone numbers, and draw nothing from a photo, a voice or a video.
Your choices. To object, or to be taken off every prospect board, write to hello@noombat.ai with your name and your LinkedIn page or employer. We act on it within one month. We take you off every prospect board we have built and stop reading your pages. Apart from a record of your request, we keep only a one-way code made from your name, employer and LinkedIn address, so our tools skip you from then on. You can also ask what we hold about you, or ask us to correct it. Your other rights are listed below.
Connected AI apps and the API
A member of a client workspace can connect an AI app, such as ChatGPT (by OpenAI) or Claude (by Anthropic), to one board of that workspace, or read that board from their own code with a personal API key. This is switched on per workspace. Each connection or key reads one board, and none of it can send a message or change data. We pass the board's data to the app on the client's behalf, at its member's request, as its processor. On a prospect board we prepared ourselves (above) we are the controller of what we pass, and the sample board holds made-up companies and people only.
What leaves noombat. Only what the app or the code asks for, from the one board the member picked. Depending on the question, that can be:
- Companies: name, web address, LinkedIn company page, industry, size, city, country, year founded, a short description, the board's group and reasons, the Priority number and the dated lines behind it, whether the company is a client on record, whether someone on the member's team once worked beside people there, the rival in place, a suggested opening line and next step.
- People at those companies: name and business title, headline, location and country, seniority, their part in the buying decision, a Priority number where the board gives one, a link to their public LinkedIn profile, past roles where the board holds them, quotes from their public posts about the client's field with the date and the number of reactions, comments and reposts, the dated lines that say why they matter now, a dated line on how they recently leaned in (a new role, or a reaction to a post), and a suggested opening line.
- Ways in: the people on the member's own team, or the contacts in the client's CRM, who can introduce them to someone, with how well they know that person and a short note on how.
- Signals: dated public events about the companies (for example a contract ending, a hire or new funding), quoted, with a link to the page that published them and the source named in words.
- Competitors: name, web address, LinkedIn page, what they sell and lead with, owner, size, headquarters, stage, how hard they press on the client's buyers, their social reach and the mix of their posts, how many people engage with those posts (as counts), the names and business titles of their leaders with the themes they post about and how often they post, hiring and staff moves as counts, the board's companies where they are in place, how the client wins, and their latest dated move.
- The board at a glance: counts, the board's own words and definitions, and which fields are usually empty.
- Search and fetch: the name, id and noombat link of the companies, people and competitors that match a name, or one of those records as text.
AI apps: who receives the data, what we keep, your controls
No answer has a field for an e-mail address or a phone number. On the sample board, which anyone signed in with a confirmed e-mail address can connect, every company, person and event is made up, so nothing about a real person leaves noombat from it.
Who receives it. The AI app the member chose, under that provider's own terms and privacy policy: OpenAI for ChatGPT and Codex, Anthropic for Claude and Claude Code, or the maker of another app the member connects. With a personal key, the data goes to the code or tool the member runs. What the app keeps, for how long and whether it trains on it is decided by its provider and the member's settings there; noombat does not control it. OpenAI says it does not train on data from connected apps for ChatGPT Business, Enterprise and Edu by default. Some providers process data in the United States.
What noombat keeps. For each connection: the member, the board, the app's name and id, the access granted, and when it was made, last used, ends and was revoked. For each call: the connection, the member, the organization and board, the app, the tool or read, the outcome, the number of rows and bytes, the time it took and an error code. We never keep the question, its arguments or the answer. Each call is also counted in the workspace's usage record (the tool and the app). For a personal key we keep a one-way hash and its last four characters, never the key. Call lines are deleted after 400 days (about 13 months), and a connection's record 400 days after it ended or was revoked; sign-in requests and one-time codes go a day after they expire, and access tokens a week after; an app that registered itself and has no live connection is deleted after 90 days. The connect pages and Settings, API & AI apps send nothing to our analytics.
Your controls. A member can revoke any connection or key in Settings, API & AI apps, and it stops at once; removing noombat in the app itself (ChatGPT: plugins; Claude: Customize, Connectors) stops the app asking. Someone with no workspace who connected the sample board cannot open Settings and removes noombat in the app. A connection ends by itself after 90 days. An administrator of the client organization can turn AI apps off for the whole organization and limit how long keys live. How to do each of these: Support.
Directory reviewers. Reviewers at app directories (such as OpenAI's and Anthropic's) get an account that signs in with a password, only while connecting an app, and can connect the sample board only. We keep each reviewer account's e-mail address and sign-ins like any other account's.
People named on a client's board can exercise their rights as described under “Exercising your rights” below. Data an AI provider has already received is covered by that provider's privacy policy.
International transfers
Client workspace data is stored in the EU (Supabase, Frankfurt). Some of our providers (for example Anthropic, PostHog and certain visitor-identification and enrichment providers) process data in the United States. Where personal data leaves the EEA we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
Retention
We keep personal information only as long as needed for the purposes above, to comply with legal obligations, resolve disputes and enforce agreements. Client organizations control retention of the data in their workspaces; on termination, workspace data is exported on request and then deleted as described in our Terms and DPA.
Security
Access to client workspaces is organization-scoped and authenticated, data is stored with established cloud providers, transport is encrypted, and secrets are managed outside the codebase. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Security questions: hello@noombat.ai.
Your rights under GDPR
If your personal data is subject to the GDPR, you have the right to:
- Object to processing — including direct marketing and processing based on legitimate interest (such as visitor identification)
- Be informed about how your data is used
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data where there is no compelling reason for continued processing
- Restrict processing while a dispute is resolved
- Port your data to another service
- Withdraw consent at any time, where processing is based on consent
- Complain to a supervisory authority — in Romania, ANSPDCP (dataprotection.ro), or your national regulator. We would appreciate the chance to address your concern first at hello@noombat.ai
Exercising your rights
Write to hello@noombat.ai with your request; we respond within the timelines the GDPR requires. If your data is in a client organization's workspace, the client is the controller: we will pass your request to them and assist them in fulfilling it.
Links to other sites
The Service may link to external sites we do not operate. Review the privacy policy of every site you visit; we are not responsible for third-party content or practices.
Children
The Service is for business use. We do not knowingly collect personal information from children, and clients may not bring data about children into the platform. If you believe a child's data has reached us, contact hello@noombat.ai and we will delete it.
Changes to this policy
We may update this policy from time to time; the current version is always at noombat.ai/privacy, with the date above. For material changes we will provide notice on the site or by email.
Contact
Smith Business Solutions SRL · Trade Register No. J29/1411/2014 · CIF RO33734100
sat Predesti, com. Tinosu, nr. 28, Prahova, Romania, 107612
hello@noombat.ai