GNOMI

GDPR overview

The privacy policy carries a dedicated section 8, Supplemental Notice for EU/UK GDPR, and a section 11 Data Retention and Disposal Policy presented as GDPR compliance documentation. The GDPR principles named are storage limitation, data minimization, purpose limitation, integrity and confidentiality, and accountability. The rights listed are access, correction, deletion, restriction, objection and portability, plus the right to lodge a complaint with a local supervisory authority for EEA and UK users. For transfers out of the EU/UK, the publisher says it may use EU Standard Contractual Clauses as safeguards; CCPA/CPRA and the New York SHIELD Act are cited alongside. Two gaps are worth noting: no Article 27 EU representative is designated and no data protection officer is named. Requests go to privacy@gnomi.com, general privacy questions to support@gnomi.com.

Who owns the data?

GNOMI and its licensors exclusively own all right, title and interest in the Services, including all associated intellectual property rights, so nothing in the platform itself passes to the user. What the user submits and receives is framed in the terms as Input and Output. On personal data, the publisher states that it does not sell personal user data, and the Memory Layer announcement commits that memory data is never sold, never shared with advertisers and never shared with partners without explicit consent. Usage and search activity, by contrast, are shared with third-party AI model providers, and those providers may retain the information.

Reuse rights

GNOMI collects account data (username, email, password, country) and device data (IP address, cookies, browser, location). The privacy policy is explicit about what happens next: usage and search activity are used to help train GNOMI's own models and third-party AI models, and providers that receive the data may retain it. If the Social Connections feature is enabled, social media interaction data also trains AI models and feeds personalized news recommendations. No opt-out from that training is documented anywhere on the site. The Memory Layer is the one stated exception: what it stores is chosen by the user, can be revoked at any time in the settings, can be switched off across every surface from any one of them, and is never used to train the models. Financial data pulled through the Plaid integration is read-only and limited to the authorized feature. The policy also asks users not to send passwords or sensitive financial data into the chat.

Data retention & training

Hosting summary

No hosting country and no hosting region is named by the publisher — a stated fact, not a gap in the reading. The privacy policy says only that information may be stored anywhere in the world, including countries with different data protection laws, and that for transfers from the EU/UK the company may use EU Standard Contractual Clauses as safeguards. The promotions section adds that data may be processed in the United States or elsewhere. No cloud provider, data center or region is identified anywhere, and no subprocessor list is published. On the technical side, the publisher declares encryption in transit, encryption at rest where supported and appropriate, and secret and key management. A public Trust Center hosted by Vanta exists at trust.gnomi.com, but its content could not be read outside its own interface, so whatever hosting detail it may carry remains unverified. In practice, an EU or UK organization evaluating GNOMI has a contractual safeguard to point to, but no data residency commitment.