Terms of service

Last updated: 14 October 2026

These terms are an agreement between Noumento Ltd, a company registered in England and Wales under number 17487720, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“Noumento”, “we”, “us”), and the business that signs up to Noumento (“the Customer”, “you”). The person who accepts them confirms that they have authority to bind the Customer. Schedule 1, the data processing terms, forms part of these terms. If we sign an order form with you, it takes priority where the two conflict.

1. Definitions

Service: Noumento’s software, including the app, the connectors, and the server that answers AI assistants.
Members: the people the Customer allows to use the Service, admins included.
Customer Content: content the Service reads from the Customer’s connected tools, content Members add, and the record the Service builds from them.
Connected Tool: a third-party tool a Member connects to the Service. Our security page lists the tools available.
AI Assistant: a third-party assistant a Member connects to the Service, such as Claude or ChatGPT.
Order: an order form, quote or written plan we agree with the Customer.

2. The Service and early access

2.1 We provide the Service as described on our website and in the app.

2.2 Noumento is in early access. Features may change, be added or be removed. We will tell the Customer’s admins before any change that materially reduces the Service.

2.3 We aim to keep the Service available, but we do not promise it will be uninterrupted or free of errors.

3. Accounts, admins and Members

3.1 Access starts with a request. We review every request and may decline any.

3.2 The Customer’s admins invite and remove Members. The Customer is responsible for its Members’ use of the Service and for their keeping to these terms.

3.3 Members must be at least 18 and use the Service for work.

3.4 Members must keep their sign-in details secure. They must tell us at security@noumento.com about any use of their account they did not authorise.

3.5 Each Member chooses which tools the Service reads, what within them where a tool offers a choice, and what to share with their team. The Service is designed so that a Member’s private record is visible in the Service only to that Member and the AI Assistants they connect. A Member who turns on the weekly review in Slack is sent the items awaiting their decision there. The Customer instructs us to process Customer Content that way.

4. Trial

4.1 Each approved team starts with a free trial of 14 days, unless we agree a different length.

4.2 If the Customer has not moved to a paid plan when the trial ends, we stop collecting from its Connected Tools, and Members can still ask about what was already collected for 30 days. This agreement then ends, and clause 17.4 applies to Customer Content.

5. Fees and payment

5.1 Fees are as set out in the Order.

5.2 We invoice in advance, at the intervals set out in the Order, and invoices are due within 30 days. Fees exclude VAT, which the Customer pays on top.

5.3 If an invoice is overdue, we may charge interest under the Late Payment of Commercial Debts (Interest) Act 1998. After 14 days’ written notice, we may also suspend the Service until it is paid.

5.4 We may change fees from the next renewal by giving at least 30 days’ notice.

6. Customer Content

6.1 The Customer and its Members own Customer Content. We claim no ownership of it.

6.2 The Customer gives us a licence to use Customer Content only to provide, secure and support the Service, as Schedule 1 sets out.

6.3 We do not sell Customer Content, and we do not use it to train AI models.

7. AI output

7.1 The Service uses AI to build its record and to answer questions. Its output can be incomplete, out of date or wrong. Where claims conflict, the Service shows the conflict rather than resolving it.

7.2 Every answer shows its sources. The Customer and its Members are responsible for checking an answer before relying on it, especially for decisions about people, money or legal matters.

7.3 Output is not professional advice.

8. The Customer’s responsibilities for Connected Tools

8.1 The Customer confirms that it, and each Member who connects a tool, is entitled to let the Service read that tool’s content. That includes under the Customer’s agreement with the tool’s provider and under its own policies.

8.2 The Customer is the controller of personal data in Customer Content. It is responsible for having a lawful basis to process it, and for telling the people concerned. Those people include its staff, and people outside it whose content the Service reads. Updating its own privacy notices is one way to do this.

8.3 The Customer must not use the Service on purpose to process special category data, or data about criminal offences. The Service’s sensitivity check lowers the chance of sensitive matter being shared with a team. It is a safeguard, not a guarantee.

8.4 Third parties provide Connected Tools under their own terms, and we are not responsible for them. The Service may stop working with a tool if its provider changes or withdraws access.

9. AI Assistants

9.1 Members choose which AI Assistant to connect. The Service answers a Member only from that Member’s private record and their team’s shared record.

9.2 Each answer goes to the AI Assistant the Member connected, which handles it under its provider’s terms. We are not responsible for what an AI Assistant or its provider does with it.

10. Acceptable use

The Customer and its Members must not:

use the Service to break the law, or to process content they have no right to process
try to reach another customer’s data, another Member’s private record, or any part of the Service they are not authorised to use
probe, scan or test the Service’s security without our written permission, other than by reporting a vulnerability to security@noumento.com
interfere with or overload the Service, or get round its limits
copy, resell or reverse engineer the Service, except where the law allows it
use the Service to build a competing product

11. Data protection

11.1 Schedule 1 applies to the personal data we process for the Customer.

11.2 Our privacy policy explains how we handle personal data for which we are the controller, such as Members’ account details.

