Privacy.

Who we are

nymos is a product of Mejunda, a sole proprietorship (eenmanszaak) under Dutch law, Steile Oever 5, 7731 PP Ommen, the Netherlands, registered with the Dutch Chamber of Commerce under KVK number 73264253, VAT NL002215140B29 ("we", "us"). We are the controller for the personal data described here. For anything on this page, write to support@nymos.io.

This website

nymos.io is a static site hosted by Vercel. Serving a page means Vercel processes your IP address and request details to deliver it and to protect the service from abuse. That is the ordinary technical record any web server keeps.

We use Vercel Web Analytics, which is cookieless and aggregate. It sets no cookies, builds no visitor profile, and does not follow you across sites. We see counts and general regions, never who you are. Fonts are served from our own domain, so visiting the site makes no request to any third party.

• Cookies: we set none, which is why you see no cookie banner.
• Forms: the site has none. The only way to reach us is email, and an email tells us whatever you put in it.
• Legal basis: our legitimate interest in running a secure website and knowing roughly how it is used (Article 6(1)(f) GDPR).

The app: what stays on your Mac

nymos is a sandboxed Mac app. It reads a folder only after you grant access to it, and only the files you add to a batch.

• Text is extracted on your Mac. PDF, Word, Excel, PowerPoint, CSV and plain text are all parsed locally.
• When a PDF has no usable text layer, the app reads it with Apple's on-device Vision framework. That OCR happens on your Mac and nowhere else.
• A document with no readable text never reaches the model at all. The app stops and tells you it found no text.
• Your rename history, your templates and your settings are stored locally on your Mac. We never receive them.
• Credentials: your own AI provider key, if you use one, and your license identifier are stored securely on your Mac. Your key never reaches our servers.
• No telemetry: the app contains no analytics, tracking or usage reporting of any kind.

The app: what leaves your Mac

When you ask for suggestions, the extracted text of the document is sent for analysis. For images, a downscaled copy of the image is sent instead. Nothing else on your Mac is read or transmitted: not your other filenames, not your folder structure, not your other files.

What happens next depends on which mode you are in. The two modes are genuinely different data paths, so they are described separately.

Managed mode (the default)

In managed mode you never handle an API key. Document content goes to our own server in Amsterdam, hosted by Railway, and from there to the AI provider that produces the suggestion. Both sit in the EU.

• What we store: an anonymous license identifier, whether it is on trial or subscribed, and how many documents it has processed. Nothing else: no filenames, no document content, no email address.
• What we pass on: the document content, for as long as the request takes. Our server keeps no copy of it and writes none of it to its logs, which record only that a request happened and how long it took.
• Legal basis: performing our contract with you, meaning providing the app you installed or subscribed to (Article 6(1)(b) GDPR).

The AI provider

The model that reads your document runs on servers located in the European Union, and document content is processed there. It does not leave the EU. Content is processed per request to produce the suggestion and is not used to train or improve models, under that provider's API terms for business use. The provider retains standard API logs for a limited period for safety and abuse monitoring; we do not have a zero-data-retention arrangement and do not claim one.

Because both the relay and the analysis stay inside the EU, your document content is not transferred out of it, and the processing is GDPR compliant without any of it resting on an international transfer. The provider operating those servers belongs to an international group, so for the limited cases where staff outside the EU could access data in the course of support or security work, the European Commission's Standard Contractual Clauses apply as part of that provider's data processing terms.

Self-managed mode

In self-managed mode you connect your own account at an AI provider of your choosing. Document content goes directly from your Mac to that provider, under your own account and that provider's terms. Our relay, our database and our servers are not involved at any point, and we have no record that the rename happened.

Which provider that is, and therefore where the content is processed and under which privacy policy, is your choice. Your agreement about that content is with them, not with us. We never see your key: it is stored on your Mac and sent only to the provider you connected.

Payment and licensing

Paid plans are sold through Polar.sh, acting as Merchant of Record. Polar processes your payment details and billing information, handles tax, and is the party named on your invoice.

We do not see or store your card details. What reaches us is the status of a license: active or not. Subscription management, invoices and cancellation happen in Polar's own customer portal.

How long we keep things

• Document content: not retained. It is processed to produce a suggestion and discarded.
• License record: kept while your trial or license exists, so that reinstalling the app does not reset your trial and your subscription keeps working.
• Server logs: short-lived operational logs kept by our hosting providers for reliability and abuse prevention.
• AI provider logs: the provider that performs the analysis keeps standard API logs for a limited period for safety and abuse monitoring.
• Email: if you write to us, we keep the correspondence as long as we need it to deal with the matter.

Who else processes data for us

We keep this list as short as the product allows.

• Vercel: hosting and cookieless analytics for nymos.io.
• Railway: hosting for the relay server and its database, in Amsterdam.
• An AI provider, on servers in the European Union: performs the analysis that produces a suggested filename, in managed mode only.
• Polar.sh: payment and billing as Merchant of Record.

Your rights

We are established in the Netherlands and process personal data under the GDPR, supervised by the Dutch Data Protection Authority. Under the GDPR you can ask for access to the personal data we hold about you, correction of it, erasure of it, a copy of it, or restriction of its processing, and you can object to processing based on legitimate interests.

Because we store so little, the honest answer to most such requests is that there is very little to look up: an anonymous license identifier and a document count. Write to support@nymos.io and we will answer. If you are not satisfied, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Children

nymos is a tool for work. It is not directed at children, and we do not knowingly collect data from them.

Changes to this policy

If we change how the product handles data, we change this page and update the date at the top. Material changes to how your documents are processed will be announced in the app's release notes as well, not only here.