12. Security

We maintain the security measures described on our security page and in Schedule 1. We may update them, but not in a way that materially lowers the overall protection of Customer Content.

13. Confidentiality

13.1 Each party will keep the other’s confidential information confidential, and use it only for this agreement. It may share it only with its staff, advisers and providers who need it and are bound by similar duties.

13.2 This does not apply to information that:

is public through no fault of the party receiving it
that party already knew, or developed independently
that party must disclose by law, giving notice where it is allowed to

13.3 Customer Content is the Customer’s confidential information.

14. Feedback

We may use suggestions and feedback from the Customer and its Members freely, without any obligation. This gives us no rights in Customer Content.

15. Our intellectual property

We and our licensors own the Service and everything in it other than Customer Content. These terms give the Customer a non-exclusive, non-transferable right to use the Service while this agreement lasts, and nothing more.

16. Suspension

We may suspend all or part of the Service, telling the Customer first where we can, if:

we reasonably believe its use breaks clause 10, or puts the Service, other customers or anyone’s data at risk
fees are overdue under clause 5.3
the law requires it

We will restore access once the reason is resolved.

17. Ending this agreement

17.1 This agreement starts when the Customer accepts it. It lasts until 30 days after a trial ends without a move to a paid plan, or until either party ends it.

17.2 Either party may end it by giving 30 days’ written notice, taking effect at the end of the current paid period.

17.3 Either party may end it at once by written notice if the other:

materially breaks it and does not put that right within 30 days of being asked
becomes insolvent

17.4 When this agreement ends, access stops. We then delete Customer Content and Members’ account details within 30 days, and backup copies expire within a further 14 days. During early access we do not provide an export or copy of Customer Content before it is deleted.

17.5 While this agreement lasts, the Customer may ask us to delete Customer Content, or one Member’s data. We will do it within 30 days, and backup copies expire within a further 14 days.

17.6 Clauses 6, 13, 19 and 22, and any fees owed, survive the end of this agreement.

18. Warranties

18.1 We will provide the Service with reasonable skill and care.

18.2 Except as these terms say, the Service is provided as it is. We exclude all other warranties, conditions and terms implied by law, as far as the law allows.

19. Liability

19.1 Nothing in these terms limits liability for:

death or personal injury caused by negligence
fraud or fraudulent misrepresentation
anything else the law does not allow to be limited

19.2 Neither party is liable for indirect or consequential loss, or for loss of profits, revenue, business or goodwill, however it arises.

19.3 Each party’s total liability under or in connection with this agreement, in any 12 months, is limited to the greater of:

the fees the Customer paid or owed in the 12 months before the event that led to the claim
£1,000

19.4 The cap does not apply to the Customer’s obligation to pay fees.

20. Changes to these terms

We may change these terms. We will give admins at least 30 days’ notice by email of any change that materially affects the Customer. If the Customer does not agree, it may end this agreement before the change takes effect. Other changes take effect when they are posted.

21. General

Transfer: the Customer may not transfer this agreement without our consent. We may transfer it to a successor to our business, with notice.
Subcontractors: we may use subcontractors and providers, and we remain responsible for them. Schedule 1 governs those that process personal data.
Events beyond control: neither party is liable for a delay caused by events outside its reasonable control.
Notices: by email, to the Customer’s admin address, or to us at hello@noumento.com.
Publicity: we will not name the Customer publicly without its permission.
Whole agreement: these terms, Schedule 1 and any Order are the whole agreement. They replace earlier discussions, but nothing in them limits liability for fraud.
Third parties: no one else has rights under the Contracts (Rights of Third Parties) Act 1999.
Severability and waiver: if a court finds part of these terms invalid, the rest stands. Not enforcing a right is not giving it up.

22. Law and disputes

English law governs these terms. If a dispute arises, both parties will first try in good faith to settle it within 30 days of written notice. After that, the courts of England and Wales have exclusive jurisdiction.

Schedule 1: Data processing terms

These terms apply when Noumento processes personal data for the Customer under the terms of service. They are written to meet Article 28 of the UK GDPR, and of the EU GDPR where it applies. Controller, processor, personal data and personal data breach have the meanings that law gives them.

1. Roles

The Customer is the controller, and Noumento the processor, of personal data in Customer Content. Noumento is the controller of Members’ account details and of data about how the Service is used, as its privacy policy explains.

2. Details of the processing

Item	Detail
Subject matter	Providing the Service: reading Connected Tools, building and indexing a record, sharing it as Members choose, answering AI Assistants, and sending a Member their weekly review in Slack where they choose it
Duration	While the agreement lasts, plus the deletion period in paragraph 10
Nature and purpose	Collection through connectors, storage, AI extraction, sensitivity checking, indexing, retrieval, sending answers to the Member’s AI Assistant, and sending a Member their weekly review in Slack where they choose it
Types of personal data	Names, email addresses and other identifiers. The content read from Connected Tools, which may contain any kind of personal data. Facts extracted about people, such as their roles, the work they own and the decisions they took part in
Data subjects	Members; the Customer’s other staff; people outside the Customer who appear in content or send it, such as its clients, suppliers and contacts

3. Instructions

Noumento processes the personal data only on the Customer’s documented instructions. These terms, the terms of service, and the settings Members and admins choose in the Service are those instructions. If Noumento thinks an instruction breaks data protection law, it will say so. If the law requires Noumento to process the data in another way, it will tell the Customer first, unless the law forbids that.

4. Confidentiality and access

Noumento makes sure everyone it authorises to process the personal data is bound by confidentiality. Today only Noumento’s founder can access production systems. Noumento’s own AI development tools do not read Customer Content.

5. Security

Noumento keeps the technical and organisational measures in Annex B, which are appropriate to the risk. It may update them, but not so as to lower the overall level of protection.

6. Sub-processors

6.1 The Customer authorises Noumento to use the sub-processors in Annex A.

6.2 Noumento will email the Customer at least 30 days before it adds or replaces a sub-processor. If the Customer objects on reasonable data-protection grounds, the parties will discuss it. If they cannot resolve it, the Customer may end the agreement and receive a refund of fees prepaid for the unused period.

6.3 Noumento binds each sub-processor by written contract to data protection obligations at least as protective as these, and remains responsible for it.

7. Transfers outside the UK and EU

Noumento stores Customer Content on Amazon Web Services in Ireland. Where a sub-processor processes it outside the UK and EU, Noumento makes sure a valid transfer mechanism is in place. For Google, that is Google’s participation in the EU-US Data Privacy Framework and its UK Extension. For WorkOS and Pydantic, it is the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in their data processing agreements.

8. Requests from individuals

If someone asks Noumento to exercise their rights over Customer Content, Noumento will pass the request to the Customer. It will not answer it itself, other than to say it has passed it on. It will help the Customer respond, including by finding, correcting or deleting the data.

9. Other help

Noumento will give reasonable help with the Customer’s security obligations, data protection impact assessments and consultations with the ICO. That help takes account of the nature of the processing and the information Noumento has.

10. Deletion

10.1 When the agreement ends, Noumento deletes the personal data in Customer Content within 30 days. Backup copies expire within a further 14 days. The exception is data the law requires Noumento to keep.

10.2 While the agreement lasts, the Customer may ask Noumento to delete Customer Content, or one Member’s data. Noumento will do it within the same periods.

10.3 During early access, Noumento does not provide an export or copy of Customer Content before it is deleted.

11. Personal data breaches

Noumento will tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Content. It will give the information it has, and update it as it learns more:

what happened
the data and the people affected
the likely consequences
the measures taken or proposed

12. Audits

12.1 Noumento will make available the information needed to show it meets these terms, and will answer reasonable security questionnaires.

12.2 The Customer may audit Noumento’s compliance, or have an independent auditor bound by confidentiality do so, only if the information under 12.1 is not enough to show compliance, a regulator requires it, or there has been a personal data breach affecting Customer Content. An audit:

takes place no more than once in any 12 months, unless a regulator requires it or it follows a breach
needs at least 30 days’ notice and a scope agreed in advance
is carried out remotely where possible, and otherwise during business hours
is at the Customer’s cost, including Noumento’s reasonable time
must not disrupt the Service or expose other customers’ data

13. Liability

The liability limits in the terms of service apply to these terms.

Annex A: Sub-processors

Sub-processor	What it does	Where it processes data	Data it receives
Amazon Web Services	Hosting: servers, database, file storage, credential storage	Ireland (EU)	All Customer Content
Google	Gemini AI models, through the Gemini API	Any country where Google has facilities, including outside the UK and EU	Text read from Connected Tools, to extract, check and index it; the questions AI Assistants ask and the notes they save
WorkOS	Sign-in and invitation emails	United States	Members’ email addresses and, where given, names; the Customer’s organisation name
Pydantic (Logfire)	Operational monitoring	EU (Netherlands)	Disguised identifiers and technical data

Annex B: Security measures

Customer Content is hosted on Amazon Web Services in Ireland.
Stored data is encrypted at rest: the database, the file storage and the servers’ disks.
Data in transit is encrypted with HTTPS.
Connection credentials are kept in AWS Secrets Manager.
Access checks on every read and write keep each customer’s records apart. Tests that try to reach another customer’s data check them.
Each Member’s record is private by default. Content reaches a team’s shared record only when the Member approves it, or under their automatic-sharing setting, and only after a sensitivity check. Content the check is unsure about is treated as sensitive, and content it cannot check is held back.
Answers are built only from the asking Member’s private record and their team’s shared record. Noumento identifies the Member from the access key it issued them, never from anything in the request.
Connectors only read. They use each Member’s own access and, where a tool offers a choice, read only what the Member chooses. They do not download attachments or files.
Only Noumento’s founder can access production systems, with two-factor sign-in, and that access is logged.
Backups are made daily and each is kept for 14 days.
Monitoring uses disguised identifiers. There are no analytics or advertising trackers.
Noumento’s own AI development tools do not read Customer Content.